The Hack and the Furious
Nothing is sacred when it comes to hacking – not even cars. This week in Wired, security researchers Charlie Miller and Chris Valasek demonstrated an attack that allowed them to take control of a Chrysler Jeep Cherokee from a remote Internet connection.
Not surprisingly, the experiment raised plenty safety concerns. After the story came out, Chrysler posted how drivers can patch the vulnerability exploited by Mr. Miller and Mr. Valasek, and today recalled 1.4 million cars in the US. Rob Graham, cofounder of Errata Security, argued in a blog post that the benefits of conducting car hacking tests far outweigh the safety risks of the experiment itself. “I, for one, praise these two,” he wrote, “and hope they continue their research – knowing full well that they'll likely continue to make other sorts of minor mistakes in the future.”
Not surprisingly, the experiment raised plenty safety concerns. After the story came out, Chrysler posted how drivers can patch the vulnerability exploited by Mr. Miller and Mr. Valasek, and today recalled 1.4 million cars in the US. Rob Graham, cofounder of Errata Security, argued in a blog post that the benefits of conducting car hacking tests far outweigh the safety risks of the experiment itself. “I, for one, praise these two,” he wrote, “and hope they continue their research – knowing full well that they'll likely continue to make other sorts of minor mistakes in the future.”
Transportation Secretary Anthony Foxx said at a Christian Science Monitor breakfast this morning his agency has "urged the auto industry to develop a roundtable of sorts to focus in on issues like cybersecurity" and wants more public-private collaboration "to make sure the security of our vehicles is air tight."
But the Electronic Frontier Foundation worries that automakers will wield laws to prevent other research from exposing vulnerabilities within vehicle computers. Specifically, it says, the Digital Millennium Copyright Act has chilled independent research on automobiles. Any action that could break security measures to get to a technology’s copyrighted source code, even for research, could be interpreted as breaking the law. The EFF filed for an exemption to the law for research, which was met with opposition from automakers. // Malena Carollo
But the Electronic Frontier Foundation worries that automakers will wield laws to prevent other research from exposing vulnerabilities within vehicle computers. Specifically, it says, the Digital Millennium Copyright Act has chilled independent research on automobiles. Any action that could break security measures to get to a technology’s copyrighted source code, even for research, could be interpreted as breaking the law. The EFF filed for an exemption to the law for research, which was met with opposition from automakers. // Malena Carollo
Flash back, Flash forward
The life and uncertain future of Adobe’s troubled multimedia Flash Player. // Joe Uchill
|
Opinion: Why the US government must lose cryptowars 2.0
Law enforcement’s argument today is just as flawed now as it was in the 1990s. We cannot bend software or cryptography to our will – technology is science, not magic. // Elissa Shevinsky
The cost of secret ads
A study by security company Forensiq found that more than 5,000 apps were secretly running ads in the background unbeknownst to users. The ads, found on both Apple and Android devices, can slow down the phones significantly and cheat advertisers out of revenue generated from mobile ads. The study projects that nearly $1 billion will be lost by advertisers to this kind of fraud, as it distorts the clicks per minute rate and provides false information on user traffic.
In some cases, five ads at a time were running in the background. The study did not name any of the apps, but Bloomberg reported that a company called Girls Games Only created several of the affected apps. Its apps were taken out of the Google Play store Thursday. This practice is not allowed by either Google or Apple. // Bloomberg
Google study shows that security pros don't trust antivirus. Trust the pros
A study by Google shows that while most people's top security strategy is an antivirus program, it doesn't even make security pros' top five security measures. Why don't people in the know like antiviruses? Antiviruses were long the gold standard in stopping viruses – it's even in the name. They work by finding identifiable blocks in malware. That made sense when viruses spread by one infected computer strike a new victim. But most current attacks come straight from an attacker, who can change the program just enough to avoid detection or even design it to change automatically. Even Symantec, makers of Norton Antivirus, acknowledge that antiviruses alone are no longer capable of protecting a system. An antivirus might be useful as part of a comprehensive strategy to stop malware, but the front line of defense is to eliminate the vulnerabilities that malware uses to invade a computer. That means keeping software up-to-date – the security pros' top strategy for cybersecurity. // Joe Uchill
|
