hacking – Page 12 – Stilgherrian

11 August 201511 August 2015

Talking the cybers on ABC TV’s Lateline

It was my very great pleasure to talk about hacking and the impending security disaster that is the Internet of Things (IoT) on ABC TV’s Lateline last night — and don’t I look concerned.

Also joining the program was security researcher Runa Sandvik, who got plenty of media recently for hacking a smart sniper rifle.

I won’t go into too many details here, because you can see the video and transcript at the Lateline website. For the next month or so, you can also watch it in HD on iView.

However, this exchange surprised me:

STILGHERRIAN: … Scarier though is what’s happening with smart TVs. There are millions of those around the world. They’re networked, so you can watch clips from YouTube or whatever on them or Netflix or any of the streaming services, and yet I’ve seen a young hacker from South Korea not only hack a smart TV, hack it in 10 different ways and set it up so that the camera and microphone in the TV are streaming live video and sound out to the internet while the television looks like it’s turned off. These are televisions that are being installed over the last few years and more in the future in hotel bedrooms, classrooms, corporate boardrooms. So they’re kind of like an always-on surveillance device.

JOHN BARRON: I guess, Runa, the question then occurs: well, who would want to do this? Who would want to hack into somebody’s TV set in suburban Australia or the United States? The answer would probably be: well, nobody. But why would somebody want to do this?

RUNA SANDVIK: There’s a mix. There’s definitely people that are doing this for sort of evil purposes, if you will, or to make money, and there are people that do it just because they can, because it’s there, it’s a possibility, it’s not as secure as it should be and they do it just to show that they can.

Personally, I’d have thought that the security risks of peering into people’s homes would have been obvious, but the questions moved on before I could point out the attraction to both pilferers and perverts.

Anyway, you can also read my thoughts on this in my December 2014 column, All aboard the internet of things infosec hype train, and its January 2014 predecessor, Our hackers, who art in open source, deliver us from refrigerators.

02 August 2015

Weekly Wrap 269: Winning, mostly, with three kinds of fire

My week of Monday 27 July to Sunday 2 August 2015 represented a remarkable turnaround — perhaps the turnaround that I’d been detecting in the winds since June. And then there’s the bushfire. It’s all so complicated!

Why? It was a full week with a properly-working computer — a week spent in a house with a properly-working kitchen, heating, and inspiring view — and that brought back some of the clarity of thought which I’ve been sorely lacking. I got plenty done, the most important in many ways being the launch — finally! — of The 9pm Urgent Hardware Refresh.

I was very pleased when people started contributing to this crowdfunding campaign just as soon as it was launched. I’m even more pleased to report that as I write this, roughly half-way through the campaign period, we’ve reached 54% of the initial target. That means we’re likely to succeed.

The stress of not having a working computer is subsiding, but I’m not counting my chickens before they’re hatched.

People who write or perform for a living will also understand the importance of the kind of reassurance that comes with people supporting the plan which, until then, had existed solely in your own head.

That has helped. Thank you. If you haven’t done so already, please check out The 9pm Urgent Hardware Refresh

Thanks also to the many people who asked whether I was in any danger from this weekend’s bushfire at Wentworth Falls. No, I’m not.

The fire is only 3km from Bunjaree Cottages, but between it and me there’s some significantly challenging terrain, and the wind has been taking the fire in a different direction. More than 100 volunteers from the NSW Rural Fire Service have been keeping us safe.

I’m certainly paying attention to what’s happening, though, and I see that there’s a wind change forecast for Monday. Depending on how the RFS people go with their plans for the rest of today and overnight, well, my risk assessment may change.

Just as I write this, the alert for the fire area has been raised from WATCH AND ACT to EMERGENCY WARNING — the latter being described thusly:

You may be in danger and need to take action immediately. Any delay now puts your life at risk.

I must stress again, though, that I am not in the alert area, and I currently face no risk.

Articles

ACSC publishes first threat report, but… ho hum, ZDNet Australia, 30 July 2015. The Australian Cyber Security Centre lost a real opportunity here.
Should we let cyber espionage victims hack back?, ZDNet Australia, 31 July 2015. This idea was raised during a panel discussion at the Atlantic Council in Washington, and it horrifies me.

Podcasts

On Friday, I posted “The 9pm I Can’t Believe Itâ€™s Not a Planet”, being The 9pm Edict episode 46. I turned out better than its convoluted production process led me to imagine. I may tell you about that during the week.

Media Appearances

On Thursday, I spoke about the ACSC cyber threat report on 1395 FIVEaa Adelaide.

5at5

The hiatus has ended. There were two editions, on Thursday and Friday. Why not subscribe so you’ll get all the future ones?

Corporate Largesse

None. But there’s quite a bit scheduled for the coming week.

The Week Ahead

This is going to be a better-structured one, folks.

Monday will be a media production day — but I’ll decide the exact details on the day, depending on the bushfire threat level.

On Tuesday, I’ll be catching the 0706 train to Sydney, because on Tuesday and Wednesday I’ll be covering the ADMA Global Forum, presented by the Association for Data-driven Marketing and Advertising. Also, at 2030 AEST on Tuesday night, I’ll be a guest on ABC Local Radio around NSW. And on Wednesday night, I’ll be going to Text100’s (in)famous Christmas in August event, a preview of their clients’ consumer technology for Christmas.

On Thursday, I’ll be going to a lunchtime briefing by NetSuite, and writing something for ZDNet, before taking the train back to the Blue Mountains. Thursday is also the last day of The 9pm Urgent Hardware Refresh, with the campaign ending at 2100 AEST that evening.

On Friday, I’ll be confirming what’ll happen with the funds so raised.

[Photo: The Final Redoubt, photographed on 2 August 2015. Should I ever need a final hiding place from a severe bushfire — and everything has happened so quickly that we skipped straight past three levels of warning, the fire jumped the road and railway, and all escape routes were blocked — then this cutting on Railway Parade near Wentworth Falls is where I’d wrap myself in wet woollen items and hope for the best.]

26 July 2015

Talking the Ashley Madison data breach on ABC 936 Hobart

ABC logo The information security news story of the week was, of course, the data breach at “affairs” and “cheaters” website Ashley Madison, something first reported by journalist Brian Krebs.

I spoke about this data breach in a couple of radio spots — I’m reluctant to call it a
“hack” until we have some evidence that a hack was involved, as opposed to some internal problem — but I reckon the first was the best.

Here’s that conversation, a 13-minute chat from Tuesday morning with ABC 936 Hobart morning presenter Leon Compton. Enjoy.

Podcast: Play in new window | Download (8.6MB)

20 June 201521 June 2015

Talking Samsung’s phone vulnerability on The World Today

ABC logo Hundreds of millions of Samsung smartphones have a serious security vulnerability. The company has known about it since December, but hasn’t done anything about it. I spoke about this on ABC Radio’s The World Today on Thursday.

A software bug is making around 600 million Samsung mobile phones around the world vulnerable to attack. The bug in the phone’s keyboard software could allow hackers to read text messages and to view and take photos. It was found by a US computer security company which informed Samsung late last year.

If you want the technical details, read the Ars Technica story, New exploit turns Samsung Galaxy phones into remote bugging devices.

Here’s the three-and-a-half minute radio story. There’s also a transcript, and a written news story, Samsung phones vulnerable to cyber attacks because of software bug.

Podcast: Play in new window | Download (1.6MB)

Since this report aired, Samsung has said that it will fix this vulnerability, but not all Samsung smartphone owners will receive the fix immediately.

14 June 201517 June 2015

Weekly Wrap 262: From a birthday to a wake

My week of Monday 8 to Sunday 14 June 2015 has been another productive one, despite Monday allegedly being a holiday. Thank you, Your Majesty. I’m exhausted.

I also think I’m coming down with a cold, which is hardly surprising. We’ll see.

There’s much I want to talk about, but this very moment I’m at the regularly monthly Poetry in the Pub in Katoomba. I have Sunday Lunch here many weeks. But this month it’s essentially a wake, because one of their number has passed. I’ll admit that I shed a tear as one chap read Henry Lawson’s “The Glass on the Bar”. My whinges can wait for another time.