network security
The Register has an interesting article about cell phone, blue-tooth specifically, security called How shall I own your mobile phone today? which is definately worth checking out.
Just a few weeks ago, a security group calling themselves Flexilis made the news. One of their members stood next to the red carpet at the Academy Awards with a laptop and an antenna hidden in his backpack, and the results weren’t exactly unsurprising: between 50 and 100 of the celebs were vulnerable to bluesnarfing (ignore the erroneous comparison the article makes between Paris Hilton and the Academy Awards - the techniques used in each situation are completely different).
Cell phones are so common place. People take them for granted and put complete trust in them, storing more and more personal information on them everyday. But cell phones and all electronic devices, computers and the internet for that matter, are vulnerable.
Here’s an example of just how vulnerable technology is:
On 25 August 2000, the press release distribution service Internet Wire received a forged e-mail that appeared to come from Emulex Corp. and said that the CEO had resigned and the company’s earnings would be restated. Internet Wire posted the press release, not bothering to verify either its origin or contents. Several financial news services and Web sites further distributed the false information, and the stock dropped 61% (from $113 to $43) before the hoax was exposed.This is a devastating network attack. Despite its amateurish execution (the perpetrator, trying to make money on the stock movements, was caught in less than 24 hours), $2.54 billion in market capitalization disappeared, only to reappear hours later. With better planning, a similar attack could do more damage and be more difficult to detect.
This is something that Bruce Schneier calls The Third Wave of Network Attacks:
The first wave of attacks was physical: attacks against the computers, wires, and electronics. These were the first kinds of attacks the Internet defended itself against. Distributed protocols reduce the dependency on any one computer. Redundancy removes single points of failure. We’ve seen many cases where physical outages — power, data, or otherwise — have caused problems, but largely these are problems we know how to solve.
Over the past several decades, computer security has focused around syntactic attacks: attacks against the operating logic of computers and networks. This second wave of attacks targets vulnerabilities in software products, problems with cryptographic algorithms and protocols, and denial-of-service vulnerabilities — pretty much every security alert from the past decade.
The third wave of network attacks is semantic attacks: attacks that target the way we, as humans, assign meaning to content. In our society, people tend to believe what they read. How often have you needed the answer to a question and searched for it on the Web? How often have you taken the time to corroborate the veracity of that information, by examining the credentials of the site, finding alternate opinions, and so on?
Computer processes are much more rigid in the type of input they accept; generally this input is much less than a human making the same decision would get. Falsifying input into a computer process can be much more devastating, simply because the computer cannot demand all the corroborating input that people have instinctively come to rely on. Indeed, computers are often incapable of deciding what the “corroborating input” would be, or how to go about using it in any meaningful way. Despite what you see in movies, real-world software is incredibly primitive when it comes to what we call “simple common sense.” For example, consider how incredibly stupid most Web filtering software is at deriving meaning from human-targeted content.
Can airplanes be delayed, or rerouted, by feeding bad information into the air traffic control system? Can process control computers be fooled by falsifying inputs? What happens when smart cars steer themselves on smart highways?
Hmmm… We’ve going to have to figure out how to deal with these problems. Somehow :)




