Category Archives: securityengineering

Stealing Browsing History Using Your Phone’s Ambient Light Sensor

Posted on by

There has been a flurry of research into using the various sensors on your phone to steal data in surprising ways. Here’s another: using the phone’s ambient light sensor to detect what’s on the screen. It’s a proof of concept, but the paper’s general conclusions are correct: There is a lesson here that designing specifications and systems from a privacy… Continue reading Stealing Browsing History Using Your Phone’s Ambient Light Sensor→

IoT Teddy Bear Leaked Personal Audio Recordings

Posted on by

CloudPets are an Internet-connected stuffed animals that allow children and parents to send each other voice messages. Last week, we learned that Spiral Toys had such poor security that it exposed 800,000 customer credentials, and two million audio recordings. As we’ve seen time and time again in the last couple of years, so-called "smart" devices connected to the internet­ –… Continue reading IoT Teddy Bear Leaked Personal Audio Recordings→

Digital Security Exchange: Security for High-Risk Communities

Posted on by

I am part of this very interesting project: For many users, blog posts on how to install Signal, massive guides to protecting your digital privacy, and broad statements like "use Tor" — all offered in good faith and with the best of intentions — can be hard to understand or act upon. If we want to truly secure civil society… Continue reading Digital Security Exchange: Security for High-Risk Communities→

Security and Privacy Guidelines for the Internet of Things

Posted on by

Lately, I have been collecting IoT security and privacy guidelines. Here’s everything I’ve found: "Internet of Things (IoT) Broadband Internet Technical Advisory Group, Broadband Internet Technical Advisory Group, Nov 2016. "IoT Security Guidance," Open Web Application Security Project (OWASP), May 2016. "Strategic Principles for Securing the Internet of Things (IoT)," US Department of Homeland Security, Nov 2016. "Security," OneM2M Technical… Continue reading Security and Privacy Guidelines for the Internet of Things→

Cryptkeeper Bug

Posted on by

The Linux encryption app Cryptkeeper has a rather stunning security bug: the single-character decryption key "p" decrypts everything: The flawed version is in Debian 9 (Stretch), currently in testing, but not in Debian 8 (Jessie). The bug appears to be a result of a bad interaction with the encfs encrypted filesystem’s command line interface: Cryptkeeper invokes encfs and attempts to… Continue reading Cryptkeeper Bug→

Security Lessons from a Power Saw

Posted on by

Lance Spitzner looks at the safety features of a power saw and tries to apply them to Internet security: By the way, here are some of the key safety features that are built into the DeWalt Mitre Saw. Notice in all three of these the human does not have to do anything special, just use the device. This is how… Continue reading Security Lessons from a Power Saw→

Security Design: Stop Trying to Fix the User

Posted on by

Every few years, a researcher replicates a security study by littering USB sticks around an organization’s grounds and waiting to see how many people pick them up and plug them in, causing the autorun function to install innocuous malware on their computers. These studies are great for making security professionals feel superior. The researchers get to demonstrate their security expertise… Continue reading Security Design: Stop Trying to Fix the User→