Category Archives: securityengineering

Security of Solid-State-Drive Encryption

Posted on by

Interesting research: "Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs)": Abstract: We have analyzed the hardware full-disk encryption of several SSDs by reverse engineering their firmware. In theory, the security guarantees offered by hardware encryption are similar to or better than software implementations. In reality, we found that many hardware implementations have critical security weaknesses, for many… Continue reading Security of Solid-State-Drive Encryption→

Buying Used Voting Machines on eBay

Posted on by

This is not surprising: This year, I bought two more machines to see if security had improved. To my dismay, I discovered that the newer model machines — those that were used in the 2016 election — are running Windows CE and have USB ports, along with other components, that make them even easier to exploit than the older ones…. Continue reading Buying Used Voting Machines on eBay→

Chinese Supply Chain Hardware Attack

Posted on by

Bloomberg is reporting about a Chinese espionage operating involving inserting a tiny chip into computer products made in China. I’ve written about (alternate link) this threat more generally. Supply-chain security is an insurmountably hard problem. Our IT industry is inexorably international, and anyone involved in the process can subvert the security of the end product. No one wants to even… Continue reading Chinese Supply Chain Hardware Attack→

Security Vulnerability in ESS ExpressVote Touchscreen Voting Computer

Posted on by

Of course the ESS ExpressVote voting computer will have lots of security vulnerabilities. It’s a computer, and computers have lots of vulnerabilities. This particular vulnerability is particularly interesting because it’s the result of a security mistake in the design process. Someone didn’t think the security through, and the result is a voter-verifiable paper audit trail that doesn’t provide the security… Continue reading Security Vulnerability in ESS ExpressVote Touchscreen Voting Computer→

New iPhone OS May Include Device-Unlocking Security

Posted on by

iOS 12, the next release of Apple’s iPhone operating system, may include features to prevent someone from unlocking your phone without your permission: The feature essentially forces users to unlock the iPhone with the passcode when connecting it to a … Continue reading New iPhone OS May Include Device-Unlocking Security→

New iPhone OS May Include Device-Unlocking Security

Posted on by

iOS 12, the next release of Apple’s iPhone operating system, may include features to prevent someone from unlocking your phone without your permission: The feature essentially forces users to unlock the iPhone with the passcode when connecting it to a USB accessory everytime the phone has not been unlocked for one hour. That includes the iPhone unlocking devices that companies… Continue reading New iPhone OS May Include Device-Unlocking Security→

Ray Ozzie’s Encryption Backdoor

Posted on by

Last month, Wired published a long article about Ray Ozzie and his supposed new scheme for adding a backdoor in encrypted devices. It’s a weird article. It paints Ozzie’s proposal as something that "attains the impossible" and "satisfies bo… Continue reading Ray Ozzie’s Encryption Backdoor→

Ray Ozzie’s Encryption Backdoor

Posted on by

Last month, Wired published a long article about Ray Ozzie and his supposed new scheme for adding a backdoor in encrypted devices. It’s a weird article. It paints Ozzie’s proposal as something that "attains the impossible" and "satisfies both law enforcement and privacy purists," when (1) it’s barely a proposal, and (2) it’s essentially the same key escrow scheme we’ve… Continue reading Ray Ozzie’s Encryption Backdoor→