Tag Archives: NFC

How secure is Google’s/Android’s Smart Lock functionality?

Posted on by

Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering the usual PIN, pattern or password.

I’m asking about NFC in particular. How secure is Smart Lock when configured to unlock the phone when a specific NFC tag is activated?
I’m worried that someone could simply create an NFC tag with the same ID as mine (since NFC activates just by touching something, it’s very difficult to protect an NFC tag from being read at all times).
Note that I’m not asking about the case where my NFC tag is stolen – obviously, my phone would no longer be safe in that case.
What I’d like to know is how secure the technical implementation is, i. e. how can Smart Lock be sure that it’s really my NFC tag and prevent being fooled by something pretending to be my NFC tag.

In my case, the “NFC tag” is my YubiKey NEO. Their FAQ page makes some worrying statements:

Can the YubiKey NEO be used as a Smart Lock device for Android Lollipop?

Yes, the YubiKey NEO can be used as an NFC tag registered for Smart
Lock on Android Lollipop devices. For more information, see the
Android support page.

Note: Android’s SmartLock features uses a static 7 byte ID, which does
not conform to Yubico’s security threshold standards. We recommend
users consider this feature a convenience and not a strong
authentication replacement.

Continue reading How secure is Google’s/Android’s Smart Lock functionality?→

Future attack scenarios against ATM authentication systems

Posted on by

The report comprises two papers in which we analyze all existing methods of authentication used in ATMs and those expected to be used in the near future, including: contactless authentication through NFC, one-time password authentication and biometric authentication systems, as well as potential vectors of attacks using malware, through to network attacks and attacks on hardware components. Continue reading Future attack scenarios against ATM authentication systems→

Skin Bling: Wearable Electronics from Golden Temporary Tattoos

Posted on by

MIT Media Lab and Microsoft have teamed up to take wearable devices one step further — they’ve glued the devices directly to the user’s skin. DuoSkin is a temporary tattoo created with gold leaf. Metallic “Flash” temporary fashion tattoos have become quite popular recently, so this builds on the trend. What the team has done is to use them to create user interfaces for wearable electronic devices.

Generally speaking, gold leaf is incredibly fragile. In this process to yield the cleanest looking leaf the gold is not actually cut. Instead, the temporary tattoo film and backer are cut on a …read more

Continue reading Skin Bling: Wearable Electronics from Golden Temporary Tattoos→