ripperdoc's clinic

Now, part of this hack has been disputed elsewhere, but still - hijacking a plane with an Android and remote controlling it!

This article, no, TOME, is too big to summarise but it discusses cypherpunks, encrypted layered nets, Silk Road - the online drug dealer, and so much more. Read!

In a presentation at the BreakPoint security conference in Melbourne, IOActive researcher Barnaby Jack described an attack on pacemakers that could, he says, deliver lethal shocks to their owners. Jack claims that an unspecified pacemaker vendor’s devices have a secret wireless back-door that can be activated by knowledgeable attackers from up to 30 feet away, and that this facility can be used to kill the victim right away, or to reprogram pacemakers to broadcast malicious firmware updates as their owners move around, which cause them to also spread the firmware, until they fail at a later time.

Hacking a smartphone using NFC makes hacking start look like magic (“I can take over your phone just by touching it”).

Charlie Miller, a security researcher at Accuvant and serial smartphone hacker, demonstrated how easy it is for hackers to exploit near-field communication technology to take control of devices remotely. In front of a packed audience, he successfully hacked three smartphones using N.F.C.: a Samsung Nexus S, a Galaxy Nexus and a Nokia N9. In each case, he was able to access photos, send texts, browse the Internet and even make phone calls from the phones, without laying a finger on them.

Car hacking is starting to emerge…

A disgruntled former employee of Texas Auto Center chose a creative way to get back at the Austin-based dealership: He hacked into the company’s computers and remotely activated the vehicle-immobilization system, which triggered the horn and disabled the ignition system in more than 100 of the vehicles. The dealership had installed the system in their cars as a way to deal with customers who fell behind on their payments.

Suddenly, Hollywood style hacking doesn’t seem so  silly anymore:

It assumes that you have access to a suspended/screen-locked computer whose disk is encrypted. You access the machine over its FireWire interface (or, if it doesn’t have FireWire, you plug a FireWire card into one of its slots, and the machine will automatically fetch, install and configure the drivers, even if it’s asleep), and then use the FireWire drivers to directly access system memory, and from there, patch the password-checking routine and walk straight into the computer.

Of course, this is where we are going when everyone is carrying a pack of connected sensors in their pockets:

PlaceRader hijacks your phone’s camera and takes a series of secret photographs, recording the time, and the phone’s orientation and location with each shot. Using that information, it can reliably build a 3D model of your home or office, and let cyber-intruders comb it for personal information like passwords on sticky notes, bank statements laying out on the coffee table, or anything else you might have lying around that could wind up the target of a raid on a later date

Via Bruce Schneier.

When hacking starts to get scary interesting, is when we hack medical devices. It is not surprising that pacemakers are not secure enough - security grows from earlier mistakes and experience and is rarely designed from day one. But to take this one step further - what happens when we all live in the chrome-shining world of cyberpunk and a nasty worm can make it all go berzerk?

G4S got a bit of bashing during the London Olympics, forcing them to donate to the armed forces (the start of a good relationship, huh?). But it remains a security giant that is reminiscent of those dystopian futures we’re used to seeing in SF.

It’s big:

The first thing you need to know about G4S is that it’s enormous. It has 657,000 employees – more than the population of Glasgow – and is the world’s second-largest private employer, after the American retail giant WalMart. It’s also booming, with profits up 39 per cent in 2011.

It deals in questionable business:

G4S operates prisons and asylum centres across the UK, and will be moving into policing as more and more public services are cut.

Outside the UK, G4S operates in 125 different countries, including Iraq, Afghanistan and Israel, where its paid agents operate checkpoints and provide security at jails for Palestinian prisoners, including child detainees.

And I suspect that Asia, in particular China, where every little mall or condo has security (but rarely needs it), will give us the next megacorp to outshine G4S in general evilness.

John Robb of Global Guerillas makes his living off predicting the end of the world, which is a reason to take this with a pinch of salt, but it still is good inspiration:

• Weaponized computer worms/viruses/malware.  Legal bot networks that control/manipulate society and markets (think in terms of quant hedge funds).  That’s the White horse.  Conquest.
• Drones/robots.  Weaponized drones that at first self-perpetuate by acquiring fuel from the environment.  Weaponized drones that can self-replicate ala 3-D fabrication and scavanged materials (think rep-rap).  That’s the Red Horse.  War.
• Superbugs/superweeds (some may be aided by engineered modification, but all get their start due to the stupidity of growing food in monocultures).  Organisms that can wipe out monocultures and cause the loss of productive farmland and crops ond a global scale.   That’s the Black Horse.  Famine.
• Plague.  Genetically modified weapons, laboratory mistakes, or naturally occuring disease (due to too much physical proximity) that result in plagues.  That’s the Pale Green horse.  Death.

Whenever people apply too much security (“better safe than sorry!”), you can always turn it around into a Denial of Service attack. Example below:

The University of Pittsburgh has been the recipient of 50 bomb threats in the past two months (over 30 during the last week). Each time, the university evacuates the threatened building, searches it top to bottom — one of the threatened buildings is the 42-story Cathedral of Learning — finds nothing, and eventually resumes classes. This seems to be nothing more than a very effective denial-of-service attack.

Think about this for a minute. There are so many situations where security can be turned on itself. Another example is when typing the wrong password locks your account - so someone can lock your account.

An attacker can use this to cause basic problems, economical loss or to fuel conflicts (for example, getting students or citizens to go in conflict against the police). But it can also be used as a “cry wolf” preparation for an actual attack. By making people numb to security alerts, or by forcing the VIPs of the targeted systems to open back-doors (e.g. ignore password locks for important managers because they were too inconvenieced), it’s actually lowering the security for the actual attack.

Remember, nothing is secure, it’s just a cost-benefit ratio.