I spent a little time today getting caught up on some security news. Here are three fascinating security reads, I think you’ll enjoy:
Revisiting “Dude, your car’s infected!”
Last March, we posted a story about an article in Motor Trend detailing the interesting proclamation that cars may soon be in need of “McAfee or Norton protection.” Basically, a research team developed a virus called “CarShark” that allowed a car’s computer system to become exploited. Here’s a recent white paper on their findings.
The good news is the attack vectors and vulnerable subsystems are unique by car make and model. Thus, an exploit that makes one car vulnerable doesn’t necessarily cross over to another make or model at this point in time.
However, I believe it is simply a matter of time before the car industry starts implementing standards similar to the computer industry. For example, the computer industry’s ATX form factor standard simplified the assembly process by specifying locations of mounting holes and bus slots. These types of common sense changes could very well see their way into the auto industry as our computer technology becomes more fluid and replicable in all cars. But with a simplified system, comes easier access for a CarShark-like virus to take form.
A Truly Black Friday
After the Thanksgiving holiday, City College of San Francisco discovered their network had been breached. Now what makes this story especially shocking is the hole in the network that caused this breach has been open for over A DECADE. The network was compromised way back in 1999 and was a consistent source of private information for computer criminals in China, Russia and multiple other countries. Private data, including personal banking information was stolen from” tens of thousands of students, faculty and administrators” at the college over the past 12 years.
AT&T Wi-Fi Woes
In April 2010, CNET wrote an article about AT&T phones automatically connecting to Wi-Fi hotspots named “attwifi” without even bothering with username or password. Apparently the Einsteins at AT&T believe no one but AT&T would possibly name their wireless network “attwifi.”
In today’s day and age, this little goof was found and naturally exploited. A fun little blog entry from May 2011 ran an “attwifi impersonation experiment” with surprising results. AT&T still hadn’t eliminated this loophole and a high percentage of AT&T devices still automatically connected.
Imagine my surprise when a co-worker emailed me this last week, clearly illustrating the whole “attwifi” is still unfixed and still being exploited! A person on the above thread who plays around with the “attwifi” loophole allows users to connect to his fake hotspot, however uses a few harmless tools to flip images upside down and/or make them blurry in the hope people notice and start paying attention to what they’re connecting to.
And branching off the concept of altering the look and feel of web pages, check out this video by g0tmi1k of what he can do with Squid scripts. My personal favorite is the ASCII art script.