Typing ‘cadence’ used to identify authorized database users, lock everyone else out

We’ll admit to having shared a few login credentials amongst friends here and there in our younger days, but it sounds like the party might soon be over: a company called Scout Analytics has developed a way of identifying a user’s “typing cadence,” and matching it to how a username and password are entered. It only takes 5 login attempts of around 12 characters for Scout to nab your cadence, and although 1 in 20,000 people will share the same cadence, combining the data with browser info and IP addresses makes it accurate enough for general usage. No word on what sites are using this technique, but we won’t be surprised if it starts popping up rapidly — and sniffing typing cadences becomes the next great malware scourge.

P.S.- Yes, we just wanted to run the picture of the keyboard pants again. Seriously, can someone please hook us up with those?

Typing ‘cadence’ used to identify authorized database users, lock everyone else out originally appeared on Engadget on Sat, 20 Feb 2010 01:57:00 EST. Please see our terms for use of feeds.

Permalink   |  sourceArs Technica  | Email this | Comments

Corsair’s Padlock 2 offers 256-bit AES encryption inside a rugged body

Our British readers will already be painfully familiar with the comical propensity that government officials (even spies!) have for losing sensitive data while on the move. It might be an idea, therefore, to give your forgetful local representative a break with one of these new Corsair USB drives. The Padlock 2 features OS-agnostic password protection via the keypad you see above plus 256-bit encryption of the data stored on the flash inside. So even if someone is tenacious enough to pry the case open, he’ll have a hard time getting anything useful out of it. Oh, and don’t worry about forgetting the passcode, there’s a procedure for wiping the drive clean and generating a new one. 8GB units are available immediately, and we’ve spotted them online priced at £46 in the UK and $59 in the good old US of A.

Corsair’s Padlock 2 offers 256-bit AES encryption inside a rugged body originally appeared on Engadget on Fri, 19 Feb 2010 06:55:00 EST. Please see our terms for use of feeds.

Permalink Hexus  |  sourceCorsair  | Email this | Comments

Cyber ShockWave training exercise tests US readiness for cyber-attacks

If we’ve learned anything from Hollywood it’s that cybersecurity is a growing national concern. And there are a couple approaches the country could take to tackle the problem. The first, which we wholeheartedly endorse, involves relying on tough guys with bad attitudes, short fuses, and a propensity for tattered clothing (at least once the bombs start dropping). The other — endorsed by Washington think tanks with names like the Bipartisan Policy Center — would be actual preparation and policy-making. To this end, the Mandarin Oriental Hotel in DC hosted Cyber ShockWave, which only sounds like an awesome energy drink — in fact, it was a simulated, 12-hour cyber attack held yesterday. In the words of the Wall Street Journal, organizers intended “to show how the U.S. government would respond to [attacks] against its networks and infrastructure.” According to a 367-page November report by the US-China Economic Security Review Commission, the DoD has had to deal with some 54,640 total cyber attacks in 2008 — with the number of attacks increasing to 43,785 in the first half of 2009 alone. That’s a lot of attacks! On second thought, maybe the whole “preparation” and “training” thing does sound like a good idea. So long as we keep John McClane around — just in case.

Cyber ShockWave training exercise tests US readiness for cyber-attacks originally appeared on Engadget on Thu, 18 Feb 2010 06:28:00 EST. Please see our terms for use of feeds.

Permalink   |  sourceWall Street Journal  | Email this | Comments

Christopher Tarnovsky hacks Infineon’s ‘unhackable’ chip, we prepare for false-advertising litigation

Christopher Tarnovsky hacks Infineon's 'unhackable' chip, we prepare for false-advertising litigation

As it turns out, Infineon may have been a little bit… optimistic when it said its SLE66 CL PE was “unhackable” — but only a little. The company should have put an asterisk next to the word, pointing to a disclaimer indicating something to the effect of: “Unless you have an electron microscope, small conductive needles to intercept the chip’s internal circuitry, and the acid necessary to expose it.” Those are some of the tools available to researcher Christopher Tarnovsky, who perpetrated the hack and presented his findings at the Black Hat DC Conference earlier this month. Initially, Infineon claimed what he’d done was impossible, but now has taken a step back and said “the risk is manageable, and you are just attacking one computer.” We would tend to agree in this case, but Tarnovsky still deserves serious respect for this one. Nice work, Big Gun.

Christopher Tarnovsky hacks Infineon’s ‘unhackable’ chip, we prepare for false-advertising litigation originally appeared on Engadget on Fri, 12 Feb 2010 10:31:00 EST. Please see our terms for use of feeds.

Permalink Yahoo! News  |  sourceDarkReading  | Email this | Comments

Bad-Luck Criminal Nabs from Swann Security at CES

SwannVideo.jpg

Who doesn’t love a dumb criminal story? Take the case of Willy Wu, who lifted a customer sign-in book from a CES booth this year. While that might not seem like a worthwhile target in a convention full of shiny new technology, the book was full of valuable business leads. Wu might have gotten away with it, if his target booth hadn’t been Swann Security, a video surveillance company.

When Swann’s group CEO and vice chairman Keith Oldridge noticed that the valuable book was missing, he yelled out a $1,000 reward for anyone who could catch the thief. Then he realized that he had several of his company’s own security devices running at the booth and could ID the criminal himself.

Oldridge found footage of Wu’s theft and showed it to CES security, who quickly tracked Wu down and recovered the book. For more, watch Las Vegas’s local news report.

Protonex fuel-cell batteries to power HULC exoskeleton for three solid days

We’re selfishly daydreaming of how we could use something like this at the next CES, but chances are that Lockheed Martin is really only fixated on boosting its bottom line by assisting the US military. The company’s HULC exoskeleton, which was originally introduced by Berkeley Bionics in 2008, is seeing a significant upgrade this week courtesy of a fuel-cell power pack from Protonex. The goal? To strap a new, more potent battery onto the Human Universal Load Carrier that will support 72+ hour extended missions. Soldiers tend to carry around a lot more gadgetry now, all of which requires more and more power; with this pack, the men and women in the field could carry fewer conventional batteries while seeing an overall boost in available juice. There’s no mention of when exactly this stuff will be rolled out en masse, but that’s a detail you’ll probably never know, anyway.

Protonex fuel-cell batteries to power HULC exoskeleton for three solid days originally appeared on Engadget on Fri, 22 Jan 2010 09:29:00 EST. Please see our terms for use of feeds.

Permalink The Register  |  sourceLockheed Martin  | Email this | Comments

Microsoft patches IE security hole, human rights activities fully resume

Ready for an update? Good. If you’re still using Microsoft’s Internet Explorer (versions 5.01 to 8) for some inexplicable reason, there’s a patch that you should probably install on the double — that is, if you’re a hardcore human rights activist that just might end up on a Chinese hit list. All kidding aside, the devs in Redmond have broken free from their usual monthly update cycle in order to push out a patch to fix the hole that was exploited by a group of sophisticated hackers last week. Refresh that Windows Update if you’re scared, or — you know — just download one of the many other free web browsers that are far, far superior to IE.

Microsoft patches IE security hole, human rights activities fully resume originally appeared on Engadget on Thu, 21 Jan 2010 18:22:00 EST. Please see our terms for use of feeds.

Permalink   |  sourceYahoo! Tech  | Email this | Comments

Brits Send 4,500 USB Sticks to the Cleaners

Last year in Britain, 4,500 USB sticks were left in pockets of clothes that were sent to the dry cleaner. Don’t laugh, we’ve all done it: I even managed to run an iPod Nano through the wash (without killing it). The survey, paid for by data security company Credant Technologies, apparently highlights the dangers of putting sensitive company data onto the little thumb drives.

The thinking goes that absent-minded employees with dirty clothes could fall afoul of the UK’s Data Protection Act and incur fines of up to £500,000 ($813,000). The news isn’t all bad, though: the number of drives left in pockets has halved since last year.

Lest these new figures threaten Credant’s marketing plan (why else would you commission a survey other than to prove a point you had already decided upon?), the company has a new spin. Perhaps all this sensitive information is being loaded onto netbooks and smartphones? The horror. Remember when the iPod, with its then-capacious hard drive, was the garlic and stake to the corporate IT security team, banned from workplaces to protect precious noughts and ones from being spirited away? This is the same thing over again.

And anyhow, thumb-drives are the pocket lint of the modern day. Dry cleaners of course rummage through your pockets, and while loose change will always be a welcome perk, we imagine that the USB stick has lost all novelty and will simply be tossed away as if it were a hardened, desiccated Kleenex.

Data hung out to dry as 4,500 USBs are left in Dry Cleaners [Credant. Thanks, Yvonne!]


AT&T fixes bug that logged users into random Facebook accounts

Okay, so we were under the impression that Facebook login credentials were a locally-managed affair, but it looks like almost anything can break when AT&T’s involved — according to CNET, the carrier just fixed “several problems” that had users logging into the wrong Facebook account from their phones. The issue was apparently related to subscriber identification numbers being mistranslated into bad URL session IDs, and AT&T says it’s taken some security measures to prevent it from happening again, while Facebook’s just shut off the automatic login feature that used the ID number entirely. Excellent work all around. Unfortunately, there’s also a pesky incident in Atlanta where someone was able to login to another Facebook account from an AT&T phone due to a bad cookie, but AT&T says that was an “isolated” case and that it’s “unclear how this cookie was set on the phone.” How very reassuring. Back to Friendster!

AT&T fixes bug that logged users into random Facebook accounts originally appeared on Engadget on Mon, 18 Jan 2010 23:04:00 EST. Please see our terms for use of feeds.

Permalink   |  sourceCNET, Yahoo  | Email this | Comments

Novatel’s MiFi devices shown to be incredibly useful, easily hacked (video)

Novatel's MiFi devices shown to be incredibly useful, easily hacked (video)

We’ve personally experienced the joys of portable wireless routers like Novatel’s MiFi, little things that do the 3G talkin’ for you, but from what we’re seeing here current users may be about to experience something altogether different: fear. A hack that is both very nasty and easy to execute has been shown which would, most troublingly, allow a malicious page to modify the MiFi settings on behalf of the user, possibly disabling security or even locking out the owner of the router, as shown in a quick demonstration video after the break. A factory reset fixes it all, of course, but doesn’t do anything to alleviate the apparently shoddy security mechanisms at play here. Time for another firmware update, perhaps?

Continue reading Novatel’s MiFi devices shown to be incredibly useful, easily hacked (video)

Novatel’s MiFi devices shown to be incredibly useful, easily hacked (video) originally appeared on Engadget on Mon, 18 Jan 2010 08:59:00 EST. Please see our terms for use of feeds.

Permalink Boy Genius Report  |  sourcenGenuity, evilpacket  | Email this | Comments