The researches at the University of Cambridge have published a paper titled “PIN Skimmer: Inferring PINs Through The Camera and Microphone” describing a new approach to recovering PIN codes entered on a mobile on-screen keyboard. We had seen applications use the accelerometer and gyroscope before to infer the buttons pressed. This time, they use the camera to figure out where the fingers are touching after the microphone has signalled the start of a PIN entry. The success rate varies between 30% and 60% depending on configuration and number of samples. And that is a lot.
This attack falls into the category of side-channel attacks and it is rather hard to prevent. The paper explains in detail how the attack works and gives recommendations for mitigation to the developers. The paper also refers to several other works that use side-channel attacks using smartphone. For mobile application developers, it would be a wise idea to read through this and referenced publications to find out what the state of the art now is.
The last week’s meeting of the IETF discussed security of the Internet and the recent revelations that the NSA turned the Internet into a giant surveillance machine. While the sentiment was clear that the Internet should not allow itself to such abuse, there is little evidence that anything at all could be done about it.
The problem is not that it is technically impossible to introduce more encryption and build better protocols. The problem is that it is not in the current interest of the companies to do so. The Internet was conceived for use in academia, so it was not a commercial thing from the start. The principles on which it is built are idealistic. But it is commercial from the hardware to the applications, through and through now. And it is not in any company’s commercial interest to introduce better security. It is quite the opposite, in fact: most companies are interested in less security even if they claim otherwise.
Me and you, as people, as independent human beings, can introduce better security because it is in our interest. I would not rely on companies to do so.
I meant to write about the subject of spying and corporate information security for a while now but got around to it only now. The article Confessions of a Corporate Spy has provided an excellent background for the discussion and is absolutely worth a read.
Twenty years ago the corporate spying was already abound and me, as a fresh employee, was excited to find out that we are actually being spied upon. We had to keep quiet about our work when we went out for drinks or lunches. Once a Good Samaritan lady reported overhearing our colleagues talk about their work in a restaurant near the company. This lead to disciplinary measures and the whole company new what happened. And we all new it was wrong to discuss things outside.
Fast forward twenty years. The company managers discuss the upcoming mergers and acquisitions in a social network account of a third-party company. Details of products, designs, problems, customers are exchanged freely at lunch tables and in trains. How often do you see privacy screens on laptops of people doing their work in trains and at the airports?
People became careless. It’s like if in the drive to deliver more and faster we completely forgot that the competition does not really have to do a lot to catch up with us if they have all the information available to them. We forgot that despite the information flowing in heaps over the Internet we still have to protect it in all the mundane places. Web security, application security, network security do not matter anything if all the same information is available to anyone who can listen carefully and record.
Security is said to be about finding the weakest link and mending it. Nowadays, the physical security of information is rising in the ranks and will become the weakest link. Sometimes it already is. Especially when a specialist in competitive intelligence comes around. With the business intelligence market estimated at $80 billion, do you think we should be sloppy?
Making sure your people know that it is a really bad idea to talk business outside a business setting, to talk confidential information to strangers, to work on company numbers where the screen can be seen and so on is not that hard. Companies 20 years ago did it. We can do it now. Let’s do it.
There is a lot of truth in saying that every tool can be used by good and by evil. There is no point in blocking the tools themselves as the attacker will turn to new tools and subvert the very familiar tools in unexpected ways. Now Google crawler bots were turned into such a weapon to execute SQL injection attacks against websites chosen by attackers.
The discussion of whether Google should or should not do anything about that is interesting but we are not going to talk about that. Instead, think that this is a prime case of a familiar tool that comes back to your website regularly subverted into doing something evil. You did not expect that to happen and you cannot just block the Google from your website. This is a perfect example of a security attack where your application security is the only way to stop the attacker.
The application must be written in such a way that it does not matter whether it is protected by a firewall – you will not always be able to block the attacks with the firewall. The application must also be written so that it withstands an unanticipated attack, something that you were not able to predict in advance would happen. The application must be prepared to ward off things that are not there yet at the time of writing. Secure design and coding cannot be replaced with firewalls and add-on filtering.
Only such securely designed and implemented applications withstand unexpected attacks.