A Merry Christmas to all Bankers

Found on Light Blue Touchpaper on Friday, 24 December 2010
Browse Hardware

The bankers' trade association has written to Cambridge University asking for the MPhil thesis of one of our research students, Omar Choudary, to be taken offline. They complain it contains too much detail of our No-PIN attack on Chip-and-PIN and thus "breaches the boundary of responsible disclosure"; they also complain about Omar's post on the subject to this blog.

The bankers also fret that "future research, which may potentially be more damaging, may also be published in this level of detail".

So basically the banks want to hide a known security flaw by trying to censor research on it instead of coming up with a more secure solution.

Why the Leather Cover Crashes the Kindle 3

Found on Connectify on Monday, 20 December 2010
Browse Hardware

I was in the middle of writing a blog post about how great the Kindle 3 and Connectify work together (which I will post in the next day or two), but started having a problem with my Kindle crashing randomly.

It didn't seem to make a lot of sense that a leather cover would crash an electronic device, so I got curious and started to look closely at my Kindle's case.

Once a bit of paint has rubbed off the hooks, power starts flowing through the cover, leading to brownouts.

A really smart move to make the hooks from a single piece of metal when the sockets for exactly those hooks work as a power supply.

Intel's Sandy Bridge processors have a remote kill switch

Found on Techspot on Saturday, 18 December 2010
Browse Hardware

Intel's new Sandy Bridge processors have a new feature that the chip giant is calling Anti-Theft 3.0. The processor can be disabled even if the computer has no Internet connection or isn't even turned on, over a 3G network.

While a given stolen netbook, laptop, or desktop can no longer be turned on if Intel's new kill switch is flipped, there's nothing stopping the thief from taking out the HDD and putting it in another computer.

What could possibly go wrong? It's not like Intel would set a default password like '12345', right?

Secret Button Sequence Bypasses iPhone Security

Found on Wired on Monday, 25 October 2010
Browse Hardware

A Brazilian iPhone customer demonstrates the quick method to circumvent an iPhone's passcode-protected lock screen: tap the "Emergency Call" button, then enter three pound signs, hit the green Call button and immediately press the Lock button.

An Apple spokeswoman contacted Wired.com with a response regarding the security flaw: "We're aware of this issue and we will deliver a fix to customers as part of the iOS 4.2 software update in November."

Seems Apple does not consider that bug important enough to issue a fix.

Sony: Counterfeit PS3 controllers can explode

Found on CNet News on Wednesday, 22 September 2010
Browse Hardware

Sony informed consumers this week that some counterfeit PlayStation 3 controllers could ignite or explode when used.

The company did recommend that consumers stick with its own wireless controllers, which are available from a number of reputable retail outlets.

So what? Laptop batteries from Sony explode too. Perhaps Sony should come up with a better way to spot the fakes.

Intel Threatens to Sue Anyone Who Uses HDCP Crack

Found on Wired on Saturday, 18 September 2010
Browse Hardware

Intel threatened legal action Friday against anybody who uses its proprietary crypto key - leaked on the internet - to produce hardware that defeats the so-called HDCP technology that limits home recording of digital television and Blu-ray.

The anonymous release this week of the HDCP master key means black market hardware makers, perhaps in China, can now create hardware capable of defeating the copy protection scheme.

"Someone has used mathematics and computers to be able to work back to what the master key is"

It had to happen sooner or later. Yet the industry does not learn that copy protection won't really work and information wants to be free.

PSJailbreak cloned, released, freely available

Found on Ars Technica on Tuesday, 31 August 2010
Browse Hardware

You'll need the code, a PlayStation 3, and a USB microcontroller in order to open your system. Oddly enough, sales of such devices seem to be in the middle of a spike.

Once the PlayStation 3 was hacked it was only a matter of time before the software was made available free of charge; there are simply too many risks involved with selling this sort of thing via a standard storefront, and too many people more interested in the software's spread than profit.

It's amusing to see how much effort the industry puts into a technology that gets broken sooner or later anyway.

New iPhone Security Patent App: User Protection or 1984 iSpy?

Found on Wired on Monday, 23 August 2010
Browse Hardware

One method the patent describes for detecting a stolen iPhone is checking whether it's been hacked (aka "jailbroken") or its SIM card has been yanked out - things a clever thief would do to override the iPhone's security.

"Ignoring the possibility that a false positive in Apple's proposed theft protection might activate the spy cam while the user is in the bath, or in the middle of some other intimate moment, this technology seems Orwellian for another reason: It gives Steve Jobs and Co. the means to retaliate when iPhones aren't being used in ways Cupertino doesn't expressly permit," The Register wrote over the weekend.

Apple just doesn't give up. After admitting that it spied on users to create a geolocation service and after jailbreaking was deemed legal, Steve still tries to keep a tight grip on everything.

E-Voting Machine Easily Reprogrammed To Play Pac-Man

Found on Techdirt on Wednesday, 18 August 2010
Browse Hardware

The really important point is that they did this in three afternoons (and remember, these machines are often left totally unguarded, in the open at polling places for days before elections) without breaking any of the "tamper-resistant" seals that are supposed to alert anyone to any foul play.

So now my only question is whether or not they get a cease and desist from NAMCO.

Tamper-resistant, eh? Looks like some real idiot was responsible for that if removing the screws doesn't break the seal.

U.S. Declares iPhone Jailbreaking Legal, Over Apple's Objections

Found on Wired on Sunday, 25 July 2010
Browse Hardware

Federal regulators lifted a cloud of uncertainty when they announced it was lawful to hack or "jailbreak" an iPhone, declaring Monday there was "no basis for copyright law to assist Apple in protecting its restrictive business model."

Apple also told regulators that the nation's cellphone networks could suffer "potentially catastrophic" cyberattacks by iPhone-wielding hackers at home and abroad if iPhone owners are permitted to legally jailbreak their shiny wireless devices.

Perhaps it would be smarter to pay more attention to security then. If the network is well-designed, a "terrorist" with a jailbroken iPhone can't do much. However, relying on locked down device and therefore neglecting network security is the worst thing one can do.