Apple's TouchID on the iPhone 5S

Since the Apple iPhone 5S has come out, I've read a few articles on one new feature of the phone, the TouchID fingerprint recognition system.  This is not the first time that fingerprint systems have been used in either smartphones or in technology devices, but I think this is the first time to put it in a system of more mass consumer use.

I recall that several laptops over the years have included a fingerprint system.  My current laptop has one, tho I don't use it.  With smartphones, the Motorola Atrix 4G has it.  I used the phone for awhile, and it seemed to work ok, tho when a new version of Android was rolled out, it no longer worked.  That was part of the problem.  With the iPhone 5S, fingerprint recognition is actually built into iOS7, and is not an add-on service or like with the Atrix 4G or with various laptop.

But people will keep trying to added fingerprint systems to devices.  I even have a USB thumbdrive that has a fingerprint system in it.

Thing is, fingerprint recognition is tricky.  There are a lot of potential issues, especially as the finger can get dirty, which can affect the effectiveness of the scanner.

Why people want to use them is pretty clear.  When it comes to authentication, there are 3 factors that can be used:

• "what you know" (passwords, other information)
• "what you have" (hardware tokens)
• "what you are" (biometrics: fingerprint, handprint, iris scan)

A system that uses more then one factor is considered more secure.  Thus, your basic login system which uses username & password is actually using "what you know" twice.  Whereas if you had a "what you have" such as a hardware token or a one-time code sent to your phone is considered more secure.

Biometrics is more tricky.  But its getting better.  I recall at a college I was at tried a handscan system for the cafeteria, but due to issues dropped it for an ID card.  I think the face scanner ideas are interesting.

Another factor that people are really considered about is the privacy issues.  People are concerned that Apple will be able to pull their fingerprints from their phones.  Something to look into further.

This is a work in progress, and I plan to return to this topic.

Currently reading: Android Application Security Essentials

I wouldn't ordinarily do this, but I am currently reading Android Application Security Essentials by Pragati Ogal Rai and published by PackT Publishing.

(you can check out the book here:   http://bit.ly/15mnEus)

Seeing as how more and more people are moving the mobile devices (smartphone and tablets) not just as a secondary device but sometimes a primary device, security applications on these devices becomes more and more important.  This book aims to address it.  I am still reading it, but what I've read it pretty good.  Even if your focus is not application development, this will help your understanding of Android security.

Once complete, I hope to do a full review here.  In the meantime, check out the publishers other works.  I've seen several that have caught my eye.

The new version of Android- 4.4 Kit Kat

By now, I think most people know that the new version of Android is 4.4, and is called "Kit Kat".  Yes, the candy.  Most people thought the next version would be 5.0 and that it would be called "Key Lime Pie".  For those not aware, major versions of Android have been named after deserts, and in alphabetic order.  The next letter would be "K", and the rumors was it would be "Key Lime Pie".

Now that Google has released it, we now more about it.  It seems we don't have a lot of new flashy features, but more fundamental improvements.

October is National Cyber Security Month. What are you doing?

For those not aware, October is National Cyber Security Awareness Month (NCSAM).

"NCSAM is designed to engage and educate public and private sector partners through events and initiatives with the goal of raising awareness about cybersecurity and increasing the resiliency of the nation in the event of a cyber incident. October 2013 marks the 10th annual National Cyber Security Awareness Month sponsored by the Department of Homeland Security in cooperation with the National Cyber Security Alliance (NCSA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC)."

Now, locally, Nova Southeastern University's Graduate School of Computer and Information Sciences is hosting a series of events that tie in with NSCAM.  The brochure for the events is HERE.

The events are:

* October 3rd- FBI Presentation on National Cyber Security Awareness
* October 10th- Raising Savvy Cyber Kids
* October 17th- Healthcare Cyber Security Summit
* October 24th- Webinar: 12 Simple Cybersecurity Rules for your Small Business

Overall, I think this is a great lineup of sessions.  What is going on in your area for NCSAM??

Filling the void of Blackberry

By now, I think more people are aware of what's going on with RIM/Blackberry.  For most people, it was a matter of who they would be bought out by and when.

When RIM rolled out the Blackberry many years back, its focus was on the business user.  This user needed something relayable and SECURE.  But when the iPhone hit (and later Android), even tho these devices were less secure than Blackberry, they had features that Blackberry lacked and was hard to catch up: the array of applications.

Now, some tried to bring iPhones and Androids up to the level of Blackberry, to be able to compete for the business user.  For a period of time, Motorola Mobility had an array of products that made their phones more acceptable to the business user.  They had bought out 3LM (mentioned in a prior posting) to make Android more secure.  Their "webtop" on their high end phones was another addition aimed at the business user.  This was a stripped down Linux OS with added features that would turn the phone into a "laptop" if connected to an HDMI device and keyboard (say thru one of their docking stations) or plugged into one of their "lapdocks" which gave a netbook-sized screen and keyboard.  Sadly, when Google bought Motorola Mobility, all that would be dropped as Google wanted the new division to instead focus on the larger consumer market.

Thus, it was left to others to step into the field.  Samsung has already done so to a degree with their Knox security add-on to Android (again, see my prior posting).  Now they seem to have extended this with their SAFE (Samsung for Enterprise) effort.  As higher security for such devices is important, this bearing watching.

See article HERE.

New Security features of Android 4.3

The new version of Android rolled out, 4.3 Jelly Bean, also brings new security features.

By most count, it seems there are 7 security features rolled out.

1.  First off, we have Restricted Profiles.  This is a feature ONLY for tablets, as these are devices that are often shared among people, especially family members.  This allows for different profiles to be setup, some with restrictions, for, say, children.   More on this HERE.

2.  Next there is strengthening of encryption.  This includes tools to make sure neither hackers or other malicious entities can access the keys.  There are a new set of APIs for this, known as the Keychain/Keystore system API.

3.  There is a Nousid command that makes sure no program can obtain root privileges by setting the setuid bit.  The /system partition is also better secured as part of this.

4.  The new Find My Phone app (Android Device Manager) can be used to find/locate a lost or stolen device.  And the user can use this to remotely manage, lock, or wipe clean the device.  This I find interesting, as this is a service that many obtain thru MDM systems.  For a corporate user, this is usually part of such a corporate MDM system, run by their company admins.  For the individual user, one can obtain their own such service from third parties.  So I would think this would compete against that more so then the corporate MDM.  But could this be a competition for the corporate MDM systems?  Here is more info on this feature.

5.  Again, something that is not actually in Android, there is the Verify Apps feature that is part of Google Play.  I already blogged about this in a previous posting.  This should extend the protection of Bouncer, but we've already see Bouncer failing (see my previous postings).  So while Google seems to feel that such things (Bouncer and probably Verify Apps) negates the need for anti-malware apps on Android, I am a bit skeptical of this.

6.  They have activited within Android SELinux.  Now, many may not realize that Android is actually built on Linux.  SELinux is "Security Enhanced Linux", which adds mandatory access controls (MAC) to the Linux kernal.  For more on SELinux, go to the project page HERE.

7.  Finally, there is new WPA2 Wi-Fi security capabilities.  This isn't something the end user can use, but only programmers.  It allows for the use of the new WPA2 (Wi-Fi Protected Access 2) features of Wi-Fi.

These are pretty nice set of additions.  I would like to see how the security of Android 4.3 compares to the latest versions of iOS and Windows Phone.  Not seen a side-by-side comparison.  If any know of one, I'd like to know.

On a related note, I came across THIS article at the Official Google blog on securing your Android phone. They basically give 3 tips:  1) screen lock, 2) be secure on apps you install, but Bouncer & Verify Apps will protect you, and 3) used Find My Phone to be able to find and/or wipe your phone.


I used this article for the source of this posting: HERE  Another good resource I found is HERE.

Security in the "Internet of Things"

During the recent round of IT Security/Hacker conferences in Las Vegas (Defcon, Black Hat, BSides), a variety of interesting security issues have been revealed in various "non-computer" devices that are networks.

Here is a high level overview of several:

• Hacking of the "Smart Home":  HERE  and HERE   and HERE
• Hacking of the "Smart Car":   HERE   and longer commentary on the issue HERE
• Hacking of the "Smart Toilet":   HERE  and HERE
• Hacking of a baby monitor:   HERE  and HERE  (Updated)
• Hacking of networked lightbulbs:  HERE