Tag Archive for Bluetooth

| November 27, 2020
Comments Off on Does that Doggy E-Toy Protect Privacy?

Does that Doggy E-Toy Protect Privacy?

Does that Doggy E-Toy Protect Privacy?Thanks to COVID it is the virtual silly season. No more jamming into malls it is online shopping now. Half of shoppers spend some of their money on pet treats and other supplies this holiday season. If your virtual gift list includes presents for your four-legged buddy – be careful, there are some puppy toys out there that can compromise your privacy while Fido is entertained. Mozilla’s “Privacy Not Included” project analyzed the security of pooch-gifts, and the results are not good for your privacy.

Internet of ThingsAll of these technologies can become part of the Internet of Things (IoT). IoT technology interconnects them. For example, IoT connects the camera in your living room with the smartphone on your desk, allowing you to monitor your pet while you’re at work. IoT enables the collection and interconnectivity of data, which is extremely important when considering your safety and privacy.

Dogness iPet Robot – This doggy toy costs $299.00 and has all the bells and whistles to keep Fido entertained. It moves and chases your pooch. It has an HD video camera with night vision to record your pup, two-way audio to talk to your doggo, a laser to chase, and the ability to toss treats to your buddy with the click of a button in the app. The iPet Robot connects over Wi-Fi so your home network better be secure – otherwise, somebody could take over the rolling spybot and catch your pooch – or you – in a compromising position.

Dogness iPet RobotThe Dogness iPet Robot also comes with Mozilla’s “*Privacy Not Included” warning. The bot can roll around your house with a night vision camera and microphone while connected to Wi-Fi. Mozilla says that both the Dogness device and app can snoop on you. The researchers report the device doesn’t encrypt your data. Dogness doesn’t state what information is collected from the robot, or what they do with it. Dogness uses artificial intelligence, but the reviewers could not determine how the firm uses AI.

If that is not scary enough, in March 2020, it was reported that Dogness left its Amazon ElasticSearch server exposed, containing the usernames, emails, clear-text passwords, and session cookies of its users. The unprotected information has led to the complete exposure of its production SQL database and application source code and the complete takeover and control of its pet feeding devices and associated accounts.

Mozilla could not determine if the Dogness iPet Robot meets its Minimum Security Standards.

Cheerble WickedboneCheerble Wickedbone Interactive Gaming Toy For Dogs –This $78.99 interactive bone is next on the naughty list. You can control this interactive bone through an app on your phone that connects through Bluetooth. From the app you can make the bone roll around and change colors. When you get bored, a 20-minute interactive mode can entertain your pup without you.

The app requires access to your phone’s GPS location data—why? That’s a good question. Additionally, the reviews could not determine if the firm encrypted your data, required strong passwords, or used AI to make decisions about you. And like most IoT devices, it doesn’t seem to have a way to manage security vulnerabilities. Mozilla says this pet toy does not meet its Minimum Security Standards for these reasons.

Fitbark GPSFitbark– I first wrote about Fitbark back in 2013. The Fitbark GPS costs $99.95 + subscription + the costs of Verizon’s LTE-M cellular network coverage. It is a bone-shaped tracking device that goes on your dog’s collar and will track her just about anywhere in the U.S. It also connects to Wi-Fi.

The Fitbark monitors your dog’s activity, sleep habits, scratching habits, and stress 24/7. You can link it to your FitBit, Google Fit, or Apple HealthKit apps and you can stress about your doggo’s health too.

Mozilla reports that Fitbark tracks your dog’s movements and whereabouts with Bluetooth, Wi-Fi, and GPS. With all that tracking, an attacker could keep tabs on you or your pup. The app does collect personal data, including name, email, phone number, address, date of birth, profile photo, dog’s health, and biometric data.

Felik Pet CompanionThe Felik Pet Companion—This mouse-shaped bot costs $129.00. It has a camera and artificial intelligence that tracks your pet, learns from their movements, and reacts to how they hunt so it can simulate real prey. Felik connects to the Wi-Fi in your house and has an app where you can schedule play throughout the day.

Mozilla says the firm seems to take privacy and security seriously. They built security and privacy-aware features into the dog toy, like the ability to toggle Wi-Fi on and off with a physical button, an indicator light when the camera is streaming, and even an on-device firewall.

Since it has a camera and a microphone, it could be sued to snoop on you. The app tracks your location. The product uses AI to analyze your personal data to make decisions about you. However, users can request an explanation about any decisions taken as a result of automated decision-making by contacting Felix.

rb-

The Felik Pet Companion is the only online dog-toy that I would allow in my home.  

The Mozilla *Privacy Not Included buyer’s guide investigates the privacy and security of connected toys, gadgets, and smart home products. They flag products they think consumers should think twice about before buying. Mozilla looks at how well they can confirm a product meets a Minimum Security Standard.

 

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , ,
| October 10, 2020
Comments Off on Smart Backpacks

Smart Backpacks

Smart BackpacksI first wrote about Google’s Project Jacquard which weaves conductive threads to create touch-responsive clothing in 2015. Since then COVID has changed the world. As a result of the pandemic, Gartner found that 88% of businesses mandated or encouraged all their employees to work from home as COVID-19 spread and 97% of the firms canceled all work-related travel.

Despite the growth in WFH, Google’s Project Jacquard has announced its latest innovation: two new smart backpacks developed with luggage maker Samsonite. Unlike the previous Jacquard backpack co-created with Yves Saint Lauren with a stupid $995 price tag, The Samsonite version has prices low enough for normal people to actually consider buying one.

The new Google Jacquard “Konnect-i Slim” smart backpack begins at $199.99. The slightly larger “Konnect-i Standard” will run you $219.99. Both available are through Samsonite’s webshop. Both are also water-repellent, and they have the same materials and feature list.

Besides smart backpacks, Google has partnered with Levi to make the Trucker jacket with Jacquard and Adidas to create the GMR insoles that use Jacquard.

Connect the smart backpacks

Jacquard controlsTo connect the smartbackpack to your iOS or Android phone, you’ll have to stuff a thumb-sized dongle into the backpack’s strap. According to Engadget, the module syncs with your phone via Bluetooth. The functionality seems pretty limited. Through the Jacquard app, you can define what brushing up and down or double-tapping the strap does. You can skip or pause your music, ask Assistant a question or drop pins to remember places you’ve been, or take a selfie. An LED on the strap will light up to alert you to notifications.

Jacquard relies on a small Micro-USB-charged Bluetooth puck which contains most of the electronic components. Google reduced the physical footprint from a large USB drive to something roughly the size of an SD card. It’s charged using magnetic pins, and data transfer is possible with a microUSB connector. The removable Jacquard Tag lasts up to two weeks on a charge and is separately rechargeable. The Jacquard Tag module still needs to be removed before washing.

The Samsonite Jacquard backpacks require an internet connection, a compatible Android or iOS phone, the Jacquard app, and a Google account for access to Jacquard features. For Android, you need a supported phone running Android 6.0.1 or newer. For iOS, you need an iPhone 6 or newer running iOS 11 or newer.  Data usage fees may apply. 

rb-

Ambient computingAs a product still don’t get it – as wearable tech – it seems to me that the $200 iWatch can do more than the backpacks. But as another way to invade our lives and steal our data – it makes sense.

Google told CNet it could add gestures on top of voice into Google Assistant – “… as a new direction for Google’s AI … Bringing these nonverbal cues into the conversation with technology is a key opportunity …” 

Combining AI with Google’s security and privacy problems makes me uneasy. In this uber-google world, will they give us the best result or the one that is paid for? 

Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , ,
| October 27, 2015
Comments Off on Online Security in Era of Connected Cars

Online Security in Era of Connected Cars

Online Security in Era of Connected CarsKarl-Thomas Neumann, CEO of General Motors‘ (GM) European Opel brand announced that GM would launch OnStar telematics service in vehicles sold in Europe in late 2015. The Opel CEO declared the new technology, “transforms the car into a true part of the Internet of things.” The Detroit Bureau says it raises some of the same concerns consumers face on the Internet, including how to protect their privacy in highly connected cars.

App controlled carEven though a growing number of consumers have embraced the idea of having mobile access to smartphone apps, built-in Wi-Fi, and the safety and security promised by systems like OnStar issues loom that consumers, manufacturers, and regulators need to address. At the 2014 Consumer Electronics Show, Jim Farley,  then the top marketing executive at Ford Motor Company (F),  told an audience that the automaker “know(s) everyone who breaks the law, we know when you’re doing it,” thanks to the data collected by its OnBoard Sync technology system.

Despite a quick backtrack by Mr. Farley, the article says he was being truthful. The fact is, the onboard black boxes in most cars are now equipped with two-way capabilities. Privacy has become “a big issue,” according to Jon Allen, a principal with consulting firm Booz Allen Hamilton who focuses on security issues. Precisely what makes such technology so compelling is why it is also so worrisome. Mr. Allen told The Detroit Bureau,

Connected products provide customization and convenience because of the data they track. Part of the great opportunity to improve the customer experience is producing a vehicle that ‘learns’ your habits and preferences. But that information must be protected.

Data privacyThe EU takes privacy seriously and these types of tracking technology have drawn the attention of regulators in Europe and to a lesser extent, in the U.S. The article describes a measure of just how strongly Europeans feel about the issue that came during Opel chief Neumann’s news conference. Unlike the U.S. version of OnStar, the European system will include a “Privacy” button to let a user “choose whether they want to provide location information or not.”

That choice would only be over-ridden after a crash severe enough to trigger OnStar’s emergency call system, CEO Neumann explained. It’s designed to call rescue crews in the event of an accident severe enough passengers might be disabled.

Don't panicThere have been experiments with marketing that could target motorists much as Google today can toss ads at a web viewer based on information revealed by hidden “cookies.” Imagine, they suggest, being able to send a McDonald’s ad and virtual coupon to a car driving near one of its restaurants around lunchtime.

While some drivers might embrace that possibility, others are appalled. The Detroit Bureau reports the potential to reveal more detailed personal information, as well as allowing a vehicle to be tracked, is raising flags on both sides of the Atlantic.

Digtal trackingIn the U.S., an auto industry alliance recently agreed on an approach called “Privacy Principles for Vehicle Technologies and Services.” (rb- Which I covered here) Meanwhile, both the U.S. Federal Trade Commission and the National Highway Traffic Safety Administration are exploring the issues – though in some cases, they are actually encouraging greater access, noted analyst Allen.

The issue is further complicated by the threat of cyber-criminals exploiting vulnerabilities in-vehicle communications systems.

rb-

I first covered this threat in 2011 here and here. And the theoretical became real in 2015 when researchers demonstrated they could use online systems to take over a Jeep Grand Cherokee.

The threat to personal freedom and privacy in your car has accelerated as Apple (AAPL) and Google (GOOG) join Microsoft (MSFT) in the battle to rule the car. Apple’s automotive ambition does not stop at CarPlay, they are also focused on developing an iCar. Google’s Autonomous Cars ambitions are well known, but their efforts to take over the car cockpit are also taking off with Android Auto.

The government is contributing to the connected car conundrum. The Feds are abetting the Autos by trying to prevent security researchers from doing testing and reverse engineering that could improve security and safety for all of us according to Naked Security.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Cars | Tags: , , , , , , , , , , , , , , , , , , ,
| September 22, 2015
Comments Off on How Safe Is Your Connected Car?

How Safe Is Your Connected Car?

How Safe Is Your Connected Car?There will be 250 million wirelessly connected cars on the road by 2020 according to Gartner (IT). The technical prognosticators believe that 60% – 75% of them will be capable of consuming, creating, and sharing Web-based data. In light of predictions like these and highly publicized car network attack demonstrations car need more security. Intel (INTC) has established the Automotive Security Review Board (ASRB) to help mitigate cyber-security risks associated with connected automobiles.

Intel logoAn Intel presser says ASRB researchers will do ongoing security tests and audits. They will codify best practices and design recommendations for advanced cyber-security solutions and products. Intel will publish automotive cyber-security best practices white papers, which the company will update based on ASRB findings. Chris Young, senior vice president, and general manager of Intel Security said in the presser.

We can, and must, raise the bar against cyberattacks in automobiles … Few things are more personal than our safety while on the road, making the ASRB the right idea at the right time.

Secure car networks

It is the right time to secure the networks in cars. A study released by Atlanta-based PT&C|LWG Forensic Consulting Services looked at what made cars vulnerable to attacks.
Robert Gragg, a forensic analyst with PT&C|LWG told CSO cars with the highest risk of cyber threat tended to have the most features networked together, especially where radio or Wi-Fi networks are connected to physical components of vehicles.

radio or Wi-Fi networks are connected to physical components of vehiclesToday’s modern automobile uses between 20 and 70 computers, each with its own specialized use. The article explains that engine control units oversee a wide array of electronic sensors and actuators that regulate the engine and maintain optimal performance. Vehicle manufacturers use the generic term “electronic control units” (ECUs) to describe the myriad of computers that manage various vehicle functions.

For example, the author says ECUs control vehicle safety functions, such as antilock brakes and proximity alerts. The ECU which governs climate control systems receives temperature data from sensors inside the cabin and uses that to adjust airflow, heating, and cooling.

modern automobile uses between 20 and 70 computers

What is a controller area network

Typically, all of a vehicle’s computer systems can be accessed over a vehicle’s controller area network (CAN) via the radio head unit, a computerized system that runs a car’s or truck’s communications and entertainment system.

firmware can be used to compromise the vehicleMany of today’s modern vehicles can be accessed via cellular, Bluetooth, or even WiFi connectivity. While no easy task, the CSO article says, once a hacker gains access to the vehicle’s head unit, its firmware can be used to compromise the vehicle’s CAN, which speaks to all the ECUs. Then it’s just a matter of discovering which CAN messages can control various vehicle functions.

Car attacks

These attacks can happen at a distance. PT&C|LWG study estimated minimum distances from which a vehicle could be hacked according to the wireless communication protocol it is using. For example, a passive anti-theft system could be access from 10 meters, a radio data system (or radio head unit) could be hacked from 100 meters, a Bluetooth system could be accessed from 10 meters, a smart key from five to 20 meters, and a vehicle equipped with Wi-Fi… well, it could be hacked from anywhere there’s Internet access (rb- I wrote about this vulnerability in 2011).

That may be a problem. Increasingly, carmakers are coming out with vehicles that include Wi-Fi routers for Internet connectivity. PT&C|LWG’s Gragg said.

In more advanced vehicles — the ones that have infotainment systems — wireless security and wireless access points are all connected into the navigation system. So those are more susceptible to hacking because there are just more wireless access points … Anything open to wireless capabilities is susceptible to the hacking.

rb-

In May, both General Motors (of ignition switch cover-up infamy) and the Auto Alliance, the car maker’s lobbyist, testified against a proposed exemption in copyright law that would allow third-party researchers to get access to vehicle software. A decision in that matter could come any day from the U.S. Copyright Office.

Ralph NaderThe Auto Alliance has also threatened to run to Congress should the Copyright Office rule in favor of the researchers to cover up threats to the consumer, like Volkswagen and GM. The lobbying group calls legitimate researchers attackers in a letter to a Congressional subcommittee investigating the auto industry’s ability to thwart cyber attackers; “Automakers are facing pressure from the organized efforts of technology pirates and anti-copyright groups to allow the circumvention of protected onboard networks, and to give hackers with the right to attack vehicles carte blanche under the auspices of research”.

This would set a dangerous precedent for devices connected to the Internet of Things (IoT) to be unregulated. If the automakers are successful in their DMCA claims, it would be deadly for everyone on the road too. 

Who remembers “Unsafe At Any Speed“?

 PT&C|LWG infographicRelated articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Cars | Tags: , , , , , , , , , , , , , , ,
| August 18, 2015
Comments Off on Prevent Pervy Pics

Prevent Pervy Pics

Prevent Pervy PicsFrom the world of unintended consequences, iPhone users have become the victims of a new phenomenon known as cyber-flashing. Reports out of London state that Apple iPhone users are being sent pervy pics. The pervy pics are unsolicited and indecent photographs. The pics are being sent over a new Apple feature in iOS called AirDrop.

BluetoothAirDrop is a feature on the iPhone, iPad, and Mac computers. AirDrop allows users to send files, such as images, to each other at a close range. The pics can be sent up to 33 feet (10 m) via a Bluetooth connection. Apparently, even if the receiver rejects the photo, they are still shown an uncensored preview of the image.

AirDrop initially establishes a connection over Bluetooth. It then uses a direct Wi-Fi connection between the two iPhones to send files. This makes the transfer much quicker.  It’s supported by devices from the iPhone 5 onwards with iOS 7 released back in 2013.

How to prevent the pervy pics

Pervy pics appearing on your iDeviceTo prevent the pervy pics from appearing on your iDevice, you need to take action. Mark James, a security specialist at ESET UK, explains. You have to set your AirDrop settings to “Contacts Only” which will only permit AirDrop file transfers from people in your address book or disable AirDrop entirely. He explains that AirDrop is not turned on by default, but it’s easy to set AirDrop to receive from Everyone, and then forget all about it.

ESET explains how to prevent cyber flashing:

  1. On the home screen of your iPhone, swipe up to open the Control Center.
  2. Tap on AirDrop, below the media playback and volume controls.
  3. Tap ‘Off’ or ‘Contacts Only’ to prevent files from being sent from strangers.

Apple Airdrop settings

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow him at LinkedIn, Facebook and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , ,
« Older Entries