Tag Archive for iPhone

Fake Fingerprints Can Open Your Phone

– Updated 03-30-2016 – The Business Insider proves that you can use Play-Doh to fool the fingerprint sensor in your Phone.

Fake Fingerprints Open GalaxyI have pointed out a number of times that biometrics will not be the complete final solution for passwords. Biometrics is the measurement and statistical analysis of people’s physical and behavioral characteristics. The technology is mainly used for identification and access control. The basic premise of biometric authentication is that everyone is unique. An individual can be identified by his or her intrinsic physical or behavioral traits.

Fake Fingerprints Can Open Your PhoneThere is a huge issue with biometrics.  You can’t change your intrinsic physical or behavioral traits if they get stolen or hacked. Well, now there is more proof that biometrics can be hacked without cutting off a finger.

Hack mobile phone authentication

Two smarty Sparty’s from Michigan State University’s biometrics group has figured out a way to hack mobile phone fingerprint authentication. According to Help Net Security, the MSU researchers can hack your secure phone by using just a scanner, a color inkjet printer, a special type of paper, and ink.

AgIC silver conductive ink cartridgesTurns out that the attack is easy to execute. The first step is to scan the target’s fingerprint image at 300 dpi or higher resolution. Then, the image is mirrored and the original or binarized fingerprint image is printed on the glossy side of an AgIC special paper. The printer uses AgIC silver conductive ink cartridges (along with normal black ink).

Magical conductive ink

CrunchBase explains that advances in material science have made it possible to manufacture almost magical conductive ink. AgIC silver conductive ink has tiny silver particles and can be purchased online. The ink is printed by standard Brother printers. The ink dries in a few seconds and conductivity emerges instantly when the traces are drawn on special photo inkjet printing paper also available online.

spoofed fingerprintAll in all, an attacker can have a spoofed fingerprint that would allow him to access a phone protected with fingerprint authentication in less than 15 minutes, and the cost of all the tools he needs to do this does not surpass $500.

Researchers Kai Cao and Anil Jain successfully managed to fool the fingerprint sensors on the Samsung (005930) Galaxy S6 and Huawei (002502) Hornor 7 phones.

They posted a demo of the attack on YouTube:

 

The attack is an improvement over Germany’s Chaos Computer Club’s attack against Apple (AAPL) Touch ID on iPhone 5S by lifting a fingerprint of the genuine user of a glass surface and then making a spoof fingerprint. More details about the Michigan State researchers’ work can be found here (PDF).

Only a matter of time

Starbucks app hackedThe Sparty researchers note that not all mobile phones can be hacked using this method. But their experiment is proof of the urgent need for anti-spoofing techniques for fingerprint recognition systems, especially for mobile devices which are being increasingly used as a part of two-factor authentication for site access and payment processing like Apple Pay, Google (GOOG) Pay, or Samsung Pay.

The researchers warn that it is only a matter of time before hackers develop improved hacking strategies not just for fingerprints, but other biometric traits that are being adopted for mobile phones (e.g., face, iris, and voice).

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Tablets are Doomed

Tablets are DoomedTechCrunch reports from Mobile World Congress in Barcelona that tablets are dead. Six years after the original iPad ushered in the post-pc era, there were no tablets at the premier mobile showcase. Companies and consumers have moved on.

iPadTo be fair, TechCrunch says that if you looked hard enough, you could find an Android tablet or two stashed away in a corner. And Apple (AAPL), the tablet leader, doesn’t come to MWC. They conclude that tablets are not the future for Samsung’s (005930) and LGs (LGLD) of the consumer electronics world.

In fact, the author reports that Samsung, Sony (SNE), HTC (2498) and LG didn’t have any new tablets to announce. They didn’t even mention tablets during their conferences. It’s not just that people don’t care about tablets anymore — the big electronics companies themselves aren’t even trying to release new products for this market anymore. The article lists a number of reasons why tablets have become so unpopular.

Tablets are now a commodity

tablets have become so unpopular

First, tablets are now a commodity. You can find dozens of perfectly fine tablets for less than $200. And there’s no differentiating factor between Android tablets. As a result, companies are not making a profit from them.

You already have a tablet

Second, chances are you already have a tablet at home and it’s working fine. So the author reports that there’s no reason why you should upgrade it — it probably runs Netflix, Facebook (FB) and the Kindle app. It has a browser and your emails. Long replacement cycles mean you don’t need to pay attention to the new and shiny tablets. The Business Insider also observes tablets are more like PCs — you buy a new one only when the old one is worn out or doesn’t run the software you need.

Phones are getting bigger

everybody uses their phones constantly to interact with other people and do everything they’d do on a tablet.Third, phones are getting bigger. The LG G5 (5.3-inch display) and Samsung Galaxy S7 (5.1-inch display) are the two most interesting flagship phones that were announced at MWC. The first Samsung Galaxy Note had a 5.3-inch display, which could be called a phablet. Today, it would be an average phone. According to TechCrunch, big phones are the new normal, and everybody uses their phones constantly to interact with other people and do everything they’d do on a tablet.

BI explains the phenomenon of phones replacing tablets includes Apple. Apple started making larger phones, the iPhone 6S and 6S Plus, a year ago, which eliminates some of the justification for a bigger touch screen device. Also, consumers upgrade their phones every two or three years, since the carriers subsidize some of that up-front cost (plus, it’s just cool to have a new phone, which you carry with you everywhere in public).

it's just cool to have a new phone, which you carry with you everywhere in publicFor those who need a snapshot of the decline of the tablet, Business Insider presented a chart from Statista based on numbers from IDC. In the last four quarters, tablet sales have been down from the previous year’s quarter. Overall, shipments in the first three quarters of 2015 are down 9% from the same time a year ago.

Business Insider - Global Tablet Market Decline

TechCruch takes a pretty hardcore position on tablets. Tablets had a good run, but won’t be around for much longer. They argue that the iPad is a better tablet than any Android tablet because there aren’t many tablet-optimized apps on the Play Store. This is key to understanding the iPad’s appeal.

rb-

I have covered the issues around tablets since 2011 including the first signs of a decline in Apple’s iPad Teflon armor in 2014.  TC says tablets can still make a comeback. They need to become something else. But something needs to change and soon. Current tablets prove that you should never bet against the smartphone.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Cisco Loves Apple

Cisco Loves AppleApple has announced a new partnership with network giant Cisco. If you believe Fortune, the goal is to sell more iPhones and iPads to business customers. The move is intended to make it easier for businesses to use Cisco products like its video, chat, and web conferencing services on Apple‘s (AAPL) mobile devices. Fortune says that no new products have been announced under the partnership.

New partnership between Apple and CiscoIn fact, this collaboration seems to be a deal looking for a plan. Rowan Trollope, Cisco’s senior vice president and general manager of Cisco’s collaboration technology group, told the author that both Cisco (CSCO) and Apple sales teams would soon meet with business leaders at other companies to discuss their technology needs. The conversations are intended to help give Cisco and Apple ideas about the products they will develop together. He also declined to confirm if any Cisco or Apple engineers are engaged or any timeline for when the new products will hit the market.

Even though there are no plans, the Cisco VP claimed that customers will be able to prioritize mobile traffic on their networks so that workers watching YouTube videos on their iPhones won’t hog all of a company’s bandwidth. Apparently, Cisco and Apple engineers will work on updating iOS Apple’s mobile operating system, to prioritize network traffic from Apple devices, which “would be difficult without a joint engineering project,” according to the article.

Prioritization would be a good start, iOS updates have crushed networks in the past. The number of hoops you have to jump through to make AppleTV’s Bonjour work on an enterprise network is stupid. Just proof that Apple is not ready for the enterprise.

TelepresenceCisco has tried to create new product lines outside of its core networking and switching businesses to help boost its sales. Sales of its collaboration products are so stagnant that the firm has resorted to 85% discounts on telepresence gear.

Cisco has a history of buying consumer-orientated businesses like Apple, destroying the business, and then jettisoning the remains. Linksys and Flip Video come to mind.

Apple has also buddied up to IBM (IBM). The plan seems to be to add an IBM markup to overpriced Apple mobile devices. And then sell them to firms that have too much money. The combination has developed pushed-based apps that target specific industries, like healthcare or law enforcement.

rb-

add an IBM markup to overpriced Apple mobile devicesThe fanboyz are drooling over this deal – Apple Will Change the World (again?) – Maybe if they clean up their proprietary non-routable protocols.

It has been a while since Cisco has done something notable. Maybe new CIO Chuck Robbins will shake things up at Cisco now that King Chambers has mostly moved on.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Prevent Pervy Pics

Prevent Pervy PicsFrom the world of unintended consequences, iPhone users have become the victims of a new phenomenon known as cyber-flashing. Reports out of London state that Apple iPhone users are being sent pervy pics. The pervy pics are unsolicited and indecent photographs. The pics are being sent over a new Apple feature in iOS called AirDrop.

BluetoothAirDrop is a feature on the iPhone, iPad, and Mac computers. AirDrop allows users to send files, such as images, to each other at a close range. The pics can be sent up to 33 feet (10 m) via a Bluetooth connection. Apparently, even if the receiver rejects the photo, they are still shown an uncensored preview of the image.

AirDrop initially establishes a connection over Bluetooth. It then uses a direct Wi-Fi connection between the two iPhones to send files. This makes the transfer much quicker.  It’s supported by devices from the iPhone 5 onwards with iOS 7 released back in 2013.

How to prevent the pervy pics

Pervy pics appearing on your iDeviceTo prevent the pervy pics from appearing on your iDevice, you need to take action. Mark James, a security specialist at ESET UK, explains. You have to set your AirDrop settings to “Contacts Only” which will only permit AirDrop file transfers from people in your address book or disable AirDrop entirely. He explains that AirDrop is not turned on by default, but it’s easy to set AirDrop to receive from Everyone, and then forget all about it.

ESET explains how to prevent cyber flashing:

  1. On the home screen of your iPhone, swipe up to open the Control Center.
  2. Tap on AirDrop, below the media playback and volume controls.
  3. Tap ‘Off’ or ‘Contacts Only’ to prevent files from being sent from strangers.

Apple Airdrop settings

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow him at LinkedInFacebook and Twitter. Email the Bach Seat here.

Mobile Apps Leaking Your Info

Mobile Apps Leaking Your InfoJust in time for Blackhat, San Francisco-based Appthority released its Q2 2015 Enterprise Mobile Threat Report. The big headline from the Appthority report is that enterprise mobile apps are leaking your info. They are sending personally identifiable information (PII) and other sensitive information all over the world often without the enterprise’s knowledge. Your phone is leaking your info all over the web.

Appthority logoFierceMobileIT says that the Appthority Enterprise Mobile Threat Team (EMTT) collected and analyzed security and risky behaviors in three million apps. They found that the top iOS apps sent data to 92 different countries, while the top Android apps are leaking your info to 63 different countries.

Zombie apps are leaking your info

The report found another threat to all data. Appthority’s all-in-one App Risk Management service shows that 100% of enterprises surveyed have zombie apps in their environments. Zombie apps are apps that have been revoked by the app stores and are no longer getting security updates. Zombie apps can give attackers a conduit into the enterprise.

zombie appsThe report estimates that 5.2% of the Apple (AAPL) iOS apps on employee devices in an enterprise are dead apps, and 37.3% are stale Apps. On Google (GOOG) Android devices, 3.9% are dead apps and 31.8% are stale apps.

Zombie apps can leak your info. Appthority explains that malicious third parties could use a man-in-the-middle attack to hijack the update mechanism for these apps to install new malware on user devices.

Threat to the enterprise

Despite the threats, app stores run by Apple, Google, and Microsoft (MSFT) are under no regulatory obligation to tell users of revoked apps anything after release. Including copyright infringements or serious security/privacy concerns.  The report points out. Domingo Guerra, president, and co-founder of Appthority classified this as a stealthy risk; “The ongoing threat of zombie apps and stale apps continues to be an ‘under the radar’ threat to the enterprise.

programmersA third risk to the firm’s data comes from their own programmers according to the venture capital-backed Appthority. The firm says over-taxed enterprise app development teams are increasingly relying on third-party libraries and software development kits. Vulnerabilities in the third-party packages can put enterprise data at risk when they get baked into a corporate app.

The company told CSO that few mobile devices have security applications installed. In particular, only 4 percent of Android devices in use within enterprises had on-device scanning solutions.

Rb-
Firms that depend on mobile solutions as part of a Bring Your Own Device (BYOD) effort need to look after their apps as well as connectivity and hardware and data and governance and reimbursements. Bring your own device hardly seems like a cost saver to me.

I have said this repeatedly, it seems like costs are just being moved around. From spending on a PC in the office that is very less likely to be lost and that can be controlled to a bunch of new enterprise applications like EMM, mobile anti-malware to app monitoring.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.