By Ed Sperling & Brian Bailey

As more technology makes its way into safety-critical marketsand as more of those devices are connected to the Internetsecurity issues are beginning to merge with safety issues.

The number of attempted cyberattacks is up on every front, which has big implications for devices used in safety-related applications. There are more viruses, ransomware, and counterfeit chips and IP. And while the total number of breaches is flat, mostly due to increased attention to security, the impact of those breaches is larger. In effect, hackers are getting better at choosing their targets.

Fig. 1: Total cybersecurity breaches. Source: Symantec Internet Security Threat Report, April 2017.

Fig. 2: Ransomware demands. Source: Symantec Internet Security Threat Report, April 2017.

This is bad enough for IT systems. But as as medical devices, cars, and industrial control systems are connected to the Internet, cybercrime increasingly will have a direct effect on personal and public safety. Moreover, while most of this has involved software in the past, chips increasingly will be part of the attack infrastructure.

There is another facet to consider with these new applications, as well. Most hardware designs today have a life expectancy of two for consumer/mobility designs, to four years for server hardware. But in the case of industrial, medical and automotive applications, electronics are supposed to last a decade or more.

Security, meanwhile, is never 100% effective, and it becomes less effective over time. Connectivity and device complexity, which is compounded by regular software updates, are contributing factors to a rise in data leakage. In addition, security measures that are considered impervious to attacks today likely will be vulnerable within several years because hacker tools and know-how are constantly evolving.

As soon as you think you have a secure device, you find a hole, said Dipesh Patel, president of the IoT Services Group at ARM. So you are never done. And devices need to be upgraded, which is done with software. That makes it more vulnerable. If you look at the Mirai attack, devices were exposed because someone decided to use default passwords.

Patel said hardware-software co-design will be a baseline necessity for security. But that will not be enough. You can supply more secure devices, but you need to educate others about the need to do things properly. Secure devices need to be complemented with other things, such as tutorials, how-to guides, and in the case of enterprises, they need to be more aware. The best solutions are a combination of technology and best practices.

But how, exactly, does this work for an autonomous vehicle or a medical device such as a pacemaker? The answer is that nothing is perfect. Numerous steps need to be considered at every level, from design through manufacturing and out into the market, and they need to be revisited regularly.

Security is a big topic for EDA, and its a big topic for the semiconductor industry, said Wally Rhines, president and CEO of Mentor, a Siemens Business. While it hasnt become critical yet, we believe that ultimately youll need to have trustworthy silicon as part of the total solution because chips will be subject to Trojans and companies will get more and more concerned about what gets into their chips and how it gets protected. Over time, it will become one more big part of IC design and verification. Tools will be available to help you, but this is a dynamic. Unlike a physics problem that you solve and it stays solved, security is one where the people working to break the security are just as smart as the people working to improve the security.

Different approaches for different markets Standards compliance adds cost, complexity and time to safety-critical designs. A chip designed for any automotive application would likely have to adhere to the ISO 26262 standard, which is essentially a best-practices checklist. But if that chip is used in the control of an autonomous vehicle, it also would have comply with the most stringent restrictions defined by the SAE and ASIL standards, as well as ISO 26262.

In the medical electronics field, it would have to adhere to a different set of standards being developed by such groups as the U.S. Food & Drug Administration and the Medical Device Innovation, Safety and Security Consortium. And in mil/aero, it would have to follow the DO-254 standards as well as various country- and region-specific regulations for supply chain integrity.

This adds a whole different level of scrutiny, validation and verification. And that, in turn, will boost the cost of a design and the time it takes to get a chip certified and into production.

With safety, we are looking at single-fault effects, and for that we know what full coverage means, said Ashish Darbari, director of product management for OneSpin Solutions. We can analyze that every fault is detected using a number of mechanisms. But for security, attacks are not equivalent to single faults. How can we measure the effectiveness of the protections for security? If we could model and specify what the interactions need to be, what must happen, what must not happen, intentional versus unintentional, then you can come up with a good set of checks that could be specified. Security is more systematic analysis, but it will always be difficult to get a handle on completeness.

In many cases, markets define what security means. Security means different things to different people, said Darbari. To one person it is about illegal access to an unprivileged user to a CPU or part of memory. Firmware plays a big role here, as well, and a lot of bad firmware can cause these issues to manifest and allow access to the hardware. What is the security vulnerability model?

Software updates add security risks, too. While updates are necessary to keep devices current and help close security holes as they are spotted, the update process itself provides another attack vector.

If you look at the market for cars, which is still evolving, over-the-air updates open up a whole new level of exposure, said Bernd Stamme, vice president of product marketing at Kilopass . At least with the CAN (controller area network) bus, to hack the system you physically have to open it up. But with over-the-air updates, physical connections are no longer required.

There is plenty of experience with securing over-the-air updates to software, particularly with set-top boxes and information technology downloads. But Stamme noted that carmakers will require sophisticated ways of distributing security keys over the network, which most have never done before. Companies need the most secure on-chip medium for this. Otherwise, if you get a hold of the chip you can reverse engineer it. The algorithms being used are well understood. If you have enough compute power, its easier to decide how to prevent this. But not all of these devices will have that.

Security solutions There are several recurring aspects to security. One is the protection of data. The addition of cryptographic capabilities to support secure communication and data storage requires software with hardware support for secure storage of keys and, in many case, acceleration is added for performance, said Tim Mace, senior manager business development in the MIPS Business Unit of Imagination Technologies. However, every additional capability added to a chip adds to the power and cost.

Security isnt free in any respect. It can affect overall chip performance, particularly if the security is active rather than passive. Active is considered more effective, but its also more expensive on every level. In some cases, it may require a separate chip or IP accelerator on the same chip.

Security is one aspect of the workload, said Anush Mohandass, vice president of marketing and business development at NetSpeed Systems. You need different chips for different workloads. And if youre using heterogeneous IP within a single chip, to get the maximum out of that chip you need to understand the workload.

It also may require such techniques as virtualization to keep the data from one function separate from another, which also affects the initial design. If you have 10 operating systems running, they should not have knowledge of each other, Mohandass said. That way there is no contamination of data.

Memories are another area that needs shoring up. The next level of protection is that they may encrypt regions of memory, said Drew Wingard, CTO at Sonics. In a more secure chip you may want to ensure that if someone was able to gain access to the entire content of the memory, they would still not be able to understand anything. That has a latency impact because you have to map the data between memory and processing.

Another common form of protection is the establishment of a secure enclave. You can run security functions isolated from other aspects of the chip, said Mike Borza, member of the technical staff for Synopsys Security IP. There are different ways to get that secure enclave. There are embedded hardware security modules that run inside the chip and are a companion to the main CPU. It is designed to provide a real, hard target for the security processing to take place. That tends to be a larger solution and adds cost in terms of IP licensing and area. For something in the class of a small router or IoT hub, the costs that may be acceptable are in the order of a few cents per chip for a chip that sells in the low single digit dollar range.

Another way to do this is to create virtual environments. Separation of the data and applications can be best implemented using an approach based on virtualization, added Mace. This is often supported by hardware memory management for performance.

Virtualization depends on the system having a memory management unit, which is not always the case with heterogeneous system. We introduced a firewall into the NoC that lives in front of the transaction destinations, Wingard explained. This builds a memory protection capability and allows the chip designer, or software people at runtime, to configure the chip to allow one region of memory to be accessible to this processor while in this mode, or these three units and the DMA engine to be able to access another part when in another mode. We can build multiple mutually secure nodes. This is easy and simple to understand and has very little software overhead if you dont have to reprogram it. There is no performance impact.

This type of system can also hunt for suspicious activity. We are starting to see things that look at traffic flows between interfaces or between ports on a bus and identify patterns that are unusual or shouldnt be happening at all, said Borza. If a network interface is talking directly to an encryption controller that is not what should be happening and may be flagged as an unusual pattern that you may want to detect. We are starting to see people build this into the fabric of the chip.

Making progress? While the fundamentals of security are understood well enough, metrics about what makes one device or IP block more secure than another are less than clear.

Security is very difficult to measure, said Asaf Ashkenazi, senior director of product management in Rambus Security Division. There is a lot of misinformation out there, and you can claim whatever you want. You can claim that security is built in, but there is not a way to measure it that has consequence. There are no guidelines or best practices.

This may be an annoyance with a consumer or business system, but it can be life-threatening in a safety-critical device. If a computer is hacked, you lose data, Ashkenazi said. But if you hack a car, industrial machine or a traffic light, you can cause reasl damage.

Until there is some formalization of the malicious fault problem, it is difficult to think about adequate analysis or automation tools. There is some research devoted to building a more objective measure for how secure something is, said Borza. An example of that is a DARPA project that is trying to build those metrics and provide a quantitative assessment of security.

This may require a simplification of the problem. One approach is based on root of trust modules that are starting to become more common, Borza explained. This recognizes that providing a small isolated environment, which uses relatively simple software, can be assessed and analyzed for vulnerabilities and immunity to certain types of attacks. The approach is to contain complexity in the security functions in order to provide a reasonable guarantee of how secure that part of the chip is. Then you can use that to bootstrap the rest of the system securely.

Perhaps the most important change that a team has to make is rooted in their mindset. Both safety and security are not solved by simply adding some special IP, or software, as an afterthought, said Mace. They need to be addressed throughout the design and manufacturing process as in both cases the overall level of safety and security of a product is limited by the weakest element.

There is no disagreement on that point. The teams that are putting out successful semiconductors have baked this in from day one, said Rob Knoth, product management director for the DSG group at Cadence. The architecture of the system and the verification plan, the physical floorplan everything has the concepts baked into it. Otherwise it becomes a horribly non-convergent process and you end up missing stuff and having to do a respin.

The industry is taking the problem seriously. Security is lagging safety by about five years, said Darbari. We will see compliance standards for security being established within five years. But if you are not even doing your functional verification properly in the first place, and relying on directed test then you dont have a hope.

Safety and security need to be baked into the methodology. Only then will they permeate through the chip as needed for both efficiency and effectiveness, concludes Mace. It is important that each stage in the development process is reviewed closely to consider the design implications. It is only when these techniques are embedded into the development tools and the design and verification processes, that new chips will be created with safety and security at their core.

Related Stories Safety Plus Security: A New Challenge (Part 1) There is a price to pay for adding safety and security into a product, but how do you assess that and control it? The implications are far reaching, and not all techniques provide the same returns. Security: Losses Outpace Gains Complexity, new and highly connected technology, and more valuable data are making it harder to keep out hackers. IoT Security Risks Grow Experts at the table, part 2: Mirai, Shodan, and where the holes are in security; establishing a chain of trust from a solid root; how to future-proof security.

See the original post here:
Safety Plus Security: Solutions And Methodologies - SemiEngineering

UK consumers reported a 40 percent increase in security-related concerns since 2014, according to the new Unisys Security Index that surveyed consumers in April 2017 in 13 countries around the world. The global study gauges the attitudes of consumers on a wide-range of security-related issues.

UK respondents reported increasing concern in all four categories of the core survey: national, financial, internet and personal security. The biggest increases in concern were related to national and internet security - which rose 66 percent and 50 percent, respectively.

Highlights from the UK results include:

Salvatore Sinno, chief security architect, Unisys, said: "Factors such as terror attacks, high profile cyber-attacks and the rising cost of living are all outside the public's control and they are major contributing factors to the Unisys Security Index registering record levels of concern in the UK. Steps to advise and protect the public, such as the launch of the National Cyber Security Centre, are moves in the right direction, but we need joined up thinking across the public and private sectors to ensure the public are aware of risks, know how to avoid threats and act as securely as possible."

The Unisys Security Index scale runs from 0 - 300, where 0 represents no concern and 300 represents extreme concern. Overall the UK's Index score is at a record high of 144, up 41 points from 2014's survey. The global study gauges the attitudes of consumers on a wide range of security-related issues, with the core survey categories - Internet (150), Financial (147), Personal (141) and National (136) - all registering record highs in 2017. The global average Index score stands at 173[1] from the 13 countries surveyed, with the Philippines scoring highest (243) and the Netherlands lowest at 125.

About the Unisys Security Index

Unisys has conducted the Unisys Security Index - the only recurring snapshot of security concerns conducted globally - since 2007 in order to provide an ongoing, statistically-robust measure of concern about security. The index is a calculated score out of 300 covering changing consumer attitudes over time across eight areas of security in four categories: national security and disaster/epidemic, in the National Security category; bankcard fraud and financial obligations, in the Financial Security category; viruses/hacking and online transactions, in the Internet Security category; and identity theft and personal safety, in the Personal Security category. The 2017 Unisys Security Index is based on online surveys conducted between April 6-18, 2017 of nationally representative samples of at least 1,000 adults in each of the following countries: Argentina, Australia, Belgium, Brazil, Colombia, Germany, Malaysia, Mexico, Netherlands, New Zealand, Philippines, the U.S. and the UK. The margin of error at a country level is +/-3.1 percent at 95 percent confidence level, and 0.9 percent at a global level. For more information on the 2017 Unisys Security Index, visit http://www.unisys.com/unisys-security-index/uk

About Unisys

Unisys is a global information technology company that specializes in providing industry-focused solutions integrated with leading-edge security to clients in the government, financial services and commercial markets. Unisys offerings include security solutions, advanced data analytics, cloud and infrastructure services, application services and application and server software. For more information, visit http://www.unisys.com.

Follow Unisys on Twitter and LinkedIn.

Unisys and other Unisys products and services mentioned herein, as well as their respective logos, are trademarks or registered trademarks of Unisys Corporation. Any other brand or product referenced herein is acknowledged to be a trademark or registered trademark of its respective holder

1. The 2017 Unisys Security Index score shows a 30-point increase over its score of 143 in 2014, the last time Unisys conducted the index on a global scale. Five points of the 30 points are due to the addition of new countries to the index.

SOURCE Unisys

Continue reading here:
Concerns in the UK Over National, Financial, Internet and Personal ... - PR Newswire UK (press release)

To Mark Loveless, aninternet-enabled cordless drill seemed like a perfect recipe for an IoT security nightmare.

Duo Securitys senior security researcher confessed that it sounded silly and quite possibly part of a push by the electronics maker to inject smarts into devices that ultimately turned them into hackable punching bags for adversaries to exploit. So when he examined an internet-connected Milwaukee Tool cordless drill he was pleasantly surprised to find the devices smarts were implemented in a safe and responsible manner. The results of his findings are part of research published Monday, Bug Hunting: Drilling Into the Internet of Things (IoT).

My expectations for security were very low for a smart drill, Loveless said. But after examining the security, I feel like there is hope that consumer-device IoT can be done the right way.

The drill in question was a $250 Milwaukee Tool ONE-KEY M18 Fuel 1/2 Drill/ Driver. The drill comes with an asset-management platform called One-Key. The platform allows tool owners to use a smartphone app or website to track the drills whereabouts using GPS technology. It also allows for remote custom configuration of equipment (such as the drills torque), or disable it should it be stolen.

When it comes to the world of IoT devices, there is no shortage of faulty security to keep experts such as Loveless skeptical. From IoT botnet-fueled Mirai to the co-opting of theConficker worm to target hospital IoT devices, last year alone IoT malware activity more than doubled.

That is why after Loveless closely examined the drill he was impressed to find that the manufacturer appeared to have performed comprehensive threat modeling on the device, used reliable open source software libraries correctly, and implemented strong SSL encryption.

If DVR and CCTV makers took the steps Milwaukee Tool did, Mirai wouldnt have had a chance, he said.

Thats not to say all was perfect. Loveless investigation found what he called minor flaws. One was that static passwords were hard-coded into the smartphone app. Also found, the power drill could be readily identified by a potential thief remotely via Bluetooth scanning.

With a $100 Bluetooth antenna I could scan the neighborhood and find these expensive drills within a half-mile radius, Loveless said.

During his research, it was also discovered that the GPS data used for inventory tracking could be spoofed. Basically, if I stole your drill, I could fake the GPS data to make it look like another neighbor had the drill in his toolshed, he said.

The big caveat to his research? We are talking about a drill. If this were an insulin pump, pacemaker or security alarm these flaws would be a lot more serious, Loveless confessed.

In all, four vulnerabilities were identified by Duo Security, generating two unique CVEs.

CVE-2017-3214 relates to the fact, the ONE-KEY app includes master credentials in base-64 encoded format that are needed to obtain a bearer token. The bearer token allows for read-write access to information stored in Milwaukee Tools website.

With CVE-2017-3215, the One-Key app has a bearer token that doesnt expire and stays stored on the phone. A typical bearer token has an expiration time of 1-2 hours, these have an expiration time of one year, and are stored on the phone for reuse while the phone is logged in. In the event of a compromised phone, it is possible for an attacker to gain access to the bearer token and use it, according to the report.

Loveless told Threatpost that he believes the Milwaukee Tool drill is the exception, not the rule, when it comes to IoT security. As Milwaukee competitors are racing to catch up, they have raised the bar and made security a first thought not an afterthought.

Continued here:
Internet-Enabled Drill Demonstrates IoT Security Done Right - Threatpost

Internet Security virus is a fake antivirus program that belongs to the family of extremely aggressive rogue parasites. It is a clone of the Internet Security 2012 omitting the year number in the name. It is one more program that displays falsified information and imitates checking your system for infections while in fact it cannot detect anything. The program is installed to a random system through Trojan viruses and it is straight away configured to start automatically when computer is rebooted.

Internet Security virus launches its scanner with every login to Windows. The program imitates looking for infections and warns that your system is badly infected. Unfortunately, since Internet Security is not able to detect real threats, it displays non-existing files and presents them as infections. The program uses generic names of parasites and this way it prevents computer users from getting any information about them. The parasites detected by this malware include W32.Blaster.Worm, Email-Worm.Brontok, W32/Child-Porn.PROXY/Server, Mal/Generic-A, various TrojanDownloader versions. It is unlikely that any of these parasites are on your system, except, ironically, the TrojanDownloader which downloads Internet Security malware in first place. However, it will not be detected.

In addition, Internet Security scam warns that your system is at risk by displaying various security notifications and pop up ads which inform about system threats and recommend activating Internet Security in order to protect your computer.

You should remove Internet Security virus from your system as soon as you notice it there. Have in mind that this malware can try to block your legitimate antispyware tools and block these executables, it will also kill browsers and most of other applications. However, There are several ways to remove Internet Security from your system without resorting to system reinstal.

Note Internet Security Virus uses multiple process names names now (2013). The names used are : isecurity.exe , amsecure.exe, indefender.exe,tdefender.exe, ildefender.exe, ihdefender.exe. If the window does not closes during steps 2/3, try using these file names.

Remember that full legitimate anti-malware program like Malwarebytes Anti-Malware or spyhunter can prevent your system from being infected with this kind of infections.

Important Note:Although it is possible to manually remove Internet Security virus, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other toolsfound on 2-viruses.com.

All UsersApplication Dataisecurity.exeAll UsersAppDataisecurity.exe%TEMP%winupd.exe3C2.TMP%TEMP%[random].exeC:WINDOWSPrefetchISECURITY.EXE-1824C86D.pf

HKEY_LOCAL_MACHINESoftwareISECURITY.EXEHLEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun ISECURITY.EXEHKCUSOFTWAREMicrosoftWindowsCurrentVersionRun Internet Security 2012?

Visit link:
Internet Security virus - How to remove? - 2-viruses.com