Page 4,212«..1020..4,2114,2124,2134,214..4,2204,230..»

Encryption key for iPhone 5s Touch ID exposed, opens door to further research – AppleInsider (press release) (blog)

By Mike WuertheleThursday, August 17, 2017, 11:14 am PT (02:14 pm ET)

First spotted by Redmond Pie on Wednesday, Twitter user "xerub" posted the information, and an extraction tool for the Secure Enclave firmware, in advance of the Singapore Hack in the Box conference.

The tool and hack is not for the inexperienced. The outputs of the tool are binaries of the kernel and related software regulating the communications between the Touch ID sensor and Secure Enclave but not any information transmitted presently or in the past between the Touch ID sensor and the Secure Enclave.

The exposure of how to extract the encryption key from an iPhone 5s does not mean that the device is no longer secure. However, it does mean that people angling to make exploits for the device are able to examine the Secure Enclave firmware on the device in more detail than previously possible.

At present, there is no known exploit utilizing the tool, or the gleaned data, and it is not clear how one would even be produced or installed on a target device. Any exploit developed with the tool would be specific to the iPhone 5s, and require physical access to the device to load custom firmware as well.

Apple's Secure Enclave is in Apple's A7 processor and later and provides all cryptographic operations for data protection in iOS devices. The Secure Enclave utilizes its own secure boot and can be updated using a personalized software update process that is separate from the application processor which is how any exploit would have to be installed, one device at a time.

The Secure Enclave is responsible for processing fingerprint data from the Touch ID sensor, determining if there is a match against registered fingerprints, and then enabling access. Each pairing of the Touch ID uses the shared encryption key, and a random number to generate that session's full encryption key.

Continue reading here:
Encryption key for iPhone 5s Touch ID exposed, opens door to further research - AppleInsider (press release) (blog)

Read More..

How security pros look at encryption backdoors – Help Net Security

The majority of IT security professionals believe encryption backdoors are ineffective and potentially dangerous, with 91 percent saying cybercriminals could take advantage of government-mandated encryption backdoors.

72 percent of the respondents do not believe encryption backdoors would make their nations safer from terrorists, according to a Venafi survey of 296 IT security pros, conducted at Black Hat USA 2017.

Giving the government backdoors to encryption destroys our security and makes communications more vulnerable, said Kevin Bocek, chief security strategist for Venafi. Its not surprising that so many security professionals are concerned about backdoors; the tech industry has been fighting against them ever since global governments first called for unrestricted access. We need to spend more time protecting and supporting the security of our machines, not creating purposeful holes that are lucrative to cybercriminals.

Encryption backdoors create vulnerabilities that can be exploited by a wide range of malicious actors, including hostile or abusive government agencies. Billions of people worldwide rely on encryption to protect critical infrastructure including global financial systems, electrical grids and transportation systems from cybercriminals who steal data for financial gain or espionage.

Link:
How security pros look at encryption backdoors - Help Net Security

Read More..

The Laws of Mathematics and the Laws of Nations: The Encryption Debate Revisited – Lawfare (blog)

Australia is weighing in on the encryption debate regarding exceptional access by law enforcement. As George Brandis, the Australian Attorney-General, described last month, the Prime Ministers office advocates requiring internet companies and device makers [to follow] essentially the same obligations that apply under the existing law to enable provision of assistance to law enforcement and to the intelligence agencies, where it is necessary to deal with issues: with terrorism, with serious organized crime, with paedophile networks and so on. He further asserted that the chief cryptographer at GCHQ, the Government Communication Headquarters in the United Kingdom had assured him that this was feasible.

The Prime Minister of Australia, Malcolm Turnbull, subsequently entered into an interesting interchange with a reporter. When asked by Mark DiStefano, a reporter from ZDNET, Wont the laws of mathematics trump the laws of Australia? And then arent you also forcing people onto decentralized systems as a result? The Prime Minister of Australia said the laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia."

This interchange provides a good opportunity to explore where the laws of mathematics and the laws of nations hold sway. DiStefanos comment about the laws of mathematics is a reference to the conclusion offered by many technically informed parties that including a capability for exceptional access into any encryption scheme invariably reduces the security afforded by that scheme.

But this conclusion is not what the Attorney-General was referring to; he spoke only of an obligation of vendors to provide assistance to law enforcement and intelligence agencies (presumably to provide clear text when required by law). It is certainly possible to develop a system that enables vendors to meet this requirement, and a system with this capability must be that which the chief cryptographer at GCHQ asserts is feasible. This system will not be as secure as it would be without this requirement, though it will enable certain law enforcement and intelligence activities to take place that would not otherwise be possible.

So once again, we see that participants in this debate are not arguing about the same thing. The anti-exceptional access community is talking about the impossibility of developing a system with exceptional access capability that affords the same security as one without such a capability. The pro-exceptional access community is talking about the feasibility of a system with exceptional access capabilities that provides the best security possible given that requirement. And both communities are correct.

Whether the tradeoff is worthwhilelesser security for all in exchange for better ability to pursue certain law enforcement and intelligence activitiesis clearly a policy and legal decision for the Australian government. Of course, to have a reasonable debate about this question, the Australian government would have to acknowledge the first part of this tradeofflesser security for alland whether or not it is willing to do so is not yet clear.

Turnbulls statement is absurd on its face. A more astute response would have been to acknowledge that human laws must be consistent with the laws of mathematics but then to say that the laws of mathematics do not prevent compliance with a requirement such as the one proposed by the Attorney-General. But the Prime Minister would also have had to acknowledge the above-mentioned trade-off explicitlyand maybe such an acknowledgment would have been politically inconvenient.

As I have writtenbefore, these comments also apply precisely to the corresponding debate in the United States. To make progress on either side of the Pacific Ocean, it would help if both sides were talking about the same thing.

See the article here:
The Laws of Mathematics and the Laws of Nations: The Encryption Debate Revisited - Lawfare (blog)

Read More..

72 percent of security pros say encryption backdoors won’t stop terrorism – BetaNews

A new survey of information security professionals carried out at last month's Black Hat conference suggests that the majority think encryption backdoors are ineffective and potentially dangerous.

The study carried out by machine identity protection company Venafi finds that 72 percent of respondents don't believe encryption backdoors would make their nations safer from terrorists.

This follows an earlier study from Venafi into consumer attitudes to encryption and government powers which showed that people have mixed feelings about the effect it would have on them personally.

This new study shows thatonly 19 percent of professionals believe the technology industry is doing enough to protect the public from the dangers of encryption backdoors. 81 percent feel governments should not be able to force technology companies to give them access to encrypted user data, and 86 percent believe consumers don't understand issues around encryption backdoors.

"Giving the government backdoors to encryption destroys our security and makes communications more vulnerable," says Kevin Bocek, chief security strategist for Venafi. "It's not surprising that so many security professionals are concerned about backdoors; the tech industry has been fighting against them ever since global governments first called for unrestricted access. We need to spend more time protecting and supporting the security of our machines, not creating purposeful holes that are lucrative to cybercriminals."

You can read more about the findings on the Venafi blog.

Photo credit: Spectral-Design / Shutterstock

Read the original here:
72 percent of security pros say encryption backdoors won't stop terrorism - BetaNews

Read More..

Resilience, Emergencies and the Internet: Security In-Formation – Peace Research Institute Oslo (PRIO) (press release)

This book traces how resilience is conceptually grounded in an understanding of the world as interconnected, complex and emergent. In an interconnected world, we are exposed to radical uncertainties, which require new modes of handling them. Security no longer means the promise of protection, but it is redefined as resilience - as security in-formation. Information and the Internet not only play a key role for our understanding of security in highly connected societies, but also for resilience as a new program of tackling emergencies. Social media, cyber-exercises, the collection of digital data and new developments in Internet policy shape resilience as a new form of security governance. Through case studies in these four areas this book documents and critically discusses the relationship between resilience, the Internet and security governance. It takes the reader on a journey from the rise of complexity narratives in the context of security policy to a discussion of the Internet's influence on resilience practices, and ends with a theory of resilience and the relational. The book shows how the Internet nourishes narratives of connectivity, complexity and emergency in political discourses, and how it brings about new resilience practices. This book will be of much interest to students of resilience studies, Critical Security Studies, Internet-politics, and International Relations in general.

View post:
Resilience, Emergencies and the Internet: Security In-Formation - Peace Research Institute Oslo (PRIO) (press release)

Read More..

LIBTELCO Hosts First Cyber Security Confab – Liberian Daily Observer

The Liberian government has become cognizant of the threat of cyber crime that is affecting countries and companies globally.

Against this back ground the Liberia Telecommunications Corporation, (LIBTELCO), yesterday convened the nations first annual National Cyber Security Forum at a resort in Monrovia to deliberate on the establishment of a national cyber-security strategy against external invaders.

The forum is focused on creating awareness for cyber security and its implications for the government, business, and society. The event was graced by some of the sub-regions leading cyber security experts from business, government, and academia.

We are proud to be hosting this event and appreciate the important role that cyber security plays to ensure our economy operates securely, said Dr. Darren Wilkins, Managing Director of LIBTELCO. We look forward to working with our colleagues toward the development of a national cyber security strategy in the near future.

The future of every entity in Liberia that uses computers and the internet hinges on its approach to cyber security.

By bringing thoughtful people of like minds together from across disciplines, we can transform our country from a start-up nation to a cyber-nation, cognizant of cyber security and cyber threats, Dr. Wilkins explained.

Several institutions from various sectors of Liberia are participating in the event. The program also brings together cyber security experts from the Ivory Coast, Liberia, United States, and China.

Making a presentation at the conference, an Ivoirian Business Development Manager, Koffi Adjoumani, said the issue of cyber security should not be overlooked by any government or entity.

On the topic, Cyber Security Awareness, Mr. Adjoumani noted that it is hard to time that Africans began to prepare themselves against the threat of hackers, who are causing a substantial amount of damage across the globe. This is a threat that is invading the globe and we have to prepare ourselves for it. There is no better way to go about that than to convene such a gathering where we can put our ideas together, he said.

Some of the major contributors to the event include Liberia Telecommunications Authority (LTA), the Central Bank of Liberia (CBL) and several other institutions from both the public and private sectors.

LIBTELCO Head of Cyber Security, Al-hassan Sheriff noted that the conference would not have come at no better time as the nation is about to go to a very important election.

He indicated that the need for a vibrant cyber security program in the country cannot be overemphasized. We need a very strong strategy that will help protect our country. The sooner we do this, the better it is for us, Mr. Sheriff said.

It is my hope that this event will address and increase our awareness on cyber-security and bring us together for a closer collaboration on this very important subject.

The advent and use of the internet and its accompanying technologies has made it imperative for all of us to understand the basic understanding of the cyber threat, cybercrime, and cyber security, he said.

The internet is a communication tool that now affects almost every aspect of our lives, from education to entertainment to banking, health, sports among others.

What the entire internet has brought to us for comfort has altered our daily routine. The internet is also the world marketplace, where trillions in financial deals occur yearly. Moreover, as technology advances, especially Wi-Fi technology, the internet has become widely accessible by smaller and smaller mobile users, he said.

See the article here:
LIBTELCO Hosts First Cyber Security Confab - Liberian Daily Observer

Read More..

Free or hate speech? Silicon Valley searches for proper line – CBS News

The internet was built on the premise of allowing people to engage in free speech and exchange ideas, even dangerous ones.

That ethos now faces a stern test following the violence and terror attack in Charlottesville, creating a host of ethical questions for businesses including Facebook, PayPal and Spotify. Many are deciding to ban white supremacist and neo-Nazi users from sending money, posting comments and listening to "white power" music.

While those decisions are applauded by many, others are questioning whether tech companies are going too far by deciding what music their customers can listen to or what comments are acceptable. The dilemma was spelled out by Cloudflare CEO Matthew Prince, who wrote in a blog post about how he decided to cancel the account of the Daily Stormer. The issue came to a head for Cloudflare, an internet security company, when the neo-Nazi publication claimed "we were secretly supporters of their ideology," he noted.

That was a "tipping point" for his company, Prince noted.

"Someone on our team asked after I announced we were going to terminate the Daily Stormer: 'Is this the day the Internet dies?'" he wrote. "He was half joking, but only half. He's no fan of the Daily Stormer or sites like it. But he does realize the risks of a company like Cloudflare getting into content policing."

During the past decade, American businesses have increasingly espoused ideals such as diversity and inclusivity. The Charlottesville attack is pushing employees and customers to ask those corporations whether they are going to live up to their slogans and corporate policies, said Brian Kropp, HR practice leader at consulting firm Gartner.

"You don't know what the values of your company are until they are tested, and now they are being tested," he said. "Whatever you say you stand for in an organization, you have to stand up for it when the moment comes. If you do that, odds are things will work out."

PayPal (PYPL) cut off business with more than three dozen hate groups and other extremist organizations following the white nationalist rally in Charlottesville. Among those are Altright.com, a white nationalist group led by Richard Spencer.

"Regardless of the individual or organization in question, we work to ensure that our services are not used to accept payments or donations for activities that promote hate, violence or racial intolerance," PayPal said in a statement.

Facebook (FB) banned the Facebook and Instagram accounts of a white nationalist who attended the Charlottesville rally. Facebook CEO Mark Zuckerberg wrote in a post, "Debate is part of a healthy society. But when someone tries to silence others or attacks them based on who they are or what they believe, that hurts us all and is unacceptable."

At the same time, some customers are pushing back, asking in social media posts whether the organizations will hold other groups to the same standards. Others are expressing concern that it might backfire.

"I think this leads to more Nazis," one user wrote in response to Cloudflare's decision. "Instead of laughing at them, they feel persecuted and silenced. Which reinforces their beliefs."

While some users claim their free speech is being violated, private companies have the right to set their terms of service, just as they have the right to discipline employees for code of conduct violations. The latter was an issue that arose when Google fired engineer James Damore after he published a manifesto that argued the gender gap in technology is due to biological factors, such as women's higher "neuroticism" than men.

"People confuse the fact that the government is not allowed to restrict free speech, but private companies are," said Michael Niborski, a partner at law firm Pryor Cashman who specializes in free speech issues. "It's a cost-benefit analysis by the company: Are we going to lose customers? Are we going to get bad publicity because we are giving them a platform or a website and allowing them to display their music?"

He added, "One thing that makes this particularly unique is you are talking about one of the most vilified, negative groups in history, and so companies feel protected in taking their music down."

In essence, Silicon Valley is confronting the "paradox of tolerance," the idea outlined by philosopher Karl Popper that a tolerant society must be intolerant of intolerance. Otherwise, the intolerant will have the freedom to destroy tolerance.

Employees increasingly are important constituents in businesses' decisions to stand up against bigotry and white supremacy, Gartner's Kropp said. A generation ago, workers didn't identity as much with their employers' values, but employees now see their workplaces as extensions of their own core beliefs.

"If you are banning some of these things, it's a fairly small minority of people who are fairly outraged about it," he said. But without speaking out against intolerance, "especially in the tech space where it's super competitive, you run a huge risk of losing a chunk of your employee base to the competition."

But banning white supremacists can be good for business, even if some customers question corporate control over free speech.

For instance, dating site OKCupid banned white supremacist Chris Cantwell for life, 10 minutes after they received the alert he had a profile on their site. Customers praised the decision, with one women writing, "Single women all over the world thank you!!!"

"There is no room for hate in a place where you're looking for love," OKCupid said on Twitter.

Link:
Free or hate speech? Silicon Valley searches for proper line - CBS News

Read More..

Australian money cops gain powers to regulate cryptocurrency – The Register

Australia has decided digital currencies need the same level of regulation enjoyed by other currencies.

Justice minister Michael Keenan yesterday announced an intention to strengthen the Anti-Money Laundering and Counter-Terrorism Financing Act and give more digi-dollar regulatory powers to the Australian Transactions and Reporting Analysis Centre (AUSTRAC).

Describing the current state of affairs as a regulatory gap, the minister said the decision to bring digital currencies under the same laws as other currencies has been taken after consultation with industry and our national security agencies.

The threat of serious financial crime is constantly evolving, as new technologies emerge and criminals seek to nefariously exploit them, Keenan gravely intoned. These measures ensure there is nowhere for criminals to hide.

There's a draft of the upgraded Act for your consideration. It defines a digital currency as "a digital representation of value that:

(i) functions as a medium of exchange, a store of economic value, or a unit of account; and (ii) is not issued by or under the authority of a government body; and (iii) is interchangeable with money (including through the crediting of an account) and may be used as consideration for the supply of goods or services; and (iv) is generally available to members of the public without any restriction on its use as consideration."

The draft also calls for the creation of a Digital Currency Exchange Register so that AUSTRAC knows who to regulate.

Australia's decision aligns it with other nations. The UK's National Cyber Security Centre last week included Cyber criminal use of cryptocurrency in its weekly Threat List. China and Japan have also moved to regulate digital currency exchanges.

Sponsored: The Joy and Pain of Buying IT - Have Your Say

See the rest here:
Australian money cops gain powers to regulate cryptocurrency - The Register

Read More..

Could Cryptocurrencies Replace Cash? – Investopedia

At the beginning of the cryptocurrency boom, Bitcoin seemed to be the unquestioned leader. Up until early this year, Bitcoin accounted for the vast majority of the industrys market capitalization; then, in a span of just weeks, Ethereum, Ripple, and other currencies rushed to catch up. While Bitcoin is still in the lead, the rapid turnover in the industry has some analysts predicting that even bigger changes could be ahead. Among them? The idea that cryptocurrencies could come to replace cash entirely.

A report by Futurism highlights some of the possible outcomes, should cryptocurrencies surpass fiat currencies at some point in the future. One important consideration is that cryptocurrencies cannot be manipulated quite as easily as fiat currency, largely due to their decentralized and unregulated status. Beyond that, cryptocurrencies could better support the concept of a universal basic income than fiat currencies would. As a matter of fact, some programs have already experimented with the use of cryptocurrencies as means of distributing a universal basic income.

Further, cryptocurrencies could help to get rid of intermediaries in everyday transactions. This could cut costs for businesses and help out consumers.

Of course, there are also some huge challenges and concerns with this scenario. If cryptocurrencies outpace cash in terms of usage, traditional currencies will lose value without any means of recourse. Should cryptocurrencies take over entirely, new infrastructure would have to be developed in order to allow the world to adapt. There would inevitably be difficulties with the transition, as cash could become incompatible quite quickly, leaving some people with lost assets. Established financial institutions would likely have to scramble to change their ways.

Beyond the impact of a cryptocurrency future on individual consumers and on financial institutions, governments themselves would suffer. Governmental control over central currencies is key to regulation in many ways, and cryptocurrencies would operate with much less government purview. Governments could no longer, for example, determine how much of a currency to print in response to external and internal pressures. Rather, the generation of new coins or tokens would be dependent upon independent mining operations.

Regardless of how individual investors may feel about the prospect of a switch from standard cash to cryptocurrencies, it is likely out of anyones hands. Of course, with ample speculation abounding that the cryptocurrency industry is a bubble that is destined to pop, its also possible that predictions of a crypto future could be overblown. What is difficult for investors is that, as with all things crypto-related, changes happen incredibly quickly, and predicting them is always tough.

Read more:
Could Cryptocurrencies Replace Cash? - Investopedia

Read More..

NVIDIA CEO Believes Cryptocurrencies Have Longevity – Investopedia

Since the beginning of the year, cryptocurrencies like Bitcoin and Ethereum have skyrocketed in value, adding billions in market cap and increasing in value by huge factors. The precipitous growth of the industry has been so pronounced, in fact, that analysts both within and outside of the industry have speculated that cryptocurrencies are a bubble that will eventually pop and that the market will crash. On the other hand, though, there are proponents of the crypto space who believe (or hope, at least) that cryptocurrencies are here to stay. The CEO of Nvidia (NVDA), the graphics card manufacturer, falls into the latter category.

It is perhaps unsurprising that Jen-Hsun Huang, CEO of Nvidia, is optimistic about the future of the cryptocurrency world; Nvidia has benefited greatly from the recent spike in cryptocurrency mining around the globe. As mining operations have taken off, and particularly because individuals can set up their own computer systems to mine for most cryptocurrencies, demand for high-power graphics cards has taken off. In many markets, top graphics cards have sold out entirely, with prices skyrocketing as a result. Nvidia has reaped the benefits: its second-quarter earnings jumped up 56% year over year, and its GPU division took in a whopping $1.9 billion during the second quarter alone. That is a rise of 59% in comparison with the same time period a year previously.

Huang explained to VentureBeat that cryptocurrency and blockchain are here to stay. Over time, it will become quite large. It is very clear that new currencies will come to market. Its clear the GPU is fantastic at cryptography. The GPU is really quite well positioned.

Huang is not the only GPU maker to weigh in on the future of cryptocurrencies, and the diagnosis is far from unanimous. Rival Advanced Micro Devices, Inc. (AMD) is less bullish on the prospect of cryptocurrencies going forward. In fact, AMD CEO Lisa Su suggested that her company does not predict a long-term future for sales of their products to the mining market. Still, though, they would plan to continue to watch the developments in the space, according to CoinDesk.

In the past several months, demand for graphics cards has grown significantly. Miners require top processing capacity in order to add new transaction blocks to any of the top blockchains. Their reward for solving those complicated math problems is newly minted coins or tokens. GPUs are specifically used to mine cryptocurrencies including Ethereum or Litecoin, as these are based on a hashing algorithm called scrypt. Bitcoin operates with another set of procedures and is generated using dedicated hardware known as ASICs.

Go here to read the rest:
NVIDIA CEO Believes Cryptocurrencies Have Longevity - Investopedia

Read More..