Security and Videogames

--Originally published at Information Security A01229898

Hi everyone, On this post I will talk about Security and videogames, yes, finally something about software, so let’s start this.

On this post as I mention I will talk about videogames, I was searching on internet and I found a post from welivesecurity esset and they talk about this topic, they interview Andres Rossi the CEO of an Argentine company that develops videogames for social networks, so I grab some information of that post so you can know a little of what they talk and at the end of the post I will put the link so you can check all the post of esset

Andres told that with his experience he has seen a lot of incidents related with security like payment-card frauds, cyberattacks targeting gamers and the subsequent claim of prizes, to exploitation of servers just for the sake of playing, but he says that the most common problem is that players leave their accounts open in machines that do not belong to them. He said that there is a lot of ignorance among video games developers regarding security implementation and one example is that the online Playstation platform was compromised a few years ago, the problem is that there are so many games that, as is to be expected, the challenge is still only focused on the largest and most famous game companies.

At last, I want to say that the security problems that the video game industry it’s because on the past, the industry didn’t need to take care for security, because all games were offline, so, it was not possible to extract information of other players, but with the online games the problem started but is difficult to try to secure all games.

Link of the interview: https://www.welivesecurity.com/2016/08/16/security-transversal-issue-video-games-development/

Master Key for hotels

--Originally published at Lord Security

There are may things someone takes i count to select a hotel to stay, the luxury, wifi connection, pool, air conditioner and many others. but something really important is that your stuff remains safe, knowing that no one can enter without your permission, including the cleaning staff.

That is why a new exploit discovered by F-Secure researchers is important, a vulnerability in a popular and widely used electronic lock system (Assa Abloy) that can be exploited to unlock every locked room in a facility

For this hack, the attacker needs access to any target hotel key, even though it isn’t from a room or it has expired. Then he would need a portable programmer with a custome code they created, it is hold near the lock to open and in a minute it will be unlocked.

The researchers, for obvious reasons didn’t released the code for the master key and, in fact, showed the findings to the affected company. With Assa, the worked for over a year to recently release an update that fixes the problem

References:

https://thehackernews.com/2018/04/hacking-hotel-master-key.html

Researchers Find Way to Create Master Keys to Hotels

I2C

--Originally published at Information Security A01229898

Hi everyone, on the other post I talk a little about some protocols, but I want to talk more about I2C, so let’s start.

As I explained on the other post I2C means Inter-Integrated Circuit and it is a synchronous, multi-master, multi-slave, packet switched, single-ended, serial computer bus invented in 1982 by Philips Semiconductor (now NXP Semiconductors). It is widely used for attaching lower-speed peripheral Integrated Circuits to processors and microcontrollers in short-distance, intra-board communication.

I2C uses only two bidirectional open-drain lines, Serial Data Line (SDA) and Serial Clock Line (SCL), on the SDA the master and the slave will send and receive information and the SCL is the clock that the master provides, that clock will determine the velocity of the the transmission.

The bus has two roles for nodes: master and slave:

Master node – node that generates the clock and initiates communication with slaves.
Slave node – node that receives the clock and responds when addressed by the master.

The bus is a multi-master bus, which means that any number of master nodes can be present. Additionally, master and slave roles may be changed between messages (after a STOP is sent).

There may be four potential modes of operation for a given bus device, although most devices only use a single role and its two modes:

master transmit – master node is sending data to a slave,
master receive – master node is receiving data from a slave,
slave transmit – slave node is sending data to the master,
slave receive – slave node is receiving data from the master.

So this is a little of I2C, but the real question on this post is, WHY ARE YOU TALKING ABOUT COMMUNICATION PROTOCOLS ON MICROCONTROLLERS IF THIS A INFORMATION SECURITY POST?

The answer is easy, I’m an electronic engineer and I have more knwoledge of microcontrollers, I don’t work too much with software and don’t Continue reading "I2C" →

Communication protocols

--Originally published at Information Security A01229898

Hi everyone, on this topic I will talk a little about Communication protocols, this topic is related with microcontrollers, because I’m talking about the communications protocols that microcontrollers use, I’m not going to talk about all the communications protocols, so let’s start.

-CAN: I know that I talk about CAN in other post, in fact, I have a post that talks only talks about CAN, but it is a important protocol and I think that I should mention it.

CAN is a protocol that in short words, is a bus, it has two cables and that’s it, it doesn’t have any security, so once your are in, you can know everything and technically you can interfer the system, if you want to know more about CAN protocol you can check my post of CAN and there I explain more and there’s a video that explains more.

-UART: Universal Asynchronous Receivert Transmitter (UART) is a computer hardware device for asynchronous serial communication in which the data format and transmission speeds are configurable. The electric signaling levels and methods are handled by a driver circuit external to the UART. A UART is usually an individual integrated circuit used for serial communications over a computer or peripheral device serial port. One or more UART peripherals are commonly integrated in microcontroller chips.

-I2C: Inter-Integrated Circuit (I2C) is a synchronous, multi-master, multi-slave, packet switched, single-ended, serial computer bus invented in 1982 by Philips Semiconductor (now NXP Semiconductors). It is widely used for attaching lower-speed peripheral Integrated Circuits to processors and microcontrollers in short-distance, intra-board communication.

-LIN: Local Interconnect Network (LIN) is a serial network protocol used for communication between components in vehicles. The need for a cheap serial network arose as the technologies and the facilities implemented in the car grew, while the CAN bus was too expensive to implement for every component in the car. European car manufacturers started using different serial communication topologies, which led to compatibility problems.

There are other protocols that I could Continue reading "Communication protocols" →

Not even your car is safe!

--Originally published at Paco's adventures

Maybe you have noticed that the cars are getting more advanced in their technology, this is great, or is it? More technology doesn’t always mean better or more secure. Of course I’m talking about this from the perspective of informatics, right know most of the cars have bad, or not even have security against hackers. But, why is this an issue? How can this happen? and what are the big companies going to do? Well, let me tell ya!

First, How can someone hack a car? I’ll try to be as simple as possible with the explanation. A lot of the computers used in the cars control things like the brakes, air conditioner, stereo, lights, the gearbox, etc. Mostly all the cars use a bus network to connect each of the computers. Something like this:

In a network like this, you just need to access one of the computers to see what the other computers are doing, and usually there is not a lot of security inside the bus. It has been proved that a lot of ports in the computers are left open for no reason and the hackers can exploit them. Things like the bluetooth and the wi-fi inside the car doesn’t have security. Here is an example of cars hacked (Volkswagen and Audi):

https://www.bleepingcomputer.com/news/security/volkswagen-and-audi-cars-vulnerable-to-remote-hacking/

And if you look for yourself, there are more examples of other cars being hackable. All of this is an issue, a big one, because as I said before, they can control things like the breaks and the gearbox, the hackers can cause an accident making it seem like it was your fault and also it would untraceable, in my opinion the companies should slow down their car releases and start making sure their cars aren’t easily hackable, thankfully they are Continue reading "Not even your car is safe!" →

Microcontrollers and security

--Originally published at Information Security A01229898

Hi everyone, This time I will talk a little about Microcontrollers and security, I talk about that topic on class a few classes ago and I realize it could be a good topic for my blog, I think that microcontrollers will need to get upgrades on security, since all this thing of IoT started the quantity of microcontrollers connected to the world has increased and will increase more, a lot of products and projects related with IoT are using microcontrollers and with that we have the problem that they are not secure and maybe they aren’t secure because normally a microcontroller won’t need that security, because no one cared about getting information of a microcontroller, but now, I think that security is becoming a must have, because maybe it will be easier to try to get information from the microcontroller than trying to hack other thing.

This post is related with the other posts because most of the security problems that we have and we will have are going to be related with IoT, having everything connected to the net is really usefull for the users, but is a two-edged knife, having everything connected means that people could access to your personal information and that could be problematic, now with the microcontrollers getting directly connected to the for the Internet of Things could be really dangerous, microcontrollers don’t have that security with the data they transfer, it’s relatively easy to get the data of a microcontroller, for example, in some classes, to know that what we are sending is ok, we check with a oscilloscope what we are sending, and that is just connecting the oscilloscope to the transmit of the microcontroller, so, if we can get that information that easy, imagine if that kind of security could be Continue reading "Microcontrollers and security" →

YouTube’s way of flagging videos

--Originally published at Let’s talk security. – Rudy's Corner

In the last months, right after the series of Apocalypse that YouTube faced, YouTube decided to create a new algorithm to flag videos that weren’t “advertiser friendly”. This new system worked, well kind of, depending of who you ask. According to the Google CEO this new system removed over 8 million videos from YouTube, of that number 6.8 million were first flagged by the computers, which is about 76% of the total.

Now the question is, does it really work? Does it actually just flag bad content, or does it also take down content that follow YouTube’s policies? And that is the core of the problem, because the system is not perfect (nothing really is) but YouTube is leaning a lot in a system to catch the “bad” videos. I

am sure that a lot of the videos that gets flagged are actually non advertiser friendly. But a fare share is okay.

Here is where we get to machine learning and if it will be good or not. No matter how much we try to, we won’t be able to program emotions or common sense to a computer (or at least any time soon). So, how much should we depend on a computer to do work where there is a lot of common sense involved? Yes the systems do the work for us, but at what cost?

In my opinion, we should keep a check on it, monitoring their behavior, us the humans making sure that the computer actually does what is supposed to do without damaging others, just as YouTube is trying to do. I am a little scared of what a system like that could do unchecked, but I hope it never happens.

Azure Sphere

--Originally published at miguel.net

Great news came last month, Microsoft launches it's first non-NT based OS, it is an Linux based OS for MCUs (microcontrollers), the great thing here, they claim to have a solution for the security problem on IoT, they claim to have the most secure OS for MCUs, we all remember that dark day when the "full" internet was down, because a botnet took down one of the main DNS service providers in the USA, it was a hard punch to the IoT movement but also was an oportunity to really make a deep dive into the security issues of IoT.

What they claim
Microsoft published a great post providing a great overview on the product, but lets just review it.

The certified MCUs are, as they state, secure from the silicon, that means that security is the first thougth when building one of this MCUs, but how efficient and cost-value effective are them? well, we don't know, the first one is about to lauch but no price has been said.

Azure Sphere OS: it is a OS that is built for security and agility, thats what they have said, but I haven't found any security test results on the web.

Azure Sphere Security Services: this are cloud services built to provide an upper layer of security to the MCUs and also a layer to push updates of the firmware and user software that will run on the MCU.

My concerns
Well, we know that they love to charge for everything, and also if the services are bound to Azure, then maybe that could be a barrier that is hard to tackle, because not everyone likes Azure, every one have their issues with any cloud provider.

My conclusions
I really like to see this kind of things, companies making new technology Continue reading →

Never hard code Connection strings

--Originally published at miguel.net

A common practice during development is to just hard code every connection string that is been used on the project, but why is this a bad, and I mean a really bad practice?

Let's see what outputs the C# compiler for hard-coded strings:

As we can see, the line marked as IL_0001 is where the sintrg is been loaded to a variable, it is just written there, with out any consideration, imagine if someone gets access to your binaries, then they can just decompile them and read any sensitive string that was just hard-coded inside the program.

How to store them.

Many aproches can be used, maybe using encrypted files to store those keys, but also that can be cracked, or maybe using environment variables that store the encrypted strings, but again, it can be cracked. So, we cannot trust anybody, we need to be completly away from any kind of machine to be completly safe, but we can trust one institution, and when running on a cloud platform this is important, all cloud providers have their safe way to store this things Azure has Key Vault, Amazon has Systems Manager Parameter Store and Google has

ObjectAccessControls, all of them have their own capabilities and ways to charge you for those services.

Now, you maybe asking, why would I trust any of this companies to save my important stuff? You don´t have to, but they are certified by some external authorities, so at least you have a way to berify their security.

Additionaly you must be carefull when pushing a commit to an open repository, it is way to easy to find connection strings on Github, I personally use an extension on my IDE that can be configured to produce compiler errors if a connection string is hard-coded, Continue reading →

Fake News

--Originally published at TC2027SWSecurity

We could define fake news as falsely descriptive information that seeks to manipulate the audience regardless of its purpose.

Although using fake news to manipulate the public is a thousand year old practice, this new iteration we call fake news is much more powerful because of its speed, power and low production cost. The fake news is a kind of cancer of the web that is born as a result of the business models of Google and Facebook, in conjunction with the decline of traditional media.

Resultado de imagen para Fake news

To face it, then, what we need are better professional means that inspire confidence and seriousness, that win over the audience with courageous and objective coverage, taking advantage of both technology and historical journalistic techniques. If we can not value journalistic work seriously, making both readers and platforms pay for good content, then we will end up hurting ourselves, living in a less informed society and therefore less free.

Source: fakenews source

Gilberto Rogel García A01630171 #tc2027