Category: Uncategorized

Hacked Pacemakers and Insulin Pumps Are Just the Beginning — Bastille

Posted on June 13, 2017 by FINAO Admin - Uncategorized

As the number of medical devices explode, protection against RF risk in the clinical setting gets more complicated.

In 2016, the healthcare industry received a wake-up call. Federal regulators discovered critical cybersecurity vulnerabilities in certain pacemakers, defibrillators and other medical devices made by St. Jude Medical. Because these devices use RF signals to transmit and receive patient data, these devices were vulnerable to intrusions and exploits that could have dire consequences for patients.

It wasn’t the first time medical device security threats have been exposed. In 2011, hackers demonstrated how easy it was to hack an insulin pump during the Black Hat security conference. But it did reinforce the growing concern around medical device security in clinical settings.

Internet of Things (Io)T security in the clinical setting has become a top priority for healthcare delivery organizations, especially as the number of connected medical and non-medical wireless devices skyrockets. Gartner Research estimates that 25 percent of healthcare cyberattacks will originate from IoT devices by 2020 [insert source]..

One of the challenges in securing the clinical setting from wireless and RF risks is the stakeholders involved. Healthcare delivery organizations are accustomed to securing Ethernet and wireless network communications. But what about common IoT protocols like cellular, Bluetooth and ZigBee? Not so much. Furthermore, most don’t have the resources to deploy advanced white-hat security measures to really dig into threat exposure.

Considerable amounts of personally identifiable information are transmitted unencrypted over wireless and wired networks, These systems rely upon the security of the network itself. Given that security researchers been able to purchase used medical equipment on eBay with stored network passwords, it would be possible for an attacker to use such credentials to exfiltrate confidential information once they are on the network.

Much of the security responsibility – and vulnerability – lies at the medical device manufacturer level. Manufacturers often tweak standard protocols and make them their own, or fail to provide specs and documentation on custom RF protocols to the public. Lack of public scrutiny does no favours to patients, only making it moret difficult to understand how these devices communicate with other devices and the network, and what vulnerabilities may be present.

Patients are also becoming a key stakeholder in the security equation, as data is exchanged with patients in their homes, both by in-home medical devices and as more patient reported outcomes data is collected to improve the standard of care.

In addition, telemedicine and implanted devices create remote care environments, in the patient’s home or care home. In these cases, patients and care home providers have to take an active role in security – including things like network protection and security updates to devices.

Given the evolving threat landscape and a complex web of stakeholders, it’s understandable that many healthcare delivery organizations are overwhelmed. Where does the journey begin for securing the clinical setting from RF and wireless risks?

It starts with visibility. You can’t secure what you can’t find. Clinicians and technical resources within the clinical setting must be able to identify which devices are present in their environment – both authorized and unauthorized. Furthermore, they need visibility into all devices transmitting across the entire RF spectrum. Where are these devices located? Which RF protocols are they using? When and where is suspicious activity occurring?

There is no silver bullet to securing the clinical setting. It will ultimately require better collaboration between manufacturers, clinical environments and patients. But, there are protective measures healthcare delivery organizations can and should take now. Patient outcomes depend on it!

If you would like to learn more, please watch our webinar, Wireless MD: Addressing Wireless and RF Risk in Clinical Settings

Do You Know Who’s Hacking the Trading Floor? — Bastille

Posted on May 2, 2017 by FINAO Admin - Uncategorized

What You Need to Know About Monitoring Cellular and IoT Devices in Capital Markets

Will the regulatory climate for capital markets cool off given the pro-business agenda of the current administration? It may be too early to tell, but many believe the answer will be “no” – especially as the government zeroes in on cybersecurity.

Another area of particular focus is electronic communications (or e-comms), which touches virtually every aspect of buy and sell-side activities.

Just ask FINRA. Last December, the agency fined 12 large financial institutions a total of $14.4M for improper electronic records-keeping practices, which made the firms vulnerable to cybersecurity threats.

So, what’s the issue? The challenge with e-comms monitoring is that it has to go beyond preventing illegal activities. It has to provide the ability to measure, prove and – the most challenging of all – disprove intent.

The interesting thing about the 12 FINRA settlements is that most of the cases didn’t focus on actual instances of failure in record keeping (and the e-comm surrounding it). The fines were for negligence in preventing these things from possibly happening.

Therein lies the real challenge. How do you prove your employees aren’t communicating the wrong way? How do you monitor for unauthorized devices – not just phones and wearables, but for more obscure IoT devices like wireless printers or keyboards that can be hacked and exploited for malicious activity?

Without real-time monitoring of all the devices in your space – both the detection of devices and determining whether they present security vulnerabilities – firms don’t have a mechanism to enforce the rules.

This is where Bastille’s enterprise threat detection technology comes in, and why it’s so critical to capital markets. Bastille provides constant and holistic awareness of devices in the enterprise. It allows firms to identify in detail all devices in the enterprise, where they are, the protocols they’re using, the data volume they’re transmitting and what security vulnerabilities may exist. When an unauthorized device enters the enterprise or does something out-of-policy, someone is alerted.

Bastille also enables forensic analysis on device comms. Were there strange patterns in data flows between devices? Which devices? Were they authorized? Were those devices attached to a persona or employee in the enterprise?

Finally, Bastille performs this monitoring in a discreet and non-disruptive way.

At the technical layer, Bastille helps firms meet the dual demands of e-comms monitoring – the ability to prevent malicious activity and the ability to measure, prove or disprove intent through forensic analysis. Finally, it demonstrates and validates to auditors that the firm has the technology in place to enable systemic and continuous monitoring.

If you would like to learn more, please watch our webinar, Cellular and IoT on Wall Street: Changes in Compliance Requirements, Cellular, and IoT Devices in Capital Markets.

Dallas Siren Attack — Bastille

Posted on April 14, 2017 by FINAO Admin - Uncategorized

In light of recent events, particularly the Dallas siren hack we’d like to go through a couple of plausible scenarios that might explain this attack and how they relate to the need for more security when designing RF-enabled devices and implementing RF-enabled networks.

For now, let’s look at the Dallas incident to examine how some public safety and large-scale RF networks work, how they might be vulnerable to such attacks, and what you should take into account when designing and securing such networks.

Dallas – Networks, Topologies, and Sirens
Let’s have a look at an overview of the potential components involved in the Dallas scenario. With a central controller node at the headquarters, there would be some sort of control module.

For example, a computer and software would be interfaced to radio equipment, and then connected to an antenna.

The individual sirens are spread out over a large area, which is an important factor to consider, and is one reason that RF is such a good way to control these systems. At each node, there is a pole with a siren, a radio receiver listening for commands to control that siren, as well as some sort of module that actually controls the siren and whether or not to emit alarms.

The Dallas Office of Emergency Management (OEM) has not revealed how their network is organized or what sort of security it had, or has, so we are still left to hypothesize on how this might have happened. While there are a number of theories, here I am going to discuss the types of networks that might be deployed in Dallas and the types of transmission technologies in use.

NETWORK TYPES

Single Frequency Networks
One possible scenario for Dallas is that they use a single-frequency network. In this situation, all the sirens and radios operate at either end of a single-frequency network, which is registered with the FCC.

A single-frequency network uses a large single transmitter to cover an entire emergency region. The transmitter might be up high on a tall building or on a hill and uses a very, very large power output to allow the radio waves to propagate over a significant distance and cover the entire array of sirens. Since all of the Dallas sirens appear to have been set off at once, this may indicate some sort of centralized control over all of them, as opposed to individually, visiting each one and setting it off.

So, in the single frequency network attack, the attacker most likely traveled to a high point to achieve a good propagation to all the sirens. The equipment to undertake this sort of attack would have included a powerful transmitter, a power amplifier, and antenna set to the specific frequency used by the Dallas system (or around about those frequencies).

Radio Repeater Networks
In this network there is a centralized instance of a single repeater to cover a large region. The repeater accepts weaker signals on one ‘input’ frequency and rebroadcasts them at a stronger signal on a different ‘output’ frequency to cover the larger area.

How does this play out? One hypothetical scenario is that a controller module at headquarters sends out a transmission on the input frequency, which is registered to a particular repeater. The repeater then rebroadcasts the same transmission over the output frequency, but at a much stronger signal. The siren modules will be listening on the output frequency, and anything transmitted on the input would be repeated to the output. That’s how you can cover this broad area.

We’ve briefly covered network configurations, now let’s take a look at how commands are sent.

COMMAND TRANSMISSION: Analog or Digital?

Analog RF Networks
The simplest and least costly approach to use is an analog technique. A normal analog single-frequency or repeater network, most likely using narrowband FM, is used to send voice data. To listen to these transmissions, all that is needed is a hand-held radio, which is easily purchased from eBay or Amazon for less than $30. You don’t really need anything more sophisticated than that.

If it’s analog transmission, then you can send a series of tones. One possibility is exactly the same sort of dual-tone multi-frequency (DTMF) tones you hear when you dial the digits on a telephone. What might be the case here is that tones are transmitted from headquarters to a receiver and demodulator at each node, and each node is programmed to listen for a certain sequence of tones. Upon receiving the tones, the node will enact some command, in this case, to activate the sirens.

Now, in either single-frequency or analog case, if there is someone out there that has found the frequency in use, they can simply listen for those tones to be transmitted prior to the monthly test. In some cases, where there’s practically no security, those tones are transmitted in the clear, and you’re able to replay them to achieve the same effect.

Where might the attacker be? On a single-frequency network, the attacker needs to be up high, with a very powerful transmitter,a power-amplifier, and antenna. With an analog repeater, the attacker simply needs to transmit close to the repeater, perhaps with a directional antenna, on the input frequency, and have those tones in the initial broadcast, rebroadcast by the repeater over the entire network to achieve the same effect.

Digital Repeater Networks
With a digital repeater, emergency headquarters has a radio to send digital data instead of just narrowband FM. Data is rebroadcast by the digital repeaters to ensure full coverage of the emergency area.

There may be one repeater, or in the case of modern public safety networks, it might be established as a simulcast network, which means that multiple synchronised repeaters would cover an even broader, geographic range.

The difference here is, instead of tones such as the DTMF tones, there would be a distinct packet of data. This is received by a radio, decoded and then the received command is put into action, in this case, to activate the siren at each node.

Encryption
With a digital network, there is the option of including encryption. However, in many networks encryption is not implemented for various reasons, such as key management or simply the much higher cost charged by the manufacturer.

To listen to ‘encrypted’ (where it is not properly implemented) transmissions the attacker may simply need a handheld radio. Alternatively, the attacker can use a computer or existing radio equipment with a demodulator. As with the analog example, the attacker can wait for the time when the equipment testing occurs to record the transmissions. To attempt to perpetrate an attack, the attacker rebroadcasts the recording just as with an analog network. However, this may not succeed as it depends on how the encryption was implemented. The Dallas OEM did not use encryption.

Trunked Networks
There is a nuance in certain networks (either analog or digital) when they’re trunked networks. A trunked network uses a more sophisticated type of repeater system.

The trunked network has allocated to it a number of frequencies that are shared amongst multiple radio users, which means that a single public safety network can support a large number of users, such as the police, ambulance, fire, and other first responders. This operates over a fixed number of frequencies (a pool of channels) that are allocated on-demand as users need to make ‘calls’. These calls are either all analog or digital in nature depending on the type of repeater, just as in the standard repeater case described previously. However, regardless of the call type, a digital signalling (output) channel is still used by the trunking controller to inform radios of allocated channels, and another digital (input) channel is used by radios to request a channel from the controller.

Now, this is not only about calls between mobile users or people. It could potentially be calls to end nodes such as radio-enabled equipment. The radios in these end nodes might be configured to operate on a trunked network, and they might be assigned to a particular talk group. At headquarters, the radio might transmit out to a trunked repeater network, saying, “Call this particular talk group,” so it establishes a call effectively to every single end node. They all start listening, and then the attacker would send either the tones in the analog trunked case, or dial packets in the digital trunked case. Either way, the network would receive the commands and have them sent out to each end node.

The primary problem with common trunked networks is that there is no method to authenticate a legitimate transmitter before setting up a call. Also, as with standard digital networks, there is no method by the network to authenticate the actual message that’s being sent, and there’s no low-level network encryption (it is commonly transparent to the network and implementation is left to the radios using the network). This means that this type of RF network is entirely open and susceptible to replay attacks.

“Over-the-air rekeying”
With the Dallas incident, the media reported that some level of encryption was added in very short order after the attack took place. While the Dallas OEM didn’t supply further details of how this was done or what encryption was added, here’s what could have happened: If Dallas was already using a digital repeater network, with radios that supported “over-the-air rekeying,” then they could have enabled encryption or updated the existing encryption keys via a radio-issued command signal.

Encryption and Initialization Vectors
With encryption, the system is now far less susceptible to the “record/replay” attack. However, this depends on how the encryption was implemented. If the encryption requires an initialization vector to be sent before each actual data transmission, then the data is much safer. However with systems that do not use this, due to time or cost, an attacker can still just replay the improperly ‘encrypted’ packet – and control the network, encrypted or not!

Emergency networks mainly use analog or unencrypted digital
The vast majority of emergency warning systems are still using analog or digital hardware without encryption, this largely due to cost. Since it is less likely that Dallas OEM has one of the more sophisticated networks, it is somewhat unclear how Dallas added “encryption” in such short order after the attack.

Radio vs. Wired?
Radio offers many advantages over wired communication systems, such as flexibility and cost, but security is often overlooked. Wired networks are not 100% secure either, but there is substantial investment to protect them, whereas there is little-to-no investment to protect devices using radio-only networks.

If you set up a radio network, you must secure points within your system, particularly end nodes. Otherwise an attacker can simply perform something like the replay attack and take control of your end node, or gain entry into whatever radio or wired network that is also connected to your end node.

The requirement for security improvements to radio-enabled devices does not just apply to government agency alerting systems. Today, many buildings and cities are using the Internet of Things to become Smart Buildings and Smart Cities. To achieve this, radio-enabled networks are being deployed – often without having to pass the same security requirements as wired or Wi-Fi devices. The Internet of Things often uses low-energy protocols operating beyond secured Wi-Fi — these include ZigBee, Z-Wave and LoRa. Often multiple radios are installed on each sensor to allow for future flexibility, and security is nearly alwaysthe last thing on the manufacturer’s list of features to add as they rush to market.

The Internet of Things, the Internet of Radios
With Internet of Things, or the Internet of Radios, it seems all too often that security’s overlooked and is the last consideration by manufacturers. The Bastille Research Team has found vulnerabilities in many common office and home devices. Last year, we notified brand name manufacturers of wireless keyboard and mice such as Logitech, Dell, and HP of the vulnerabilities in their products that would allow an attacker compromise their customers’ data and networks. Internet of Things sensors and controls operate key building security and infrastructure devices such as office entry and exit systems, windows, and HVAC. These are often deployed without the same level of security scrutiny and testing as the main Wi-Fi and wired network.

RF: Security through Obscurity
In the case of emergency siren systems, perhaps vendors and purchasers, thought it was security through obscurity, because they had their own special network, with their own dedicated protocol on their own frequency. However today, radio and computing technology is faster, more accessible and cheaper, enabling hackers the opportunity to research, exploit, and quickly find any weaknesses that exist.

What other RF-controlled infrastructure has similar security vulnerabilities to the Dallas OEM system?
Public safety is obviously a big issue, but there are also other issues in Smart Meters that control people’s gas, electricity and water. There are concerns and interesting research that have turned up issues with the electricity grid and how various substations and transformers can be controlled using SCADA radio links and radio modems. In some cases, there’s very little or no encryption, which means an attacker could even influence that network via the radio-enabled devices on that network.

Smart Cities
As deployment of “Smart City” technology increases, there will be new and interesting ways to use radio-enabled technologies to control streetlights, traffic lights, and so on. However, these can all be vulnerable to attack if the network is not designed with security in mind from the very start.

If you’d like to learn more about what Bastille does to protect wireless infrastructure or how it can help you sense, identify, and locate your RF-enabled devices, especially those that you’re not even aware of, please request a demo or your own Wireless Vulnerability Threat Assessment .

Bastille Enterprise — Bastille

Posted on October 18, 2016 by FINAO Admin - Uncategorized

Today, the Bastille team is proud to announce Bastille Enterprise, an integrated solution that delivers enterprise security through software defined radio to some of the world’s largest and most admired organizations. People and devices enter your building every day. Some are authorized to be there, but many are not. As the number of connected items in your buildings increases, how do you monitor them? How do you know what protocols they are using? How do you know if they’ve been securely configured, and how do you know if their communications are encrypted?

Wireless device vulnerabilities are no longer an emerging threat. They are here today. Eavesdropping devices can be easily ordered online for less than $40, are small and can be hidden in boardrooms and other highly sensitive areas. Rogue cell towers can be deployed to intercept calls and data. One can be set up across the street from your building to capture all of your calls and data coming out of your enterprise for only a few thousand dollars.

These devices pose a new and unknown risk for your security and your customer’s data. Bastille Enterprise uses a combination of ceiling-mounted sensors and an advanced analytics platform to sense, identify and localize radio-based security threats within your enterprise. Bastille has 14 patents approved and pending which apply machine learning techniques and advanced radio signal processing.

Key technologies in Bastille Enterprise include:

Bastille’s sensors are easy to install and can be out of sight. Custom brackets attach the sensor to struts inside of your suspended ceiling and use power over ethernet. No software is installed on any of your devices. We like to say you can’t protect what you can’t see, and with more than 20 billion connected devices expected by 2020, there’s already much to see and protect.

For a detailed threat analysis report of the devices operating in your enterprise airspace, contact us.

Beware of KeySniffers! — Bastille

Posted on July 25, 2016 by FINAO Admin - Uncategorized

We’re taught to be cautious online… to use multiple passwords, to not share our social security numbers, and to be wary where we use our credit cards. And as we protect ourselves, we trust that the websites we use will have strong security in place to protect us as well. With major hacks occurring almost daily, we expect companies to be prepared. We also expect the devices we use to connect to the Internet to be safe and secure, but a new discovery by the Bastille research team finds that this, unfortunately, is not the case.

Bastille has uncovered a new vulnerability in wireless keyboards that allows hackers to see every keystroke we type: every letter, number, space, caps lock key, and so forth. Dubbed KeySniffer, this vulnerability leaves millions susceptible to being hacked.

Affected manufactures include Hewlett-Packard, Toshiba, Kensington, Insignia, Radio Shack, Anker, General Electric, and EagleTec. Unfortunately, most–if not all–of these keyboards cannot be upgraded or fixed. They must simply be thrown out and replaced.

When conducting a KeySniffer attack, hackers are able to detect and access affected keyboards as far as 250 feet away. Whether you are at a coffee shop, the office, or in your own home, hackers in close proximity can watch everything you type in clear text. This means when you are logging into Facebook, checking your bank account, shopping online, or answering security questions, someone could be watching your every move.

With millions of these affected keyboards currently in use in homes and businesses alike, everyone from consumers, professionals, and government officials must recognize this threat and act immediately to protect against becoming a KeySniffer victim.

For more information on KeySniffer and to find out if your wireless keyboard is at risk, visit www.keysniffer.net.

Don’t Get MouseJacked — Bastille

Posted on March 2, 2016 by FINAO Admin - Uncategorized

Don’t Get MouseJacked

Bastille has recently announced the discovery of a security vulnerability that puts billions of PC’s and millions of networks at risk.

Maybe even yours.

It’s called MouseJack and it’s a massive security flaw in wireless mouse and keyboard dongles.Affected vendors include: Logitech, Dell, HP, Lenovo, Microsoft, Gigabyte, and AmazonBasics.

MouseJack was discovered by Bastille Engineer and Researcher Marc Newlin. He was able to exploit the vulnerability and prove that hackers as far as 100 meters away (that’s just over the length of a football field) could potentially exploit the affected wireless mouse or keyboard and use it as a portal to potentially take over a computer, transfer files, insert malware, delete the contents, and even infiltrate a network.

To see MouseJack in action, watch this video.

MouseJack is a breakthrough discovery that has caught the world’s attention. The Bastille MouseJack announcement has been published in more than 80 online publications and broadcast outlets ranging from Forbes, WIRED, CNET, Dark Reading, CBS News, Yahoo Tech, and Network World, to name a few.

MouseJack adds new research into the community concerning major security vulnerabilities with wireless mice and keyboards. In 2010 Thorsten Schröder and Max Moser released details of a different vulnerability dubbed “KeyKeriki v2.0 – 2.4GHz”. The KeyKeriki project targetted XOR-encrypted Microsoft dongles, exposing a weakness in their encryption scheme. The KeyKeriki work was extended in 2011 by Travis Goodspeed – “Promiscuity is the nRF24L01+’s Duty”.

In 2015, Samy Kamkar released the broadly reported KeySweeper hack.

“KeySweeper is a stealthy Arduino-based device, camouflaged as a functioning USB wall charger, that wirelessly and passively sniffs, decrypts, logs and reports back (over GSM) all keystrokes from any Microsoft wireless keyboard in the vicinity.”

For links to the research detailed above, and a discussion of how MouseJack builds on the previous research in the area, read this whitepaper

Unlike these earlier exploits which attacked the encryption schemes for dongle to keyboard communication, Mousejack shows that an attacker can entirely bypass a dongle’s encryption scheme and powerdrive keystrokes to the computer (Windows or Mac). These keystrokes impersonate the user and thus have all the authority to steal data and damage local or network file systems that the logged-in user has.

You’ll find comprehensive information on Bastille’s MouseJack findings and a list of affected devices and vendors at www.mousejack.com.

Are Cars Hacking Us? — Bastille

Posted on October 1, 2015 by FINAO Admin - Uncategorized

Are Cars Hacking Us?

2015 has been a very exciting year for car hacking, from Chris Valasek and Charlie Millers “road show” – to seeing a jeep literally stripped to pieces at DEFCON the blood is certainly in the water for exploitation of the advanced new software as our vehicles rapidly turn into computers.

The Volkswagen emission testing scandal brings to light another future, one in which perhaps the vehicles are doing the hacking. The idea isn’t new. Ford, GM, and even VW have tried to skirt the EPA’s strict rules on emissions. This time, however, there seems to have been clear advanced warning. Bosch, a supplier of automotive parts for VW, warned the company against using the “defeat devices” outside of test environments. While it might be a stretch to call this an 11M node botnet designed to attack the EPA, it was certainly software configured illegally to manipulate sensors for financial gain.

One thing is clear – modern cars are moving computers. It’s clear by VW’s cheating stunt and Jeep’s remote hijacking earlier in the year that there is little in place to prevent these sensors from being used for illicit purposes. If such a conservative company is willing to go to such lengths willfully, what kind of competition will we see in the world of semi-autonomous, or fully autonomous (level 4) vehicles that could be available as soon as 2020. Imagine vehicles that can force other vehicles to change lanes? There are sensors in place for this now aimed at driver safety, but they have had little, if any, security consideration. Could these sensors be vulnerable to takeover and manipulated for evil? The question certainly becomes more concerning as we get closer to taking humans out of the driving equation.

While I doubt we will see Google cars forcing Apples and Teslas off the 101, if we don’t start to take connected device security seriously, we could be faced with a real-life Mad Max scenario. For instance, Uber is notorious for aggressive business tactics and they are currently working on autonomous vehicles. I don’t suppose it’s out of the realm of possibility to have a vacant Uber block the one-way street of an oncoming Lyft vehicle. Of course, behind most of these doomsday transportation scenarios there is a bad guy pulling the strings. The FBI issued a warning about driverless cars back in 2013 and just last month they broadened their concern to IoT devices as a whole.

It will be interesting to follow the outcome of this massive Volkswagen hack, where the EPA, the consumer, and the environment were the victims.

Guest Blog, How to Merge the IoT into Enterprise Master Data Management Programs — Bastille

Posted on August 19, 2015 by FINAO Admin - Uncategorized

Guest Blog, How to Merge the IoT into Enterprise Master Data Management Programs

August 19, 2016 – By Dan Virgillito

Dan Virgillito is a Security Researcher for the InfoSec Institute.

Absorbing the data from the growth of interconnected devices that produce large data quantities is becoming the natural focus of all big data companies, especially when it comes to driving MDM (Master Data Management)/DQ (Data Quality) going beyond the acquisition of these continuous data streams.

Does IoT (Internet of Things) fit the description of driving MDM? Well, if an enterprise has IoT implemented for sensor data to keep track of behaviors, configurations, and identities, then it should be keeping master databases for all these assets. It gives companies certainty over where all data is and its performance at every point.

Much of the early adoption of Internet of Things comes from sensor data or machine generated data from mobile sensors in the form of log files such as Sensors, Location Intelligence and Geofencing. Sensors and devices like smart meters and jet engines are also contributing to streams of data. Other IoT data-driven initiatives include tracking devices, wearables, and logistics. Supply-chain materials and production units are also being equipped with sensors while smart-machines are being deployed to optimize processes.

However, organizations face challenges when it comes to gaining access to current sensor networks encapsulated within control systems as well as difficulties in managing and using captured data. To overcome these challenges, organizations need to exploit industrial analytics, intelligent applications, IoT security, and sensor-driven computing.

With the growth of Internet of Things, IT has the opportunity to add value to MDM/data quality programs. IoT use cases are expected to account for an increasing percentage of MDM solutions as corporations look to govern the fast-growing data sets around sensor data.

IoT data management complements MDM/data quality initiatives in a multitude of ways, but these specific scenarios are highlighted within organizations:

Frequent sensor data use: Sensor data use requires the setup of specific processes that can be expanded across additional applications to gain value. The use case for MDM is to connect dependent systems while maintaining linkages with source sensor data. An example is the collection of location data to find nearby businesses. The data can be used to optimize routes to reduce the number of steps taken as well as search efficiency. Moreover, following the optimization, it can be used for accurate location tracking, as well as for alternative routes to an office (routes with traffic can be avoided).

Sensor data API sharing: Sensor data, while valuable to organizations collecting the data, can be shared with partners provided it remains anonymous and the sharing organization has access control. Passing of additional data from non-sensor devices to partners would require API use, and an MDM solution will control and screen the data before it goes out the firewall to ensure only good data is passed out. For instance, a company offering location data to its customers may share the data with corporate partners, but they need to anonymize any information about customers. In addition, bad data needs to be identified and destroyed, unless it provides value as competitive intelligence.

Data treated as personal data: As data volumes grow, it can be difficult to anonymize related data sets. However, it is critically important to treat data obtained from IoT devices as personal data. It needs to be anonymized for different use cases, and require access governed by the organization and anyone else with whom the data is shared. Additional data sources need to be recorded and made available when IoT device use grows. Data should be processed locally before it goes out of the enterprise; solutions like end-to-end encryption should be considered where it isn’t possible to process data locally. All actors in the data-sharing regime should make strong privacy considerations.

The scenarios indicate that there is a huge opportunity for organizations taking new initiatives to understand the special needs of Internet of Things, as well as the modern technology leveraged by IoT devices. The bigger opportunity is for those companies who learn how to leverage IoT to provide better data to their clients/partners by offering insights that were previously impossible.

At the heart of the ability to succeed is the opportunity to screen out bad data and move the good one from one place to another. However, these organizations will need to adapt their data integration technology to make sure it deals with unstructured and streamed data as it is processed and moved by IoT technology.

Challenges that lie ahead

Machine-to-machine communication and IoT devices generate a lot of data. The top barrier is analyzing that data to get useful insight as it takes expertise. Enterprises need to change their processes to integrate MDM and enable employees to use and respond to the insights from data analyses.

However, the challenge isn’t crunching the data: it’s making use of connected systems needed to paint a complete picture to spur authentication, integration, and security throughout the organization. Companies need to spend less on integrations and leave some money aside for the operational changes that actually produce the results; some of the investment should go towards processes that stitch things together.

Then in order to turn these initiatives into profit, organizations need to have a deep understanding of the impact of IoT. Turning an organization into a smart enterprise affects every process of the business, but organizations that are slow to adapt to this change could be left behind the competition.

In addition, even with the best governance policies in place, the sheer volume of data flowing through IoT can make it challenging to drive peak MDM/data quality at all times. The key to overcome this challenge is to identify and prioritize IoT resources that require governance and streamline sensor data processes.

There are benefits of integrating MDM and IoT, such as automatically updating master data to improve the value-flow of data quality processes, and enabling prediction on master data to enable new business models and processes. However, the IoT is only valuable with an analytics model that is able to describe the semantic relations between master data objects and IoT devices. As a result, a proper semantic description is required for IoT data and MDM to generate fruitful results.

Corporations also need to detect anomalies and patterns while they occur, in motion, to make a considerable impact on the outcome of events. Whether it’s a pacemaker, a jet engine or medical device, sensor data will flow in a constant stream between device and network, leading to massive amounts of data, which makes IoT a major contributor to big data. New database technologies are required because traditional MDM solutions may have not been designed for Big Data, which is a necessity for the combination of MDM and IoT.

At a time when the enterprise sector is looking to take advantage of IoT data management to drive MDM/data quality, a culture of data-driven decision-making will help process sensor data while analytical skills of the domain will be used to extract valuable information.

What’s lurking in your corporate airspace? — Bastille

Posted on July 29, 2015 by FINAO Admin - Uncategorized

What’s lurking in your corporate airspace?

Seeing high profile research announcements in the weeks leading up to the infamous Black Hat and DefCon conferences is common. This year, our research team was getting pretty excited about ProxyHam, that is, until it was mysteriously pulled from the DefCon line up. The device claimed to be able to use a 900 megahertz radio link to give anonymous access to a Wi-Fi network from 2 miles away. In more plain language, a person could conduct illicit business over the Internet from his home, but appear as if he’s sitting in a Starbucks down the street. Ultimately, ProxyHam would make a user impossible to identify and track. But, in true hacker style, the presenter dropped the demonstration without explanation. It’s a bit odd that the paper was even accepted, since ProxyHam is more of a combination of Commercial Off-the-Shelf Products than custom hardware/software that is usually on display at DefCon.

With ProxyHam’s sudden disappearance a couple weeks behind us, researcher Samy Kamkar decided to revive the project and give ProxyHam a bit of an update. Kamkar released his version, called ProxyGambit, online just weeks before the Vegas conference season kicks off. For $238, anyone can build the location concealing device and Samy’s version extends the reach of anonymity to 10 kilometers, with an option to add a 2G GSM component that – in theory – allows you to access the ProxyGambit from anywhere in the world. Kamkar cautions that this is a proof of concept, but that didn’t stop our research team from using the plans to build one of their own. Of course (here comes the trite plug for our research team), you’ll have to wait until DefCon’s IoT Village to see what we do with it.

The intent of ProxyGambit seems to be on increasing privacy but attackers can repurpose the technology for nefarious use; it is possible to exfiltrate data from a corporate network over ProxyGambit’s 900 mGZ or GSM channels and this would go completely undetected by traditional IT security infrastructure. In much the same way a freedom fighter could plant a ProxyGambit in a coffee shop and get increased geolocational privacy, an attacker could leave behind a ProxyGambit style device to gain access to enterprise wifi or wired networks. Couple this with the original intent of keeping anonymity on the Internet and you have just created the perfect crime – limitless distance from the intrusion point.

Thankfully, it would appear as if the research community is starting to catch on to the increasing threat of using low-tech in an effort to target high-value environments. Just yesterday, Wired ran a follow up story on Israeli researchers that claim to be able to breach an air-gapped machine using RF. They upped their game since I wrote a blog on their original research. Instead of needing a smartphone to read video card transmissions, they’ve been able to accomplish the same attack with a dumb phone using a 2G network. It won’t dump down massive data like the Sony breach, but it could intercept passwords that could be used to access sensitive data environments. And all of this wouldn’t sound a single alarm.

The point of all of this is to illustrate that the level of cyber threats is increasing. Critical infrastructure and corporate networks will become softer targets as their environments get more porous with the addition of IoT. As long as there is money to be made in cyber crime, hackers will develop new exploits and new vectors to gain access to what they want. For now, the good guys seem to be staying one step ahead, but as IoT continues to connect our everyday lives to the Internet, these connections have the potential to bring in the bad guys and they will gain access through means that won’t always be detectable.

I’m looking forward to this year’s Vegas run. I hope you’ll check out what we’re doing at DefCon’s IoT Village – if nothing else we’ll get to see if ProxyGambit lives up to the hype.

Is your wearable selling you out? Data Privacy in an IoT World — Bastille

Posted on July 22, 2015 by FINAO Admin - Uncategorized

Is your wearable selling you out? Data Privacy in an IoT World

Big Data. Cloud Computing. The Quantified Self. The Internet of Things. These things are not just marketing buzzwords, they are concepts that are fueling today’s IT ecosystem. And the one thing that they all have in common is the consumption and analysis of large quantities of data for better decision making. Whether you’re looking at consumer or business markets, one thing is certain, we want to know more about what we do and when we do it. The sensor industry is changing business landscapes and adding efficiencies and improvements to automation. The wearables market is allowing everyday people to examine their daily activities through constant data accumulation served up as digestible intelligence on phone apps. With all this data being aggregated, how much of it is being used outside of its originally intended purpose? Are we – the users, consumers and businesses – for sale? And if we are, would we knowingly put ourselves out there as much as we do?

Employers are turning to wearables as part of their corporate wellness programs. These small devices are being leveraged to incentivize employees into a healthier lifestyle. On the surface, the increased steps, better sleeping habits and friendly competition all seem like a win-win for both company and employees, but there could be a hidden danger in the massive data dragnet. For instance, many wearable companies have openly admitted to sending data – anonymized – to third parties for a variety of reasons. Privacy policies rarely call these cloaked third parties by name, though many will define the purposes for sharing your data. These are similarly vague, citing things such as product improvements or customer experience enhancements. Regardless of the purpose, you can rest assured (consult your wearable for your actual sleep metrics), that your private health data is making the rounds on the Internet.

With this said, let’s explore some questions that I have surrounding this data traffic:

Who owns the data? This is data about YOU. Is it yours, or does it belong to the device manufacturer? While some devices allow you to have a choice in your sharing policies, many, if not most, come with maximum sharing as a default setting. Likewise, terms like “third party” are vague enough that it can encompass just about anyone, including data brokers and companies looking to better target products to your activities.
Who is responsible for securing the data? Encryption and de-attribution are important, at rest and in motion. How is it being sent to third parties? Are those third parties then able to store it or send it elsewhere and are they doing so safely? What about apps that consumers elect to use with their wearables? Again, this is your personal health data, and while many makers state that they disassociate personal information from the data, will we really know until there is a breach? After all, I’m sure that the Feds thought OPM was taking great care of their social security numbers, which we now know was being housed unencrypted.
Will you be on the side of profit or punishment? These wearables will give insight into daily activities that can be used to adjust the costs – for consumers and businesses – on things like medical and car insurance. If you’re donning a wearable for your corporate wellness program, don’t call in sick and then hit the ski slopes or you could find yourself in trouble come Monday.

These questions just scratch the surface of data security. As IoT devices become more ubiquitous, our thirst for data and insights will only increase. And, as recent news has proven, the underground market for stolen data has an insatiable appetite. I suppose time will tell as to who will be picking up the tab.