Security of real hardware

CNN has a big video online which comments on a recent DHS security video showing the results of someone hacking real power-handling generators.

I think they are referring to SCADA, the technology used to control various pieces of hardware. By changing the internal settings of a generator, it’s quite easy to make that generator to go boom. Even though the CNN footage is a bit on the panicky side, it’s still a nice article.

Technorati Tags: ,

Security Analysis of VoIP Protocols

I think this article is an interesting read. From the abstract:

The most serious attack is a replay attack on SDES,
which causes SRTP to repeat the keystream used for media
encryption, thus completely breaking transport-layer security.
We also demonstrate a man-in-the-middle attack on
ZRTP, which allows the attacker to convince the communicating
parties that they have lost their shared secret. If
they are using VoIP devices without displays and thus cannot
execute the “human authentication” procedure, they are
forced to communicate insecurely, or not communicate at
all, i.e., this becomes a denial of service attack. Finally, we
show that the key derivation process used in MIKEY cannot
be used to prove security of the derived key in the standard
cryptographic model for secure key exchange.

Fishing traffic from Tor nodes

It appears that one problem with Tor is that there can be rogue nodes that can listen in on all outgoing traffic. Can I hear a very loud and resounding “Duh” here? If you are an exit node and not really interested in one particular target, it’s easy to intercept the traffic. No need to do anything complex, just see what’s coming by. When using Tor you trust the exit nodes.

A security researcher intercepted thousands of private e-mail messages
sent by foreign embassies and human rights groups around the world by
turning portions of the Tor internet anonymity service into his own
private listening post.

Read more

Technorati Tags: