EU Commission Working Group looking at privacy concerns in IoT

The Article 29 Working Group advising the EU Commission on Data Protection has published their opinion on the security and privacy concerns of the Internet of Things. A couple of interesting quotes come from this document and it points to possible future laws and regulations.

"Many questions arise around the vulnerability of these devices, often deployed outside a traditional IT structure and lacking sufficient security built into them."

"...users must remain in complete control of their personal data throughout the product lifecycle, and when organisations rely on consent as a basis for processing, the consent should be fully informed, freely given and specific."

One thing is for sure, privacy is likely to get eroded further with the widespread adoption of IoT devices and wearables. It is critical that these devices, and the services provided with them, have security built in from the start.

City Link and Gathering Data for Spear Phishing

I have just been sent an email giving me a tracking number for a City Link parcel due to be delivered. On checking this on their website, I found that I only need the tracking number to track the parcel and no other information. Is this a problem?

Well, I think it is. Via my tracking number I am able to find the company name of the sender and my postcode. Now, postcodes normally only relate to around a dozen properties at most. However, that's not the end of the story. By entering different numbers (based on the one that I received) I was able to get the details of other parcels being sent around. Incidentally, their format is AAAddddd - representing three uppercase letters followed by sequential numbering.

Does this matter? Well, by going backwards through the sequential numbering system I was able to find a parcel that had just been delivered (at 13.50 to be precise) to a postcode in West Yorkshire - BD22 (I have omitted the last part of the postcode here). Helpfully, they include the surname of the person that signed for the parcel. Then it was a simple matter of doing a quick search on the properties to find someone with the correct surname. I found Denise and Jonathan X living at that address for a number of years and was able to find additional information, such as the fact that Jonathan worked for a local University. Crucially, I was able to find email addresses for them. It would now be very simple for me to launch a phishing attack on them as I have real details with which to trick them. There is simply a privacy issue here as well. Do you want anyone and everyone knowing what deliveries you receive and from which organisations? This could make a very good profile.

How hard would it be for City Link to require some additional information before giving out the detail? A simple solution would be to ask for the correct postcode in addition to the tracking number, then it would be much harder for someone to extract the details. They have included a captcha that kicks in after a few attempts, but this doesn't work, and simply entering anything in the field over the minimum required length and containing a space will be accepted. Also, cycling through IP addresses or performing the requests slowly will bypass this requirement. Anyway, I'm off to write a script to extract the details for the postcodes of City Link employees, MPs and newspaper reporters to see where they shop...

3M Privacy Filters Update

I have blogged about 3M's privacy filters before and their gold filter still remains, in my opinion, the best privacy filter on the market. If you want to find out more about that one and why you need a privacy filter, see my previous blog post "Why do I need a privacy filter? (3M's new Vikuiti Gold Privacy Filter)". I also blogged about their mobile phone privacy filter.

The problem with their mobile phone privacy filter last year was that it was only available in their standard grey louvered filter, so didn't work well with accelerometer phones that can be used in portrait or landscape modes - you had to pre-select which orientation you wanted to use your smartphone in. Also, the light transmission wasn't as good as the gold filter nor was the touch quite as good after applying it.

Well, they've addressed this and lanuched a new filter for mobile phones and slates at InfoSecurity Europe. The filter is now significantly thinner with excellent touch response and better light transmission - they also have a clarity measure which makes the screen easier to read with the filter (it does kind of work, having seen an iPad with only half the screen covered). They also have (in the lab) a grey louvered filter in two planes. This stops people from being able to read the screen if they aren't directly in front of it and deals with mobile phones and slate devices that can be used in the two orientations. This filter isn't available yet, but 3M told me that they were targeting the end of this year for these new filters. 3M also assured me that the new filter with double-louvers will be no thicker than the current one. This, combined with 3M's great adhesive that allows for a simple application, will make 3M's new privacy filters for mobile phones and slates the one to have, especially as they double as screen protectors.

Unfortunately they only do pre-cut versions for iPhones, iPads and HTC phones at the moment. If you don't have one of these then you will have to either cut it yourself or get a third party to cut one for you.

Series of Demo Videos of Trusteer's Rapport

I am currently producing a series of videos demonstrating the anti-spyware capabilities of Trusteer's Rapport. So far I have looked at keylogging software and screen capture. Specifically, I have demonstrated it with Zemana ScreenLogger, Zemana KeyLogger and SpyShelter. I will be adding more videos over the next few days. The first two videos are embedded below. (Edit: 17/05/10 - I have now added three more videos covering Zemana SSL Logger, AKLT and Snadboy's Revelation V2.)





Links to the YouTube videos are below:

• Trusteer's Rapport Demo 1 - Zemana ScreenLogger
• Trusteer's Rapport Demo 2 - Zemana KeyLogger
• Trusteer's Rapport Demo 3 - SpyShelter
• Trusteer's Rapport Demo 4 - AKLT
• Trusteer's Rapport Demo 5 - Zemana SSL Logger
• Trusteer's Rapport Demo 6 - Snadboy's Revelation V2
• Trusteer's Rapport Demo 7 - Pharming Attack
• Trusteer's Rapport Demo 8 - Amecisco Invisible Keylogger Stealth
• Trusteer's Rapport Demo 9 - Anti-Phishing Protection

3M's Mobile Phone Privacy Filter

At this year's InfoSecurity Europe I visited the 3M stand again to see what developments they had for their privacy filters. They had their excellent Gold filter there of course, which is now properly on sale in the UK and the best on the market in my opinion. I previously blogged about this filter in my post "Why do I need a privacy filter? (3M's new Vikuiti Gold Privacy Filter)".

So what's this blog post about? Well, they have now produced privacy filters for mobile phones. Let's add a bit of context to this decision. How many businesses provide mobile devices to their employees that are connected to the corporate network with access to email, contacts, calendars and corporate documents? If you were reading an email from a client or reviewing a sensitive document would you be happy for someone to peer over your shoulder? Maybe you're paranoid like me and try to avoid reading emails in public places and stand with your back to the wall, shielding the screen when you have to read something urgently (Note: you shouldn't really store sensitive documents on a mobile phone in the first place, but that's another topic). However, 3M have made the whole thing a bit easier and allowed people to look a bit more normal than I do when using email in a public place.

I had a bunch of questions that I wanted to ask 3M about this new filter and I got some answers that I will share with you here. Firstly, I'll give you a brief introduction to their product, which can be seen in the image below. This is basically a screen protector with the privacy filter combined. It uses the standard matte grey louvered filter that gives privacy in one plane (I'll explain this in a bit and the problem with it). It uses the matte film as reflective films would get scratched with the type of use that a mobile gets according to the guys on the stand. The film is self-adhesive, using 3M's Post-It note glue, so it should come off with no residue and be easy to fit. This is effectively a replacement for your standard screen protector with the added benefit of including the privacy filter.



Now to some of the questions I had:

• Does it work with touch screens? - Yes it does. They had an iPhone there and it worked perfectly.
• Does it work with a stylus? - Yes it does. They had an Windows Mobile-based XDA there, which also worked with no problems.
• Does it make the mobile hard to use? - No, the dimming of the screen caused by the filter is not too much of a problem. With the backlight off you pretty much can't read the screen, but how many people use their mobile with the backlight off? There is some drop in brightness, but you can increase the brightness of the screen to compensate. However, this does have the big side-effect of reducing battery life - a major problem on smartphones.
• What if I have a mobile that I can use in landscape as well as portrait, like an HTC or iPhone? - Well, you have a problem. It comes back to what I said above: the filter only works in one plane. The filter has vertical louvres so that as you move to the side they overlap and block out the screen, like vertical blinds. However, vertical movement doesn't change the overlap of the louvres, so there is no blocking of the screen in this plane. So, you have to decide which way you want the filter, portrait or landscape - it will only provide privacy in one plane. Now, this isn't a problem for a lot of phones, particularly the majority of Blackberries, which are still the preferred business machine by many organisations. It is a problem, however, for iPhones (which aren't business phones in my opinion) and many Windows Mobile phones with the iPhone-esque interface.
• Couldn't we have the Gold filter on a mobile to sort this problem? - Unfortunately, not yet, but they are working on it. There are a few technical difficulties apparently. Firstly, there is the point I made earlier, that mirror finished filters would scratch too readily on a mobile device that is thrown in a bag or stuffed into a pocket with other things. Apparently, they have a matte version of the Gold Filter in the lab, but it isn't available yet or in the near future. There is a second problem. Apparently, the Gold Filter doesn't take to being glued so easily as the grey filter. However, they are working on this as well and hope to have a solution soon.
• Do they come pre-cut to my mobile? - Yes and no. If you have a Blackberry or iPhone then yes, otherwise no. You buy a sheet and cut it yourself. I believe that there are other companies, such as wrappz.com, that will be able to cut one for your device in the future. I think this is a must for the uptake of the filter. How many business executives are going to sit down with a craft knife and straight-edge to cut their filter to the exact shape and size of their phone as well as the holes for the buttons, cameras, speakers, microphones, etc.? The problem for 3M is that mobiles come in all shapes and sizes, with absolutely no standardisation. Laptops and monitors, on the other hand, do have standard sizes.

What's my verdict? Another good product from 3M. I think this would be very good for executives with the Blackberry-type device and still help those with touchy-feely, accelerometer-driven interfaces, as long as they remember to only access sensitive information in one plane. They will have a great product when they get the matte Gold filter stuck to the mobile.

Which Browser is the Most Secure?

I was recently talking to a fellow security professional who develops secure plug-ins for browsers and we started talking about the security of various different browsers. Most of the talk around browsers centres around how fast they are and what sort of features they have, but rarely do people talk about the security of their browser. Unfortunately, the browser is one of your weak points on the network as users have the ability to navigate to sites containing malware or phishing attacks as well as install plug-ins or run scripts that are malicious. So, which browser is the most secure? Any guesses?

All browsers (and all security products for that matter) have security weaknesses and vulnerabilities. However, the architecture of the browser and certain features can make browsing safer. The feature I'm going to put forward first is web browser protection against socially-engineered malware (phishing sites). According to many of the big AV and security vendors, phishing is on the rise and set to be the biggest headache of this year. Two statistics worth quoting are: according to Trend Micro, 53% of malware is delivered via Internet downloads against only 12% via e-mail; and Microsoft claim that 0.5% of the download requests through IE8 are malicious and they block a download for one in 40 users every week. In January 2010 NSS Labs tested five of the latest browsers against socially-engineered malware. Their full report is worth reading, but I have shamelessly reproduced their main graph here.


According to NSS Labs, Internet Explorer 8 blocked 85% of these malware sites using their SmartScreen Filter. The next nearest was Safari 4 at 29% and 0.2% behind that was Firefox 3.5. Chrome 4 was worse, on only 17%, and Opera 10 was bottom of the pile, achieving less than 1% blocking. By far the best of the pack was IE8, but even that still lets through 15% of malware. An interesting and noteworthy aside to this is that I believe Safari and Firefox use Google's Anti-Phishing API and achieve a 29% blocking rate, yet Google's Chrome only achieves 17%. If you want to see what the SmartScreen blocking looks like in IE8, you can see an example below, where IE8 is blocking it and Comodo's Dragon (a Chrome derivative) is not.

Also, again according to NSS Labs, Firefox had an 'average add time' of 5.7 hours, the fastest, versus Microsoft's 6.7 hours. The average add time is how long on average does a user have to wait before a visited malicious site is added to the block list. Speed is very important here, but it does actually have to get blocked in the end to make this a valid metric. These figures are better than the other three browsers, which scored: Safari - 9.0 hours; Chrome - 14.7 hours; Opera 82.4 hours.


Having mentioned Comodo's Dragon now I will give you a brief introduction, if you haven't heard of it before. It is a free Chrome derivative browser from Comodo. This browser has been designed to be more secure than the average browser. It doesn't perform well in the above tests, but has several other features up its sleeve centred around privacy. Some of the main features include not sending the HTTP Referrer so that you cannot be tracked from site to site, it won't send crash and problem reports (so your history remains on your machine only), it highlights DV only secured sites and will give a visit history with the certificates. If you don't know the difference between a DV and an EV SSL/TLS Certificate then read this blog post. An example of the DV certificate warning can be seen in the screenshot below.


One problem I have with the privacy tag associated with this browser is the UserAgent string. I have blogged about Cookieless Browser Tracking by using the UserAgent string before. The point is that the string sent to a web server by your browser to identify its and your machine's capabilities gives about a third of the information required to uniquely identify you. There will only be a handful of machines with the same UserAgent string, especially if you stray from the most common browsers (IE & Firefox). I also think that 'Never save passwords' should be the default setting and 'Allow all cookies' should not be the default setting. It is a new browser though, and I'm sure it will improve over time as the company is committed to security in many guises. Certainly its positive features are good and something that other browser vendors should follow.

The next point is about actual downloads from the Internet. Dragon, and other browsers, will give a warning when downloading executable files, but will just download ZIP, PDF, etc., and allow you to open them without warning. Bear in mind that PDFs and ZIP archives can contain malware. IE8, on the other hand, will ask you to confirm the software used to open a download, regardless of its type. This will always give you the chance to opt out if it wasn't what you were expecting. Also, IE8 will tell you if it is a signed or unsigned download, if it is a plug-in or an executable. Other browsers do not support this feature. What does it mean though? Well, if I am a software vendor, like Adobe, and I want you to download and install my plug-in I will sign it with a digital signature. When you download it, you can verify the signature, which will tell you that I (or Adobe) created and signed the download and that nobody has tampered with it in the meantime. If the download isn't signed, then how do you know that this isn't a phishing or pharming site pretending to be Adobe (or intercepting the download with a proxy) giving you a version containing a Trojan or some other malware? The answer is that you don't!

So, you should only download and install signed plug-ins and executables. Unfortunately, Internet Explorer is one of the few browsers that will control this for you and it makes a distinction between signed and unsigned plug-ins even when they are installed. Which brings me onto my final point (as this post is getting very long and a bit like a rant). Internet Explorer is, I believe, the most attacked browser as it has, until recently, been the most widely used. Due to this, Microsoft has had to build it in a secure fashion, controlling all plug-ins carefully. Firefox, on the other hand, performs many of its tasks by using a plug-in architecture, even for standard functionality. As far as I am aware, there is little or no distinction between a 'built-in' plug-in and one installed from a third party at a later date. This is very dangerous in my opinion. Firefox now enjoys the top position for browsers and it won't be long before the hackers make the switch from attacking IE over to Firefox. I think it will be harder to secure Firefox against this onslaught than it will be for Microsoft to keep up with their architecture.

It is interesting to note that the speed of the browser runs roughly inversely to the graph at the beginning of this post, i.e. Chrome is very fast and IE is considered the slowest of the big 4. However, security always comes at a price - processing being a big loser. Could it be that the reason why IE is such a leviathan and slower than its rivals is because they're doing much more checking and keeping you much more secure? I think so. Microsoft have a way to go though and can't rest on their laurels. I will be watching Comodo Dragon with interest to see if they can really push for the top spot in terms of a secure browser. It certainly does something for user education and privacy.

Why do I need a privacy filter? (3M's new Vikuiti Gold Privacy Filter)

I received my free sample filter from 3M a week ago now - it is one of the first of their new Vikuiti Gold Privacy Filters. Before I tell you about my experiences with it though, I think I ought to cover the question: 'Why do I need a privacy filter?'

So, what is a privacy filter? It is a thin sheet of plastic that fits over your screen to reduce the viewing angle. LCD manufacturers spend all their time increasing the viewing angle of their screens so that many people can view the TV from all over the room or crowd round a computer screen to share information. The problem with this is the advantage itself - what if I have sensitive information on my screen that I don't want everyone to be able to read? The privacy filter reverses the wide angle viewing trend to reduce it as close to straight on as is practical. The point of a privacy filter is to stop prying eyes and shoulder surfing.

Do you need a privacy filter? I was speaking to one professional a little while ago and they told me about the time they were on a plane travelling back from an exhibition. He was sat beside a competitor who was working on their laptop for the whole journey, looking at details of their sales leads from the exhibition. At the end of the flight he thanked his fellow passenger for the information. Do you or your users have corporate laptops that they use in a public location? Shoulder surfing documents, usernames, security procedures, etc., can be a serious issue. We can spend all our time and effort protecting the storage and transmission of information and forget about the display and viewing of them.


Back to the new 3M Gold Privacy Filter. The viewing angles of filters are around 40 degrees from perpendicular. Mostly they work in a similar way to vertical blinds - if you are straight on then you only see the thin edge, but as you move off the perpendicular they start to show until they overlap and you can't see through them. The problem with this is that you can still see the screen if you move in the vertical plane. The 3M Gold filter seems to have a narrower angle of view (which is good for a privacy filter) and also cuts out vertical shifts to a certain extent. This is due to the gold mirror-like surface that cuts out the light from the screen and reflects the surroundings. The matte filters from 3M and other vendors are not so effective due to the lack of reflections. However, in bright ambient light with the laptop LCD panel turned to minimum brightness it can be harder to see the screen effectively with a shiny filter. This can be mitigated, to a certain extent, by the gold filter as it shows a brighter, clearer image than the grey ones in my opinion. Which brings up another problem with privacy filters; they do reduce the brightness of the screen. However, with the brightness turned up on my laptop, I can see the screen with no problems in any ambient lighting environment.

The one poor feature of the filter is the fitting. Small clear plastic tabs get stuck to your laptop round the screen (they have to protrude over the screen). The filter then slides in behind these and fits the screen perfectly (you have to buy the correct size). Fitting the filter is fairly easy (but can be a bit fiddly on a screen like mine as the sides of the laptop slope towards the screen) and removing it is very easy. However, you are left with the tabs over the edges of the screen even with the filter removed. They aren't that obtrusive though and you don't really notice them when the filter is in place.

Overall, I think that the 3M Gold Privacy Filters are probably the best filters on the market at the moment - certainly the best ones I've seen, though I haven't seen them all.

Cookieless Browser Tracking

We all know about tracking cookies and privacy. However, according to EFF it isn't necessary to use cookies to do a fair job of tracking your browser activities. According to their research browsers give 10.5 bits of identifying information in the userAgent string, which is supplied to the web server with every request. This is around a third of the information required to uniquely identify you.

They have set up a website to gather more data and give you a 'uniqueness' indicator for your browser, which you can find here. This data set is growing quite rapidly and will tell you how many of the userAgent strings they have received that are the same as yours. I managed to find a machine to test that was unique amongst the 195,000 machines they have tested. This means that someone could potentially track that machine even if cookies are disabled. Even if you come out with the same userAgent string as others, you can be narrowed down by using geolocation of your IP, browser plugins, installed fonts, screen resolution, etc. This isn't a new idea and others have tried it, like browserrecon. Of course if you have a static IP address then you are fairly easy to track anyway.

Various suggestions are made to help protect yourself, such as don't allow scripts to run on untrusted websites, which is fairly obvious. However, although this may reduce the amount of data given out from highs of 15.5 bits on a Blackberry or 15.3 bits on Debian, this won't stop the whole problem. It seems like the worst devices for giving out identifying information are Blackberry and Android phones, with minimum figures of over 12 bits. The best combination would seem to be FireFox running on Windows, which can be controlled down to only 4.6 bits (although highs are around double this), but this could just be because it's the most common combination.

What can you do? Don't visit untrusted sites. Also, you could change your userAgent string. It is just a text string stating the capabilities of your machine so that the web server can customise content to suit you. However, there is no real harm in tweaking this to fall in line with more common strings so that you are harder to track. You have to be careful here, because just removing most of the information will probably make your userAgent string unique. Alternatively, you could regularly change the string. Perhaps browsers should change the string with every connection? Plugins could do this, like User Agent Switcher. This would allow you to use different strings across different sites. Maybe hiding certain activities by temporarily switching the userAgent string would be useful.

FireFox and Opera are both quite easy to configure - type about:config or opera:config in the address bar respectively and navigate to the userAgent options. Internet Explorer is slightly more trickey, in that you have to make a registry change to alter the userAgent string. Navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent] in regedit. Here you can create string values for 'Compatible', 'Version' and 'Platform' to control what is sent. Under the 'Post Platform' key are a whole bunch of additional parameters that will be added to the string, so you can change or remove these.