On Target: Embedded Systems

Automotive Privacy Protection Principles Don't Go Far Enough

The Association of Global Automakers and the Alliance of Automobile Manufacturers jointly announced on November 13, 2014 a set of voluntary “Consumer Privacy Protection Principles.” (See the press release here, and download the principles PDF document here.) The document is written in quasi-legalese, but in essence, it’s a pledge by automakers, beginning with the 2017 model year, to among other things: inform consumers about how data collected from their vehicles will be used obtain “affirmative consent” for certain ways that data might be used anonymize aspects of the data under some circumstances VDC applauds the auto industry for recognizing the... Read more →

Notable Demos from ARM TechCon 2014 and JavaOne

Semiconductor intellectual property supplier ARM kicked off its annual TechCon conference and trade show in Santa Clara, CA with expansion of the mbed IoT Device Platform, including a free operating system as well as server side IoT technologies. We describe the mbed OS in more detail in a separate blog post. In this post, we’ll highlight a couple of notable demos from other vendors on the show floor, plus one from Oracle’s concurrent JavaOne conference and trade show in San Francisco. In a literal sign-of-the-times at both events, you couldn’t swing a dead cat without hitting a sign that read,... Read more →

IoT Lessons from the Russian CyberVor Hacking

Widely reported during the first week of August was the revelation that a group of Russian hackers known as CyberVor had amassed a database of 1.2 billion usernames and passwords, as well as more than 500 million email addresses. The New York Times originally broke the story, based on findings from the firm Hold Security. Unlike the Target retail data breach of late 2013 and the more recent eBay breach, CyberVor’s loot is not the result of one or two large breaches, but rather a large number of breaches of all sizes. Hold Security says that the data came from... Read more →

eBay Response to Data Breach Shows the Company Still Doesn’t Get It

This month’s major data breach news comes courtesy of hackers who accessed eBay’s user database by using valid credentials pilfered from eBay employees. The hackers apparently had access to eBay’s entire database of 145 million active users during the months of February and March 2014. The information accessed included passwords in encrypted form, as well as names, email addresses, shipping addresses, and dates of birth all in plaintext. eBay’s user database was apparently accessible to the hackers because they logged in using genuine eBay employee credentials. But why should that give the hackers unfettered access to the entire user database?... Read more →

Exploiting the Exploit: The Marketing of Heartbleed

No doubt anyone reading this post is already aware of the Heartbleed bug affecting OpenSSL implementations of the TLS Internet security protocol. Heartbleed has received massive press coverage –deservedly so given its potential implications for a significant portion of web sites and Internet-connected devices. We won’t belabor the technical details of the bug, which are summarized nicely at Heartbleed.com. What we will discuss is how Heartbleed has been publicized. To the best of our knowledge, Heartbleed is the first computer systems bug to have both its own website and its own logo, the cute bleeding heart. As such, Heartbleed sets... Read more →

The AllJoyn Protocol: Does Its Openness Compromise Security?

On December 10, the Linux Foundation announced the formation of the AllSeen Alliance, an industry consortium that seeks to expand the Internet of Things in home and industry. Premier members include: Haier, LG Electronics, Panasonic, Qualcomm, Sharp, Silicon Image and TP-LINK, with more than a dozen additional community member companies. The members plan to adopt an open-source peer-to-peer communications framework called AllJoyn, originally developed by Qualcomm Innovation Center and launched back in 2011. Qualcomm has now contributed AllJoyn to the Alliance. AllJoyn is hardware agnostic and can run on multiple popular OSs including Linux, Android, iOS, and various Windows desktop... Read more →

Secure Your Software Supply Chain

The rapid growth in software-driven content for embedded devices is not new - nor is the recognition that connectivity and the Internet of Things are fundamentally changing the ways that OEMs deliver value to end clients. The ways in which OEMs are responding to these new content and feature creation requirements, however, are adding new layers of complexity to the SDLC - and vulnerabilities - to their products. While many engineering organizations are scaling internal software development efforts and receiving a increasing percentage of their code bases from third-party sources, they are often not placing proportional investments into their security... Read more →

The Foibles of Fingerprints

When Apple announced the iPhone 5s in September 2013, much of the popular press hailed the device’s inclusion of fingerprint sensing (dubbed Touch ID) as a major breakthrough in mobile security. The more astute journalists pointed out that Motorola had brought to market fingerprint scanning in the Atrix 4G handset back in February 2011, more than two and a half years earlier. As an owner of the Atrix 4G since its early days, I can provide some insight into the real-world ups and downs of using a fingerprint scanner on a daily basis, although the proliferation of fingerprint devices presents... Read more →

Trusteer Your Security to IBM: Acquisition Fortifies Security Portfolio

On August 15th, IBM (NYSE:IBM) announced it reached a deal to acquire Trusteer, a Boston-based software-security firm focusing on financial and enterprise cyberthreats. As part of the deal, IBM will absorb Trusteer’s R&D lab in Tel Aviv into its security organization. One major focal point for Trusteer is their mobile security product line, which focuses on preventing intrusion and data theft through enterprise-connected mobile devices. Smartphones and tablets are becoming integral tools for large and small businesses alike. Mobile devices – like an iPhone equipped with the SalesForce app – are a huge benefit to employees and their employer by... Read more →

M2M World Congress – London – Highlights from Day 1 of 2

VDC’s CEO Mitch Solomon is participating in M2M World Congress (one of the industry’s larger M2M-centric conferences) this week in London, and sent in the following post from the field. First off, the event is oversold and is standing room only, a testament to building interest in M2M (…and perhaps the strong promotional efforts of its producer). The day consisted of roughly a dozen presentations and panels, covering a broad landscape of topics. Speakers were largely from major wireless carriers, primarily European. Below are a few key insights (…derived from a much longer list), just hours after the last session... Read more →