Robert Lemos

How China and Others Are Altering Web Traffic

Google leveled new charges against China this week, claiming that the country has interfered with some citizens' access to the Internet giant's Gmail service, disguising the interference as technical glitches.

Security experts say that China is most likely using invisible intermediary servers, or "transparent proxies," to intercept and relay network messages while rapidly modifying the contents of those communications. This makes it possible to block e-mail messages while making it appear as if Gmail is malfunctioning.

Technology Review

Securing All Androids Proves Tricky

With Android, each mobile phone company has its own build of the Android operating system so that it can include its own user interface, graphics, and branding. Although Google released an updated version of Android that fixed the vulnerability soon after it was discovered, at least 42 percent of phones run an older version that is still vulnerable, according to data available on the Android developer site.

Technology Review

A Way to Attack Nuclear Plants

For the last few months, a sophisticated computer worm has wriggled its way between some of the most critical control systems in the world.

The timing of the worm's release, combined with several clues buried in its code, has led some experts to speculate that the worm, dubbed Stuxnet, was originally designed to sabotage an Iranian nuclear facility, possible the enrichment plant in Natanz, roughly 180 miles south of Tehran. This week, officials in Iran confirmed that Stuxnet had been found on systems inside the plant, although they denied that it had caused any harm.

But Stuxnet has since spread to hundreds more industrial systems within Iran and around the world. Experts say this highlights a worrisome weak spot in critical infrastructure that could become a new focus for saboteurs and malicious hackers.

Technology Review

Mobile Flaw Could Cloak Clicks

It's possible to craft a malicious website so that a user's clicks are secretly redirected to a legitimate site in a way that steals a user's passwords and other data. Many Web developers have added protections to block the tactic on standard Web sites, but Stanford University researchers warn that there are not nearly enough defenses against the technique on mobile websites, which are accessed from devices such as the iPhone.

As a result, a smart-phone user could think he's tapping to check a baseball score but is actually tapping on a button in a hidden page to confirm a money transfer.

Technology Review

Wireless Car Sensors Vulnerable to Hackers

Hackers could "hijack" the wireless pressure sensors built into many cars' tires, researchers have found. Criminals might then track a vehicle or force its electronic control system to malfunction, the University of South Carolina and Rutgers University researchers say.

The team, which successfully hijacked two popular tire-pressure-monitoring systems (TPMS), will describe the work at the USENIX Security conference in Washington, DC, this week.

Technology Review

Your Apps Could Be Leaking Private Info

A study of iPhone and Android apps has revealed that many of these programs secretly collect and transmit users' personal information.

The App Genome Project, launched by the mobile security company Lookout, analyzed every app available through Apple's App Store and Google's Android Market. Developers must disclose an app's functionality when they submit an app to either store. Apple performs its own review before making an app downloadable.

Technology Review

Your Groups Tell Hackers Who You Are

People often get categorized by social group--jock, geek, soccer mom. The same is true for our online identities: If you have an account on Facebook or LinkedIn, you might also belong to several groups on each site.

Now researchers at the Vienna Institute of Technology, Institut Eurecom and UC Santa Barbara have found a way that malicious websites could find out what groups you belong to, and use that information to identify you. Such websites could use the trick for identity theft or to craft personalized scams.

Technology Review

Marketwatch: Threats Create Opportunities

A decade ago, a company looking to secure its computer systems would have purchased antivirus software, a firewall, and perhaps an intrusion detection system. Today, the growing variety of attacks has given rise to nearly 70 different security niches, including markets for firewalls that specifically protect Web-based applications and for systems that prevent data loss across an enterprise. Meanwhile, each submarket is getting increasingly complex. In 2009 one of the biggest security companies, Symantec, generated 2.9 million separate signatures, or digital patterns associated with malicious software--an increase of 71 percent over the previous year.

Technology Review Magazine

Over the Horizon: Bulletproofing Cryptography

Much of today's data security rests on encryption techniques involving mathematical functions that are easy to perform but hard to reverse, such as multiplying two large prime numbers. Factoring the result without knowing either of the prime numbers is very difficult, at least for the computers we use today; it could take thousands of years for even the most powerful supercomputer to identify the original numbers and crack an encrypted message.

The task would be a snap for a quantum computer, however.

Technology Review Magazine

Open-Source Could Mean an Open Door for Hackers

The ability to access the code of open-source applications may give attackers an edge in developing exploits for the software, according to a paper analyzing two years' worth of attack data.

The paper, to be presented this week at the Workshop on the Economics of Information Security, correlated 400 million alerts from intrusion detection systems with known attributes of the targeted software and vulnerabilities. The data supports the assertion that flaws in open-source software tend to be attacked more quickly and more often than vulnerabilities in closed-source software, says Sam Ransbotham, assistant professor at Boston College's Carroll School of Management and the author of the paper.

Technology Review