Hackers Can Use a $32 Device to Break Into Your Car and Garage Undetected - http://clapway.com/2015/08/10/hackers-can-use-a-32-device-to-break-into-your-car-and-garage-undetected123/

For most consumers, the DEF CON hacker convention is a place to hear about how vulnerable every single electronic device in your home is, but it serves a very useful purpose: it educates developers on how to code smarter. One of the latest scare stories to come from the conference was presented by a hacker named Samy Kamkar. Kamkar has developed a device that allows him to hack into any modern car or garage.

Taking a Look at the RollJam

During the hacker conference, Kamkar introduced a relatively cheap device he called the “RollJam.” It’s a $32 radio jamming device that is incredibly small, and designed to exploit the “rolling codes” that are so prevalent in the keyless entry systems of most vehicles. Worse yet, this same device can also be used to deactivate car alarms outright, making them largely useless.

How Does It Work?

The concept behind RollJam is incredibly simple. Kamkar said that a would-be hacker would simply plant the device near the target vehicle and wait. The victim would come out to the vehicle and press the key fob in an attempt to unlock it, but it will not work the first time. The second attempt will be successful, and while the victim may think it strange for a few minutes, they’ll likely continue about their day without giving it a second thought. The hacker would then return to the vehicle, replay the recorded code, and viola, they then have access to the car.

Rolling codes are a security measure that automakers have been using in an attempt to throw off “code grabbers” that hackers have been using for years. Vehicles that use rolling codes never reuse the same code twice, so each code should technically be unique, but RollJam has a clever way around this.

The first time the victim attempts to unlock the car, the RollJam jams the signal using two radios that emit noise onto the most common radio frequencies used by auto manufacturers. A third radio then intercepts the code needed to gain access to the car. In the second attempt the RollJam blocks the signal again, but signals the first code it picked up so the car will unlock for the victim. Meanwhile, the device retains the second code it picked up so it can be used again when the hacker retrieves the device. Scary, huh?

RollJam has Successfully Hacked a Wide Range of Vehicles from Manufacturers like Volkswagen, Toyota, and Cadillac

In the presentation, Kamkar has said he has already tested the device on multiple vehicles and had success with a decent amount of major auto manufacturers, and a few garage door openers. Kamkar believes that there are millions of automobiles out on the road today that are susceptible to hackers using this vulnerability, but many auto manufacturers are already working on alternatives to rolling codes.

---

 

https://www.youtube.com/watch?v=qu3Z6AbM2D0

 

Hackers Can Use a $32 Device to Break Into Your Car and Garage Undetected

Here are some reasons we shouldn"t take #hacking problems lightly and reasons #hackers might want to do the extreme things they do. - http://clapway.com/2015/08/09/how-hackers-are-killing-people-virtually245/

If you read the news enough then you might begin to think that hackers are making the real world a pretty dangerous place to live in. Whether it’s hacking vehicles or guns, it’s becoming clear that no element of technology is completely safe.

Chris Rock, founder and CEO of security firm Kustodian (and no, not that Chris Rock), has recently reported that hackers are beginning to kill people off virtually, and the victims don’t even know it until they try to apply for something that requires their ID.

The Entire Process Can be Completed Without Leaving Your Computer

In the report, Rock goes into some good technical detail on the whole process, but here is the short of it.

There is a lot of sensitive information about doctors that is easily accessible to just about anyone online. Information like their license number, address, and more can all be used to set up a doctor’s account in the Electronic Death Registration System. In the report, Rock uses California’s online license verification to set up his account.

Once someone has a doctor’s account, they can fill out both death and birth certificates. That’s right. Not only can hackers technically kill someone, they can also create someone as well. There are several resources available online that instructs users on how to properly fill out a death certificate. Rock humorously suggests people not select a cause of death that might warrant a look from the coroner.

The next step of the process involves a funeral director, but guess what? Conveniently enough, you can also spend a little time online going through a process that will allow you to become a registered funeral director. In the report, Rock demonstrates the process by creating a funeral home website and filling out Australia’s funeral director application. Moments after the application is sent off, Rock receives a confirmation email that he is now permitted to submit online death registrations. This won’t work everywhere, though. The UK doesn’t have any requirements to become a funeral director, but some states in the US require certain qualifications to be met.

Why Kill Someone Off?

Rock says there are numerous reasons a hacker might want to kill someone off, but each person is going to have their own reason for wanting it to be done. Some examples he listed were people trying to claim life insurance money, or trying to commandeer their elderly parent’s estate before they actually pass.

To “hinder” people was another reason Rock said a hacker might want to off someone. Perhaps they hold a grudge against someone and want to prevent them from traveling, or maybe they’re involved in an investigation and the hacker wants to interfere with the case by killing off a judge or detective.

Virtual Birthing

Sitting on the opposite spectrum of death is life, and Rock says creating someone virtually is even easier than killing them off. Here in the US a midwife can submit a birth registration application, and there are processes in place that allow people to register home births as well.

A virtual death would typically have instant results, but virtual life is basically committing to the long con. Most people who would want to create a fake birth certificate are typically looking to create a new identity for themselves. Whether it’s trying to erase a criminal record or debt, having a hacker create a new identity would certainly do the trick.

---

You’ll want to protect your data with Nanoform:

How Hackers Are Killing People Virtually

Hacking the Hospira Pump is Real, FDA says - http://clapway.com/2015/08/01/hacking-the-hospira-pump-is-real-fda-says456/

Catching Up With Some Small talk

Medical care has always been a serious topic and an area of concern. Many court cases arise from the lack of professional courtesy, or due to operations that were unnecessary. With that being said, we cannot argue that the advancements in the medical field are astounding and ingenious at times, especially when thinking back to a century when penicillin, a heart monitor, or even the Hospira Pump didn’t exist.

The surprise announcement about hacking the hospira pump

It is very surprising to hear that the US Department of Homeland Security issued a warning to the public, revealing that Hospira’s Symbiq medication pumps, or computerized pumps used to deliver drugs, can be hacked remotely. The concerning news was discovered by a white hat (or ethical) hacker while checking the system out. According to the Food and Drug Administration, this is the first instance it has warned health care providers and caregivers to stop using a product due to a cybersecurity risk.

Inevitable Results

But what exactly is the main concern regarding the Hospira hack? The biggest worry is that the security breach gives someone the opportunity to manipulate the system. Because the device can be potentially remotely controlled, an intruder essentially has the power to change the amount of medication a patient receives. Although, newer pumps have additional protection against these potential hacks, the FDA suggests that health care providers disconnect them and update drug libraries manually. However, this method also has its drawbacks, as it is prone to human errors. The process is also much more labor intensive and may not be entirely feasible.

---

If health is a concern, check out the review for Thin Ice weight loss apparel, which can help you lose weight quickly and effectively.

Hacking the Hospira Pump is Real, FDA says

A married hacker couple and has spent a year researching a way to #hack into #smartrifles. - http://clapway.com/2015/07/31/married-couple-plans-to-hack-smart-rifles-at-black-hat-conference123/

At this years Black Hat hacker conference, security researchers, Runa Sandvik and Michael Auger, will demonstrate how they are able to exploit the vulnerabilities of a self-targeting sniper rifle to change the scope’s variables when planning out a shot, and even bricking the rifle altogether.

Sandvik and Auger Plan to Hack a Pair of $13,000 TrackingPoint Rifles

Sandvik and Auger are a married hacker couple and have spent a year researching a way to hack into these smart rifles. The techniques allow a knowledgeable hacker to exploit its sight through Wi-Fi.

Once the rifle has been infected, a hacker can then use software to manipulate a scope’s calculations, disable the scope completely, or just prevent the gun from firing entirely. In a demonstration the couple did for WIRED, the two demonstrated how they were able to manipulate the targeting system to accurately hit a target that they chose rather than one chosen by the shooter.

“You can make it lie constantly to the user so they’ll always miss their shot,” said Sandvik.

Hackers Can Brick Smart Rifles Remotely

According to Sandvik, hackers can perform a number of different functions to disable a shooter’s weapon. An attacker can lock a user out, preventing them from using the smart rifle, or completely erase the gun’s file system. This would essentially render the scope useless, leaving the shooter to have to aim manually.

The file system in TrackingPoint’s self-aiming system is a vital part of the scope. The system allows a shooter to designate a target, which tells the computer to begin dialing in variables needed to make an accurate shot. It’s important to note that the gun will not fire until the shooter has pulled the trigger. Once the trigger is pulled, the gun will then determine when the best time to fire is and take the shot when the barrel is perfectly aligned.

TrackingPoint Are Already Working on an Upcoming Patch to Address the Exploit

Fortunately, Sandvik and Auger are working together with TrackingPoint in order to develop a software patch that will quickly address the severe vulnerability of smart rifles. While it’s not ready yet, TrackingPoint founder, John McHale, said the company would be mailing out a USB drive to customers in order to update their rifles as soon as possible.

“The shooter’s got to pull the rifle’s trigger, and the shooter is responsible for making sure it’s pointed in a safe direction. It’s my responsibility to make sure my scope is pointing where my gun is pointing,” said Hale in an interview.

The emergency of smart devices means many of these devices can be taken advantage of, but it’s good to see security researchers and developers working together to get these issues resolved as quickly as possible.

---

For more technology related news, check out Clapway Trends:

Married Couple Plans to Hack Smart Rifles at Black Hat Conference

How #Chrysler plans to protect users of its #Fiat against #CarHackers - http://clapway.com/2015/07/22/fiat-chrysler-says-it-has-a-fix-for-the-latest-car-hacking-incident-123/

On Wednesday, Fiat Chrysler stated that the company has come up with a software fix that will put a stop to future hacking involving their vehicles.

When Nightmares Become Reality

This software update put out by Fiat Chrysler is in response to the Wired article that ran earlier in the week about two well-known hackers who remotely commandeered a Jeep Cherokee and drove it into a ditch. While the owner was still inside.

In the article, the driver details how the exploit took over his vehicle while he was driving at speeds nearing 70 mph, just on the edge of downtown St. Louis. The driver, Andy Greenberg, wasn’t completely surprised by the take over, though. In fact, he came to St. Louis to specifically be the test dumb of Charlie Miller and Chris Valasek, the two hackers performing the stunt.

Miller and Valasek were able to turn on the air conditioner, take over the in-seat climate control system, manipulate the radio, and turn the windshield wipers on and off — all very small things. After a while, Miller and Valasek were able to send a video feed of the two directly through to the vehicle’s touchscreen display. That’s when they cut the transmission, rendering the accelerator useless, and began to take full control over the Jeep.

Downloading the Patch

The vehicle hacking scenario described in the article was meant to be a direct warning to the auto industry — the smarter a vehicle becomes, the more susceptible it will be to vulnerabilities.

According to the FCA, 2013 and 2014 models with 8.4-inch touchscreens are affected by the security flaw. This list includes Ram pickups, Dodge Durangos, the Jeep Grand Cherokee, the Viper, and some 2015 Chrysler 200s.

In order to download the patch you’ll need to grab the software off the FCA’s UConnect Web site. Alternatively, dealerships will also perform the install for free. Owners that could be affected will be contacted directly through mail.

Finding Peace of Mind

According to Miller, the patch he received appeared to fix the issue he and his partnered used in order to hack the vehicle. However, Miller also stated that there are plenty of other issues that could potentially lead to future hacks, one of which is the fact that automakers don’t have an ability to detect hacks currently in progress. In other words, they’re flying blind.

---

 

A theme of hacking has been in the media lately. Nanoform could be your solution. Check out our review:

Fiat Chrysler Says It Has a Fix for the Latest Car Hacking Incident

Better keep a close watch on all your accounts. - http://clapway.com/2015/07/11/leaked-emails-show-that-police-agency-was-looking-for-spyware-124/

An Italian company that sells surveillance software to law enforcement agencies and governments around the world is negotiating with a Florida police agency to provide them with spyware technology. This spyware technology, which was developed by Hacking Team, will be able to infiltrate computers, and phones. This is all according to some recently released emails. This spyware technology can monitor emails and conversations and even remotely activate cameras and microphones of cell phones and laptops, turning them into surveillance devices.

HACKING TEAM SUFFERED A DATA BREACH 6 DAYS AGO

Hacking Team was recently compromised in a data breach on July 5th, when unknown hackers posted a link to downloading more than 400 gigabytes of company data. A message that was posted to the Hacking Team’s hijacked Twitter account saying that since they have nothing to hide, they were publishing all of their files, emails and source codes.

THE HACKING TEAM WORKS WITH MANY DIFFERENT COUNTRIES

The files and emails have since been catalogued by WikiLeaks, have shown that the Hack Team was also not just in business with the United States. They were also selling their products to Bahrain, Russia, Kazakhstan, Russia, Saudi Arabia, Sudan Ethiopia and Azerbaijan.

HACKING TEAM WANTS TO GET INTO THE UNITED STATES MARKET

According to the files, this year the Hacking Team was looking to enter the large market of local police agencies within the United States. One of the most promising areas was in Florida. On April 22, an agent of one of the large major crimes task forces in Osceola and Orange counties emailed Hacking Team in regards to their products.

In less than a month, a Hacking Team employee flew from Italy to Orlando with four agents and invoiced the MBI officials for over $400,000. The Orlando law enforcement agents were concerned about laws that prevent bulk surveillance and collection from those who aren’t the targets in investigations.

MIB WAS INTERESTED, BUT CONCERNED ABOUT SEARCH WARRANTS

A major concern for the Florida law enforcement was the software of the Hacking Team’s products. They are designed to provide information about everyone that the target of the investigation communicates with. In order to comply with search warrants, the MBI would need for the Hacking Team to minimize the amount of information that would be collected.

Although this is the first documented contact between Hacking Team and Florida law enforcement, this is a reflection of Florida’s stance on aggressive surveillance technologies.

---

 

Issues keeping your home safe can be resolved. Check our the Clapway Trends:

Leaked Emails Show that Police Agency Was Looking for Spyware