The WiKID Blog

Viewing posts tagged Wireless, cellular, mobile devices

garage-door-authentication-they-cannot-steal-what

Posted by: admin 15 years, 11 months ago

The Washington Post has an article about garage door openers not working around Quantico due to a denial of service attack by the Marines and consumers wanting to get money from the Marines.

new-software-tokens-for-windows-smartphone-and

Posted by: admin 15 years, 11 months ago

Just a quick announcement about our new software token clients for Windows Smartphone and Windows Mobile 6 Professional. Please give them a test!

on-the-security-of-software-tokens-for-two-factor

Posted by: admin 15 years, 11 months ago

Securology has a post about RSA's software tokens. In it, two key issues with are raised, one is specific to tokens that use symmetric encryption such as the RSA software tokens:

Distributing the seed record requires a confidential channel to ensure that it is not perfectly duplicated in transit. Distributing seed records to many of the supported platforms of soft token vendors involves plaintext transmission, such as sending the seed record as an email attachment to a Blackberry client. An administrator may provision the seed record encrypted using an initial passphrase that is distributed out-of-band, but it is common practice for seed records and initial passphrases to be distributed side-by-side. Whereas a physical token can only be in one place at a time, a soft token could be perfectly duplicated by an eavesdropper, even complete with its initial passphrase (especially when it isn't distributed out of band). If Alice receives her soft token and changes its passphrase, Eve could keep her perfect copy with the intial passphrase or choose to change the passphrase-- either way, the back end of the one-time-password authentication system will receive a valid token code (time value encrypted with the seed record).

Note that this is not an issue with WiKID's software tokens as we use public key encryption. The private key remains on the device and only the public key is transmitted. It is the out-of-band method of verifying the user's registration code that matters for WiKID. This could be done over the phone or via an application which uses some existing trusted information or credentials. (We protect against a man-in-the-middle attack in this process by hashing the registration code with the WiKID server's public key before presenting it to the user. Thus, if someone is trying to impersonate the server, the registration with the real server will fail.)

the-problems-at-palm-and-some-suggestions

Posted by: admin 15 years, 11 months ago

BusinessWeek points out the struggles at Palm, how their operating system is 5 years old, the last Treo was released in 2003 and they've canceled the Foleo. They announced a new Treo for Europe, which looks interesting.

trusted-computing-for-mobile-devices

Posted by: admin 15 years, 11 months ago

There is a new specification for mobile phone security called the Mobile Security Specification. It is essentially trusted computing for cell phones.

The specification has been years in development, said Janne Uusilehto, head of Nokia product security and the chairman of the working group developing this technology. "It is a big deal. This is the first time that we have created such common security specifications for all handheld devices," Uusilehto said.

More:

When these devices appear, they will make things more difficult for data thieves and mobile virus writers. Down the line, the technology could be used to build electronic wallets into mobile phones. In general terms, the specification calls on hardware vendors to store protected information in a secure area of the phones. Similar to the Trusted Platform Module used in PCs, this technology could be used to ensure that the phone's operating system, applications and data have not been tampered with.

All the usual trusted computing warnings apply here, but perhaps more so as cell carriers maintain a 'walled garden' and can limit the devices available. They are also essentially 'tri-opolies'. It seems likely that you will be able to buy a computer without TCP in the future. You might not be able to buy a cell phone without it (that works on a carrier).

• Page 1 of 2
• ←
• 1
• 2
• →