HP And 3M Team Come Up With Solution To 'Visually Hacking'

Computer giant HP is adding privacy screens from 3M's own laptops, so as to avoid "visual hacking."As more and more PCs are used in public places, is visually hacking, collecting confidential information by looking at the screen of another, a high security risk," said HP CEO Alex Cho.

According to Herve Gindre 3M is visually hacking a growing problem. In addition to being a study sponsored by 3M (pdf) noted that early this year and was published which showed that almost 90% of attempts to steal sensitive corporate data by only 'visual aids' is successful. To prevent this, 3M created a privacy screen that the limited viewing angles, so that others can not observe.

The company has also developed filtering software that acts as a rear and uses face detection and webcam. Once someone is watching over the shoulder, the software saves alarm. The software can also obscure the image when the user sits at his computer. Shoulder Surfing, as the watch is also called, is already a very old phenomenon. In 2007, in this way the credit card information stolen from more than 11,000 Americans. In 2013, the security chief of Microsoft even called shoulder surfing a greater risk than counterfeit fingerprints.

HP Laser Printers Protects Against BIOS Attacks

Computer manufacturer HP has three new laser printers announced which security (pdf) that enable attacks to be prevented in the BIOS of the printer. The BIOS (Basic Input / Output System) is a set of basic instructions for communication between the operating system and printer hardware.

It is essential for the operation of the printer, and also the first major software that is loaded. Attacks on the BIOS are difficult to detect and may give attackers longer period of time access to a device. Printers run while also risk of being attacked. Many corporate networks are printers on the network accessible. The security of the network printer is often forgotten, so that the devices can serve as input for attackers.

To protect printers, HP has therefore implemented various security measures. This involves HP Sure Start, a measure that can recognize malicious BIOS attacks and recover. This protection was already present in the Elite line of HP computers, but has now also been added to the printers. Furthermore, it is whitelisting used only known allowable firmware to install the printer and there is "Run-time Intrusion Detection" which monitors the printer memory for malicious attacks.

The three new security measures are standard in the Enterprise LaserJet printers and OfficeJet printers with HP Enterprise X Page Wide Technology. In addition to the features through a firmware update on several HP LaserJet Enterprise printers installed that are available since April. Furthermore, whitelisting and Run-time Intrusion Detection are added to HP LaserJet and OfficeJet printers Enterprise Enterprise X printers since 2011. For this, an HP FutureSmart service pack update must be installed.

HP Will Stop Sponsoring Pwn2Own Mobile Because Of Wassenaar

Computer manufacturer HP has decided the Mobile Pwn2Own competition in Japan not to sponsor this year. If reason be called the export restrictions of the Wassenaar agreement. Mobile Pwn2Own is an annual event which is part of the PacSecWest Conference in Japan.

The event is organized by the Zero Day Initiative (ZDI) of HP and has different categories where researchers feel the test the safety of popular smartphones and tablets. Compromising a mobile phone via Bluetooth, WiFi, USB or Near Field Communication (NFC) last year yielded 75 000 dollars. A successful attack via a mobile web browser HP rewarded with $ 50,000. At the last edition of the Apple iPhone 5S were Samsung Galaxy S5, LG Nexus 5 and Amazon Fire Phone hacked.The vulnerabilities that were used for this purpose had to give researchers at HP. The computer giant then informs the relevant supplier. Only when the problem is patched researchers may share the details of their vulnerability.

Wassenaar agreement

This year, HP will not sponsor the event and organize, let Dragos Ruiu know via Twitter. Ruiu, the organizer of the PacSecWest Conference. The reason is called the Wassenaar agreement. The Wassenaar agreement sets rules on goods, software and information that countries are allowed to export such technologies as "intrusion software" (pdf) are described.These are so-called "dual use" goods that can be used for multiple purposes. So stand surveillance systems on the list, but also weapons like landmines and nuclear materials. It is a voluntary agreement and it is up to countries how they apply the agreement within their own legislation. The way the US government will be implementing the rules could have far-reaching consequences, as warned Google and Microsoft before.

As a solution, said Ruiu which vulnerabilities are found given to Japanese delegates during Pwn2Own Mobile. In this way, the bugs do not need to go back to the United States. Thus Ruiu think to the export restriction bypass. Besides Pwn2Own Mobile will also find the annual Pwn2Own contest in Vancouver instead, which is part of the CanSecWest conference. As far as known HP continues to sponsor this contest and organizing. The PacSecWest Conference takes place on 11 and 12 November in Tokyo.

Research: Smart Watches Full Privacy And Vulnerabilities

Smart Watches are full privacy and security holes, so that information users may end up with all kinds of parties and the devices are vulnerable to various types of attacks. That set of HP researcher who examined ten popular smart watches ( pdf ).

The researchers ran during the investigation against all kinds of problems. For example, information collected often sent to multiple destinations at the watch, including third parties. The information also appears to intercept simple. Something that was possible in nine of the ten models. Furthermore, the firmware of seven aircraft is sent unencrypted. The impact of this problem is limited because many watches only allow signed firmware updates. Five watches offer also no way to activate a screen lock.

HP has not disclosed to the watch models and manufacturers involved. The computer giant advises consumers not to use smart watches for opening of housing and cars, unless there is strong authorization is offered. In addition, consumers should always set strong passwords and make maximum use of two-factor authentication. Finally have no requests from unknown devices and applications are permitted who want to link the smart watch.

HP Reveals Details Of An Patches IE Flaw

Researchers at HP have unveiled a vulnerability in Internet Explorer for which no security update is available, and Microsoft has indicated that there is no patch will appear. In February this year, the HP researchers received an amount of $ 125,000 from Microsoft for the discovery of a new attack technique and developing a solution.

By using the technique, it was possible to circumvent the security ASLR-IE in the most recent version. ASLR is a measure to abuse vulnerabilities more difficult to make, the researchers decided in February not to reveal the details of the attack, because Microsoft had not yet resolved all the bugs. "We wanted to give them a little more time and assumed that was a solution to any problems reported in the making. Unfortunately, Microsoft did the team finally know that a comprehensive solution would not come," says Dustin Childs HP.

According to Microsoft, the problem would not exist in the default configuration of IP. Something the researchers disagree.They decided therefore to demonstration code to publish the attack, so users can see the problem yourself and determine what measures they should take for their own installations. "We think it's important that everyone knows about this threat, so they can better understand the risk to their network," Childs says. Besides the demonstration code and a YouTube video showing the attack, there is also a white paper (PDF) about the attack and underlying problems put online.

BitTorrent Sync Resolves Wing Btsync Link

The creators of BitTorrent Sync, a program that allows users to set up their own private cloud, a patched vulnerability could allow an attacker through malicious attacks could btsync links users. The software contained a vulnerability that was created in the processing of btsync-links. By enticing a user to lure a malicious page or open a malicious file could allow an attacker to execute arbitrary code with the privileges of the logged in user.

The vulnerability was discovered by security researcher Andrea Micalizzi, who reported it to the Zero Day Initiative (ZDI). This rewards program from HP TippingPoint researchers pay for bug reports. HP then warned on November 6 last year, BitTorrent.Which version is the vulnerability is not reported present, except that an update has been released that fixes the problem, according to the advisory from ZDI.

BitTorrent Sync allows users to set up a personal cloud, which can be synchronized across multiple devices and platforms of the user files. Thus, it is possible, for example on a smart phone, laptop and desktop to synchronize files. Once one of the devices, a new file it will automatically appear on the other devices are synchronized, which the program uses P2P technology.

Microsoft Will Pay Researchers $ 125,000 For IE Attack

Microsoft has three researchers from HP with $ 125,000 reward for demonstrating an attack on Internet Explorer with two security features of the browser were bypassed. The two functions are precisely designed to protect the memory against attacks and were last June and July through security updates to IE added.

Microsoft has a reward program whereby it rewards researchers for developing attacks. It's not about specific vulnerabilities here, but methods to circumvent security features and technologies. The researchers reported the problem more than 120 days ago by Microsoft, which eventually confirmed the effect of the attack. The software giant awarded the researchers $ 100,000 for their reporting, plus $ 25,000 for the proposed solution.

However, HP has a deadline of 120 days after it has informed the supplier, where the details of discovered vulnerabilities are published after this period. In this case, however, decided to reveal the details yet, as Microsoft has not solved the problem.The money the researchers received they gave to charity, as did HP today announced .