Category: Motor Industry

Car virus rumours crushed

Posted on by admini

Antivirus experts have concluded that mobile phone viruses are unable to infect cars.

Technicians at F-Secure announced on Monday they had quashed rumours that mobile phone viruses could spread to cars via Bluetooth, after failing to infect the onboard computer of a Toyota Prius with the mobile phone virus Cabir. This test comes after Russian antivirus company Kaspersky revealed in January that it had been contacted by someone looking to remove a virus from a car’s computer.

“It came as no surprise that we could not infect the car, but the Prius performed in the test even better than expected,” wrote F-Secure technician Jarno on the company’s blog. “No matter what we did the car did not react to the Bluetooth traffic at all. Cabir tried to send itself to the car and the car just did not allow the transfer to happen.”

The Toyota Prius, which has the same onboard computer as the Lexus cars reported in the initial rumours, supports Bluetooth so that phone book contacts can be transferred from a mobile phone to the car’s built-in phone.

The technicians took the car 42 metres below sea level and used a Cabir-infected phone to try and infect it. However, they were given a shock when the dashboard warning lights suddenly activated and all other functions in the car went dead. The onboard computer displayed the message: “The transmission lock mechanism is abnormal. Park your car on a flat surface, and fully apply the hand brake.”

“Thoughts of massive product recalls started to float in our minds,” said F-Secure. “So we started from scratch and double checked everything. Going through the standard process of elimination by switching all Bluetooth devices off and waiting for some time, the problem repeated itself.” After three attempts with the same result, the technicians found that the battery was running low. “The car computer was going haywire because of that, and the problem had nothing to do with Bluetooth! But those were quite tense moments indeed — we almost thought that the impossible might have happened.”

http://news.zdnet.co.uk/0,39020330,39197786,00.htm

Read more

Gates Pushes Auto Industry on Technology

Posted on by admini

Eventually, Gates said, there could be a car that wouldn’t let itself crash. “That absolutely should be the goal,” Gates told several hundred participants of the Microsoft Global Automotive Summit at the automaker’s suburban Detroit campus.

“The embrace of technology will be the key for the leaders of the industry.”

Also on Friday, Microsoft unveiled its Performance Peak Initiative – a line of computer systems to help the auto industry better coordinate supply chains, streamline design, production and sales and fill vehicles with computer gadgets.

The company said its technology is currently in 25 vehicle devices from 13 automotive companies.

Microsoft also owns MSN Autos, a vehicle information and buying network.

http://apnews1.iwon.com//article/20050430/D89PED0G0.html

Read more

How vulnerable is the ‘Net?

Posted on by admini

“It was an attempt to make a massive problem,” says KC Claffy, principal investigator at CAIDA. “They certainly made a blip on a graph.” But the Internet and its users got off easy. The barrage lasted only an hour, and no end users were affected. The attack did, however, serve as a wake-up call, as network operators and others have taken steps to better secure the Internet since then.

But some still question whether the Internet is susceptible to attack and needs more authoritative oversight. “If somebody was to do a real concerted, knowledgeable attack, it wouldn’t be very difficult to have a catastrophic impact on a huge component of commerce,” says Larry Jarvis, vice president of network engineering at Fidelity Investments. “It would be huge to the U.S. economy and to a lot of companies that now view the Internet as the equivalent to a dedicated circuit to all these entities.”

Clif Triplett, global technology information officer at General Motors, says he is worried mostly about router and host software bugs, as well as broadcast storms such as distributed DoS (DoS) attacks bringing down the ‘Net. “I’m highly concerned about it,” Triplett says. “If that network is a core piece of your business, I think you’re at a risk.”

Two-thirds of the 1,300 “technology leaders, scholars and analysts” surveyed recently by the Pew Internet & American Life Project said they “expect a major attack on the Internet or the U.S. power grid within the next 10 years.”

The 13 DNS root servers resolve Internet naming and addressing. If they were knocked out, Internet sites would become inaccessible. The servers repel distributed DoS attacks every day, operators say.

CAIDA research shows that up to 85% of the queries against the DNS servers are “bogus” or repeated from the same host.

The system has been bolstered since the 2002 attack, with root servers now consisting of 50 to 100 physically distributed, highly redundant boxes in 80 locations across 34 countries. In 2002, far fewer servers were located in 13 sites across four countries. This level of distribution and redundancy makes a complete shutdown of the DNS system unlikely, says Paul Mockapetris, chairman and chief scientist of IP address management vendor Nominum and the inventor of DNS.

The physical servers use Anycast, a routing technique that heightens resiliency by multiplying the number of servers with the same IP address and balancing the load across an army of geographically dispersed systems.

“If I was going to try and arrange a DNS 9/11, it’s a very bad target to try and attack because it’s so distributed – you’d have to take [the servers] out everywhere,” Mockapetris says. “If you took out one root server today, nobody would notice.”

But the more distributed a system is, the more difficult it is to defend, notes Stephen Cobb, an independent security consultant who was recently quoted in a Network World column stating a belief that the ‘Net can be brought down and kept down for 10 days or more.

“The reason it hasn’t gone down for days so far is that the people who know how to do it aren’t so inclined.” However, the good guys are inclined to implement security best practices, like those outlined in an IETF informational document on root server operation called RFC 2870, says Jose Nazario, security researcher and senior software engineer at Arbor Networks, which makes products carriers use to protect their networks from cyberattacks. Originally drafted in 2000, RFC 2870 has been extended over the past couple of years.

Cisco, the leading provider of Internet routers, regularly issues bug alerts. And BGP, which distributes routing information between networks on the Internet, is susceptible to IP address spoofing. “BGP peering has some security problems,” says Sam Hartman, area director for the IETF’s Security Area working group.

http://www.nwfusion.com/news/2005/041805-internet-security.html

Read more

Can a Virus Hitch a Ride in Your Car?

Posted on by admini

Could you find yourself at the wheel of two tons of rolling steel that has malevolent code coursing through its electronic veins? That frightening prospect has had Internet message boards buzzing this year, amid rumors that a virus had infected Lexus cars and S.U.V.’s.

The virus supposedly entered the cars over the Bluetooth wireless link that lets drivers use their cellphones to carry on hands-free conversations through the cars’ microphones and speakers. A handful of real if fairly benign cellphone viruses have already been observed, in antivirus industry parlance, “in the wild.” Still, a virus in a cellphone might muck up an address book or, at worst, quietly dial Vanuatu during peak hours.

But malicious code in cars, which rely on computers for functions as benign as seat adjustment and as crucial as antiskid systems that seize control of the brakes and throttle to prevent a crash, could do far more harm.

The Lexus tale, based on murky reporting and a speculative statement by Kaspersky Labs, a Moscow antivirus company, seems to have been unfounded. “Lexus and its parent companies, Toyota Motor Sales USA Inc. and Toyota Motor Corporation in Japan, have investigated this rumor,” the carmaker said in a statement last month, “and have determined it to be without foundation.”

But the question lingers: Could a car be infected by a virus passed along from, say, your cellphone or hand-held computer?

“Right now this is a lot of hype rather than reality, the idea that cars could be turning against us,” said Thilo Koslowski, a vice president and lead analyst for auto-based information and communication technologies at Gartner G2, a technology research firm.

First, vehicles are increasingly controlled by electronics – to the point that even the simple mechanical link between the gas pedal and engine throttle is giving way to “drive by wire” systems.

Second, more data is being exchanged with outside sources, including cellphones and real-time traffic reports.

Finally, the interlinking of car electronics opens up the possibility that automotive worms could burrow into a memory storage area in ways that engineers never imagined.

Less obvious are the advantages of having the components communicate: an antiskid system, designed to help keep a car from spinning out of control, links sensors in the steering, brakes and throttle, and can effectively seize control from the driver.

http://www.techweb.com/wire/security/159400873

Read more

Joint venture to exploit Rolls-Royce security IP

Posted on by admini

Loughborough-based electronics manufacturer Datalink Electronics is setting a joint venture with Rolls-Royce and private investors to develop an signature verification device.

Sign Assured is being set up to develop, manufacture and market the signature verification device using intellectual property from Rolls-Royce and Datalink’s research, development and manufacturing resources. Datalink has a 25 per cent stake in Sign Assured alongside Rolls-Royce and private investors Charlie Ding and Professor David Auckland, both from Manchester University and Tony Endfield, managing director of housewares company Rayware.

Signature verification could be used is systems for employees to clock on and off as it removes the ability of a colleague to clock someone else in. Building security is another area of application and financial institutions may use the system when dealing with internal transfers.

The technology could eventually be used to supplement chip and PIN security for credit and debit cards.

Eric Luckwell, managing director of Datalink and director of Sign Assured, said, This is an exciting development for Datalink as it sees us potentially having our own product range. Growing competition in the global manufacturing services market makes this diversification necessary. Professor Auckland and Charlie Ding will be chairman and managing director of Sign Assured respectively.

The device arose from technology developed by Rolls-Royce to measure acoustic emissions from aircraft engines. When people sign their names they write with different amounts of pressure and speed, resulting in an acoustic signature that is as distinctive as a traditional signature but much more difficult to replicate. The new device will listen to how people sign their name and store this information in a database. Current verification systems are image-based, with inherent higher costs.

Paul Harris, corporate development manager at Rolls-Royce, said “The technology has already undergone extensive testing and development”.

http://www.eetimes.com/showArticle.jhtml?articleID=59300908

Read more

Security Sells

Posted on by admini

Translation: They advertise security or otherwise make it part of the message they present to customers and business partners.

Look closely, though, and you’ll find that these companies share a common goal: to create a sense of trust for their customers—while being careful not to overpromise.

In February 2003, Derek Bond, a 72-year-old retiree from Bristol, England, spent three weeks sleeping on the concrete floor of a South African jail after his name and passport number showed up on an FBI wanted list as he arrived in the country for a vacation. In vain, he protested that not only was he ignorant of any supposed crimes he’d committed in America, but he’d never even been to the country. Release didn’t come until the publicity surrounding his fate prompted an informant to point the FBI to the “Derek Bond” whom they did want to talk to—comfortably holed up in Las Vegas, after purloining the identity of the real Mr. Bond some 14 years before.

Bond’s misfortune illustrates—to the extreme—the menace of identity theft. Armed with just a few pieces of information—information readily available from trash or stolen documents—identity thieves can take advantage of lax security at financial institutions to enrich themselves.

Not if Citigroup can help it, says Ronni Burns, director of business practices for Citi Cards, the group’s credit card arm. In 1991, she says, Citi was among the first card issuers to offer its customers early warning of fraud, by programming computers to spot suspicious transactions. And in 1992, Citi followed this by being the first major card issuer to include customers’ photographs on cards. Most recently, Citi has bolstered its identity-theft prevention offerings with a personalized solution that involves trained counselors providing support to victims. In the event that a customer’s identity is stolen, explains Burns, a single Citi representative is assigned to the case to help customers identify the fraudulent transactions, fill in the various police forms, notify credit bureaus and generally get their lives back on track.

Microsoft Aims for Trustworthiness Curiously, one of the biggest developments in Microsoft’s history—and certainly one that is intended to have an enormous impact on its customers—isn’t being marketed yet. Or at least not in the direct manner that Citigroup is using.

While Microsoft does actively promote some security-related products (including through advertisements in CSO), “Trustworthy Computing,” as the company christens it, deliberately isn’t mentioned in the company’s advertising. “There is no advertising around Trustworthy Computing at all,” insists Microsoft spokeswoman Nicole Miller. The company does, of course, provide a website that explains the initiative, and a quick Google search will turn up plenty of Microsoft quotes discussing the initiative in the media.

But Trustworthy Computing itself is still a long way from victory. In fact, says Chief Security Strategist Scott Charney, who describes the initiative as “very much a work in progress,” Microsoft has had to apply strong-arm tactics to software vendors who have built Microsoft technologies into their products: They are not to make claims that aren’t yet matched by the reality that Gates wants to see.

OnStar Sells Peace of Mind If you’re going to set up in business as a guardian angel, you’d better be a guardian angel that people trust. When you’re lost, for example, two critical pieces of information are (1) where you are and (2) the directions for getting back on course. Minutes can be lost while the emergency services try to locate you—which in the event of a serious accident can literally make the difference between life and death.

“Key to the promise of the brand is that a real, live person will share your problem and help resolve it,” says Andrew Young, director of marketing at Detroit-based OnStar, who’s been with the business since its inception in 1996. “They’ll make connections, find information and help you. The help depends on the nature of the problem. OnStar is careful to avoid overpromising, says Young, and tries hard to make sure that subscribers understand the limitations of the service. “We’ve tried to be very honest in how we market the service and build the brand,” he says.

For the past two years, OnStar has been running a radio advertisement campaign featuring the voices of real callers.

http://www.csoonline.com/read/120104/sells.html

Read more