Smartphones, watches and a thousand home appliances. More day-to-day objects are connected every day. But the Internet of Things also runs on four wheels. Tomorrow’s cars will not be flying cars, as science fiction movies have told us, but their future lies in the Internet.

Cars will connect to one another to share information and they will also be connected to infrastructures to obtain data of interest in real time.

If the next revolution in automobiles will come from Car-to-Car (C2C) and Car-to-Infrastructure (C2I) connections, automakers will need an army of cyber-security experts to safeguard the cars of the future. If they can connect to one another, they will also be vulnerable to cyber-attacks.

So far, cyber-security does not seem to be a strong point of the intelligent cars currently on the market. For example, a 14-year-old boy managed to gain wireless access to the brain of one of these cars using a $15 (just over €13) circuit board.

He achieved this feat at a hackathon organized a few weeks ago by Delphi, a US company that makes electronic systems for vehicles.

During this hackathon, the participants —the majority of them students— demonstrated that intelligent vehicles are not immune to IT attacks. They also showed that some of these vehicles can be opened (or even started) even though they are locked.

Internet-connected cars

The cars of the future will be a clear target for cyber-criminals, as not only will they be able to cause a large number of accidents by hacking the brain of these vehicles or steal them without needing to break the windows and hotwire them; the vulnerability of these cars will allow them to steal large amounts of data and wreak havoc in cities.

C2C and C2I systems will allow vehicles to constantly share information. Sharp breaking, breakdowns, traffic jams or the duration of traffic lights will be some of the data that could circulate through short-range wireless networks or simply through the car’s Internet connection.

A cyber-attack could turn one of these intelligent cars into the gateway to any information network connected to the vehicles, from the power grid to the system used by the police or the traffic light network in a city.

The solution lies in manufacturers of intelligent cars considering security and developing systems that detect which cars have been hacked in order to isolate them from the rest of the network.

There are many suggestions, such as installing security chips like those used on credits cards, or creating new software or hardware that establishes secure connections.

The post Car to car: Internet-connected cars. Will they be the main cause of accidents in the future? appeared first on MediaCenter Panda Security.

More and more cameras are watching us from the sky. And no, they don’t belong to the police or some intelligence agency, but to your neighbors. Unmanned aerial vehicles are becoming a more common sight, and there is no shortage of people wanting to fly their small camera-equipped drones to get the perfect shot.

Despite the many good uses of these flying machines (crop inspection, rescue missions, crime fighting, etc.), drones can also pose a security threat as they are difficult to detect and neutralize.

A few days ago, the U.S. Secret Service opened an investigation after finding a small recreational quad copter in the grounds of the White House. Despite the machine was operated by a government employee and not a criminal, the incident raised a lot of concerns as it came just four months after another incident in which an intruder managed to jump over the perimeter fence of the presidential mansion.

U.S. authorities (who have been using unmanned aircrafts in military operations for years now) are increasingly worried about the fact that drones could be used by criminals or terrorists to launch attacks with explosives or chemical weapons.

At the beginning, drones were restricted from flying near other aircrafts, airports or populated areas (in Spain, for example, drones must stay at least 8 kilometers (5 miles) away from an airport). However, the proliferation of domestic drone use is raising new concerns for privacy and security. Can small drones be used for small-scale espionage?

DJI Technology Co., the Chinese maker of the device that crashed on the lawn of the White House, and one of the leading makers of consumer drones in the world, has announced it has plans to change software on its drones to prevent them from flying over Washington. Additionally, the company also plans to disable its drones from crossing national borders after police discovered a DJI drone that apparently crashed while attempting to carry drugs into the U.S.

But, are drone manufactures taking enough measures to prevent cyber-criminals from manipulating their software? According to ‘The Wall Street Journal’, cyber-security experts have warned that drone no-fly zones are relatively simple for computer programmers to deactivate. “There’s more stuff that the industry can be doing as a whole to improve the overall security,” DJI spokesman Michael Perry said.

There are actually reasons to be concerned, as shown by the appearance of the first ever backdoor malware for drones: Maldrone. Security expert Rahul Sasi has discovered and exploited a ‘backdoor’ in Parrot AR, one of the most popular drone models. A backdoor malware can infiltrate target computers, appearing to be harmless, and take control of a drone by interacting with its sensors and serial ports. Rahul Sasi has even published a video proof-of-concept to demonstrate its efficiency.

“After the connection is established, we can interact with the software as well as the drivers/sensors of the drone directly. There is an existing AR drone piloting program. Our backdoors kill the autopilot and take control,” explained Sasi.

This security expert is not the only one concerned about the existence of security holes in drones. Hackron, a cyber-security congress recently held in Santa Cruz de Tenerife (Spain), challenged participants to hack into a drone, with a 200-euro prize for the winner.

What would happen if cyber-criminals set their sights on drones? Are drone manufacturers taking precautions? Although we’ll still have to wait before we can answer these questions, it seems clear that cyber-security risks are no longer just limited to computers and smartphones. In the case of cyber-criminals, the sky is not the limit…

The post Cyber-criminals set their sights on drones appeared first on MediaCenter Panda Security.

Goodbye CD, DVD and pen drive. When you need to share a document with a work colleague or you have to take work home, you no longer need to use physical storage devices: the cloud has everything you need.

Services like Dropbox, Mega or Box have become more popular recently, gradually sending physical storage drives into oblivion.

More specifically, and according to Eurostat, 21 percent of European Union citizens used the cloud as storage space in 2014. In fact, this figure is only the average for EU countries and in some countries, like Denmark and the United Kingdom, the percentage of citizens who use the cloud to store files greatly exceeds 30 percent.

There is no doubt that the business world is largely responsible for the growing use of the cloud for storing and sharing files. More convenient than using physical devices and more economical than installing internal servers, the cloud seems to have gotten into our offices too.

The advantages of services like Dropbox are obvious. However, when using virtual storage spaces to store and share your company’s information their security measures could leave much to be desired.

A few months ago, a vulnerability was discovered in Dropbox that disclosed personal files, and at the end of 2014, 7 million passwords for this service were leaked. If the fact that confidential corporate information is one of the main targets of cyber-criminals is added to these serious security flaws, the conclusion is obvious: your company’s files are not completely secure in the cloud.

However, your company does not need to steer clear of these services from fear that a cyber-criminal will steal its document, but you will have to take certain precautions before using them. The key is in passwords, file encryption, two-step verification and the best enterprise antivirus solution.

In this case, Panda Cloud Fusion can protect, manage and provide remote support for all the devices in your company’s network anytime and anywhere.

Firstly, it is essential to follow the tips on how to create strong passwords, like any other service. You know: letters, numbers, uppercase, lowercase, a symbol or two and if possible, never use the same password as the one you use for your email, Facebook and other services.

As regards file encryption, some virtual storage services store our documents encrypted. Although Dropbox does not, Mega, the cloud platform of the controversial Kim Dotcom, does encrypt your files. However, nothing is perfect. Mega stores on its servers a copy of the key for decrypting your files, so it is not 100% secure either. One of the best options is for you to encrypt your files before uploading them to the cloud using one of the services that allows you to do this.

Finally, some of these services (like Dropbox or Google Drive) allow you to enable two-step verification of your account. This system combines the password that you choose with a password that the service sends to one of your devices (almost always to your phone in a text message or an app). This adds a second layer of security that makes it difficult for someone to access your account.

The cloud is convenient, yes, but you have to pay attention to security.

The post How to secure the files your company stores in the cloud appeared first on MediaCenter Panda Security.

We are used to hearing about cyber-attacks and the massive damage they cause to those affected. You do not need to go too far back to find some examples, such as the leaking of the photographs of celebrities in a compromising situation last summer or more recently, the mass attack on Sony that leaked several unreleased movies.

The attacks against the integrity and reputation of the production company and celebrities are serious, but we do not often see that the consequences of these crimes result in tangible material damage. Although various cases have been recorded, they have not gone beyond the borders of their countries because they do not have the same public nature as Sony and the Hollywood stars.

While we carefully followed the latest events in the Sony case this Christmas, another event took place in Germany. Just before the holidays, the German government published a report that detailed how a group of cyber-criminals had attacked a steel mill in the country.

The cyber-criminals manipulated the facility’s control systems. When one of the blast furnaces exploded, the detection and extinguishing equipment failed, resulting in massive damage (which is not specified in the document).

The case of Germany is not the first case of a computer attack that resulted in physical damage. Another earlier example is that of Stuxnet, a spy malware that reconfigures industrial systems. It was used by the United States and Israel against Iran at the end of 2007 and the beginning of 2008. They used it to sabotage the centrifuges at a uranium-enrichment plant.

The malware was not discovered until a couple of years later, in 2010. Since then, experts have been warning that something similar could happen again, and perhaps with worse consequences.

Major vulnerabilities have been detected in the equipment and systems that manage not only corporate and industrial facilities but also those that control the power supply of a town,  water treatment plants and even hospitals and government offices.

However, there is some doubt about the veracity of the attack on the German steel mill. The report that attests it, compiled by Germany’s Federal Office for Security Information, says that the cyber-criminals accessed the steel mill’s network and from there, they took control of production and the equipment.

According to the report, the event could have been triggered in two ways: either through an email message carrying hidden malware or a downloaded file that allowed the malware to install itself on a computer. Once it had reached one computer, it was able to spread across the company’s network.

The German office’s report does not refer to the name of the company, when the first attack took place, how long it took for the explosion to occur or if the fire was actually part of the cyber-criminals’ plan. Although the last question shows that, intentionally or not, cyber-criminals can cause significant physical damage.

The experts who reported the findings say that the probability of this type of cyber-attack happening again is increasing and, therefore, measures should be taken to prevent them.

One of them is to separate management and administration networks from those that control production and machinery. In this way, cyber-criminals will not be able to reach the latter via the Internet.

They also warn that a system is only isolated when it is not connected to a computer with an Internet connection. Many companies believe that it is enough to use a firewall as a barrier between the two areas, but it could be incorrectly configured or have security flaws that make it vulnerable.

Everything suggests that more effort should be made not to leave any weak spots. Not only is valuable corporate information at risk of being disclosed, but a cyber-attack could have physical consequences as serious as they are unpredictable.

The post When cyber-attacks cause physical damage appeared first on MediaCenter Panda Security.

There’s a city in a secret place in the state of New Jersey where the public services are always a mess. Power cuts, water supply problems and even Internet outages. Then add to that banks, stores, hospitals, schools and public transport that can’t operate normally on a daily basis because their security is continually compromised. In this city however no human being has to suffer any of the consequences. Nobody lives there: the city is just 1.8m wide by 2.4 m long.

CiberCity is a model city created by the Sans Institute, an organization that brings together over 165,000 IT security professionals. Its aim is to show the US army how to hack every corner of a modern city. It’s a 1:87 scale training camp designed to ensure the military is properly prepared for a cyber-war.

Ed Skoudis is the director and instructor of this unusual project aimed at teaching the latest cyber-security techniques. “A lot of computer security over last 10 years has really focused on computers themselves and the data on them… or it’s focused on spying and espionage”. Now there are other types of attacks. “But the threat is changing. It’s still that, but adding to that, it’s now people hacking into computers to cause real-world physical damage“, explains this expert in IT security.

If CiberCity existed in real life, it would have 15,000 inhabitants. It’s a city that has all the typical amenities and features of a real town: garden plants, swings in the parks, urban traffic, bars with WiFi and even a chemical plant have all been recreated in this mini city.

Five cameras monitor CiberCity so students have a live stream of everything happening there, and can carry out remote cyber-attacks, thereby learning how to attack and defend a city by hacking its security systems.

In one of the training missions, these security experts assume the role of hackers to cause a complete blackout of the city then reconfigure the power company’s computers so utility workers can’t access them. A city can’t live without power, so the challenge is how to get the system up and running again.

Another scenario asks students to work out how to simultaneously turn all traffic lights in the city to red, to prevent terrorists from escaping from the city. Derailing a train hurtling towards the town and laden with radiological weapons; reprograming a rocket launcher aimed at a hospital and hacking a water treatment plant so that clean water appears to be dirty are just some of the entertaining challenges that students will have to tackle.

According to Skoudis, the fact that the model is so realistic makes the project more meaningful to military leaders than if the missions were simply in virtual environments. “They want to see physical things. They want to see the battle space, and what’s happening there”.

Some 70% of Americans say they fear cyber-attacks from other countries, and would no doubt approve of their military acquiring such advanced system hacking skills in order to be better prepared to defend them. And it’s a fair bet that the students enjoy themselves too. Who wouldn’t with such a realistic Lego set?

The post The most cyber-attacked city is a model town appeared first on MediaCenter Panda Security.