Your Screen can be Seen from Far Away

Like the 2nd floor of a mall.

What about using using a real camera, instead of a phone?

And know how, while typing, the letters get larger?

The Attack

HD video camera > zoom > record > play it back slowly > get password

The Defence

Back to the wall when entering passwords, and look up first, everyone forgets to look up.

 

 

Medical Offices – Password Protect all Computers

A scenario illustrating why.

Patient is shown to a private room.

They are instructed to change, then left alone to do so.

The desk is bumped, the mouse moves, and the screen comes to life.

It’s displaying the doctor’s daily schedule.

1 – Patient Name – Age – Reason (!) – Note – Other Doctors – Insurance   

There’s 30 listings like this.

2 – the yellow is a name highlighted, which displays the below information:

3 – Patient phone number

Another example screen.

4 – Billing screen

That’s a lot of time alone,
with a lot of personal information

Medical offices – protect your patient’s privacy, and put a password on all computers. Ideally it’s 15 characters strong, uses numbers, characters and letters, and is changed regularly.

(How to edit a sensitive photo)

 

 

Be Cautious Using Hotel Lobby WiFi

Wanting to make it easy for guests, a hotel lobby WiFi network is usually left open and unsecured, no password required.

Avoid submitting passwords and credit card numbers
while using this network.

A lobby is a target rich environment – the people using hotel WiFi are often booking travel plans, making reservations, using their credit card. Plus, it’s easy to blend into a lobby, and not look out of place sitting for a long time with a laptop.

 

 

This Robot is Brute-Forcing an iPhone

The robot will try all possible 4-digit passwords on an iPhone.

Seen at Black Hat 2013.

Best Use I Can See

It’s not elegant, but it would work. Grab a phone off the street, return to a secure location, put it under the robot, wait.

You’d need a location though, and time. And it’d be a targeted attack; you’d be after the information on the phone, not the phone itself. Otherwise, just wipe it.

Defences

– turn OFF simple passcode. Then you can have a longer passcode, with alphanumeric characters
– turn ON “after 10 failed password attempts this iPhone will wipe itself”
don’t use any of these – Most Common iPhone Passwords
– hang onto your phone tight, but not like this this

Sorry, that’s all I know; saw it en route to the car hacking talk.

So if this robot belongs to you, email me and I’ll link you up, and any explanation you’d like to add.

 

 

Let’s Go WarDriving

WarDriving – the act of searching for Wi-Fi networks from a moving vehicle, driven by someone interested in mapping the locations of Wireless Access Points (WAPs)

Lists are totalled: how many WiFis are locked, unlocked? What’s yours?

Favourite line:

Contrary to its name, wardriving is a relaxed style of driving … when you get down to it, wardriving is actually pretty boring. But the information it yields is not.

They used my collage! Love when that happens.

That’s 3 now (Stick Families are a Terrible Idea, and More Decorum, Please).

Read all my columns here. I started August 2012.

I have great news – as of today, my columns are now published on Autonet.ca! Until now, they printed and that was it, gone.

As a professional documenter, oh the anxiety that created.

***

Back to ‘Keri on Driving’ – Index