Showing posts with label risk. Show all posts
Showing posts with label risk. Show all posts

Sunday, August 28, 2011

Touch Screens - Keeping them fingerprint free

Touch Screens - Keeping them fingerprint free

In my early thread about android dots locking the screen several possibilities were raised and, in particular, I happen to mention  "ii) using fingerprint tape on the touch-screen (so clean the screen regularly)"; that was mentioned in context with the theme of the discussion about avoiding your security access being breached by an unauthorised person.

After some highly active chats with people, nothing to precipitant of course, and not to put too fine a point upon it, the conversation (some of which was rather humorous) turned to prevention of *fingerprints, rather than cure of them. Various options were discussed, which had to be inexpensive:

- Wearing gloves. Ideas stretched (no pun intended) from Marigold Washing Up gloves to those Latex gloves. One would look pretty ridiculous, wouldn't one,  having to put on one's gloves everytime one wanted to use one's phone?

- False hand. Now, you see, this is exactly what I am talking about, people just wont be sensible :-). This led to thoughts about Kenny Everitt's character, the one with the giant hands, 'Brother Lee Love'. It was felt, after a long discussion and a few pints of larger, that hands like this would be OK in the boardroom but would be thoroughly inappropriate for use when sitting in a packed train carriage and tapping the passenger (in the next seat) on their face and body with hands this size and asking him/her to budge-up so one could use the touch screen phone. That was considered using poor ettiquette and simply bad form to do it. So let that be a lesson to you all, don't get on trains with big hands if you want to use your touch screen device.

   
- Cling-film. Oh yes, real classy! But it is cheap and it is disposable (but does it avoid fingerprints?). Could, though, cause a run on stock at the local supermarket due to frequent changes.

- Screen spray protection. Now it would have useful to find out more about any spray on products that prevented lipids build up on the screen, similar to this type of product Windshield Treatment

- Cover screen protection. The ones seen during research tended to show a plastic screen cover or film which might work if they do not retain fingerprint smudges or lipids residue on the cover screen of film.

- Stylus. Research reveals that there are over 15 million pages on google that refer to 'stylus'. Clearly, a bit of research refinement was necessary and I came away with these items for the purposes of the topic of this thread:

This stylus is called a 'capacitive stylus', and you can learn more about why they are used here 
 The photo is courtesy of htcaccessorystore

They can be used with resistive touch screen devices, such as HTC and so on:
Photo coutesy of engadget

From the styli research I came away with the notion that if "necessity is the mother of invention", (in fact we are told Plato actually said: "Necessity, who is the mother of invention") then styli are in need of it, apparently. I arrived at this opinion when one individual found you could make a free of charge capacitive stylus made from a "silvery-metallic looking antistatic film". OK, ok, I think I am following this. Enlightenment is just around the corner with a home made video. It is only an image, below, so follow the link to how-to-make-a-free-capacitive-stylus to watch the video. I found the author of the video waving his hands around alot and it is abit distracting when watching the video. Also, he finds it necessary to touch the screen with the hand not holding the home-made stylus, which could indicate a possible set back in avoiding fingerprints. Fair play to him, though, as it appear his find might just be a discovery of necessity of some sort, but that is just pure speculation on my behalf.



Having trawled the life and times of  these styli I happened to come across this little video gem (below) from someone using a home made version of capacitive stylus made from a "square of static bag". Two points to note. One point is that a outcome of using a capacitive stylus is that when used it cleans the screen at the same time, apparently. I had some difficulty in following that logic if the point in using a stylus is to avoid using fingers then where are the fingerprints to be revealed eg: the dots, pin, password? The second point might answer the former question as it seems the video is actually about preservation of fingerporints when a touch screen device is being examined and where the user has fingered his/her touch screen device.  I'll give at least one mark out of ten for effort for the handwritten statement of intent at the top of the paper which the author of the video helpful points out to refresh our memory of it. I'll leave all of you to judge how effective the technqiue is used by the video's author. Follow this link to preservation of fingerprints


So, luckily, having worked to bring the discussion back on topic about fingerprints, it would appear there is a world out deeply involved with 'mothers of inventions' working out how to avoid leaving fingerprints on touch screen devcies and another world working out how to preserve them. Moreover, use a stylus by all means, but you will need two if you wish to re-size the image on the touch screen. Finally, I and those raise observations take no responsibility for anyone using any of the observations above. If you have any suggestions you would like to add to this discussion on how to avoid or preserve fingerprints on touch screen devices send an email (to trewmte@gmail.com) along with your name and company and those details will be given as a by-line along with your suggestions. 

So there you have it.

Until the next time, have a great August bank holiday.

* Lipophobicity & Oleophobic
* Indium tin oxide - one of the most widely used transparent conducting oxides
* Example of device using Oleophobic coating technology Ipad

Thursday, August 18, 2011

Android DOTS - Locking the Screen

Android DOTS - Locking the Screen



I have received several emails following the earlier post iphones-common-password-usage-risks whether I had seen other studies or reports about security risks with the Locking the Screen (linking DOTS) feature in Android and similar featured mobile phones and what I thought.

It is impossible to read everything and many studies/report sometimes don't become available until some years after authors produce them.

My own analysis of the reports (at this stage) that I have seen thus far is that many of the comments about Locking the Screen privacy techniques generally identify that an author acknowledges the device has this privacy/security capability available and provides one method to reduce risk. Forensically speaking, authors also record the complications when the restricted access mode is activated when the device is presented for examination. These are useful comments, but are not fully supported by any indepth research to define common combination of DOTS used by users for their numerical choice of locking patterns. That is menat to be taken in context with the common choice of PINs as suggested by the post iphones-common-password-usage-risks.

The authors Aviv/Gibson/Mossop/Blaze/Smith in 2010 produced an informed and respected report on Screen Smudges that illustrated risks of pattern smudges on the mobile phone touch-screen being detected which refined earlier concerns in 2009 about smudging illustrated in posts on the Android - An Open Handset Alliance Project.

There are discussive science articles on the web about how secure are Android DOTS unlock_patterns regarding numerical choices for the locking code that, again, could provide useful material for more indepth forensic analysis and study. I could carrry on identifying material I have researched but that would merely produce, largely, similar and repetitous paragraphs of statements listing what I found available. However, risks to user touch-screen mobile phones may occur when considering entering unlock DOTS patterns, passwords and PINs and unauthorised access attacker or hackers gaze could potentially include the less troublesome methods to gain access using:

i) clandestine apps/progs (WORMs etc from download or P2P) that could record user entries on the touch-screens and storing the output [having fowarded to a memory cards etc] in a hidden file (so be aware of apps/progs on the handset - check eg file manager/root and change memory cards on a regular basis)
ii) using fingerprint tape on the touch-screen (so clean the screen regularly)
iii) shoulder-surfing the user's locking DOTS pattern (so the longer the pattern the harder it can be for the shoulder-surfer to memorise)

Tuesday, July 19, 2011

iPhones: Common Password Usage Risks

iPhones: Common Password Usage Risks


In the current climate of news about the use of PINs/Passwords to gain unauthorised access to mobile content and voicemail accounts, an interesting study published by an app developer identifying common iPhone passwords. The article identifies the ten most common pin/passwords determined from the study:


"Formulaic passwords are never a good idea, yet 15% of all passcode sets were represented by only 10 different passcodes (out of a possible 10,000). The implication? A thief (or just a prankster) could safely try 10 different passcodes on your iPhone without initiating the data wipe. With a 15% success rate, about 1 in 7 iPhones would easily unlock--even more if the intruder knows the users’ years of birth, relationship status, etc." most common iphone passcodes

Whilst password predicability may not be ground breaking news, this study just might be a useful insight that highlights that iphone mobile phone users appear to make predictable choices when selecting a pin/password and may persuade users to look more carefully at their choice of handset pin/password in current use.

Wednesday, February 11, 2009

Exploding Cell Phone Battery

Exploding Cell Phone Battery

.
A reminder for examiners to take care when examining mobile phones that require recharging the battery before examining the device. The horror story of a man's who had his neck artery burst by the exploding mobile phone in his breast pocket and died. Prior to putting it in his pocket the man had recharged the battery. Production line (bang it on, bang it out) mobile telephone examinations are potentially at high risk and a risk assessment procedure may need to be put in place to avoid loss of fingers or limbs or disfigurement. Insurance companies may need to be made aware of this potential high risk.
.
http://www.telegraph.co.uk/news/worldnews/asia/china/4452360/Exploding-mobile-phone-kills-man-in-China.html
.
Last year Vinny Parmar produced a document (see link below) about counterfeit mobile telephones and it is by no means certain whether these devices are using batteries that may explode.
.
http://trewmte.blogspot.com/2008/11/counterfeit-mobile-phones.html
.
Moreover, some people are apt to placing their mobile telephone in more unusual places about their person. Whether the person is smuggling or something else the exploding battery provides a stark reminder that they may put their life at risk.
.
http://trewmte.blogspot.com/2006/11/whats-this.html
.
Thanks to Richard Putnam for sending to me the Telegraph newspaper online link.

.

UPDATE: A further Telegraph online article has been written regarding the above exploding battery. Apparently, this second news article suggests it was a bullet from a home made gun that had cause the accident. However both Telegraph online articles are not referenced to each other so it is only an assumption that they both may be referring to the same incident.

http://www.telegraph.co.uk/news/worldnews/asia/china/4522915/Man-killed-by-exploding-phone-shot-himself.html