Hackers can steal PINs, passwords from your brainwaves: study

July 1, 2017

Washington, Jul 1: Hackers can guess a user's passwords by monitoring their thoughts, according to scientists including those of Indian origin who suggest that brainwave-sensing headsets need better security.brain

Electroencephalograph (EEG) headsets allow users to control robotic toys and video games with the mind.

Researchers at the University of Alabama at Birmingham in the US found that a person who paused a video game and logged into a bank account while wearing an EEG headset was at risk for having their passwords or other sensitive data stolen by a malicious software programme.

"These emerging devices open immense opportunities for everyday users," said Nitesh Saxena, associate professor from University of Alabama. "However, they could also raise significant security and privacy threats as companies work to develop even more advanced brain-computer interface technology," said Saxena.

The team, including PhD student Ajaya Neupane, used one EEG headset currently available to consumers online and one clinical-grade headset used for scientific research to demonstrate how easily a malicious software programme could passively eavesdrop on a user's brainwaves.

While typing, a user's inputs correspond with their visual processing, as well as hand, eye and head muscle movements. All these movements are captured by EEG headsets.

The team asked 12 people to type a series of randomly generated PINs and passwords into a text box as if they were logging into an online account while wearing an EEG headset, in order for the software to train itself on the user's typing and the corresponding brainwave.

"In a real-world attack, a hacker could facilitate the training step required for the malicious program to be most accurate, by requesting that the user enter a predefined set of numbers in order to restart the game after pausing it to take a break, similar to the way CAPTCHA is used to verify users when logging onto websites," Saxena said.

The team found that, after a user entered 200 characters, algorithms within the malicious software programme could make educated guesses about new characters the user entered by monitoring the EEG data recorded.

The algorithm was able to shorten the odds of a hacker's guessing a four-digit numerical PIN from one in 10,000 to one in 20 and increased the chance of guessing a six-letter password from about 500,000 to roughly one in 500.

"Given the growing popularity of EEG headsets and the variety of ways in which they could be used, it is inevitable that they will become part of our daily lives, including while using other devices," Saxena said.

"It is important to analyse the potential security and privacy risks associated with this emerging technology to raise users' awareness of the risks and develop viable solutions to malicious attacks," he said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
March 13,2020

Amid the rapid spread of the novel coronavirus (COVID-19), which has infected 73 people in India and killed more than 4,500 individuals globally, doctors have advised that in addition to regularly washing hands, one should also disinfect their smartphone every 90 minutes with alcohol-based hand sanitizer.

Ravi Shekhar Jha, Head of Department at Fortis Escorts Hospital in Faridabad said the best method to disinfect your smartphone is to use regular doctor spirit or the alcohol-based hand sanitizer at least every 90 minutes.

"Avoid touching your eyes, mouth, or nose. The best option is to use a phone cover or a Bluetooth device and try to touch your phone as less as possible. We would also recommend cleaning your phone at least twice a day," Jha told IANS.

According to research, published in 2018 by Insurance2Go, a gadget insurance provider, revealed that smartphone screens have three times more germs than a toilet seat.

One in 20 smartphone users was found to clean their phones less than every six months, said the study.

"In the time of fear of coronavirus, smartphones should also be disinfected with alcohol-based sanitizer rub. Pour few drops of sanitizer on a tiny clean cotton pad and rub it safely on your entire phone," said Jyoti Mutta, Senior Consultant, Microbiology, Sri Balaji Action Medical Institute in New Delhi.

"You can repeat this process every evening coming back home after an entire day out at work and once in the morning before going out," Mutta added.

"Maintain basic cleanliness, and try to avoid using other's phones especially if suffering from respiratory illness or flu-like symptoms as there is no other way to disinfect these regular gadgets," she stressed.

Another study from the University of Surrey in the UK, also found that the home button on your smartphone may be harbouring millions of bacteria - some even harmful.

The World Health Organisation (WHO) declared the novel coronavirus as a global pandemic on Wednesday. The death toll of COVID-19 has crossed the 4,500 marks and confirmed cases globally have touched one lakh as per the reports.

According to Suranjeet Chatterjee, Senior Consultant in Internal Medicine Department of Indraprastha Apollo Hospitals in New Delhi, "We should frequently wash our hands, cover our coughs and it is important to adapt to other good hygiene habits that are most important in such a situation."

"Coronavirus and other germs can live on surfaces like glass, metal or plastics and phones are bacteria-ridden. It is necessary that we sanitize our hands frequently and make sure that our hands are clean all the time," Chatterjee told IANS.

"The emphasis should be laid on sanitising our hands rather than sanitizing the phone - once in a while the phone can be sanitized under the guidance of the makers of the phone," Chatterjee stressed.

According to the global health agency, the most effective way to protect yourself against coronavirus is by frequently cleaning of your hands with alcohol-based hand rub or washing them with soap and water.

The WHO's report showed the virus infects people of all ages, among which older people and those with underlying medical conditions are at a higher risk of getting infected.

People should eat only well-cooked food, avoid spitting in public, and avoid close contact, the WHO said, adding that it is important for people to seek medical care at the earliest if they become sick.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 10,2020

Indian enterprises were flooded with a whopping 14.6 crore malware threats in 2019 - a growth of 48 per cent (year-on-year) compared to 2018, a new report said on Friday.

Manufacturing, BFSI (banking, financial services and insurance), education, healthcare, IT/ITES, and the government were the most at-risk industries in the country, said the report from Seqrite, the enterprise arm of Pune-based IT security firm Quick Heal Technologies.

Interestingly, almost a quarter (23 per cent) of the threats were identified through 'Signatureless behaviour-based' detection by Seqrite, indicating how a growing number of cybercriminals were deploying new or previously unknown threat vectors to compromise enterprise security.

"With the latest Seqrite annual threat report, we want to empower CIOs, CISOs, business leaders and all key public stakeholders with the insights they need to combat the growing complexity of the threat landscape," said Sanjay Katkar, Joint Managing Director and CTO, Quick Heal Technologies.

The most prominent trend was the drastic increase in the volume, intensity, and sophistication of cyber-attack campaigns targeting Indian enterprises in 2019.

The rapid integration of IoT devices, BYOD (bring your own device), and third-party APIs into enterprise networks has created newer security vulnerabilities that might go unnoticed until a major breach occurs.

Threat researchers at Seqrite observed several large-scale advanced persistent threats (APT) attacks deployed against organisations in the government sector.

"The entry of nation-states and organised cybercrime cells into the fray is expected to add more complication to this situation and will require Indian government bodies and corporate enterprises to shore up their cyber defence strategies in 2020 and beyond," the report noted.

More alarming, however, was the continued lack of security awareness amongst enterprises and government organisations.

"Unsecured Remote Desktop Protocol (RDP) and Server Message Block (SMB) protocols continued to be targeted through brute-force attacks," said the report.

Spear phishing attack campaigns leveraging Office exploits and infected macros were also used extensively by cybercriminals to gain access to enterprise networks and steal critical data.

"India's digital journey depends on ensuring robust cybersecurity for all stakeholders within the enterprise ecosystem," said Katkar.

The sharp spike should be a cause of concern for CIOs and CISOs in the country, especially given the growing digital penetration within their enterprise networks.

"With network vulnerabilities and potential entry points increasing at a rapid pace, threat actors are expected to leverage artificial intelligence (AI) capabilities to power their malware campaigns in the future to capitalise on newer attack vectors," the report added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 25,2020

New Delhi, Jan 25: The Patiala House court on Saturday started hearing a plea filed by the Nirbhaya convicts that alleged that the Tihar Jail administration have "not presented the papers on time".

The Public Prosecutor informed the court that Tihar Jail authorities have already supplied the relevant documents. He further informed that these are mere delaying tactics adopted by the convicts.

Advocate A.P. Singh, lawyer for three of the four death row convicts in the Nirbhaya gang-rape case had moved an application before the court seeking directions to the Tihar Jail authorities to supply him the relevant documents in order to exercise the remaining legal remedies available with the death row convicts -- Vinay Pawan and Akshay.

The Public Prosecutor also told the court that he spoke to the jail authorities over the phone and a report in this regard will be filed shortly as the jail officials were on their way to the court.

The judge demanded from the convicts lawyer to show what he has filed.

The convicts lawyer, A.P. Singh, said that he received some documents, but has still not been supplied with the personal diary of one of the convict -- Vinay Kumar Sharma and also the medical documents.

Judge then asked the lawyer to wait for until the report arrives form the Tihar Jail.

On this, the convicts lawyer said he was not questioning the intention of the jail. "I know the jail has been changed. It isn't there fault, too," he said.

The Public Prosecutor refuted the allegation saying that the defence counsel was trying to defeat the speed of law.

"We have supplied all the documents to the counsel. We have supplied all the documents except the painting and some other documents. We have nothing apart from that," public prosecutor said.

Singh, in his plea filed before the Patiala House Court sought urgent orders of the court in order to file a mercy petition of Vinay Sharma and in relation to requests for documents for convicts Vinay Sharma, Pawan Kumar Gupta and Akshay Kumar Singh.

He further said that the convicts undertook several steps to obtain relevant information necessary for filing the mercy petitions. In regular interval, the convicts requested the concerned authority to supply documents pertaining to their medical records from 2012 to 2015 and 2019-2020, records of cellular confinement, records of the amount earned in prison through labour, records of educational and reformative activities like Tihar Olympics and Painting, etc.

The Supreme court had recently dismissed the curative petition for the other two convicts -- Vinay Kumar Sharma (26) and Mukesh Singh (32).

The court had recently issued death warrant against the convicts and fixed 6 a.m. on February 1 as the date and time of execution of the death penalty.

The 23-year-old victim in the case was brutally gang raped and tortured on December 16, 2012, which later led to her death. All the six accused were arrested and charged with sexual assault and murder. One of the accused was a minor and appeared before a juvenile justice court, while another accused committed suicide in Tihar Jail.

Four of the convicts were sentenced to death by a trial court in September 2013, and the verdict was confirmed by the Delhi High Court in March 2014 and subsequently upheld by the Supreme Court in May 2017, which also dismissed their review petitions.

A Juvenile involved in the crime was convicted by a juvenile justice board and released from a reformation home after serving a three-year term.

Hearing in a different case, Chief Justice of India S.A. Bobde on Thursday said a condemned person cannot fight the death penalty endlessly and it was important for the capital punishment to reach its finality.

The death penalty, he noted, cannot be questioned at every turn by the convict.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.