STE WILLIAMS

Supercharge your infrastructure

Cleaners working on the London Underground will resort to industrial action this week in protest against the introduction of a controversial biometric clocking-in system.

Starting at just after midnight on Thursday morning, “up to 300 cleaners” will join in the action by refusing to scan their fingerprints every time they clock on for work, said the union. Their decision will set the workers on a collision course with ISS, the Danish firm which employs them.

According to the RMT union, 98 per cent of the 103 staffers who responded to the ballot voted in favour of the plans, which stopped short of calling for a full-on strike.

Bob Crow, RMT general secretary, said: “Our tube cleaning members have been urged to stand firm and follow the call by the union to take industrial action short of a strike by refusing to use any biometric/fingerprint technology to book on for duty. We believe this technology infringes on staff civil liberties and the overwhelming vote in favour of action shows our members’ strength of feeling on this issue.

“Strong union organisation in the workplace is the key to preventing this unacceptable method of booking on and RMT will continue to build our ‘Thumbs Down to Fingerprinting’ campaign.”

The union is vague on exactly why biometric fingerprinting is a bad idea. When The Register contacted the RMT, a spokesperson told us staff felt “brutalised” by the system, which made them feel like “slabs of meat”.

The union said it represented between 200 and 300 cleaners, and said that ISS had “bulldozed” the biometric system into use, against the wishes of its staff.

RMT also suggested the fingerprint-based sign-in system infringed the cleaners’ “dignity”. The previous clocking-on method involved an automated phone line and a sheet of paper.

El Reg also contacted ISS but they have not yet responded.

The job of cleaning the Tube is regarded as one of the worst and most poorly paid in the capital. In 2010, London Underground cleaners were guaranteed receipt of the London Living Wage, which is currently £8.55 an hour. The union describes the cleaners’ work contracts as “insecure”.

Before the word “fluffer” was co-opted by the pornographic film industry, it was the name given to hordes of poorly paid, often female workers tasked with cleaning human hair, caked grease, black brake dust and other filth from inside tube tunnels.

Fluffers still work the tracks late at night, when the trains have finished running, although their job has been made easier with the introduction of specialised tunnel-cleaning trains, akin to a series of vacuum cleaners mounted on a tube carriage. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/16/tube_workers_to_launch_protest_against_biometric_clockin_system/

Supercharge your infrastructure

Digital security outfit Gemalto has extended its SIM-based Facebook client to include Facebook Messenger, so dumbphone users can chat directly to each other as well as update each other’s walls.

Gemalto’s LinqUp SIM app has already connected Facebook to basic handsets in Argentina, Colombia and Chile, enabling the cheapest of hardware to use the biggest of social networks, but now there’s a new version which will let those handsets join the conversation, rather than just spraying graffiti around the place.

The power of SIM applications is that they run on any GSM phone. Even the most basic of dumb handsets can handle SIM Toolkit apps which means (very nearly) any GSM phone can become Facebook-enabled with Gemalto’s app.

The drawback is in interfacing. The SIM Toolkit can ask the phone to display a text menu, and collect selections as well as the contents of text fields, but that’s about it. The SIM can also ask the handset for an IP connection to the internet, but the LinqUp app uses (silent, Class 2) SMS instead so it can be deployed in areas where data connectivity is an unnecessary luxury.

Such areas include Argentina, where mobe telco Telecom Personal has been selling LinqUp SIMs (without messaging) for almost two years.

Operators doing similar things in South America include Tigo and Entel in Colombia and Chile respectively. Gemalto won’t tell us how many Facebook users are SIM dependent, but did say that they’re young – 90 per cent being under 34, despite the fact that half of the Facebook users in those countries are older than 34.

We’re obliged to assume that’s a good thing, though it probably means young people can’t afford posh phones. We’re also told that the LinqUp app consistently rates higher than the smartphone equivalents, but that can only be because LinqUp users are more impressed by the functionality as text menus don’t generally impress that much.

SIM toolkit apps are much underused, and smartphones have rendered them redundant in many markets, but Facebook is proving popular in places where computers, and connectivity, aren’t available so a SIM solution is the best solution.

Operators charge for the service – generally a monthly fee rather than a per-message rate – but it’s up to them. Sadly Gemalto can’t update the deployed Facebook-supporting SIMs, so any operator interested in handing them out to customers will have to figure in the cost of replacing their SIM stock – which (for Gemalto) is rather the point. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/16/gemalto_arms_sim_with_facebook_messenger/

Supercharge your infrastructure

Video A Russian-speaking man casually shows on camera how he can download a punter’s bank-card details and PIN from a hacked card reader.

In a video demonstrating a tampered sales terminal, a card is swiped through the handheld device and a PIN entered – just as any customer would in a restaurant or shop. Later, after a series of key-presses, the data is transferred to a laptop via a serial cable.

Account numbers and other sensitive information appear on the computer screen, ready to be exploited. And the data can be texted to a phone, if a SIM card is fitted to the handheld.

We’re told the footage, apparently shown on an underworld bazaar, is used to flog the compromised but otherwise working kit for $3,000 apiece – or a mere $2,000 if you’re willing to share 20 per cent of the ill-gotten gains with the sellers under a form of hired-purchase agreement.

Crucially, the gang selling this device offers a money-laundering service to drain victims’ bank accounts for newbie fraudsters: a network of corrupt merchants are given the harvested card data and extract the money typically by buying fake goods and then cashing out refunds. The loot eventually works its way back to the owner of the hacked card reader.

A copy of the web video was passed to The Reg, and is embedded below. We have rotated part of the footage so it’s easier to read the on-screen text.

Electronic security consultancy Group-IB said the modified Verifone VX670 point-of-sale terminal, shown above, retains in memory data hoovered from tracks 1 and 2 of the magnetic stripe on the back of swiped bank cards, as well as the PIN entered on the keypad – enough information for fraudsters to exploit.

The setup suggests the sellers are based in Russia. In the video, a credit card from Sberbank, the country’s largest bank and the third largest in Europe, is used to demonstrate the hacked terminal’s capabilities.

If a SIM card for a GSM mobile phone network is fitted to the doctored device, the information can be sent by SMS rather than transferred over a serial cable, explained Andrey Komarov, head of international projects at Group-IB.

He told us crooks tampering with point-of-sale (POS) terminals and selling them isn’t new – but the bundling of money-stealing support services, allowing fraud to be carried out more easily, is a new development in the digital underground.

“We have detected a new group that sells this modified model of POS terminals and provides services for illegal cash-outs of dumped PINs through their own ‘grey’ merchants: it seems they buy fake stuff, and then cash-out money,” Komarov said.

“It takes less than three hours. According to our information, this kind of service is really new, and it is also being used by different cyber-criminals against the Russian bank Sberbank.”

Komarov told El Reg that the emergence of hacked card readers is due to banks improving their security against criminals’ card-skimming hardware hidden in cash machines and similar scams. Planting data-swiping malware in POS handhelds out in the field is possible, but it is fairly tricky to find vulnerable terminals and infiltrate them reliably without being caught.

It’s a touch easier to buy a tampered device and get it installed in a shop or restaurant with the help of staff or bosses on the take. This creates a huge potential market for fraudsters, according to Komarov.

Scam warnings

Banking giant Visa has issued several alerts about this kind of fraud along with occasional warnings about device vulnerabilities – such as this warning from 2009 [PDF]. And social-engineering tricks [PDF] in which fraudsters pose as Visa employees carrying out adjustments to terminals – while actually compromising them – has been going on for years.

One alert [PDF] from Visa, dating from 2010, explains how thieves worked in the past and the steps merchants can take to defend against the fraud: anti-tampering advice from this year can be found here [PDF], an extract of which is below:

Criminal gangs worldwide are illegally accessing active POS terminals and modifying them by inserting an undetectable electronic “bug” that captures cardholder data and PINs during normal transaction processing.

The impact of this type of crime can be significant to all key parties involved in card acceptance. An attack can not only undermine the integrity of the payment system, but diminish consumer trust in a merchant’s business. In response to this emerging threat, acquirers, merchants and their processors need to proactively secure their POS terminals and make them less vulnerable to tampering.

A more recent advisory on combating this type of fraud, issued earlier this year by Visa, can be found here [PDF].

Avivah Litan, a Gartner Research vice-president and an expert in banking security and related topics, said that tampering with card readers has been going on for years. She agreed with Group-IB’s observation that since banks are investing more in securing cashpoints, penetrating point-of-sale terminals can be an easier way to make money for criminals.

“The bad guys will go after anything they can, but it can be easier to find dishonest merchants to cooperate in running tampered terminals [to harvest bank details] than going after ATMs,” Litan told El Reg, adding that this kind of fraud was rife in South America, particularly in countries such as Brazil.

But Group-IB’s Komarov believes the Russian-speaking fraudsters behind the black-market sale of hacked sales terminals are targeting the international market as well as crims in the motherland. “The example they showed for Sberbank was just because they also use it against Russian-speaking countries, as they have Russian-speaking roots,” he explained.

We passed on Group-IB’s research to Verifone at the start of this month, along with a request for comment on what could be done to frustrate the trade of tampered card readers through underground markets and similar scams. We have yet to hear back from the device manufacturer. We’ll update this story if we hear more. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/16/tampered_pos_market_surfaces/

Supercharge your infrastructure

National Security Agency director Keith Alexander apparently sold the concept of surveillance to members of Congress using an operations centre styled on the bridge of the starship Enterprise from much-loved sci-fi series Star Trek.

According to “a former administration official” who spoke to Foreign Policy magazine, General Alexander set up the centre in Fort Belvoir, Virginia, at the time he was running the Army’s Intelligence and Security Command. The official told FP that the set had been put together professionally by a Hollywood set designer to resemble the bridge of the USS Enterprise, complete with a massive projection screen on the forward wall, computer stations and doors that slide open and closed while making a “whoosh” sound – just like the doors in the TV series.

The facility was known as the Information Dominance Center, he told the magazine.

Politicians and other VIPs apparently got to sit in the captain’s chair at the centre of the room while Alexander demonstrated big data analytics tools on the big screen. “Everybody wanted to sit in the chair at least once to pretend he was Jean-Luc Picard,” a retired officer in charge of VIP visits explained to US news outlet PBS.

The PBS story was based on the FP feature (sign-in required) outlining Alexander’s rise to the top of the NSA, including how he got his hands on the raw caches of data collected by the spy agency.

The Guardian adds that the website of DBI Architects features purported photographs of the actual Star Trek bridge-like briefing room commissioned by Gen “Collect it All” Alexander.

The original file with the pictures is here (PDF) but was inaccessible at the time of writing due to the volume of requests – presumably from overexcited Trekkies as well as senior NSA staffers keen to try out their best Patrick Stewart impressions. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/16/alexander_star_trek_bridge/

Email delivery: Hate phishing emails? You’ll love DMARC

A US-based chap has invented a gadget he’s calling a USB condom.

The prophylactic dongle is advanced as protection for the largely hypothetical problem of malware injection from fake USB chargers.

Such polluted ports come in two varieties. The first got an airing at Black Hat, where researchers demonstrated a USB charger that concealed malware-injecting mini computers. The demo imagines that villains would swap genuine chargers for their fakes and when unsuspecting punters seek some electrons they’ll instead get some malware.

Similar attacks have since been imagined in the public realm, where USB charging stations are becoming more prevalent. Your correspondent’s recent traversal of the new international terminal at Los Angeles Airport, for example, was made tolerable by the presence of USB ports nestled beneath hundreds of new seats in the waiting lounge. Various commentators have wondered out loud what would happen if such installations were subverted.

Enter the USB condom, devices that work by terminating the data pins in the USB cable while allowing only the power pins to connect through,” according to the inventor.

Giving the data pins a temporary vasectomy means even the fake chargers shown at Black Hat have no chance of sending so much as a single bit into a smartphone.

The design of the ‘USB Condom’

Announced late last week, the USB condom was promised to go on sale on September 16th, but a price is yet to materialise on the website of the company concerned. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/17/chap_unrolls_usb_condom_to_protect_against_viruses/

Supercharge your infrastructure

Multiple NASA websites were defaced last week by a Brazilian hacktivist who may have misread the sites’ URLs, because he wasn’t protesting about the US space agency giving joyrides to inhuman stowaways – he was protesting against NSA spying.

“BMPoC” hit kepler.arc.nasa.gov and 13 other sites with messages protesting against US spying on Brazil, as well as a possible US military intervention in Syria.

It’s hard to believe anyone would confuse the NSA spy agency with NASA, the space agency, except for satirical purposes or to mock script kiddies in some way, so we can only guess that the hackers behind the attack hit NASA because it’s a US government agency whose systems are noted for being insecure.

NASA is at one level a scientific research agency with numerous links to universities. The notoriously weak security practices in much of academia have spilled over to the space agency. NASA’s less than stellar information security practices have been repeatedly criticised by government auditors.

The defacement messages themselves are all over the place, grammatically, and less than coherent logically.

NASA HACKED! BY #BMPoCWe! Stop spy on us! The Brazilian population do not support your attitude! The Illuminati are now visibly acting!

Obama heartless! Inhumane! you have no family? the point in the entire global population is supporting you. NOBODY! We do not want war, we want peace!!! Do not attack the Syrians.

A list of the defaced domains along with links to entries on defacement archive Zone-h can be found on Pastebin.

The hacked domains are maintained by various scientific missions within NASA such as the Kepler Mission, Ames Academy for Space Exploration and NASA’s Office of Planetary Protection, Virtual Astrobiology, a NASA recruitment domain, NASA Lunar Science Institute among others, CyberWarZone reports. Brief checks suggest most of the domains were returned to service by Monday morning.

A NASA spokesman played down the significance of the digital graffiti attacks, telling Fox News that everything was under control.

“A Brazilian hacker group posted a political message on a number of NASA websites. … Within hours of the initial posting, information technology staff at the Ames Research Center discovered the message and immediately started an investigation, which is ongoing,” he said. “At no point were any of the agency’s primary websites, missions or classified systems compromised.”

The same hacker/hacking group also hit NASA back in April, HackRead reports. Last time around the defacement had no politically-related content.

“NASA might be picked on simply because it represents low-hanging fruit,” writes Lisa Vaas, in a commentary on the hacking on Sophos’ Naked security blog. “Somebody ought to tell BMPoC that he/she/they are bullies kicking sand in the face of rocket scientists who have better things to do than mop up after an attack that’s spurred by a head-scratcher of a so-called rationale that’s unrelated to NASA’s mission.” ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/17/defacers_hit_nasa_in_nsa_protest/

Supercharge your infrastructure

The NSA bought specialist computer hacking tools and research from French security outfit Vupen, according to documents unearthed using the Freedom of Information Act.

A contract shows the American spooks paid for a year’s supply of zero-day vulnerability information and the software needed to exploit those flaws to attack electronic systems.

The paperwork, obtained by government transparency and accountability site MuckRock, show that the US intelligence nerve-centre signed up to a one-year subscription to Vupen’s “binary analysis and exploits service” last September.

Vupen prides itself on advanced vulnerability research as well as selling software exploits for unpatched flaws in systems – known as zero-days – to governments. Several US defence contractors and security startups, such as Endgame Systems, are also in the business of privately researching and selling information about software vulnerabilities and associated attack code.

That US government organisations may be among Vupen’s customers is not a surprise. The NSA, even though it has advanced offensive cybersecurity capabilities, not least in the shape of its Tailored Access Operations cyber-espionage unit, might still find it valuable to tap into external help from commercial providers such as Vupen.

“Likely reasons for NSA subscription to Vupen’s 0day exploits: know what capabilities other govs can buy, and false flag, deniable cyber-ops,” writes Christopher Soghoian, principal technologist and senior policy analyst at the American Civil Liberties Union in an update to his personal Twitter account.

“There are times when US special forces use AK47s, even though they have superior guns available. Same for NSA’s Vupen purchase. Deniability,” he added.

Soghoian, who delivered a presentation about the exploit vulnerability marketplace at the recent Virus Bulletin conference, has previously likened the trade in software exploits to a trade in conventional weapons – think bullets, bombs and rockets. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/17/nsa_vupen/

Supercharge your infrastructure

Belgian telco Belgacom – which operates vital undersea communications cables – says its internal network was compromised, possibly by foreign spooks.

Phone and data connections from international hot spots, such as Syria and Yemen, pass through submarine fibre lines handled by Belgacom International Carrier Services (BICS).

Security experts suspect the Belgian biz was infiltrated by state-backed hackers – and NSA and GCHQ have emerged as the prime suspects. Journalists in Belgium – writing here, here, here, and here – cite sources who reckon Belgacom’s systems may have been compromised for two years by a foreign intelligence agency.

Well-known security researcher Eddy Willems of antivirus biz G Data told El Reg that Belgacom admitted on TV that 5,000 of its internal machines were infected with sophisticated malware, which may have cyber-espionage purposes.

“I don’t have a sample of the malware but am hoping to acquire it,” Willems explained. “The circumstances look that it might be cyber-espionage but it might be something completely unrelated.”

BICS – a joint venture between Belgacom, Swisscom and South Africa’s MTN – provides wholesale carrier services to mobile and fixed-line telcos around the world. It is among a group of companies that run the TAT-14, SEA-ME-WE3 and SEA-ME-WE4 cables connecting the United States, UK, Europe, North Africa, the Middle East and Singapore to the rest of the world.

Blighty’s eavesdroppers at GCHQ run a programme called Tempora which taps data flowing through undersea fibre-optic lines of major telecommunications corporations – and BICS’s cables may be a target. Stuffing malware into the telco’s network could allow spooks to monitor the submarine communications, but how exactly that would happen is unclear.

In a statement issued yesterday Belgacom admitted its internal systems were invaded, but sought to reassure its customers that their records and other information stored in the systems were not affected. It said the intrusion, which did not compromise the “delivery” of communications, is under investigation by law enforcement:

This weekend, Belgacom successfully performed an operation in the light of its continuous action plan to protect the security of its customers and their data and to assure the continuity of its services.

Previous security checks by Belgacom experts revealed traces of a digital intrusion in the company’s internal IT system. Belgacom has taken all appropriate actions to protect the integrity of its IT system and to further reinforce the prevention against possible incidents.

For Belgacom, the protection of the customers and their data is a key priority. At this stage there is no indication of any impact on the customers or their data. At no point in time has the delivery of our telecommunication services been compromised.

Belgacom strongly condemns the intrusion of which it has become a victim. The company has filed a complaint against an unknown third party and is granting its full support to the investigation that is being performed by the Federal Prosecutor.

Security experts – such as Costin Raiu, a senior security researcher at Kaspersky Lab – have drawn parallels between the breach within Belgacom and the compromise of systems at Norwegian carrier Telenor. Analysis about the Telenor attack by infosec firm Norman pointed the finger of blame towards India.

In the case of Belgacom, the GCHQ and NSA is suspected given this year’s revelations of the two agencies’ global internet surveillance operations. “It’s still too early to make conclusions that NSA is involved, however the likelihood is high if you look at the monitoring opportunities,” G Data’s Willems told El Reg. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/17/belgacom_mystery_malware/

Supercharge your infrastructure

Security researchers have linked the “Hackers for hire” Hidden Lynx Group with a number of high-profile attacks, including an assault on net security firm Bit9, as well as the notorious Operation Aurora assault against Google and other hi-tech firms back in 2009.

Hidden Lynx is a sophisticated hacking group based in China and made of up of between 50 to 100 individuals, according to Symantec. The hackers provide “full service” as well as “customised” cyber-espionage attacks against corporate and government targets, claims the security firm. Its favoured tactics include compromising third-party sites frequented by individuals from targeted organisations with malicious code.

Such so-called watering hole attacks are an easier way to go after marks than hacking into the websites of defence contractors, government organisations and other targets directly. The group, which has operated for more than three years, has used zero-day exploits three times since 2011 alone, says Symantec.

The researchers believe the group compromised security firm Bit9’s digital code-signing certificate as part of a stepping-stone attack ultimately aimed at defence industry customers of the net security firm’s whitelisting technology.

Hidden Lynx also has affiliations to Operation Aurora, the 2009 mass break-in to more than 30 big technology companies, including Google and Adobe, the security firm claims.

“This group has a hunger and drive that surpass other well-known groups such as APT1/Comment Crew,” Symantec concludes in a blog post that praises the group for its “technical prowess”, resourcefulness and patience in running multiple attacks.

The group’s main targets include IT firms, defence and aeronautics contractors, energy sector, finance, healthcare and governments in multiple countries including the US, Taiwan and Japan. More than half the attacks linked to the group were thrown against US organisations.

Hidden Lynx “engage in a two-pronged strategy of mass exploitation and pay-to-order targeted attacks for intellectual property using two Trojans designed specifically for each purpose”, according to Symantec. Team Moudoor, a sub-group of Hidden Lynx, distributes Moudoor, a customised version of the “Gh0st RAT” Trojan, for large-scale campaigns.

Another sub-group, Team Naid, distributes the Naid Trojan, which appears to be reserved for more limited attacks against high value targets. Naid has been linked to the Bit9 incident.

More on Hidden Lynx (whose name is derived from a string found in command-and-control server communications) is available in a whitepaper published on Tuesday (PDF). ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/17/chinese_hackers4hire_crew/

Supercharge your infrastructure

A second Mobile Pwn2Own hacking competition, in which experts discover and exploit security flaws in handhelds for prizes, will take place at the PacSec 2013 conference in Japan in November.

For many years, the original Pwn2Own contest has been held at the CanSecWest get-together in Vancouver every March. Like its older sibling, Mobile Pwn2Own is also partially backed by funds from HP’s Zero Day Initiative: $300,000 in prize money is up for grabs. Google’s Android Security Team and BlackBerry are also sponsoring the mobile shoot-out.

The competition later this year in Japan will focus on exploiting vulnerabilities in smartphones and tablets – unlike the original which most recently has restricted itself to assaulting web browsers, Adobe Flash, Java and similar software on PCs running Windows, Mac OS X and Linux.

The Mobile Pwn2Own prize money is divided up by attack type: exactly how contestants manage to digitally break into the devices matters rather than the model or platform. Hacks relying on physical proximity – for example, by exploiting Bluetooth, Wi-Fi, USB or NFC holes – stand to win $50k. A successful attack “must require little or no user interaction”, so attacks that involve tricking recipients into clicking on OK to install dodgy apps won’t cut it in this category.

Winning clever hacks that skewer gear via a web browser are worth up to $40k. Victory can be secured by crafting code that silently makes a long-distance phone call, eavesdrops on a conversation or extracts and uploads data to a remote server.

Mobile application or operating system hacks are eligible for a contest with a prize of $40k. Attacks on this category have to work against fully patched smartphones that aren’t running third-party apps.

More money, a prize of $70k, is offered for successful attacks on messaging services, such as SMS and MMS. Limited user interaction is allowed in this category so having a user open a message for an attack to activate will probably fit within this rule. Attempts to trick users into following a link to a dodgy website are almost certainly offside.

The most financially rewarding competition – with a tasty $100K in offer – is reserved for hacks against the baseband system of a smartphone: the actual electronics that do all the heavy lifting involved in the radio communications between the mobe and the network. Hacking a phone by sending it a string of signals that confuses or compromises the baseband chipset and software is ideal, for example.

“The value of this prize presumably reflects the comparative difficulty of coming up with a method to break in via the mobile network itself, rather than via USB cable or over the internet,” notes security market watcher Paul Ducklin in a post on Sophos’s Naked Security blog.

(Of course, the sums on offer here are not much compared to the amounts of cash highly sought-after zero-days vulnerabilities fetch on private exploit markets.)

Smartphones and tablets waiting to be pwned in this year’s competition include a Nokia Lumia 1020 handset running Windows Phone 8, a Microsoft Surface RT slab running the Windows 8 kernel, a Samsung Galaxy S4 running Android, an Apple iPhone 5 and an Apple iPad Mini running iOS, a Google Nexus 10 tab running Android, and a BlackBerry Z10 phone running BlackBerry OS 10.

There’s a draw for who gets to attack the targeted platform first. Entrants have 30 minutes to compromise the chosen device via their chosen method.

The first to succeed in each category wins that category’s prize as well as the kit they successfully hacked. With five categories and nine devices it’ll be interesting to see which platform is the most thrashed and which remains unscathed.

“What we may never know, if there’s a device (or an operating system) that no-one chooses for any attack, is whether it was avoided due to a lack of interest, or due to its recognised strength,” Ducklin adds. “Pwn2Own, like many security tests, is good at telling you if a product has a security weakness, but doesn’t say much about each product’s strengths.”

The competition, limited to conference delegates, will run at the PacSec 2013 Conference in Tokyo between 11 and 13 November. ®

5 ways to prepare your advertising infrastructure for disaster

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/09/17/mobile_pwn2wn_2013/