STE WILLIAMS

Google’s high-tech Glass headsets might be a gadget enthusiast’s dream, but in their current form they’re far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle “Saurik” – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

“Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices,” Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 “Ice Cream Sandwich,” including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can’t be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don’t use any kind of PIN – just turn them on and they’re ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else’s Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

“If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then … launch into a security exploit to get root,” Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

“Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head,” Freeman writes. “A bugged Glass doesn’t just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do.”

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

“Nothing is safe once your Glass has been hacked,” Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user’s eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it’s not operating. That could not only help reassure people that they’re not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray’s “duh!” outburst on Friday.

“As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system,” Freeman writes. “The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/05/01/google_glass_security_nightmare/

Google’s high-tech Glass headsets might be a gadget enthusiast’s dream, but in their current form they’re far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle “Saurik” – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

“Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices,” Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 “Ice Cream Sandwich,” including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can’t be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don’t use any kind of PIN – just turn them on and they’re ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else’s Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

“If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then … launch into a security exploit to get root,” Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

“Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head,” Freeman writes. “A bugged Glass doesn’t just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do.”

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

“Nothing is safe once your Glass has been hacked,” Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user’s eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it’s not operating. That could not only help reassure people that they’re not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray’s “duh!” outburst on Friday.

“As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system,” Freeman writes. “The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/05/01/google_glass_security_nightmare/

Google’s high-tech Glass headsets might be a gadget enthusiast’s dream, but in their current form they’re far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle “Saurik” – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

“Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices,” Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 “Ice Cream Sandwich,” including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can’t be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don’t use any kind of PIN – just turn them on and they’re ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else’s Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

“If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then … launch into a security exploit to get root,” Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

“Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head,” Freeman writes. “A bugged Glass doesn’t just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do.”

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

“Nothing is safe once your Glass has been hacked,” Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user’s eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it’s not operating. That could not only help reassure people that they’re not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray’s “duh!” outburst on Friday.

“As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system,” Freeman writes. “The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/05/01/google_glass_security_nightmare/

Google’s high-tech Glass headsets might be a gadget enthusiast’s dream, but in their current form they’re far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle “Saurik” – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

“Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices,” Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 “Ice Cream Sandwich,” including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can’t be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don’t use any kind of PIN – just turn them on and they’re ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else’s Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

“If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then … launch into a security exploit to get root,” Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

“Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head,” Freeman writes. “A bugged Glass doesn’t just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do.”

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

“Nothing is safe once your Glass has been hacked,” Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user’s eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it’s not operating. That could not only help reassure people that they’re not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray’s “duh!” outburst on Friday.

“As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system,” Freeman writes. “The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/05/01/google_glass_security_nightmare/

Google’s high-tech Glass headsets might be a gadget enthusiast’s dream, but in their current form they’re far too vulnerable to malicious hacking, according to one developer who has had access to the devices.

In a lengthy blog post on Tuesday, technology consultant Jay Freeman – who goes by the hacker handle “Saurik” – gave a detailed explanation of how he was able to gain root access to his Google specs and the potential implications of that discovery for Glass wearers.

“Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices,” Freeman writes.

One such security issue was the one Freeman was able to exploit to gain full control over his specs. That vulnerability is already eight months old, Freeman says, but it still affects all versions of Android 4.0 “Ice Cream Sandwich,” including the build that powers Glass.

In fact, exploiting it on Glass was particularly easy. Many Android vulnerabilities present minimal risks for tablets and phones, Freeman explains, because they can’t be exploited while the device is PIN-locked. But the Glass Explorer Edition devices don’t use any kind of PIN – just turn them on and they’re ready to go.

Because of this flaw, it would be unnervingly easy for someone to use the same technique Freeman employed to root his own device to gain root access to someone else’s Glass, Freeman says. All they would need is to gain access to the device, and then only for a few moments.

“If you leave [Glass] somewhere where someone else can get it, it is easy to put the device into Debug Mode using the Settings panel and then … launch into a security exploit to get root,” Freeman says.

Once an attacker has root access, installing malicious software is trivial – and with a device like Glass, Freeman says, that could be a true security nightmare.

“Once the attacker has root on your Glass, they have much more power than if they had access to your phone or even your computer: they have control over a camera and a microphone that are attached to your head,” Freeman writes. “A bugged Glass doesn’t just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do.”

That kind of access raises concerns that are far more serious than the privacy issues that have been much discussed in the press, Freeman says.

An attacker who has installed spyware on your Glass headset could potentially watch you entering door codes, take pictures of your keys, record your PIN as you enter it into a bank teller machine, and intercept everything you type on computer keyboards, including passwords.

“Nothing is safe once your Glass has been hacked,” Freeman bluntly states.

To address these concerns, Freeman says he would like to see Google make significant changes to the way Glass is designed, particularly before it is released in a version for consumers.

For starters, he says, he would like to see some way that Glass can be locked once the wearer takes it off. Perhaps the device could even scan the user’s eye to reactivate, he suggests, or respond to a voiceprint – but failing such high-tech measures, a PIN should suffice.

He also would like the devices to be more obvious about when they are recording, such as displaying an LED light or concealing the camera with a plastic shield when it’s not operating. That could not only help reassure people that they’re not being recorded, but also alert Glass users if their devices start recording without their knowledge.

Moreover, Freeman says he would like to see Google take security concerns with Glass more seriously – and particularly, to avoid comments such as Tim Bray’s “duh!” outburst on Friday.

“As long as engineers, advocates, and officers from Google make statements like these without carefully looking into the facts first, it will not be possible to have any kind of reasonable and informed discussion about this system,” Freeman writes. “The doors that Google is attempting to open with Glass are simply too large, and the effects too wide-reaching, for these kinds of off-the-cuff statements to be allowed to dominate the discussion.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/05/01/google_glass_security_nightmare/