Feeds

My RFID-embedded car numberplate has a virus

Security crystal ball gazing from McAfee

The Power of One eBook: Top reasons to choose HP BladeSystem

Spyware - malicious programs that covertly track surfing habits or steal confidential data - are likely to migrate onto new platforms, including mobile phones and RFID chips.

The scenario is sketched out in the second issue of McAfee's twice annual Global Threat Report.

RFID chips, which began life as a replacement for bar codes in retailing and warehousing, are now being integrated into some identification documents, such as passports, and in emerging technologies like contactless credit cards. In January, SoMark Innovations announced the development of bio-compatible chipless RFID ink, making RFID "tattoos" and synthetic biometrics possible.

The British government plans to test RFID-embedded license plates, developed by Hills Numberplates. Such e-plates might be read by any strategically placed reader along a road at speeds of up to 300km/h and up to 100 metres away.

Applications include speed traps, detecting stolen vehicles, and traffic management. Network security firm McAfee reckons that the technology also lends itself to its use as a surveillance tool by governments or criminal exploitation.

The growing, almost ubiquitous, use of RFID technology creates a platform for malware. Research first presented in March 2006 shows how vulnerabilities in RFID technology might be used to spread viruses, worms, and spyware. Dutch researchers showed how RFID tags could be virally infected through SQL injection attacks, exploiting links between an RFID tag and a vulnerable database.

Spy on the wire

The increasing processing power and growing features set of mobile phones make the devices an "ideal candidate" for exploitation by spyware, according to security researchers at McAfee.

Examples of this limited breed are capable of forwarding call logs to a remote server, recording and forwarding text messages, listening to calls, or even remotely turning the device into a live radio "bug" without the phone user's knowledge or consent. These applications hide or camouflage themselves once installed on mobile devices.

Sold as a means for suspicious partners to track the activities of their potentially errant spouses, applications such as FlexiSpy pose a wider threat to security, McAfee warns.

A lack of awareness among consumers about how to use Bluetooth securely also represents a serious security threat to mobile phone users such as Bluebugging, where an attacker manipulates a phone to dial numbers, and Bluestabbing, where an attacker tries to crash vulnerable devices.

Second Life

The second issue of McAfee's twice annual Global Threat Report also looks at other security issues the industry is likely to face over the next five years. McAfee continues to criticise the security shortcomings of Vista it first made prior to the release of what Microsoft describes as its "most secure" operating system ever.

"While Microsoft has taken steps to make the base of Microsoft Windows Vista more secure, the improvements both weaken third-party efforts to secure systems and don't go far enough to do the job alone," McAfee analysts argue.

The majority of cybercriminals target PC users, making money by selling access to compromise PCs to spammers, for example. As technologies such as Voice over IP (VoIP) and radio frequency identifications (RFID) tags become more widely adopted, attackers are likely to branch out.

Security crystal ball gazers at McAfee also predict that application security will become a key battleground between hackers and security defenders over coming months and years. Using disk encryption technologies to prevent stolen or purloined PCs giving up secrets will become "ubiquitous" in enterprises within five years, McAfee predicts.

The report also forecasts that online crime will "migrate" to mobile phones, something McAfee has been predicting since Bill Clinton and John Major were in power, with scant evidence to date.

More on all these threats to e-commerce can be found in McAfee's report here. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.