Connect with us

E-Business

Hackers Target USB Devices in New Attacks, Researcher warns

Published

on

Kindly share this post

USB devices such as keyboards, thumb-drives and mice can be used to hack into personal computers in a potential new class of attacks that evade all known security protections, a top computer researcher revealed yesterday.

Karsten Nohl, chief scientist with Berlin’s SR Labs, noted that hackers could load malicious software onto tiny, low-cost computer chips that control functions of USB devices but which have no built-in shields against tampering with their code.

“You cannot tell where the virus came from. It is almost like a magic trick,” said Nohl, whose research firm is known for uncovering major flaws in mobile phone technology.

The finding shows that bugs in software used to run tiny electronics components that are invisible to the average computer user can be extremely dangerous when hackers figure out how to exploit them. Security researchers have increasingly turned their attention to uncovering such flaws.

Nohl said his firm has performed attacks by writing malicious code onto USB control chips used in thumb drives and smartphones. Once the USB device is attached to a computer, the malicious software can log keystrokes, spy on communications and destroy data, he said.

Computers do not detect the infections when tainted devices are inserted because anti-virus programs are only designed to scan for software written onto memory and do not scan the “firmware” that controls the functioning of those devices, he said.

Nohl and Jakob Lell, a security researcher at SR Labs, will describe their attack method at next week’s Black Hat hacking conference in Las Vegas, in a presentation titled: “Bad USB – On Accessories that Turn Evil.”

Thousands of security professionals gather at the annual conference to hear about the latest hacking techniques, including ones that threaten the security of business computers, consumer electronics and critical infrastructure.

Nohl said he would not be surprised if intelligence agencies, like the National Security Agency, have already figured out how to launch attacks using this technique.

Last year, he presented research at Black Hat on breakthrough methods for remotely attacking SIM cards on mobile phones. In December, documents leaked by former NSA contractor Edward Snowden demonstrated that the U.S. spy agency was using a similar technique for surveillance, which it called “Monkey Calendar.”

SR Labs tested the technique by infecting controller chips made by major Taiwanese manufacturer, Phison Electronics Corp, and placing them in USB memory drives and smartphones running Google Inc’s Android operating system.

Alex Chiu, an attorney with Phison, told Reuters via email that Nohl had contacted the company about his research in May.

“Mr. Nohl did not offer detailed analysis together with work product to prove his finding,” Chiu said. “Phison does not have ground to comment (on) his allegation.”

Chiu said that “from Phison’s reasonable knowledge and belief, it is hardly possible to rewrite Phison’s controller firmware without accessing our confidential information.”

Similar chips are made by Silicon Motion Technology Corp and Alcor Micro Corp. Nohl said his firm did not test devices with chips from those manufacturers.

Google did not respond to requests for comment. Officials with Silicon Motion and Alcor Micro could not immediately be reached.

Nohl believed hackers would have a “high chance” of corrupting other kinds of controller chips besides those made by Phison, because their manufacturers are not required to secure software. He said those chips, once infected, could be used to infect mice, keyboards and other devices that connect via USB.

“The sky is the limit. You can do anything at all,” he said.

In his tests, Nohl said he was able to gain remote access to a computer by having the USB instruct the computer to download a malicious program with instructions that the PC believed were coming from a keyboard. He was also able to change what are known as DNS network settings on a computer, essentially instructing the machine to route Internet traffic through malicious servers.

Once a computer is infected, it could be programmed to infect all USB devices that are subsequently attached to it, which would then corrupt machines that they contact.

“Now all of your USB devices are infected. It becomes self-propagating and extremely persistent,” Nohl said. “You can never remove it.”

Christof Paar, a professor of electrical engineering at Germany’s University of Bochum who reviewed the findings, said he believed the new research would prompt others to take a closer look at USB technology, and potentially lead to the discovery of more bugs. He urged manufacturers to improve protection of their chips to thwart attacks.

“The manufacturer should make it much harder to change the software that runs on a USB stick,” Paar said.


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

Paga Hits N14tri Transactions Value in 15 Years

Published

on

Kindly share this post

Paga, a payments and financial services provider for Africa has processed transactions value to the tune of N14trillion in the last 15 years of its existence.

Tayo Oviosu, chief executive officer, Pagatech, said at a media interaction to mark the company’s 15 anniversary that 80 percent of the amount was done in the last five years.

“When we celebrated 10 years of our business that was five years ago, we have grown our transactions values by 7 times, across the three business arms of our operation which includes; consumer payments, platform as-a-services and super App for retailers.

“This has translated into job creation as we have created over 1,000 direct jobs in Ethiopia and in Nigeria and indirect jobs through our agent network to about 100,000 jobs, this is economic empowerment of Nigerians.

“Our desire is giving people financial freedom and making life possible for them and impacting on our community. We are really proud of our economic achievements and we are making sure that our customers get the best experience.

“We are super excited about what the future holds for our business. Our vision is a world where cash does not exist anymore. We ensure that our customers’ money is safe by complying with the highest global security standards.

“Our focus is on helping both consumers and sellers pay, get paid, and access financial services. We do this directly; and through our Platform-as-a-Service, which enables other third parties to leverage the deep infrastructure we have built for endless possibilities.

Oviosu, further explained the three business lines Paga has transformed into from a mobile money operator from inception to a financial services provider includes; Consumer payment: where anyone can open a Paga account from any type of phone, by download Paga App from Apple or android store or dial *242# from any type of phone device.

“With Paga app, you can fund the account, make payments and also have a physical Visa card or a virtual Visa card on the account. This gives you significant convenience over other bank accounts we have in the market today.

You can send money into that account from any bank account or walk into any bank branch to fund the account. You can as well go to any agent and fund or make transactions from the account,” he said.

He added that when he started the business 15 years ago, there was no infrastructure, “we had to build the required infrastructure to support the business. Two years ago, we opened our infrastructure to allow other technology companies to use it for their own business. We called this Platform as a Service. With Platform as a service we are serving 150 businesses who are using our infrastructure to execute their own businesses.

“The third arm of our business is what we called Doroki this a different brand which is super App for retail business. If you are a supermarket you use it to manage your inventory among others. This is the youngest arm of our business” he noted.


Kindly share this post
Continue Reading

E-Business

FG to Fnalise National Intellectual Property Policy  Soon– NCC Boss

Published

on

Kindly share this post

Dr John Asein, director-general, Nigerian Copyright Commission (NCC), has said that the federal government is taking steps to finalise its National Intellectual Property (IP) Policy and Strategy for the country.

FG to Fnalise National Intellectual Property Policy  Soon– NCC Boss

Asein disclosed this on Friday while commemorating the 2024 World Intellectual Property Day with the theme “IP and the SDGs: Building Our Common Future with Innovation and Creativity’’ in Abuja.

The that the Day is observed every April 26 to celebrate the importance of intellectual property (IP) rights to encourage innovation and creativity.

The director-general was represented by  Mr Emeka Ogbonna, director of Legal.

NCC boss said the policy would serve as a blueprint for a more efficient modern and responsive legal and administrative framework for the country to leverage on its creative and innovative potential.

He said that the day underscored the power of innovation and creativity in achieving the Sustainable Development Goals (SDGs) and shaping a sustainable and inclusive future for humanity.

According to him, the SDGs represent a universal call to action to end poverty, protect the planet, and ensure prosperity for all by the year 2030.

“IP rights play a pivotal role in fostering innovation, creativity, and technological advancements. They provide the framework that encourages men and women to develop new solutions that address global challenges.

“It is the lynchpin for incentivising the use of creative and innovative ideas to solve many of the challenges that confront humanity.

“This year’s World IP Day reminds us that intellectual property can be a powerful tool for social, economic, and environmental development.

“It encourages individuals, businesses, and governments to leverage IP rights to drive innovation, create jobs, and build resilient communities.

“By aligning our intellectual property policies and strategies with the objectives of the SDGs, we can accelerate their achievement,’’ NCC boss said.

He said in the spirit of the “Renewed Hope Agenda’’ of the present administration, government had also shown appreciable commitment to the creative industry as a major sector of the economy.

“As one of the agencies responsible for the wholesome development of the creative sector, the Nigerian Copyright Commission will continue to provide the needed institutional, legal and administrative support for the protection, promotion, regulation and enforcement of copyright.

“The commission will pay particular attention to using the copyright system to advance Goal 1 (No poverty); Goal 4 (Quality education); Goal 5 (Gender equality).

“And Goal 8 (Decent and economic growth); Goal 9 (Industry, innovation and infrastructure) and Goal 17 (Partnerships to achieve the goals).

“We are aware that the goals would have to be adapted to fit the peculiar needs of intellectual property which is an intangible asset.’ ’he added.

The director-general, who said that the commission focused on the 17 SDGs to address emerging challenges, called on authors, innovators, users, IP experts and other stakeholders to reflect on the vulnerability of the nation’s fragile knowledge and creative ecosystem.


Kindly share this post
Continue Reading

E-Business

NITDA, ICF Train 100 Schoolgirls in ICT Skills

Published

on

Kindly share this post

The National Information Technology Development Agency (NITDA) and Illmi Children’s Fund (ICF) have trained 100 schoolgirls in digital and Information and Communication Technology skills training.

Mrs. Maryam Augie-Abdulmumin, ICF Executive Director, confirmed this in a statement on Thursday in Lagos.

The graduation followed the training of the schoolgirls in ICF and NITDA’s DIGITGALS 2.0 programme, a collaborative initiative aimed to equip adolescent girls in Abuja with critical digital and ICT skills.

Augie-Abdukmumin said the DIGITGALS 2.0 centred around essential digital literacy, programming fundamentals, digital marketing and communication skills, and cybersecurity awareness.

She added that the girls were equipped with the confidence to compete and excel in a globalised digital economy. The graduation was in commemoration of the 2024 International Girls in ICT Day celebration on April 25.

DIGITGALS 2.0 is in its second phase and empowered 100 senior secondary school girls selected from five government schools in the Federal Capital Territory.

The girls aged between 15 and 18 years were equipped with the knowledge and tools needed to thrive in the digital world and address the growing demand for ICT skills in the 21st century.

Augie-Abdulmumin reiterated the importance of bridging the digital gap in the country starting with the girl-child.

“This graduation ceremony on International Day of Girls in ICT is a powerful symbol of our commitment to closing the digital gender gap.

This programme made possible through our partnership with NITDA, and signifies a crucial step towards bridging the digital gender gap.

It also fostering a future where women are active leaders in the tech industry. This is also an opportunity for these girls to take charge of their own future,”.

Mr Kashifu  Abdullahi, the Director-General of NITDA, commended the collaborative efforts of ICF in making the DIGITGALS 2.0 a reality.

According to him, building a diverse and inclusive digital workforce is critical for Nigeria’s success.

“We are proud to collaborate with ICF on DIGITGALS 2.0 to empower these young women to become active participants in the tech industry. This programme showcases the importance of collaborative efforts in bridging the digital gender gap.

These girls have been equipped with essential digital skills, and ICF and NITDA are confident they will become active contributors to Nigeria’s thriving tech landscape,”.

ICF is a non-profit organisation dedicated to improving the lives of children, from underprivileged backgrounds, through education, healthcare, technology and entrepreneurship initiatives.

NITDA is a public service institution established in 2007. It functions as the ICT policy implementing arm of Nigeria’s Federal Ministry of Communication and Digital Economy.


Kindly share this post
Continue Reading

Trending