Month: July 2018

Facial recognition software sold by Amazon mistakenly identified 28 members of Congress as people who had been arrested for crimes, the American Civil Liberties Union announced on Thursday.

Amazon Rekognition has been marketed as tool that provides extremely accurate facial analysis through photos and video.

The ACLU tested that assertion by using the software to scan photos of every current member of the House and Senate in a database that the watchdog built from thousands of publicly available arrest photos.

“The members of Congress who were falsely matched with the mugshot database we used in the test include Republicans and Democrats, men and women, and legislators of all ages, from all across the country,” the ACLU stated.

The test misidentified people of color at a high rate — 39 percent — even though they made up only 20 percent of Congress. One member falsely cited as a crime suspect was Rep. John Lewis, D-Ga., who first came to prominence as a civil rights leader.

As part of the test, the ACLU said it used Amazon’s default match settings.

But a spokeswoman for Amazon Web Services said in an emailed statement that the ACLU should have changed those settings — and used a higher “threshold,” or percentage that measures how confident Rekognition is in finding a match.

“While 80% confidence is an acceptable threshold for photos of hot dogs, chairs, animals, or other social media use cases, it wouldn’t be appropriate for identifying individuals with a reasonable level of certainty,” she said. For law enforcement, Amazon “guides customers” to set the threshold at 95 percent or higher.

ACLU of Northern California attorney Jacob Snow responded to that comment in an emailed statement: “We know from our test that Amazon makes no effort to ask users what they are using Rekognition for,” he said.

Snow doesn’t think that changing the threshold changes the danger: “Face surveillance technology in the hands of government is primed for abuse and raises grave civil rights concerns.”

Outcry from privacy and civil rights groups has not stopped law enforcement from pursuing the technology. The Orlando, Fla., police force tested Rekognition’s real-time surveillance. The Washington County Sheriff’s Office, near Portland, Ore., has used it to search faces from photos of suspects taken by deputies.

“This is partly a result of vendors pushing facial recognition technology because it becomes another avenue of revenue,” Jeramie Scott, national security counsel at the Electronic Privacy Information Center in Washington, D.C., told NPR. He compared facial recognition software to body cameras worn by law enforcement, which can be used for police accountability or, increasingly, public surveillance.

He stressed the need for debate so that the technology doesn’t become a poor solution for bad policy. “Because of the disproportionate error rate, and because of the real risk of depriving civil liberties posed by facial recognition technology, we need to have a conversation about how and when and under what circumstances this technology should be used by law enforcement, if at all.”

Virgin Galactic has been saying for some time that it will reach outer space this year, and on Thursday it came the closest it has ever gotten. During the third powered flight of the VSS Unity vehicle, the spacecraft reached an altitude of 52km (32.3 miles), just over halfway toward the Kármán line, which generally is regarded as the beginning of space. This is the first time that Virgin Galactic has flown into the mesosphere.

The company also released a few other details about the flight, noting that the spacecraft was released from its carrier aircraft at 14.2km, that its engine burned for 42 seconds, and that the vehicle reached a maximum speed of Mach 2.7. Pilots Dave Mackay and Mike “Sooch” Masucci flew the Unity vehicle on Wednesday morning from the Mojave Air & Space Port.

“It was a thrill from start to finish,” Mackay said after the flight in a company news release. “Unity’s rocket motor performed magnificently again, and Sooch pulled off a smooth landing. This was a new altitude record for both of us in the cockpit, not to mention our mannequin in the back, and the views of Earth from the black sky were magnificent.”

Yesterday, Samsung showed off a supposedly unbreakable OLED panel for smartphones. It’s a flexible OLED with a plastic substrate, covered by a plastic cover window that allows it to bend and flex in ways that your typical glass-covered OLED panel wouldn’t be able to. Because it’s not necessarily ready to be put in your next phone, they instead tried to destroy it with a hammer to build hype.

In the video below, which has a fabulously awkward circus soundtrack and glorious graphics, the presenter bends and twists the panel before going after it with a rubber mallet. Of course, it doesn’t break because it’s not glass, bends in fun ways, and “plastic window is good.”

Will we see this type of display in the upcoming and oft-rumored Galaxy X? Who knows. This bad boy isn’t foldable like that phone is said to be, so it could instead make its way into other products first, which Samsung points out as being display consoles in cars, mobile military devices, and portable game consoles.

Now prepare yourselves, as it’s time to “start pounding the panel with the hammer!”

// Samsung

A large number of device makers is patching a serious vulnerability in the Bluetooth specification that allows attackers to intercept and tamper with data exchanged wirelessly. People who use Bluetooth to connect smartphones, computers, or other security-sensitive devices should make sure they install a fix as soon as possible.

The attack, which was disclosed in a research paper published Wednesday, is serious because it allows people to perform a man-in-the-middle attack on the connection between vulnerable devices. From there, attackers can view any exchanged data, which might include contacts stored on a device, passwords typed on a keyboard, or sensitive information used by medical, point-of-sale, or automotive equipment. Attackers could also forge keystrokes on a Bluetooth keyboard to open up a command window or malicious website in an outright compromise of the connected phone or computer.

Not novel

Bluetooth combines Simple Secure Pairing or LE Secure Connections with principles of elliptic curve mathematics to allow devices that have never connected before to securely establish a secret key needed for encrypted communications. The attack uses a newly developed variant of what cryptographers call an invalid curve attack to exploit a major shortcoming in the Bluetooth protocol that remained unknown for more than a decade. As a result, attackers can force the devices to use a known encryption key that allows the monitoring and modifying of data wirelessly passing between them.

“This attack lets an attacker who can read and modify Bluetooth traffic during pairing force the key to be something they know,” JP Smith, a security engineer and Bluetooth security expert at security firm Trail of Bits, told Ars. “It’s not mathematically/theoretically novel at all, and it’s in fact about the simplest attack you can do on elliptic curve cryptosystems. Notably, this is a protocol-level fault, so if you implemented the Bluetooth spec out of the book (without some optional validation), you have this bug.”

The active man-in-the-middle attack that allows data to be modified works successfully on 50 percent of the pairings, with the remainder failing. A related passive attack works on 25 percent of the pairings. Attackers who don’t succeed on the first attempt are free to try on later pairings. Attacks work even when pairings require the user to type a six-digit number displayed on one device into the other one. Attacks require specialized hardware that probably wouldn’t be hard for more advanced hackers to build or obtain.

In the paper, researchers from Technion–Israel Institute of Technology write:

We would like to point out two major design flaws that make our attack possible. The first design flaw is sending both the x-coordinate and the y-coordinate during the public key exchange. This is unnecessary and highly inadvisable, since it greatly increases the attack surface, while calculating the y-coordinate from a given x-coordinate is simple.

The second major flaw is that although both coordinates of the public keys are sent during the second phase of the pairing, the protocol authenticates only the x-coordinate. We are not aware of any reason why the designers decided to leave the y-coordinate unauthenticated, other than for saving a tiny computational effort. Even though the point validity should be checked by the implementation, our attack could have also been avoided if both coordinates were authenticated.

Another less significant flaw is that in the protocol designers state that “To protect a device’s private key, a device should implement a method to prevent an attacker from retrieving useful information about the device’s private key using invalid public keys. For this purpose, a device can use one of the following methods.” In this quote, the specification uses the term “should” (as opposed to “must”). Therefore, implementors may skip the instruction as it is not mandatory for compliance with the specification.

A variety of devices and software—including those running macOS, iOS, or Android or made by LG or Huawei—have already received patches. In a FAQ, the researchers said Bluetooth from Microsoft “implements an old version of the standard, which is even less secure, rather than the broken contemporary standard.” An advisory from CERT is here.

For attacks to be successful, both of the paired devices must be vulnerable. That means as long as either one is patched, users aren’t susceptible. People who use Bluetooth to transmit sensitive data or control trusted devices should ensure they have installed patches on at least one of them. While patches are available for many mainstream devices, there are likely many more specialized ones used in hospitals, stores, and other environments that will remain unprotected for the foreseeable future. Users of these devices should check with manufacturers.