Daily Archives: March 11, 2019

Radio gaga: Techies fear EU directive to stop RF device tinkering will do more harm than good

Posted on by

EU plans to ban the sale of user-moddable radio frequency devices – like phones and routers – have provoked widespread condemnation from across the political bloc.

The controversy centres on Article 3(3)(i) of the EU Radio Equipment Directive, which was passed into law back in 2014.

However, an EU working group is now about to define precisely which devices will be subject to the directive – and academics, researchers, individual “makers” and software companies are worried that their activities and business models will be outlawed.

Article 3(3)(i) states that RF gear sold in the EU must support “certain features in order to ensure that software can only be loaded into the radio equipment where the compliance of the combination of the radio equipment and software has been demonstrated”.

If the law is implemented in its most potentially harmful form, no third-party firmware could be installed onto something like a home router, for example.

Hauke Mehrtens of the Free Software Foundation Europe (FSFE) told The Register: “If the EU forces Wi-Fi router manufacturers to prevent their customers from installing their own software onto their devices this will cause great harm to the OpenWrt project, wireless community networks, innovative startups, computer network researchers and European citizens. This would increase the electronic waste, make it impossible for the user to fix security vulnerabilities by himself or the help of the community and block research which could improve the internet in the EU.”

Source: Radio gaga: Techies fear EU directive to stop RF device tinkering will do more harm than good • The Register

Oh dear, does this not mean you don’t really own the stuff you buy?

Why Is Customer Service So Bad? Because It’s Profitable.

Posted on by

American consumers spend, on average, 13 hours per year in calling queue. According to a 2010 study by Mike Desmarais in the journal Cost Management, a third of complaining customers must make two or more calls to resolve their complaint. And that ignores the portion who simply give up out of exasperation after the first call. In fact, according to a 2017 survey by Customer Care Measurement and Consulting the Carey School of Business at the Arizona State University, over three quarters of complaining consumers were less than satisfied with their experience with the given company’s customer service department.

These accounts seem at odds with the pledges by many companies that they are committed to great customer service. Consider United Airlines, among the lowest ranked of major airlines on customer service, which claims to offer a “level of service to our customers that makes [United] a leader in the airline industry”. This is in line with surveys over time that indicate that consumers consistently perceive that customer service is generally bad and even possibly becoming worse. Despite promises companies make to treat people well, customers don’t seem to be buying it.

There’s some evidence that customer queues may be unavoidable at times. Caller complaints tend to arrive randomly, making it impossible to staff agents to handle unpredictable fluctuations in call volume. But our research suggests that some companies may actually find it profitable to create hassles for complaining customers, even if it were operationally costless not to.

Source: Why Is Customer Service So Bad? Because It’s Profitable.

Smart alarms left 3 million cars vulnerable to hackers who could turn off motors, unlock doors remotely

Posted on by

Two popular smart alarm systems for cars had major security flaws that allowed potential hackers to track the vehicles, unlock their doors and, in some cases, cut off the engine.

The vulnerabilities could be exploited with two simple steps, security researchers from Pen Test Partners, who discovered the flaw, said Friday.

The problems were found in alarm systems made by Viper and Pandora Car Alarm System, two of the largest smart car alarm makers in the world. The two brands have as many as 3 million customers between them and make high-end devices that can cost thousands. Like other smart devices, smart car alarms offer people convenience, allowing owners to find their cars from a distance and unlock their doors from their phones.

Pen Test Partners said it reached out to Viper and Pandora in late February and the companies fixed the security issues in less than a week. They had discovered the flaws last October.

Source: Smart alarms left 3 million cars vulnerable to hackers who could turn off motors – CNET

Freelance devs: Oh, you wanted the app to be secure? The job spec didn’t mention that

Posted on by

Freelance developers hired to implement password-based security systems do so about as effectively as computer science students, which is to say not very well at all.

Boffins at the University of Bonn in Germany set out to expand on research in 2017 and 2018 that found computer science students asked to implement a user registration system didn’t do so securely unless asked, and even then didn’t always get it right.

The scientists speculated that because the surveyed students knew they were taking part in a study, then they didn’t make security a priority. So they modified the experiment to test whether developers unaware that they were participating in a study did any better.

The eggheads – Alena Naiakshina, Anastasia Danilova, Eva Gerlitz, Emanuel von Zezschwitz, and Matthew Smith – describe their findings in a paper titled, “‘If you want, I can store the encrypted password.’ A Password-Storage Field Study with Freelance Developers.”

Their paper is scheduled to be presented at the CHI Conference on Human Factors in Computing Systems Proceedings, which runs from May 4–9, 2019, in Glasgow, Scotland.

Posing as a client trying to build a social networking site, the researchers hired 43 developers for either €100 (~$112) or €200 (~$225) from Freelancer.com to help them create a portion of the fictitious project, the site’s registration system.

Ethics

The deception was approved by the university’s Research Ethics Board and study participants were told after the conclusion of the research that they could withdraw from the study if they wished. None did and only one declined to answer the post-job questionnaire.

The freelancers were hired to work in Java and took anywhere from one to five days to complete the assigned task. Those hired ranged from 22 to 68 years in age (median: 29; mean: 30.34) and 39 of the 43 reported being male. All but two said they’d been programming for at least two years and in Java for at least one year. Most were not fluent in English.

The study confirms previous findings that if you want security, you won’t get it by default; you have to ask for it. “Our sample shows that freelancers who believe they are creating code for a real company also seldom store passwords securely without prompting,” the paper says.

The boffins also found many of the freelancers misunderstood that encryption, hashing and encoding are different things. “We found a number of freelancers were reducing password storage security to a visual representation and thus using Base64 as their preferred method to ensure security,” the paper says. “Additionally, encryption and hashing were used as synonyms, which was often reflected by the freelancers’ programming code.”

Another finding consistent with the student research is that many freelancers (16 in this instance) submitted code copied from the internet.

Source: Freelance devs: Oh, you wanted the app to be secure? The job spec didn’t mention that • The Register