UnknowingFool writes "Over a year ago, Nest Labs launched the Learning Thermostat. The brainchild of Tony Fadell, former head of Apple's iPod and iPhone division, the Learning Thermostat promised a self-programming and wifi-enabled thermostat that would save energy costs. After some glowing reviews, Nest found itself in a patent infringement lawsuit against Honeywell. Nest responded with multiple claims calling Honeywell 'worse than a patent troll.' Among Nest's claims: Honeywell hid prior art (some on some previous patents that they owned) and inapplicable patents (patent on mechanical potentiometer when Nest's product does not include one). Nest's stance is that Honeywell filed the lawsuits not to extract money but to set back progress so that they can control the industry."

colinneagle writes "Microsoft's recent announcement that it will end support for the Windows XP operating system in two years signals the end of an era for the company, and potentially the beginning of a nightmare for everyone else. When Microsoft cuts the cord on XP in two years it will effectively leave millions of existing Windows-based computers vulnerable to continued and undeterred cyberattacks, many of which hold the potential to find their way into consumer, enterprise and even industrial systems running the latest software. Although most of the subsequent security issues appear to be at the consumer level, it may not be long until they find a way into corporate networks or industrial systems, says VMWare's Jason Miller. Even scarier, Qualsys's Amol Sarwate says many SCADA systems for industrial networks still run a modified version of XP, and are not in a position to upgrade. Because much of the software running on SCADA systems is not compatible with traditional Microsoft OS capabilities, an OS upgrade would entail much more work than it would for a home or corporate system."

An anonymous reader writes with a snippet from Hack a Day: "Clap On! Clap Off! was super awesome when The Clapper came out in the mid-eighties. Now [Mathieu Stephan] is trying to make the concept much more functional. He put together a controller that lets you knock on walls to control things around the house. It's called the Toktoktok project and uses small boxes to receive user input and control items like lamps and computers." As the project website points out, Stephan is keeping the project intentionally open.

redletterdave writes "Apple won a major patent for its 'iWallet' technology, which is a digital system that uses near-field communication (NFC) technology to complete credit card transactions and manage subsidiary financial accounts directly on your iPhone. On the home screen for iWallet, users can see their entire credit card profiles, statements, messages from their banks, and even adjust preferences or add additional cards. Within preferences, users can schedule credit card payments and set parental controls on their children, which allows kids to use their iPhones as wallets but limits the extent to which they can use it. Users can track their payments and statements within the iTunes billing system, which keeps the credit card information safe and secure."

New submitter DeanCubed writes "In a Nintendo investor meeting, CEO Satoru Iwata confirmed a new Nintendo Network for the company's 3DS and upcoming Wii U game systems. This includes multiple user accounts per console (not tied to hardware, a first for Nintendo) and digitally distributed retail software releases for their online store. Iwata also noted that the Wii U's tablet controller will feature NFC (Near Field Communication) functionality, allowing the ability to use figurines and cards to input visual data to the console. They are hoping to use this to make micro-transactions for paid DLC easier."

Trailrunner7 writes "At the S4 security conference this week, 'Project Basecamp,' a volunteer-led security audit of leading programmable logic controllers (PLCs), performed by a team of top researchers found that decrepit hardware, buggy software and pitiful or nonexistent security features make thousands of PLCs vulnerable to trivial attacks by external hackers that could cause PLC devices to crash or run malicious code. 'We were looking for a Firesheep moment in PLC security,' Peterson told the audience of ICS security experts. They got one. 'It's a blood bath mostly,' said Wightman of Digital Bond. 'Many of these devices lack basic security features.' While the results of analysis of the various PLCs varied, the researchers found significant security issues with every system they tested, with some PLCs too brittle and insecure to even tolerate security scans and probing."

ptorrone writes "Limor 'Ladyada' Fried's NYC based Open-source electronics studio, Adafruit, today announced their new open wearable platform called the FLORA (blog post & video). The FLORA is Arduino compatible as well as supporting a variety of sensors and add-on devices including: Bluetooth, GPS, 3-axis accelerometer, compass module, flex sensor, piezo, IR LED, push button, embroidered + capacitive keypad, OLED and more. The first round of hardware is in the hands of testers to create wearable projects."

Orome1 writes "Many prisons and jails use SCADA systems with PLCs to open and close doors. Using original and publicly available exploits along with evaluating vulnerabilities in electronic and physical security designs, researchers discovered significant vulnerabilities in PLCs used in correctional facilities by being able to remotely flip the switches to 'open' or 'locked closed' on cell doors and gates."

An anonymous reader writes "Despite the U.S. and Israel being widely assumed to be responsible for Stuxnet, Russia is the more likely culprit, says U.S. Air Force cyber analyst. The nuclear gangsterism of the past 20 years gives it plenty of motive. Quoting: 'So what better way to maintain Russian interests, and innocence, than to plant a worm with digital U.S.-Israeli fingerprints? After all, Russian scientists and engineers are familiar with the cascading centrifuges whose numbers and configuration – and Siemen’s SCADA PLC controller schematics – they have full access to by virtue of designing the plants. ... the observers of the virus could alert the Iranians before full nuclear catastrophe struck. The Belarusian computer security experts who 'discovered' the code seemingly played that role well. They didn't seem too preoccupied with reverse engineering the malicious code to see what it was designed to do.'"

Trailrunner7 writes "In an e-mail interview with Threatpost, a hacker who compromised software used to manage water infrastructure for South Houston, Texas, said the district had HMI (human machine interface) software used to manage water and sewage infrastructure accessible to the Internet and used a password that was just three characters long. The hacker, using the handle 'pr0f' took credit for a remote compromise of supervisory control and data acquisition (SCADA) systems. Communicating from an e-mail address tied to a Romanian domain, the hacker told Threatpost that he discovered the vulnerable system using a scanner that looks for the online fingerprints of SCADA systems. 'This was barely a hack. A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail."

An anonymous reader writes "In a breakthrough that could aid spies, keepers of medical records, and parents who want to prevent their kids from 'sexting,' a team of Virginia Tech researchers has created software to remotely put smart phones under lockdown. The phones are given permission to access sensitive data while in a particular room, but when the devices leave the room, the data is completely wiped. A general, for example, could access secret intelligence while visiting a secure government facility without fear that his or her smart phone or tablet computer might later be lost or stolen, the team's lead researcher said. 'This system provides something that has never been available before. It puts physical boundaries around information in cyberspace.'" Unless the phone or other device can also take screenshots, or doesn't have that software installed.

chicksdaddy writes "With the one year anniversary of Stuxnet upon us, a senior cybersecurity official at the Department of Homeland Security says the agency is reevaluating whether it makes sense to warn the public about all of the security failings of industrial control system (ICS) and SCADA software used to control the U.S.'s critical infrastructure. DHS says it is rethinking the conditions under which it will use security advisories from ICS-CERT to warn the public about security issues in ICS products. The changes could recast certain kinds of vulnerabilities as 'design issues' rather than a security holes. No surprise: independent ICS experts like Ralph Langner worry that DHS is ducking responsibility for forcing changes that will secure the software used to run the nation's critical infrastructure. 'This radically cuts the amount of vulnerabilities in the ICS space by roughly 90%, since the vast majority of security "issues" we have are not bugs, but design flaws,' Langner writes on his blog. 'So today everybody has gotten much more secure because so many vulnerabilities just disappeared.'"

mask.of.sanity writes "An Italian security researcher, Luigi Auriemma, has disclosed a laundry list of unpatched vulnerabilities and detailed proof-of-concept exploits that allow hackers to completely compromise major industrial control systems. The attacks work against six SCADA systems, including one manufactured by U.S. giant Rockwell Automation. The researcher published step-by-step exploits that allowed attackers to execute full remote compromises and denial of service attacks. Auriemma appeared unrepentant for the disclosures in a post on his website."

Hugh Pickens writes "Some of the same vulnerabilities that the Stuxnet superworm used to sabotage centrifuges at a nuclear plant in Iran exist in the country's top high-security prisons where programmable logic controllers (PLCs) control locks on cells and other facility doors. Researchers have already written three exploits for PLC vulnerabilities they found. 'Most people don't know how a prison or jail is designed; that's why no one has ever paid attention to it,' says John Strauchs, who plans to discuss the issue and demonstrate an exploit against the systems at the DefCon hacker conference next week. 'How many people know they're built with the same kind of PLC used in centrifuges?' A hacker would need to get his malware onto the control computer either by getting a corrupt insider to install it via an infected USB stick or send it via a phishing attack aimed at a prison staffer, since some control systems are also connected to the internet, Strauchs claims. 'Bear in mind, a prison security electronic system has many parts beyond door control such as intercoms, lighting control, video surveillance, water and shower control, and so forth,' adds Strauchs. 'Once we take control of the PLC we can do anything (PDF). Not just open and close doors. We can absolutely destroy the system. We could blow out all the electronics.'"

siliconbits writes "Two months after Apple joined the Bluetooth special interest group board, the company launched the world's first truly mainstream Bluetooth 4.0 devices, namely the new Macbook Air & Mac Mini 2011 editions. The products came only one year after the official core specifications of Bluetooth 4.0 were adopted and it looks likely that Apple fast-tracked Bluetooth 4.0's adoption so that the forthcoming iPhone 5 can use this technology with at least one Apple product. This could mean that the manufacturer is considering giving up on NFC altogether, a technology embraced by all of its rivals."

ptorrone writes "MAKE Magazine takes a look at the last ten years or so of 'wearable electronics.' From wireless watches to LCD goggles, MAKE predicts we are collectively entering a new era of wearables. As the price for enabling components drops, always-on connectivity in our pockets and purses increases, and access to low-cost manufacturing resources and know-how rises, we'll see innovation continue to push into these most personal forms of computing."

CWmike writes "While near-field communication gradually emerges to turn mobile phones into payment devices, startup Naratte is introducing a system it claims can do roughly the same thing without adding a chip to the handset. On Monday, Naratte introduced Zoosh, a technology that lets phones exchange transaction information via inaudible sound waves. As with NFC, the phone user would just put the phone near to a point-of-sale terminal to redeem a coupon or make a purchase. NFC provides short-range radio communication between phones and point-of-sale devices so users can just tap or point their phones at the device to make a purchase. NFC uses specialized chips, which are already built into a few phones such as the Google Nexus S sold by Sprint Nextel, and are expected in more handsets in the future. Zoosh involves software that utilizes the speaker and microphone in a handset to send and receive audio signals with another device, similar to the way early modems exchange data by sending tones through the handsets of desk phones cradled in coupler devices. The company has posted a video that shows how it works. Between this and barcodes (which Starbucks says is working well already, thank you very much), is NFC already irrelevant?"

alphadogg writes "Two vulnerabilities found in industrial control system software made in China but used worldwide could be remotely exploited by attackers, according to a warning issued on Thursday (PDF) by the US Industrial Control Systems Cyber Emergency Response Team. The vulnerabilities were found in two products from Sunway ForceControl Technology, a Beijing-based company that develops SCADA software for a wide variety of industries, including defense, petrochemical, energy, water and manufacturing. Sunway's products are mostly used in China but also in Europe, the Americas, Asia and Africa, according to the agency's advisory. SCADA software has come under increasing attention from security researchers, as the software has often not undergone rigorous security audits despite its use to manage critical infrastructure or manufacturing processes. SCADA systems are increasingly connected to the Internet, which has opened up the possibility of hackers remotely breaking into the systems. Last year, researchers discovered a highly sophisticated worm called Stuxnet that was later found to target Siemens' WinCC industrial control software."

itwbennett writes "Siemens has fixed a pair of bugs in its S7-1200 controller, which is used to control machines on factory floors, power stations and chemical plants. The bugs were discovered earlier this year by NSS researcher Dillon Beresford, who planned to disclose the bugs at Black Hat in August. The US Department of Homeland Security said that Siemens' patches fix 'a portion' of the problems Beresford has discovered and that it 'continues to work with Siemens and Mr. Beresford on the other reported problems.'"

jfruhlinger writes "Google today announced Google Wallet, an NFC-based payment system that will allow people to pay for purchases just by waving their phone across a reader. It's the beginning of a future where commercial transactions are 'frictionless' and convenient — but it's a future where every transaction can be tracked and data-mined, as Dan Tynan points out. Stores can user information about your Doritos purchases to rearrange their wares; Google could push coupons via its new Google Offers service; your health insurance company might be interested in your sodium intake."