Wearables – smartwatches and miniature electronic devices like Google Glass – are the new class of personal connected devices that allow access to the Web and applications with even greater convenience than smartphones and tablets. However, this plethora of new devices also brings several new security risks that their owners will have to address. Kaspersky Lab is preparing a series of articles on the risks of connected devices and our hyper-connected world in order to alert the public to the security implication of the ‘Internet of Things’.
Featured Download: CISO Data Breach Guide
This time, the Company’s researchers Roberto Martinez and Juan Andres Guerrero looked into Google Glass and Samsung Galaxy Gear 2, exploring how they could affect people’s privacy and security.
Google Glass and the Man-in-the-Middle (MiTM) There are two ways to surf the Web from Google Glass: through Bluetooth by pairing with a mobile device that shares its data network connection, or directly through Wi-Fi. The latter gives the user more freedom since it doesn’t require a separate mobile device in order to get to the Web. However, according to Roberto Martinez, researcher at Kaspersky Lab, this functionality also means that the Glass is exposed to network vector attacks, particularly MiTM when a communication between two systems can be intercepted.
This was discovered in an experiment conducted by Kaspersky Lab researchers. They attached the device to a monitored network and checked the data it transmitted. The results of the captured data analysis showed that not all the traffic exchanged between the device and the hot spot was encrypted, so in this case, it was possible to find out that the attacked user was looking for airlines, hotels and tourist destinations. In other words, it was possible to perform a profiling task, a simple form of surveillance.
“We admit that it is not a very damaging vulnerability, but even so, profiling via meta data from Web traffic exchange could become the first step of a more complex attack against the device’s owner,” said Roberto Martinez, who performed the investigation.
Galaxy Gear 2 and its spying potential As Kaspersky Lab researcher Juan Andres Guerrero discovered when he examined his Samsung Galaxy Gear 2, the device is deliberately designed to make a loud noise and warn people nearby if it is being used to take a photo. A deeper look into the software of Galaxy Gear 2 revealed that after rooting the device and using Samsung’s publicly available proprietary software tool ODIN, it is possible to enable Galaxy Gear 2 to take pictures with its embedded camera silently. This obviously opens the door to possible scenarios in which Galaxy Gear 2 could violate other people’s privacy.
A tool for espionage Silencing the camera is not the only way to turn a device into a spying tool. Dedicated apps for Galaxy Gear 2 are loaded onto the device with help of Gear Manager, a special app by Samsung designed to transmit an app from the smartphone to the smartwatch. As Juan discovered, when an app is installed on the smartwatch’s operating system there is no notification shown on the watch display. This obviously makes targeted attacks involving silent app installation possible.
“At this time there is no evidence to suggest that wearables are currently being targeted by professional APT actors,” commented Juan Andres Guerrero. “However there is a twofold appeal presented by wearables that make them a likely future target if they are widely adopted by consumers. In future the data collected by wearable devices is going to attract new players to the cyber-espionage scene.”
[wp_ad_camp_4]
More information about Google Glass and Galaxy Gear 2 smartwatch security risks can be found on Securelist.com.
About Kaspersky Lab
Kaspersky Lab is the world’s largest privately held vendor of endpoint protection solutions. The company is ranked among the world’s top four vendors of security solutions for endpoint users. Throughout its more than 16-year history Kaspersky Lab has remained an innovator in IT security and provides effective digital security solutions for large enterprises, SMBs and consumers. Kaspersky Lab, with its holding company registered in the United Kingdom, currently operates in almost 200 countries and territories across the globe, providing protection for over 300 million users worldwide. Learn more at www.kaspersky.com.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.