How to catch a cybercriminal: Tales from the digital forensics lab

What is it like to defeat cybercrime? A peek into how computer forensics professionals help bring cybercriminals to justice.

The post How to catch a cybercriminal: Tales from the digital forensics lab appeared first on WeLiveSecurity

/by

Electric scooters vulnerable to remote hacks

A helmet may not be enough to keep you safe(r) while riding an e-scooter

The post Electric scooters vulnerable to remote hacks appeared first on WeLiveSecurity

/by

Facebook privacy settings: Protect your data with these tips

As Facebook turns 16, we look at how to keep your personal information safe from prying eyes

The post Facebook privacy settings: Protect your data with these tips appeared first on WeLiveSecurity

/by

Would you get hooked by a phishing scam? Test yourself

As the tide of phishing attacks rises, improving your scam-spotting skills is never a bad idea

The post Would you get hooked by a phishing scam? Test yourself appeared first on WeLiveSecurity

/by

Week in security with Tony Anscombe

ESET research into a campaign of the Winnti Group – The FBI warns of a job scam – What IoT legislation means for device makers and users

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

/by

Week in security with Tony Anscombe

ESET research into a campaign of the Winnti Group – The FBI warns of a job scam – What IoT legislation means for device makers and users

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

/by

Don’t get sacked! Scams to look out for this Super Bowl

As the teams prepare to battle it out on the gridiron, fraudsters are waiting to intercept your funds

The post Don’t get sacked! Scams to look out for this Super Bowl appeared first on WeLiveSecurity

/by

Winnti Group targeting universities in Hong Kong

ESET researchers uncover a new campaign of the Winnti Group targeting universities and using ShadowPad and Winnti malware

The post Winnti Group targeting universities in Hong Kong appeared first on WeLiveSecurity

/by

Winnti Group targeting universities in Hong Kong

ESET researchers uncover a new campaign of the Winnti Group targeting universities and using ShadowPad and Winnti malware

The post Winnti Group targeting universities in Hong Kong appeared first on WeLiveSecurity

/by

Say hello to OpenSK: a fully open-source security key implementation

Posted by Elie Bursztein, Security & Anti-abuse Research Lead, and Jean-Michel Picod, Software Engineer, Google 

Today, FIDO security keys are reshaping the way online accounts are protected by providing an easy, phishing-resistant form of two-factor authentication (2FA) that is trusted by a growing number of websites, including Google, social networks, cloud providers, and many others. To help advance and improve access to FIDO authenticator implementations, we are excited, following other open-source projects like Solo and Somu, to announce the release of OpenSK, an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.

Photo of OpenSK developer edition: a Nordic Dongle running the OpenSK firmware on DIY case

By opening up OpenSK as a research platform, our hope is that it will be used by researchers, security key manufacturers, and enthusiasts to help develop innovative features and accelerate security key adoption.

With this early release of OpenSK, you can make your own developer key by flashing the OpenSK firmware on a Nordic chip dongle. In addition to being affordable, we chose Nordic as initial reference hardware because it supports all major transport protocols mentioned by FIDO2: NFC, Bluetooth Low Energy, USB, and a dedicated hardware crypto core. To protect and carry your key, we are also providing a custom, 3D-printable case that works on a variety of printers.

“We’re excited to collaborate with Google and the open source community on the new OpenSK research platform,” said Kjetil Holstad, Director of Product Management at Nordic Semiconductor. “We hope that our industry leading nRF52840’s native support for secure cryptographic acceleration combined with new features and testing in OpenSK will help the industry gain mainstream adoption of security keys.”

While you can make your own fully functional FIDO authenticator today, as showcased in the video above, this release should be considered as an experimental research project to be used for testing and research purposes.

Under the hood, OpenSK is written in Rust and runs on TockOS to provide better isolation and cleaner OS abstractions in support of security. Rust’s strong memory safety and zero-cost abstractions makes the code less vulnerable to logical attacks. TockOS, with its sandboxed architecture, offers the isolation between the security key applet, the drivers, and kernel that is needed to build defense-in-depth. Our TockOS contributions, including our flash-friendly storage system and patches, have all been upstreamed to the TockOS repository. We’ve done this to encourage everyone to build upon the work.

How to get involved and contribute to OpenSK 

To learn more about OpenSK and how to experiment with making your own security key, you can check out our GitHub repository today. With the help of the research and developer communities, we hope OpenSK over time will bring innovative features, stronger embedded crypto, and encourage widespread adoption of trusted phishing-resistant tokens and a passwordless web.

Acknowledgements

We also want to thank our OpenSK collaborators: Adam Langley, Alexei Czeskis, Arnar Birgisson, Borbala Benko, Christiaan Brand, Dirk Balfanz, Dominic Rizzo, Fabian Kaczmarczyck, Guillaume Endignoux, Jeff Hodges, Julien Cretin, Mark Risher, Oxana Comanescu, Tadek Pietraszek

/by