Secusmart offers encrypted calls for Android, BlackBerry

Worried about eavesdroppers? This microSD card with a built-in encryption chip locks down conversations between smartphones in real time.

HANOVER, Germany--Wish you had one of those spy-movie scramblers the president uses to to keep snoopers from tapping into his calls?
At the CeBIT show here, Secusmart debuted a microSD card with a built-in processor that lets people do just that with ordinary smartphones. It plugs into phones with a microSD slot--yes, that means no iPhones--then encrypts voice and SMS communications.
The technology uses VoIP (voice over Internet Protocol) to actually place the calls, which means it needs 3G or Wi-Fi connections, said Hans-Christoph Quelle, a managing director at the German company. With that connection, it provides real-time, full-duplex communications--in other words, with no delays and with both callers able to talk at the same time.
It works on Android and BlackBerry phones today, Quelle said.
The technology sets up a connection between smartphones with the card that's protected with 180-bit AES encryption. It also can link into an organization that builds the technology into its own phone network.
It's not clear how much it costs, though--Quelle declined to share specifics. It's not for the average person, but the audience is growing. Politicians such as the German chancellor's office and other authorities are the initial market, but businesses, too, are becoming candidates.

Read More

U.S. senators: No time to lose on strengthening cybersecurity

Four U.S. senators sound a warning on cybersecurity, comparing our time to the days prior to September 11, 2001--the system is blinking red, and we are failing to connect the dots. Again.
Editor's note: This op-ed was co-authored by Sens. John D. Rockefeller IV, (D-W.Va.), Joe Lieberman (I-Conn.), Susan Collins (R-Maine), and Dianne Feinstein (D-Calif.). In February, these four senators jointly sponsored the Cybersecurity Act of 2012, a bill that has been in the works for more than three years.
Every day, rival nations, criminal syndicates and maybe even terrorists probe for weaknesses in our most critical computer networks, seeking to steal data, money, and identities. Even more dangerous is their potential to plant malicious code in industrial control systems that would allow them to seize control of a region's electric grid, crash stock markets, or contaminate water supply with the touch of a key from a world away.
It feels like we're back to the days before September 11, 2001. The system is blinking red. Yet, we are failing to connect the dots--again.

In a letter last year to Senate leadership, former Homeland Security Secretary Michael Chertoff and Defense Secretary William Perry, along with six of our nation's premier security experts, spanning Democratic and Republican Administrations, issued a stark warning: "[The] constant barrage of cyber assaults has inflicted severe damage to our national and economic security, as well as to the privacy of individual citizens. The threat is only going to get worse. Inaction is not an acceptable option."
We agree it is time to take action. To counter these threats, we have introduced the comprehensive, bipartisan Cybersecurity Act of 2012 (PDF). Our bill has several key provisions.
First, it ensures that the systems that control our most critical infrastructure are secured. These are the systems that if breached or manipulated could reasonably lead to mass casualties, evacuations of major population centers, the collapse of financial markets, or degradation of our national security. A competing bill recently introduced in the Senate contains no provisions whatsoever to protect critical infrastructure. That is a major omission.
After identifying these precise systems, the Department of Homeland Security would then work with private-sector owners of these vital systems to develop cybersecurity performance requirements based on risk assessments of those particular industries. Covered entities must meet these performance requirements for specific systems and assets, not for their entire company.
Owners would have the flexibility to meet those performance requirements with whatever cybersecurity measures they choose as long as it achieves the required level of security. DHS will not be picking technological winners and losers, and there is nothing in this bill that would stifle innovation. Leading global information companies have even stated that that this legislation "includes a number of tools that will enhance the nation's cybersecurity, without interfering with the innovation and development processes of the American IT industry."
And if a company already has security levels that meet the requirements, it will be exempt, and entities already adequately regulated will receive waivers.
Data sharing between feds, private sector
This bill also establishes mechanisms for information sharing between the private sector and the federal government - and among private sector companies. This is important -- computer security experts need to be able to compare notes in order to protect us against the ever-evolving threat. But the bill also creates security measures and oversight to protect privacy and preserve civil liberties.
We have worked hard to address the concerns of privacy and civil liberties advocates and believe our approach offers some of the strongest protections of any proposal being discussed in Congress.
Besides securing critical infrastructure, this bill does several other important things: It provides for a cybersecurity research and development program to further strengthen our computer defenses; improves the security of the federal government's computer networks by moving to a system of continuous monitoring and "red-teaming" exercises to test for vulnerabilities, and strengthens the federal cybersecurity workforce by making sure we can offer competitive salaries to recruit and retain some of the best minds in the business.
This bipartisan bill has been at least three years in the making, with some 20 hearings held across seven different Senate committees, including at least 13 in our committees: the Homeland Security and Governmental Affairs Committee, the Commerce Science and Transportation Committee, and the Select Intelligence Committee. Homeland Security and Commerce each passed comprehensive cybersecurity bills in the last Congress. We have reached out to industry, academics, and civil liberties, privacy, and security experts for advice. Hundreds of changes have been made to this bill as a result of their input.
There is a myth that earlier versions of this bill contains a "kill switch" that would allow the president to seize control of the Internet. There is nothing remotely like that in this bill.
There is also nothing in this bill that touches on the balance between intellectual property protections and free speech that inflamed public opinion over the proposed "Stop Online Piracy Act," or the "Protect IP Act." This legislation will not regulate the design or architecture of the Internet. This bill is focused on protecting our most critical infrastructure systems and assets--those that keep the water flowing, the power on, and the trains running.
September 11 reinforced the need to stay one step ahead of those who would do us harm. Now we must apply those lessons to cybersecurity. If we fail to act, we only increase the likelihood that we will have to cope with the aftermath of a massive cyber attack."

Read More

Don't get faked by Android antivirus apps

Most Android security apps are worthless when it comes to protecting you against mobile malware, according to a new study.

If you're worried about Android malware, choose wisely. There's a good chance that your trusted security app does little to protect you, says a new report from independent testing organization AV-Test.

In a preview of the study e-mailed yesterday, AV-Test's CEO Andreas Marx revealed that desktop antivirus vendors that have migrated to Android performed the best. Avast, Lookout, Dr. Web, Zoner, F-Secure, Ikarus, and Kaspersky detected 90 percent or more of the 618 types of malicious Android APK files that they were tested against. Lookout and Zoner are notable standouts because they are only available as mobile apps, and have no PC-based counterpart.

"Using these products you don't have to worry about your malware protection," wrote Marx. He also emphasized that the security apps that tested between 65 percent and 90 percent were very good and could easily improve their detection because several apps in this category missed one or two malware families. These malware families may not be threats in "certain environments," he wrote, which may account for the lower scores.

The apps in this second group include the PC antivirus vendors AVG, Bitdefender, ESET, Norton (Symantec,) QuickHeal, Trend Micro, Vipre (GFI,) and Webroot; and two mobile-only vendors, AegisLab and SuperSecurity.

A third group comprised entirely of PC security suite vendors scored between 40 and 65 percent detections, and included Bullguard, Comodo, G Data, McAfee, NetQin and Total Defense. The report explains that their Android woes might also be due to insufficient sample collection infrastructure--basically, they might be too new to the field.

Twelve more apps detected more than zero percent but less than 40 percent of the samples, and a final group of six apps detected nothing at all. While the report hedges its bet and says that its possible that the apps detect threats that weren't among the 618 samples, it's more likely that they simply do not work at all. Alphabetically, these final six are Android Antivirus, Android Defender, LabMSF Antivirus beta, MobileBot Antivirus, MT Antivirus, and MYAndroid Protection Antivirus.

Overall, less than half of the 41 apps tested during February were found worthy; only 17 made the cut above 65 percent. The test was conducted using a combination of the Android SDK, which replicates a scalable environment, and an actual Android device for when the SDK wouldn't work. The SDK would not suffice when the app called for SMS activation, or when the 3G network was too finicky to provide a stable cloud connection. The end result was that all results were cross-checked in the SDK, emulating API level 10 (Gingerbread 2.3,) and on a real device, a Samsung Galaxy Tab running Froyo 2.2 and a Samsung Galaxy Nexus with Ice Cream Sandwich 4.0. Apps were allowed to update to their latest versions before testing, and to connect to the cloud during testing.

But is my favorite app really worthless?

The authors state in the report how challenging it is to correctly identify active, threatening malware on Android. In the report, they chalk this up to three factors: the relatively small number of malware samples; the challenge in figuring out how prevalent malware apps are; and the fact that, problems aside, malware apps are removed fairly rapidly from the Android Market and the even the user's own device.

Also, none of the ancillary security features were tested, such as remote lock and wipe, lost or stolen device location options, or data backup.

AV-Test concludes that it's possible to have sample sets that are easily marred by malware that is no longer or never has been relevant. Why even bother testing if the results are so hard to replicate? The report explains that to limit the problems of these variables, only the most widely known malware families were used, and only those discovered between August and December 2011. By looking at the family detection rates, AV-Test says, "it is still possible to get a fairly accurate picture of the absolute detection rate." For malware detection, AV-Test recommends any of the 17 apps that finished above 65 percent. It advocates using one because of the ability for ostensibly benign apps to download malware after they've been installed.

All these problems are symptomatic of the larger challenge that the security industry has in justifying its existence.

Read More

Hi-def fiber tracking helps pinpoint brain damage

Researchers at the University of Pittsburgh hope the new imaging technique will help them identify neural connections broken by traumatic brain injuries and other neurological disorders.

When a 32-year-old man crashed his all-terrain vehicle without wearing a helmet, he slipped into a coma for three weeks. Though his initial CT scans revealed bleeding and swelling, and an MRI scan a week into the coma revealed bruising and swelling in the same area, neurosurgeons had no way of knowing precisely how the man would be affected if he did come out of his coma.
Three weeks later, the man awoke without the ability to move his left leg, arm, or hand. Only then were doctors able to begin planning rehabilitation.
Fortunately for the patient, a novel imaging technique called High Definition Fiber Tracking (HDFT)--developed by a team at the University of Pittsburgh--has helped identify which of his neural pathways were disrupted, according to Walter Schneider, the professor of psychology and neurosurgery who led the team that developed the tech at Pitt's Learning Research and Development Center.
HDFT, which the team reports on this month in a case study in the Journal of Neurosurgery, runs computer algorithms on data collected from MRI scans to view the brain's fiber tracts, each of which contains millions of connections.
"We can virtually dissect 40 major fiber tracts in the brain to find damaged areas and quantify the proportion of fibers lost relative to the uninjured side of the brain or to the brains of healthy individuals," Schneider reports in a school release. "Now, we can clearly see breaks and identify which parts of the brain have lost connections."
HDFT collects data from 257 directions; the state-of-the-art imaging technique called diffusion tensor imaging (DTI), by comparison, uses 51. Researchers took both types of scans of the patient at four and 10 months post-injury, but only the HDFT method revealed a lesion in a motor fiber pathway that would explain left-sided weakness and extensive fiber breaks in the region that controls his left hand.
The patient, by the way, eventually regained movement in his left leg and arm but continued to struggle to use his wrist and fingers at the 10-month mark.
While the Pitt neurosurgeons have used HDFT to map approaches to remove tumors and other abnormalities, they say much work remains to evaluate and ultimately validate HDFT as a new imaging standard. Still, they hope to some day use the fiber tracking to identify breaks that might explain not only motor problems but also memory loss and personality changes that can occur with traumatic brain injuries.

Read More

Wii active video games don't count as exercise

A new study shows that kids who play Wii Sports or Dance Dance Revolution are as active as those who play Disney Sing-It Pop Hits or Super Mario Galaxy.

It seemed like the perfect setup--give kids video games that would motivate them to get off the couch and start moving. Not only would they have fun, they would also get healthier.
However, these high hopes may have been wishful thinking. According to a new study by Baylor College of Medicine in Houston, Texas, kids given "active" video games showed no more overall physical exertion than kids who used only their thumbs to play.
"There was no evidence that children receiving the active video games were more active in general, or at anytime, than children receiving the inactive video games," reads the study. "These results provide no reason to believe that simply acquiring an active video game under naturalistic circumstances provides a public health benefit to children."
For the study, researchers gave 78 children, who were above-average weight and between the ages of 9 to 12, a Nintendo Wii console. Half of the kids got "active" video games like Wii Sports and Dance Dance Revolution-Hottest Party 3, and the other half got "inactive" games, such as Disney Sing-It Pop Hits or Super Mario Galaxy. Over the course of the 13-week study, researchers kept logs of their play times and activity levels.
"We expected that playing the video games would in fact lead to a substantial increase in physical activity in the children," Tom Baranowski, lead researcher on the study, told Reuters in an interview. "Frankly, we were shocked by the complete lack of difference."
Researchers tallied the children's average time of moderate or vigorous activity and came up with between 25 to 28 minutes a day for the kids who played active games and between 26 and 29 minutes a day for the kids with inactive games.
Earlier studies, such as one by the University of Massachusetts in Boston that came out last year, showed that interactive games could improve moderate or even vigorous activity while playing.
Baranowski told Reuters he isn't sure why the results came out nearly the same for both groups; one suggestion is that possibly the children in the active group played with minimal effort, another is that they exercised less than they otherwise would throughout the day.

Read More

$199 Samsung Galaxy Nexus may hit Verizon on April 5th

If you crave a cheaper Galaxy Nexus on Verizon, a $199 model with less memory could do the trick.

Samsung's Galaxy Nexus on Verizon costs a steep $299 even after commitment to a two-year contract. If you're willing to live with half the internal memory, a 16GB model could be heading to Big Red on April 5th for $100 less.
According to Android blog Droid Life, this lower-priced GNex will feature many of the same tasty features of its more expensive sibling including Android 4.0 Ice Cream Sandwich, an AMOLED screen, and dual-core processing, along with Verizon LTE 4G data.
It all sounds great but when you consider the Galaxy Nexus lacks a microSD slot and relies entirely on internal storage, this might not be such a sweet deal. This is especially true if you plan to fill the phone up with tons of audio tracks or high-quality video.
Another device is rumored to arrive a few weeks later, on April 26th, is the HTC Droid Incredible 4G. The handset is likely based on the previously reported HTC Fireball, another 4G LTE phone.

Read More

Install Windows 8 virtually with free software

You can install the new Windows 8 beta in a virtual environment using the free Oracle VirtualBox or VMWare Player. Here's how

Don't have a dedicated PC on which to install Windows 8? No problem. Just install the OS virtually on an existing PC using a free virtual machine utility.
Various VM applications will let you install an operating system in a virtual environment on your Windows desktop or laptop. But not all are free and not all support the latest Windows 8 beta.
A product such as VMWare Workstation 8 supports Windows 8 but costs $200. Microsoft's own Windows Virtual PC is free but won't accept Windows 8 as a guest.
Instead, you can use Oracle's VirtualBox or VMWare's VMWare Player 4.0. Both are free and both support Windows 8.
To get started, you'll first want to download the Windows 8 beta, aka Consumer Preview, as an ISO file.
You can download Windows 8 from here. After selecting the Visit site button, click the button to Get it Now and then choose the option to "download Windows 8 Consumer Preview in ISO format instead." You can download the ISO file as either a 32-bit or 64-bit version. Both VirtualBox and VMWare Player support 64-bit Windows as a guest. Note the Windows 8 serial number as well.
Installing Windows 8 using VirtualBox
You can download Oracle VirtualBox from here. Install the downloaded exe file. After installation, open the folder for Oracle VM VirtualBox from the Start Menu Programs area and click the shortcut of the same name.
In the VirtualBox software, click the New icon on the program's toolbar. From there, just follow the steps to create a new Virtual Machine. Type Windows 8 as the name for the virtual machine. VirtualBox will automatically set the version as Windows 8. Set aside a reasonable amount of memory. You'll need 1 GB at a minimum but 2 GB or more is better if you can spare it.
Choose the option to create a new virtual disk. Select VDI as the file type. You can set the virtual disk to expand dynamically in size. Otherwise, choosing a fixed disk size should help Windows 8 run faster. If you opt for a fixed disk, 20 GB is the minimum. But if you plan to install any apps, you'll want to set it higher, maybe 30 GB or 40 GB.
Finally, select the option to create your virtual disk. VirtualBox will take a few minutes to set up the disk. You'll then see the Windows 8 virtual disk listed. Click the Start button to power it on.

The First Run Wizard will open to help you install the OS as a virtual machine. In the Select Installation Media screen, click the folder icon at the right of the Media Source drop-down field. Navigate to and select the Windows 8 ISO file that you downloaded. Click Next and then Start to set up the OS.
VirtualBox will now install Windows 8 as a virtual machine. You'll see the usual screens and prompts for installing the OS. Along the way you'll also receive a series of messages that explain how VirtualBox will let you interact with the VM.
After Windows 8 is installed, you can run it just as you would on a dedicated PC. You can also resize the VM window or switch it to full screen.
By default the VM window will display menus at the top for VirtualBox. You can view and tweak certain settings by clicking the Machine menu and choosing Settings. You can also access the user manual for VirtualBox by clicking the Help menu and choosing Contents.

Installing Windows 8 using VMWare Player
VMWare Player is a free and more limited version of VMWare Workstation, but you can use it to install and run a variety of operating systems.
Download VMWare Player from here. Register at the VMWare Web site to get the software and choose the link for VMware Player for 32-bit and 64-bit Windows. After installing the downloaded file, you'll need to reboot your PC.
After your computer is back up, open the VMWare folder from the Start Menu Programs area and select the shortcut for VMWare Player.
In the VMWare Player software, click the option to Create a New Virtual Machine. But don't choose the option to install from the ISO file at this point, otherwise you'll receive an error when VMWare tries to set up Windows 8. Instead, select the option "I will install the operating system later" and click Next.
Choose Microsoft Windows as the guest operating system and Windows 7 x64 as the version (assuming you're using the 64-bit version of Windows 8). Click Next. Name the virtual machine Windows 8. Click Next. Keep the maximum size at 60 GB but choose the option to store the virtual disk as a single file for the best performance. Click Next and then Finish.
You should now see Windows 8 listed as a new virtual machine.

Click the option to Edit virtual machine settings. Under Hardware select CD/DVD as the device. Select the option to use ISO image and navigate to the ISO file for Windows 8. Click OK. Then select the option to Play virtual machine.
The Windows 8 installation will begin, and you can set it up as you normally would. After the OS is installed, select the option at the bottom to Install Tools. This will install the free VMWare Tools software, which can boost the performance of your virtual machine's guest.
Windows 8 should run smoothly in a virtual machine as long as you devote enough disk space and memory to it. You may need to tweak some of the settings to coax the best performance.
Another alternative is to install Windows 8 in a dual-boot scenario where the new OS and your existing version of Windows each reside in a separate bootable partition. But installing the new beta in a VM is always a handy option when you don't have a dedicated PC and can use such free tools as VirtualBox or VMWare Player.

Read More