Qadit Blog

As your day-to-day apparel and accessories are turning into networked mobile electronic devices that attach to your body like smartwatch or fitness band, the threat to our personal data these devices collect has risen exponentially.

A recent study from Binghamton University also suggests your smartwatch or fitness tracker is not as secure as you think – and it could be used to steal your ATM PIN code.

The risk lies in the motion sensors used by these wearable devices. The sensors also collect information about your hand movements among other data, making it possible for

“attackers to reproduce the trajectories”

of your hand and

“recover secret key entries.”

In the paper,

titled

“

Friend or Foe?: Your Wearable Devices Reveal Your Personal PIN,”

computer scientists from the Stevens Institute of Technology and Binghamton University used a computer algorithm that can guess your password and PIN with about 80% success rate on the first attempt, and over 90% of the time with 3 tries.

Retrieving Passwords and PINs Using this Algorithm

Researchers say their “

Backward PIN-Sequence Inference

” algorithm can be used to capture anything a person type on any keyboard – from automatic teller machine or ATM keypads to mobile keypads – through infected smartwatches, even if the person makes the slight hand movements while entering PINs.

“The team was able to record millimeter-level information of fine-grained hand movements from accelerometers, gyroscopes and magnetometers inside the wearable technologies regardless of a hand’s pose,” reports Phys.org.

Although the researchers do not name specific wearable devices that are vulnerable, they note that attackers can record information about your hand movements…

…either directly by infecting your wearable device with malware or remotely by intercepting the Bluetooth connection that links your wearable device to your phone.

The bottom Line:

The team says it doesn’t have any robust solution to prevent this attack but recommends manufacturers and developers to confuse attackers by inserting

“a certain type of noise data”

that would allow the device to be still used for fitness tracking, but not for guessing keystrokes.

Another way is to take a low-tech approach – Always enter your passwords or PINs with the hand that is not having a wearable device with the highly sophisticated motion tracker.

A Ukrainian bank has become the latest victim of the widespread cyber attack on global banking and financial sector by hackers who target the backbone of the world financial system, SWIFT.

Hackers have reportedly

stolen $10 Million

from an unnamed bank in Ukraine by exploiting the SWIFT international banking system, according to an independent IT monitoring organization called the Information Systems Audit and Control Association (ISACA).

Swift or the Society for Worldwide Interbank Financial Telecommunication is the global banking messaging system responsible for managing Billions of dollars in money transfers each day between financial institutions worldwide.

The ISACA branch in Ukraine, who has been hired by the targeted bank to investigate the heist, disclosed that some unknown hackers were able to compromise the bank’s security in similar way they

hacked Bangladesh central bank

and stole $81m (£56m), the Kyiv Post reports.

"At the current moment, dozens of banks (mostly in Ukraine and Russia) have been compromised, from which has been stolen hundreds of millions of dollars," ISACA reportedly said in a release.

The Swift hackers have already made a number of victims, including Bangladesh central bank, the Banco del Austro (BDA) bank in Ecuador and an unnamed commercial bank.

Also Read: How did Bank Hackers Go Undetected?

In February, Swift hackers managed to

steal $81 Million cyberheist

at the Bangladesh central bank’s account in the New York Federal Reserve through by hacking into SWIFT network using a piece of

malware that manipulated logs

and erased the fraudulent transactions history, and even prevented printers from printing those transactions.

The second incident

targeted an unnamed commercial bank

where malware installed on SWIFT was used against the banks’ PDF reader which was being used by the bank to check statement messages.

An Ecuadorian bank called Banco del Austro (BDA) also

lost about $12 million

in the cyber heist carried out at the beginning of last year by attacking the Swift global network.

In all incidents, the hackers have exploited flaws in banks funds’ transfer initiation environments, before messages being sent over SWIFT.

Here’s how Swift hackers target banks:

• Uses malware to circumvent local security systems of a target bank.
• Gains access to the SWIFT international messaging network.
• Sends fraudulent messages via SWIFT to initiate money transfers from accounts at larger banks.

The recently attacked bank in question had not yet been named, as investigators are restricted by strict non-disclosure agreements until the Ukrainian bank itself agrees to go public with information.

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Issue 50 has been released today.

Table of contents

• Securing the future: Best practices for keeping corporate information safe during an M&A
• Executive hot seat: Ron Green, Executive VP, CISO at MasterCard
• 7 tips to get the absolute best price from security vendors
• How CISOs can bridge the gap between their organizations’ IT and security needs
• Risk management: Risks are lurking everywhere
• Report: Infosecurity 2016
• Internet of Fail: How modern devices expose our lives
• Executive hot seat: Sumedh Thakar, Chief Product Officer at Qualys
• Security: Missing from DevOps thinking?
• The life of a social engineer: Hacking the human
• What 17 years as an infosec trainer have taught me.