Slashdot Mirror

Researchers find way to spy on remote screens -- through the webcam mic

* Remote audio plus machine learning equals rudimentary remote screen viewing.

* That web cam could be giving up what's on your screen, if the person on the other end is listening the right wayâ"with the help of some machine learning and your monitor's coil whine.

Daniel Genkin of the University of Michigan, Mihir Pattani of the University of Pennsylvania, Roei Schuster of Cornell Tech and Tel Aviv University, and Eran Tromer of Tel Aviv University and Columbia University investigated a potential new avenue of remote surveillance that they have dubbed "Synesthesia"[1]: a side-channel attack that can reveal the contents of a remote screen, providing access to potentially sensitive information based solely on "content-dependent acoustic leakage from LCD screens."

The research, supported by the Check Point Institute for Information Security at Tel Aviv University[2] (of which Schuster and Tromer are members) and funded in part by the Defense Advanced Research Projects Agency, examined what amounts to an acoustic form of Van Eck phreaking. While Van Eck phreaking uses radio signal emissions that leak from display connectors, the Synesthesia research leverages "coil whine," the audio emissions from transformers and other electronic components powering a device's LCD display.

source: https://arstechnica.com/inform...
archived: https://archive.fo/ZmO62

[1] https://www.cs.tau.ac.il/~trom... & https://www.cs.tau.ac.il/~trom...
[2] http://cpiis.cs.tau.ac.il/

Researchers find way to spy on remote screens -- through the webcam mic

* Remote audio plus machine learning equals rudimentary remote screen viewing.

* That web cam could be giving up what's on your screen, if the person on the other end is listening the right wayâ"with the help of some machine learning and your monitor's coil whine.

Daniel Genkin of the University of Michigan, Mihir Pattani of the University of Pennsylvania, Roei Schuster of Cornell Tech and Tel Aviv University, and Eran Tromer of Tel Aviv University and Columbia University investigated a potential new avenue of remote surveillance that they have dubbed "Synesthesia"[1]: a side-channel attack that can reveal the contents of a remote screen, providing access to potentially sensitive information based solely on "content-dependent acoustic leakage from LCD screens."

The research, supported by the Check Point Institute for Information Security at Tel Aviv University[2] (of which Schuster and Tromer are members) and funded in part by the Defense Advanced Research Projects Agency, examined what amounts to an acoustic form of Van Eck phreaking. While Van Eck phreaking uses radio signal emissions that leak from display connectors, the Synesthesia research leverages "coil whine," the audio emissions from transformers and other electronic components powering a device's LCD display.

source: https://arstechnica.com/inform...
archived: https://archive.fo/ZmO62

[1] https://www.cs.tau.ac.il/~trom... & https://www.cs.tau.ac.il/~trom...
[2] http://cpiis.cs.tau.ac.il/

Researchers find way to spy on remote screens -- through the webcam mic

* Remote audio plus machine learning equals rudimentary remote screen viewing.

* That web cam could be giving up what's on your screen, if the person on the other end is listening the right wayâ"with the help of some machine learning and your monitor's coil whine.

Daniel Genkin of the University of Michigan, Mihir Pattani of the University of Pennsylvania, Roei Schuster of Cornell Tech and Tel Aviv University, and Eran Tromer of Tel Aviv University and Columbia University investigated a potential new avenue of remote surveillance that they have dubbed "Synesthesia"[1]: a side-channel attack that can reveal the contents of a remote screen, providing access to potentially sensitive information based solely on "content-dependent acoustic leakage from LCD screens."

The research, supported by the Check Point Institute for Information Security at Tel Aviv University[2] (of which Schuster and Tromer are members) and funded in part by the Defense Advanced Research Projects Agency, examined what amounts to an acoustic form of Van Eck phreaking. While Van Eck phreaking uses radio signal emissions that leak from display connectors, the Synesthesia research leverages "coil whine," the audio emissions from transformers and other electronic components powering a device's LCD display.

source: https://arstechnica.com/inform...
archived: https://archive.fo/ZmO62

[1] https://www.cs.tau.ac.il/~trom... & https://www.cs.tau.ac.il/~trom...
[2] http://cpiis.cs.tau.ac.il/

Very good! The noisier, the better!

How is this not a reiteration of this old attack from 2014: http://www.tau.ac.il/~tromer/h...

This place has gone full retard anymore.

https://www.cs.tau.ac.il/~trom...

There is useful link...

These things are notoriously easy to overlook. For example, there have been versions of cryptographic string comparisons that were vulnerable to a compiler optimisation which caused them to bail out at the first difference, which was really hard to see because at first glance the loop looked like it would iterate over all characters.
Here's an article by the authors with nice graphs (why wasn't that in the summary) and here's what a fix looks like. I'll let you judge for yourself whether you'd have realised you had a problem if you had seen the code.

Stealing Keys from PCs using a Radio:
Cheap Electromagnetic Attacks on Windowed Exponentiation

http://www.cs.tau.ac.il/~trome...

"Overview

We demonstrate the extraction of secret decryption keys from laptop computers, by nonintrusively measuring electromagnetic emanations for a few seconds from a distance of 50 cm. The attack can be executed using cheap and readily-available equipment: a consumer-grade radio receiver or a Software Defined Radio USB dongle. The setup is compact and can operate untethered; it can be easily concealed, e.g., inside pita bread. Common laptops, and popular implementations of RSA and ElGamal encryptions, are vulnerable to this attack, including those that implement the decryption using modern exponentiation algorithms such as sliding-window, or even its side-channel resistant variant, fixed-window (m-ary) exponentiation.

We successfully extracted keys from laptops of various models running GnuPG (popular open source encryption software, implementing the OpenPGP standard), within a few seconds. The attack sends a few carefully-crafted ciphertexts, and when these are decrypted by the target computer, they trigger the occurrence of specially-structured values inside the decryption software. These special values cause observable fluctuations in the electromagnetic field surrounding the laptop, in a way that depends on the pattern of key bits (specifically, the key-bits window in the exponentiation routine). The secret key can be deduced from these fluctuations, through signal processing and cryptanalysis."

###

Cryptology ePrint Archive: Report 2015/170

http://eprint.iacr.org/2015/17...

"Stealing Keys from PCs using a Radio: Cheap Electromagnetic Attacks on Windowed Exponentiation

Daniel Genkin and Lev Pachmanov and Itamar Pipman and Eran Tromer
Abstract: We present new side-channel attacks on RSA and ElGamal implementations that use the popular sliding-window or fixed-window (m-ary) modular exponentiation algorithms. The attacks can extract decryption keys using a very low measurement bandwidth (a frequency band of less than 100 kHz around a carrier under 2 MHz) even when attacking multi-GHz CPUs.

We demonstrate the attacks' feasibility by extracting keys from GnuPG, in a few seconds, using a nonintrusive measurement of electromagnetic emanations from laptop computers. The measurement equipment is cheap and compact, uses readily-available components (a Software Defined Radio USB dongle or a consumer-grade radio receiver), and can operate untethered while concealed, e.g., inside pita bread.

The attacks use a few non-adaptive chosen ciphertexts, crafted so that whenever the decryption routine encounters particular bit patterns in the secret key, intermediate values occur with a special structure that causes observable fluctuations in the electromagnetic field. Through suitable signal processing and cryptanalysis, the bit patterns and eventually the whole secret key are recovered.

Category / Keywords: side channel, electromagnetic analysis, RSA, ElGamal

Date: received 27 Feb 2015, last revised 3 Mar 2015

Contact author: tromer at cs tau ac il"

#####
EOF

Stealing Keys from PCs using a Radio:
Cheap Electromagnetic Attacks on Windowed Exponentiation

http://www.cs.tau.ac.il/~trome...

"Overview

We demonstrate the extraction of secret decryption keys from laptop computers, by nonintrusively measuring electromagnetic emanations for a few seconds from a distance of 50 cm. The attack can be executed using cheap and readily-available equipment: a consumer-grade radio receiver or a Software Defined Radio USB dongle. The setup is compact and can operate untethered; it can be easily concealed, e.g., inside pita bread. Common laptops, and popular implementations of RSA and ElGamal encryptions, are vulnerable to this attack, including those that implement the decryption using modern exponentiation algorithms such as sliding-window, or even its side-channel resistant variant, fixed-window (m-ary) exponentiation.

We successfully extracted keys from laptops of various models running GnuPG (popular open source encryption software, implementing the OpenPGP standard), within a few seconds. The attack sends a few carefully-crafted ciphertexts, and when these are decrypted by the target computer, they trigger the occurrence of specially-structured values inside the decryption software. These special values cause observable fluctuations in the electromagnetic field surrounding the laptop, in a way that depends on the pattern of key bits (specifically, the key-bits window in the exponentiation routine). The secret key can be deduced from these fluctuations, through signal processing and cryptanalysis."

#####

Cryptology ePrint Archive: Report 2015/170

http://eprint.iacr.org/2015/17...

"Stealing Keys from PCs using a Radio: Cheap Electromagnetic Attacks on Windowed Exponentiation

Daniel Genkin and Lev Pachmanov and Itamar Pipman and Eran Tromer
Abstract: We present new side-channel attacks on RSA and ElGamal implementations that use the popular sliding-window or fixed-window (m-ary) modular exponentiation algorithms. The attacks can extract decryption keys using a very low measurement bandwidth (a frequency band of less than 100 kHz around a carrier under 2 MHz) even when attacking multi-GHz CPUs.

We demonstrate the attacks' feasibility by extracting keys from GnuPG, in a few seconds, using a nonintrusive measurement of electromagnetic emanations from laptop computers. The measurement equipment is cheap and compact, uses readily-available components (a Software Defined Radio USB dongle or a consumer-grade radio receiver), and can operate untethered while concealed, e.g., inside pita bread.

The attacks use a few non-adaptive chosen ciphertexts, crafted so that whenever the decryption routine encounters particular bit patterns in the secret key, intermediate values occur with a special structure that causes observable fluctuations in the electromagnetic field. Through suitable signal processing and cryptanalysis, the bit patterns and eventually the whole secret key are recovered.

Category / Keywords: side channel, electromagnetic analysis, RSA, ElGamal

Date: received 27 Feb 2015, last revised 3 Mar 2015

Contact author: tromer at cs tau ac il"

####
EOF

You can't synthesize a general rule from systemic failures? Keep It Simple Shithead.
Planes do fail by software errors.
http://en.wikipedia.org/wiki/Q...
http://it.slashdot.org/story/1...
http://en.wikipedia.org/wiki/A...
Antilock brakes are very simple systems, and you have a mechanical backup as well. But, for the record, I don't like computer controlled brakes. I drive a mechanical car.
If ABS do fail or malfunction, I doubt anyone is keeping track as to how or when. As no one keeps track, you can't perceive systemic failure as a problem. They'd have to fail massively for anyone to care.
Robots don't operate very much, and frankly I certainly don't want a piece of software cutting on me. It's not outlawed for the same reason automated cars aren't outlawed. Not enough experience to perceive failure, and an unwillingness to acknowledge failure when it does happen. And civilized countries allow voting via computer programs as well - the ultimate in unpercievable failure.
Pacemakers can fail via deliberate malware infestation, or an EMP attack or accident, or a software bug. Just because you don't know of a failure doesn'[t mean it doesn't happen.
Here's some automated software injuries:
http://en.wikipedia.org/wiki/T...
http://www.ccnr.org/fatal_dose...

As to your point about a software bug failure on Twitter being different than a software bug in a car running half a billion lines of code:

You make my point for me. Twitter failed from one point. Just one point. Half a million lines of code have damn near an infinite chance of:
1. Failure through complexity. Any real-world programmer knows that hyper-complex systems can have cascading weirdness.
2. Failure through sensor failure, processor failures, bus failures, and similar failures we can't anticipate.
http://it.slashdot.org/story/1...
http://www.cs.tau.ac.il/~nachu...
And Google's robot car had to be rebooted twice during its certification run.
3. Failure through an the inability to program a PC to anticipate all the possibilities that a car swarming with other cars in a real world situation. One can't program that.
4. Failure through vulnerability to outside attack. Software on a network is very vulnerable; one hundred percent so. Physically, a high energy radio pulse fired at a car, or a whole highway of cars, would cause carnage. Carnage would be multilation and death, what happens when steel boxes swerve randomly around at 70 mph with no driver.
5. The problem isn't about ALL cars failing. One car can fail and crash the cars around it. For the system to work, all cars have to work 100% perfectly all the time.

An car - driver is eating a sandwich. Car computer failure would crash the car instantly, depending. Carnage.
An airplane - plane is, generally speaking, in the air most of the time. If the computers fail, somehow, the pilot can take control with time enough to avoid contact with other planes or the ground.
Car - failure, milliseconds to react, car may not even let you drive. Plane: seconds or minutes to recover and land.

I'm only pointing out the obvious failure points. Others will happen. I wistfully recall posting on Slashdot about the vulnerability of a NFC card being read without the owner's knowledge; I was mocked as an ignoramus. I just pointed out physics didn't rule out building a concealed reader, or very powerful pulse generator. Both have happened.

I await the stories of failed robot cars in the coming years, and either th

I mean, for fuck's sake: hackers have been able to deduce GPG private key by reading signals leaking out of a compute. Noise. Captured by a smartphone's mic.

Ref

If you think that some software sandboxing is the equivalent of a "secure enclave" chip in terms of secure-ness, you're sadly mistaken.

If you think that a "secure enclave" is really secure, when its implemented as a SEPARATE CORE ON THE SAME FUCKING SILICON, you really don't believe in SIGINT.
In a world where scientist have been able to guess GPG private key just by analysing signal.
Accoustic signals: Noise.
Over a smartphone's crappy mic.
(Ref).
Do you really think that a "secure" core on the same piece of silicon stands any chance?

Given that attack where they used the acoustic emissions of a CPU's voltage regulator circuitry to extract an RSA key I'm going to consider that one guilty until proven innocent...

How about exfiltration via simple/differential power analysis by ramping up and down cpu, gpu, power supply usage, or even a more subtle control? The best dodge to RF detectors may be to avoid open air entirely, although if you can in any way modify the hardware of the target platform the normal rules of 'You lose' still apply. Motherboards have a pretty good flexibility these days about setting power and clock parameters, which might be another way to get a signal out of a system that you can't alter the hardware of.

Not an engineer though, so I've no idea what I'm talking about. Based on the recent acoustic cryptanalysis paper that's just coupling power to air vibrations, I can only imagine that having an electrical conduit makes things an order of magnitude easier. A quick google and here's one such paper from DEFCON 17 (Not too long ago) on this exact subject, although it appears to be dealing with direct signaling through the power network with hardware modifications. Intelligence agencies must be years ahead in this particular field, as electricity is already a prime target for distruption.

To be fair this isn't exactly a radio signal like you are talking about, but signal is signal.

What they are exploiting is that in naive implementations of RSA the amount of computer power needed during en/decryption varies with each binary digit in the key. If the digit is zero then no computation is done and if it is one that a tight loop is executed.

There have been other side channel attacks that exploit this weakness in naive implementations. The obvious fix is to slightly change the algorithm so the same computation is done whether the digit is a zero or a one. This reduces the efficiency by a factor of two but it makes these side channel attacks much more difficult.

In fact, the authors contacted GPG before publicly releasing this exploit and the fix is in place:

Q9 How vulnerable is GnuPG now?

We have disclosed our attack to GnuPG developers under CVE-2013-4576, suggested suitable countermeasures, and worked with the developers to test them. New versions of GnuPG 1.x and of libgcrypt (which underlies GnuPG 2.x), containing these countermeasures and resisting our current key-extraction attack, were released concurrently with the first public posting of these results. Some of the effects we found (including RSA key distinguishability) remain present.

...

Q13: What countermeasures are available?

One obvious countermeasure is to use sound dampening equipment, [...]

Alternatively, one can employ algorithmic techniques to reduce the usefulness of the emanations to attacker. These techniques ensure the rough-scale behavior of the algorithm is independent of the inputs it receives; they usually carry some performance penalty, but are often already used to thwart other side-channel attacks. This is what we helped implement in GnuPG (see Q9).

I suspect this is YBCO grown on a sapphire wire. Previously, YBCO has been grown on flat substrates.

I was wondering about the same thing.

This is the best photo of Pluto currently available: http://www.tau.ac.il/~morris/03411203/chapter5/Pluto_color.jpg

Why is it not possible to point the same telescope towards Pluto and get a better image? Are there some constraints?

I don't know that NTFS implements their shadow system like btrfs. If they do, you might want to inform IBM and ACM Transactions on Computational Logic and let them know that they should have publish Microsoft's research instead. The paper the refer to was published August 2007.

B-trees, Shadowing, and Clones by Ohad Rodeh, IBM Haifa Research Labs.

An "ordinary" quantum computer is no more powerful than a Turing machine. It probably can't even solve NP-complete problems quickly because there's no way of directing the observation step (where you pull the answer out of the numerous universes) in such a way as to make the right answer show up often enough. This is, technically speaking, an open problem (just like P vs NP), but most believe the answer is a negative (just like P != NP).

I said "ordinary" quantum computer because there have been attempts at making quantum hypercomputers (i.e. computers more powerful than a Turing machine). The best known is Kieu's adiabatic quantum hypercomputation scheme, but that appears to have been refuted. Quantum adiabatic algorithms can be useful (they're a bit like genetic algorithms, only on the quantum level), but apparently they can't bring quantum computers above Turing power; a bit like the Brownian ratchet in this manner, in that it's not as powerful as thought, but still useful.

To sum all of that up: it's unknown whether it's possible to make a quantum computer solve NP-complete in polytime, but most think it's unlikely. It's unknown whether it's possible to make a quantum hypercomputer as well, but most think it's even less likely (although if consciousness would disprove this, that would be... interesting).

NIR would be inappropriate for this application. If you're looking for contaminant poisons in drinking water you need to have exquisitely sensitive detection thresholds in the part per billion level. A NIR spectrometer using conventional (quartz) fiber optics would be forced to look at the second and third overtones of the fundamental molecular absorption lines in the mid-IR. These overtones have a mere thousandth or hundredth of the relative absorption intensity as the fundamental lines and therefore your signal for extremely low concentrations of contaminants is going to be waaaaay below the noise in your detector. NIRS is best suited for detection of percent level deviations in chemical mixtures, not trace analysis. What this guy from Israel has done is use drawn fibers of silver chloride/bromide, which have spectacular transmittance in the mid-IR, to detect the fundamental absorption bands of trace contaminants using the evanescent waves of IR light that poke slightly outside the surface of a fiber optic. I wish I could find his latest paper that this press release is about though.....

So basically you could build a car with only a small (expensive) "buffer" LiIon battery and cheaper/lighter heat storage with Stirling engine as the main source of power.

I would sure love to have a huge solar dish on top of my car, it would look so 1930's sci-fi-ish...

many of the subjects, especially among the female photos, appeared to be frowning or pouting in the original picture, and the modified picture turned up the corners of the mouth into more of a smile.

I agree, It's most notable on these before and after pictures.

many of the subjects, especially among the female photos, appeared to be frowning or pouting in the original picture, and the modified picture turned up the corners of the mouth into more of a smile.

I agree, It's most notable on these before and after pictures.

Here's the original...

Here's the source...

WTF? Tel Aviv University is a very decent research institute that has made many important contributions to science. No, I am not and have never been affiliated with them, but the page you are referring to is obviously that of an alumni organization. And yes, they do raise money for the university, that is what alumni organizations do.

As for Yaroslavsky (the prof working on this "seeing skin" project), I know neither him nor this project (at least not more than the press release states), but his publication list shows that he regularly publishes in top journals such as Applied Optics, Optics Express, and Optics Letters. Clearly he knows a thing or two about light.

http://www.eng.tau.ac.il/~yaro/RecentPublications/index.html

Bacteria can sense chemical gradients. This is particularly useful being able to determine whether a long-term food supply is nearby and to continue reproducing or to just slow down and stick together with other bacteria. Then you get all sorts of amazing patterns forming.

Actually it does help. Long range devices need some sort of security. E.g. Bluetooth has pairing to make sure that someone can't make calls on your phone without you allowing them to. If you require physical contact then you can relax that somewhat. I can imagine tapping devices together and getting a "Allow these services" dialog on the UI.

I'm not sure how Wireless USB will handle this. Bluetooth seems to have screwed it up completely - pairing confuses non technical users I suspect, and there are exploits where people have managed to use devices they have not paired with. Kind of an issue if people crack your phone and make long distance calls.

It's tricky to get right too - keys that are uncrackable are not user friendly. And the most sensitive devices - modems and mass storage - don't have any facility for a UI. I guess they'll fudge it Bluetooth style and have a short hardcoded key, e.g. 10 digits. But that's not a lot of bits and it could be brute forced. Stopping eavesdropping seems solvable to me - devices would advertise their public key and you'd encrypt with that when you talked to them. Authorisation - whether you're allowed to access a Wireless USB storage device seems harder to get right, especially on UI-less devices. Maybe 8-16 hex digits, for a total of 64-128 bits is really ok. I don't like the idea of storing really sensitive data on a device like this though. Still if you can make the time it takes to try a key long and remove the chance of snooping them out of the air via public key encryption it would be ok I suppose. Problem is, most of the time this stuff seems ok when announced and is cracked in a couple of years.

Hopefully someone on the WUSB standards groups has had a good idea of how to solve this properly.

This isn't correct, by my reading of this paper. The metadata in question (BD_ADDR) is not "part of the key", it's an input to a cryptographic process. It provides little entropy, but that's okay because the entropy is provided by a pair of random numbers and the PIN.

If the PIN is good, the process appears to be quite secure.

Towards neuro-memory-chip: Imprinting multiple memories in cultured neural networks; Itay Baruchi and Eshel Ben-Jacob. 2007. What interesting device combinations can we imagine with the awesome 2003 P. P. Irazoqui neurotransceiver?

Do a patent search for wear levelling. M Systems (bought by Sandisk) have lots of very well written patents that describe how they do it. Datalight has some too.

This paper has a good overview
http://www.cs.tau.ac.il/~stoledo/Pubs/swste2005.pd f

Third parties probably either license one of these patents, or violate them ruthlessly if they are based in China - it's not like some no name thumb drive manufacturere in Shenzen is going to be worth investigating, given that all the code is masked into a microcontroller and they are probably immune for lawsuits. Mind you, it's quite possibly that they skip wear levelling completely.

OTOH you could just write block 0 over and over again from the USB host, and connect a bus analyzer to the NAND interface. You can tell by how the NAND physical address changes which patent they are violating.

Daniel Cohen-Or manages something I consider far more interesting. Take for instance this PDF about image reconstruction.

There's quite a few more impressive papers on his page, for those interested in graphics.

Daniel Cohen-Or manages something I consider far more interesting. Take for instance this PDF about image reconstruction.

There's quite a few more impressive papers on his page, for those interested in graphics.

For which you presumably need very high power and a really big antenna (as a rule of thumb, distance r between chip and reader equals to antenna diameter of r). Furthermore, the orientation of the tag to the antenna matters as well (you know, if the RFID's chip antenna is tilted 90 degrees with respect to the orientation of the reader's antenna, nothing can be read).

This all makes it extremely difficult to read out tags unnoticed from more than a feet away.

For theoretical background, read How to Build a Low-Cost, Extended-Range RFID Skimmer by Kirschenbaum and Wool.

http://neuron.tau.ac.il/~horn/publications/pnas.pd f - link directly to the paper, in PDF format and free to view.

My BS was plain old Computer Science, but I had Programming Languages (which made heavy use of BNF dictionaries, which also touch your field) and Intro to AI. So I'm no expert either...

The article made me think this system was building a 'grammar' in the strictest sense of the word, but definitely one without any mapping back to real world concepts. They mention statistical significance, so that makes me think they're using machine learning algorithms to guess an "optimal" set of rules they can stitch realistic-sounding sentences together with, without actually processing any of the meaning.

Aha, yes, the article contained some Google fodder, which pointed to this academic paper: http://www.tau.ac.il/~zsolan/papers/soletalb2002.p df Quote from the PDF:

Equation 1 balances two opposing "forces" in pattern formation: (1) the length of the pattern, and (2) the number and the cohesiveness of the set of examples that support it. On the one hand, shorter patterns are likely to be supported by more examples; on the other hand, they are also more likely to lead to over-generalization, because shorter patterns mean less context.
(end PDF quote)

So while I don't think this system can translate unknown language into meaningful human language any time soon, it does seem like this system can help a team of humans develop a more reliable way to machine-translate natural language.

For example, spoken American English is full of common idioms and sets of phrases. Without a system like this, a Japanese translation system developer would literally translate a common idiom because she didn't realize it was a common idiom, and then would need to find some way to resolve this pigs-flying or happy-as-a-pig-in statement. A system like this would identify these common bits of language, so this system developer would know to parse that set of words as if it's one word.

Does that make sense? Or is the article touting this method as a major breakthrough, when actually this pattern recognition system is already used in your field?

PNAS wants you to subscribe to download the PDF.

Or you could just go to the authors' page and download it for free: http://www.cs.tau.ac.il/~ruppin/pnas_adios.pdf

The project also has a website where you can download crippled implementations of the algorithm for Linux and Cygwin.

You can, however, set up your phone so that this extra auth step is required. But this exposes you to exactly the vulnerability mentioned in the paper:

6 Countermeasures

[ ... ]

Most Bluetooth devices save the link key (Kab) in non-volatile memory for future use. This way, when the same Bluetooth devices wish to communicate again, they use the stored link key. However, there is another mode of work, which requires entering the PIN into both devices every time they wish to communicate, even if they have already been paired before. This mode gives a false sense of security! Starting the pairing process every time increases the probability of an attacker eavesdropping on the messages transferred. We suggest not to use this mode of work.

Well, here might be a good place to look. The article doesn't actually tell you where to find the research, but it was posted on Schneier's blog this morning.

Cheers,
Brendan

Mike

Digging up their paper, it seems that it is not automatic:

If the attack is successful, the Bluetooth user will need to enter the PIN again - so a suspicious user may realize that his Bluetooth device is under attack and refuse to enter the PIN.

Cracking the Bluetooth PIN


This paper describes the implementation of an attack on the Bluetooth security mechanism. Specifically, we describe a passive attack, in which an attacker can find the PIN used during the pairing process. We then describe the cracking speed we can achieve through three optimizations methods. Our fastest optimization employs an algebraic representation of a central cryptographic primitive (SAFER+) used in Bluetooth. Our results show that a 4-digit PIN can be cracked in less than 0.3 sec on an old Pentium III 450MHz computer, and in 0.06 sec on a Pentium IV 3Ghz HT computer.

--AS

...Christians have been consistent throughout the ages. Squashing the advancement of our knowledge about the world time and time again. Can you imagine if Bush was in the White House during the 50s and 60s. Instead of giving the American people an amazing goal to reach, he'd have arrested scientist who were attempting to disprove the existence of the firmament!

This study argues in the strongest possible way that that design decision is a security risk. So if you go to facebook without this study and say "Hey guys, love the site, but I think the friends lists are abusable" and they say "They're pretty secure, people know who friends are in real life anyhow, there is no damage if the information is disclosed, and we think the remote possibility of abuse is outweighed by the benefit to our members", what do you do? Say "Alright, here is a proof-of-concept exploit which is empirically demonstrated to be a gaping security hole". Now, why do this without asking facebook first? Because there are hundreds of social networking sites out there and EVERY ONE which exposes relationship information to the outside world has the same design flaw. This adds to the public recognition that that flaw is actually a flaw, much like academic research has demonstrated that, say, web systems which rely on hash tables should salt their hashes or they can be DOSed by a single dialup modem producing intentional collisions and getting worst-case performance from the table. Now THATS socially valuable research.

This is completely aside from other valuable insights gained from the study in terms of human psychology and man-machine interfaces.

As the grandchild of several Holocaust survivors, I hereby inform you that there is not a shred of cleverness in this sort of posery. It is merely trite and repulsive.

If my grandmother were addressing you, she wouldn't be doing it nearly as politely as I am, you spoiled twit.

With all due respect to your grandmother, most of the Holocaust survivors I've met have been polite and thoughtful persons (and one was a rather pervy old guy with a who always made it obvious which women he was staring up and down, at least in the class I took from him).

One grants your grandmother a certain deference because of her suffering -- just as I didn't question the apparent contradiction of the Holocaust survivor, a Polish Jew, who told me that he didn't blame the camp guards because "they were young men far from home, in the army, and ordered to be guards" -- but that he did blame the Poles, who "learned to throw stones at the Jews before they learned to walk". Absolving the Germans who were taught to hate but condemning the Poles who were taught the same hate was that survivor's way of understanding what had happened to him, and I was not about to suggest he believe otherwise.

But if my argument is wrong, it's wrong whether or not you're the grandchild of several Holocaust survivors. And if it's right, it's right regardless of your ancestry -- or mine.

Ideas are funny things: they don't become more or less valid depending on who says them. If a prisoner says the Earth moves, and the Pope says it doesn't, "Eppur si muove," -- "it still moves".

Being the grandchildren of survivors does give you a special responsibility to understand their pain, and to perhaps even to work to make sure the Shoah survivor's cry of "Never again" really does mean "never again".

But it doesn't give you any special claim to wisdom, and while it may have prompted you to study history, it doesn't necessarily give you any magical understanding of history, or any special moral vantage point from which to rule on the validity of the arguments of today. And to use your grandparents' suffering to make a rhetorical point -- to merely win an argument -- seems to me a tawdry way to use them.

Again, my reasoning is valid -- or invalid -- independent of who you are or even who I am. An argument stands -- or falls -- on its own, regardless of the personality, background, or ancestry or its proponents.

BZZZZZZZZZZT! WRONG! We still need peer review, but what does that have to do with the journals?

The editors are professors who are supported by their universities. Their editorship fulfills the ``service to the profession'' portion of their job requirements, and brings some prestige to their department. It's generally considered to be easier to get published in a journal if the editor's office is just down the hall from yours, and he's heard your presentation of your ideas at one of the faculty brown-bag lunches. In short, the Universities support the editors, not the journals.

The reviewers are past and potential contributors. They work free of charge, and again, that's part of their university job description.

Yes, I know that the journals do have some paid employees. They seem to be associated with the print side of the business: they deal with subscriptions and money and such. If you are a contributor, you deal with volunteers who have .edu email addresses.

If Blackwell Publishers dumped Econometrica, the Econometric Society, which is funded largely by personal membership, could simply put its journal online, by subscription or free. Everything would continue as before: Eddie Deckel could still edit, the reviewers could still review, and the papers could still be made available with the imprimatur of the Society. They might lose out on some revenue from the journal, but I doubt that would be an insurmountable problem. I imagine that most of us could afford to double our dues, if we had to.

You're an academic, and you know all this stuff, but I'm saying it for the slashdotters, most of whom figure that they'll get involved in some science, like java programming, when they finally get to college.

I once red an article (I think it was the New England Journal of Medicine, but this was years ago), that talked about hallucinations being communication faults in the neuralnet of our brain. I don't remember how it worked out exactly, but they have actually demonstrated that interrupted communication will result in information entering the net being transofrmed into other information when exiting, and the resulting information is not going to be random, but quite consistent, and that varying input will result in _same_ output (which is how hallucinations persist). Since our brains always must interpret everything (there is no such thing as feeling noise), any bogus info will be interpreted into *something*, be it voices, visions, feelings, ideas, etc.

I did some googling, and this article apperas to describe somethig similar, but seems way over my head with those formulas.

Did you read the amendment, the Additional Protocol? It's here.

Notes for discussion as to whether or not this actually "bans ideas":

1. The amendment to the convention on cybercrime does not impact on the "wide swathe of ideas" you claim. On the contrary, it's very narrow, and relates primarily to criminal intent.
2. To summarise more precisely: the amendment requires ratifying nations to create an offence of "distributing, or otherwise making available" material which "advocates, promotes or incites hatred, discrimination or violence".
3. This is repression of expression. It is a restriction on the freedom of expression. For sure. However, to quote your article:

   We're looking for things we can't say that are true, or at least have enough chance of being true that the question should remain open.

   I argue that incitement to hatred, violence and discrimination is not truth. It is true that those concepts and acts, and their corresponding acts of incitement exist, but they have no intrinsic truth of themselves.

4. Inciting hatred and violence barely qualifies as an idea, except inasmuch as it can be described; in practice, it's more of an act, similar to criminal acts of conspiracy. As the notes provided on the amendment say,

   13. The definition contained in Article 2 of this Protocol refers to certain conduct to which the content of the material may lead, rather than to the expression of feelings/belief/aversion as contained in the material concerned.

   The language "advocates, promotes or incites" is very important. Can I put this more clearly? An example of what is outlawed by this measure might be the statement "Go out and kill Americans, and I will give you some money". This is not an idea; it is an instruction, an act of conspiracy.

5. Since you're fond of digging up old articles, here's one more, from 1997, which says:

   The Dutch government will not be adopting a law in the near future making Holocaust denial a criminal offense. According to the left-wing liberal Justice Minister Winnie Sorgrdrager, the law would not be an effective means to fight against "false and tasteless opinions." At the same time, the justice minister expressed her concern about the revival of fascist ideology in Europe.

6. The Additional Protocol does not require the denial of the Holocaust, which however vile and distasteful does qualify as an idea that we may sometimes be forced to discuss, to be an offence (Article 6.2 is the get-out clause).

Now, under Dutch law, incitement to hatred is already a criminal offence, and denying the Holocaust in certain ways has been interpreted judicially as falling under that legislation. (Holocaust denial is almost invariably an incitement to aggressive neo-Nazi groups).

So perhaps I will revise my statement and put it in context. There is nothing you can't say, but if you harm others with your statements - through incitement to violence, or discrimination - then you may be liable.

- Joshua.

Going out to find news that has _your_ slant does not make this news any less unbiased. Think about that. You need _diversity_, not a single source that you like because they echo your own line.

Very insightful and true.

The government of the United States was elected by the people. If you have a problem with the government, you have a problem with the Americans, since they put it in power. The government is acting under _their_ authority. And, notably, polls show most citizens support the actions of the government so far.

Total BS. The only 'problem' I have with Americans is they are ignorant of their governments real policies and thus they are not able to protest against them, since they have no real idea what they are. But this ignorance is not entirely their fault given the useless media organizations they have; it takes real effort to find information on some of these policies.
How many Americans knew their government assassinated Allende 30 years ago? How many approved?
How many Americans knew their government was selling weapons to Iran to support the terrorism of the contras? How many approved?
How many Americans knew their government gave the Baath regime the biological weapons it used in its terror attacks on the people of Iraq? How many approved?

It's just like those idiots in France who can't put together "rising anti-Zionism" leading to "rising (and violent!) anti-Semitism": you don't have one without the other.

Right, because you can't criticize Israel without being an anti-semite? Sorry friend, criticizing Israeli policy does not make you an anti-semite. As I've said before, the most vociferous opponents of Israeli policy are Jewish. And it's really because they are Jewish and they want to promote human rights.
If there is racism and violence against Jews, then that is a seperate, and terrible, problem that must be dealt with. Racism, all racism, is awful.