Slashdot Mirror
Making Sensitive Data Location Aware
An anonymous reader writes "In a breakthrough that could aid spies, keepers of medical records, and parents who want to prevent their kids from 'sexting,' a team of Virginia Tech researchers has created software to remotely put smart phones under lockdown. The phones are given permission to access sensitive data while in a particular room, but when the devices leave the room, the data is completely wiped. A general, for example, could access secret intelligence while visiting a secure government facility without fear that his or her smart phone or tablet computer might later be lost or stolen, the team's lead researcher said. 'This system provides something that has never been available before. It puts physical boundaries around information in cyberspace.'" Unless the phone or other device can also take screenshots, or doesn't have that software installed.
a radio host just took a picture of the pictures on the phone's screen with his phone's camera
and/or create tarballs or similar
Blackberry sells encrypted bluetooth smartcard devices that can be linked to your handheld.
When your blackberry loses the encrypted bluetooth signal, or the smartcard is removed, the handheld locks.
RIM markets them to governments & defense contractors.
"parents who want to prevent their kids from 'sexting,'" - so they can only sext from a particular room?
If you can put 100% trust in a programmable device, and tell it to behave in a certain way, you can be sure that it will behave in a certain way!
It's Genius!
why would you ever bother looking at information on your smart phone? the example given of a general viewing classified information inside a secure facility is idiotic. They're in a secure facility, with some sort of digital copy of the information present. Why would they ever transfer that information to their phone or tablet instead of just viewing it on a terminal in the facility?
You mean it'll stop them taking pictures of themselves in the bathroom mirror?
Seriously, the prudish "adult" world needs to grow the fuck up and stop treating teens as children. They're exploring their sexuality, and they need guidance showing how their actions have repercussions, not a digital chastity belt. This arbitrary "16 and no younger" is great for protecting teens from predators, but crap for biology; Teens' hormones don't comply to the Whatever The Hell Law Makes "Sexting" a Crime Act.
Finally had enough. Come see us over at https://soylentnews.org/
Santa just called. He wants his elf-master of the list back before this junket of free association into the infinite void permanently curls his toes into cranky hang nails. Santa's old experiment with CRM114 automation did not go well. Return the elf, now!
In related news, a team at Harvard/MIT/(your favorite school here) has developed stupidity-aware smartphones. On detecting the low brainwave activity of a stupid person, the phone immediately shuts down. The device was invented last year, but public relations officials at the universities had been unable to get the news out by phone. They hit upon the strategy of using the internet only earlier this week.
The one I like the most is location-based reminders, where the alarm is activated when you go at a specific place, like 'don't forget to buy milk' when you go to the supermarket.
I'll just chime in like the rest. A system like this fails to appreciate that data is the thing and it is not executable.
Once data is made accessible, then the device accessing it, can do whatever it wants. Such software based systems rely on the integrity of the client which should never be relied upon.
All one would need is some means of capturing and copying the data once presented. After that, the game is over.
Would this work for 95% of all users? Probably... unless the purpose is restricting teens. Teens are quicker to overcome such obstacles when they are presented. (Not saying teens are smarter than adults, but I am saying they don't give up as easily when they want to do something.) So while it might prevent a high percentage of most users, in the case of teens, it is going to be a rate between 33% and 75% in my estimation depending on how difficult the solution is to implement. (If it's an android or iphone app, it'll be closer to the 33%.)
Don't bother watching this, unless you happened to click through from the main page because it had Virginia Tech in the headline.
http://www.youtube.com/watch?v=-4LssHXZjIA
I'm not sure whether to be excited that VT had made it so mainstream in the last 25 years, or saddened that it took football to raise the profile of a primarily academic/technical institution. Actually, now that I come to think of it, I don't give a shit - I'm just happy to see us on TV. :-)
Is it just my observation, or are there way too many stupid people in the world?
More likely: that general would leave the room, discover that the data he needed for his upcoming meeting had been removed from the phone, and then raise holy hell to have the damn system shut down forever.
The OP doesn't mention HOW the location is being determined, but let's guess for now that it's the built-in GPS. First, there is the problem of receiving a GPS signal inside many buildings. Second, there is the issue of spoofing the location with something like a femtocell or picocell GPS transmitter.
Like anything, there's always a way around it.
I don't have any idea how this works, but one of the biggest problems facing any company is information that "migrates" outside the company and most of it is confidential files.
They seemed to talk of phones and pads/tablets in the article, but I wonder if it extends to laptops and other computer equipment. More info is needed.
Obviously a photo from any camera can not be locked down as there is no electronic connection to an isolated camera.
There are all sorts of reasons that some people want other peoples' computers to work against the owners' interests, limiting their power. I don't blame people for that, because sometimes it really is you-vs-the-other-guy, so if you can trick/coerce/bargain the other guy into using a not-quite-loyal computer, why not do it? People will have a lot of sympathy for patients who don't want their doctors "stealing" their medical records. Nobody wants their general accidentally leaking secrets.
Nevertheless, trusting someone else to run malware still comes down to trusting the other person, because they might choose for their computer to not run the malware -- either completely, or by partially emulating it. You don't really know that the other person's computer destroyed its copy of the information after it left the room.
So while I'm empathetic to the pro-DRM crowd's stated goals, it is nevertheless doomed and in practice it ends up offering the world nothing but disadvantages.
Problem: You can't trust your device to reliably store information without leaking it.
Solution: Trust your device to reliably delete that data automatically.
Actual solution: Stop relying on untrusted blackbox devices. Particularly in the military, which can theoretically afford the technical manpower to scrutinize and audit source code, closed-source software should be banned. The general in the example is smart enough to know when to delete stuff from his phone, but he needs to be sure the information is actually gone and not stored in a cloud somewhere.
Oh, this is a Software Solution..... yeah, that will will work properly 100% of the time. Move along.
I don't see too many details in this article, but there was something that sounds awful similar from Carnegie Mellon University a little while back called MULE (Mobile User Location-specific Encryption). http://sparrow.ece.cmu.edu/group/pub/studer_wisec10.pdf [pdf warning]
or the phone can fake the location data. which I suspect isn't hard if you have a reason to do it.
There is already software in the market place that does this? Even McAfee offers it in their mobile device management solution.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
What is the actual idea? The video does not describe it in any detail other than to say "it works." Prof Jules does not have any relevant publications to explain it either. If it is based on the list of visible MACs or something similar, or another attested location scheme, this has been published before at HotMobile (not by me). If they have something new, that's great, but it is not explained by watching the video or looking at his web page.
The real problem is that any information you give in ANY form to ANYONE who is carrying a smart phone is no longer secure, whether the smart phone is the delivery device or not. An uncontrolled device with the ability to capture, store, and transmit data (actively and passively, and sometimes without the user's knowledge) is the antithesis of security.