Hackers have created master keys to TSA-approved locks, and the TSA couldn’t care less

First, some background. In 2003, Travel Sentry introduced a new type of TSA-approved lock with a built-in backdoor. A TSA agent armed with the appropriate tools could open the lock, inspect the item, and then send the luggage on its way. The entire system was meant to ensure that officials could still search luggage without forcing consumers to give up all of their security in the process.For years, the US TSA (that’s the Transportation Security Agency, a division of Homeland Security) has recommended that travelers in the United States buy and equip their luggage with a TSA-approved lock. The ostensible reason for this is because it allows the agency immediate access to your bag in the event that it needs to inspect your luggage rather than requiring agents to cut the lock physically in order to inspect its contents. Now, a team of hackers have demonstrated that the seven master keys that collectively open every TSA-approved lock ever manufactured have been broken.

BitWhisper: Stealing data from non-networked computers using heat

Researchers call this technique of harvesting sensitive data “BitWhisper.” It was developed and tested in a standard office environment with two systems sitting side-by-side on a desk. One computer was connected to the Internet, while the other had no connectivity. This setup is common in office environments where employees are required to carry out sensitive tasks on the air-gapped computer while using the connected one for online activities.No matter how secure you think a computer is, there’s always a vulnerability somewhere that a remote attacker can utilize if they’re determined enough. To reduce the chance of sensitive material being stolen, many government and industrial computer systems are not connected to outside networks. This practice is called air-gapping, but even that might not be enough. The Stuxnet worm from several years ago spread to isolated networks via USB flash drives, and now researchers at Ben Gurion University in Israel have shown that it’s possible to rig up two-way communication with an air-gapped computer via heat exchange.

Google discovers new security holes in SSL — is the entire system fundamentally flawed?

The reason it’s critical that companies not mint certificates for websites they don’t operate themselves is because doing so breaks the function of SSL itself. Here’s how the system is supposed to operate:Google has discovered that an intermediate certificate authority had issued unauthorized certificates for multiple Google domains. The problem arose because the intermediate authority, MCS Holdings, had issued certificates for the Google domains, despite not holding those domains itself.

MRI scans of the brain show why we ignore security warnings

The process by which you get used to these messages and stop paying attention is called habituation. Researchers have known this to be a component of how people respond to computer interfaces for years. But it was always observed indirectly, such as one study that found only 14% of participants noticed changes to the content of the warning messages. Having actual fMRI data to connect to various warning UIs gave researchers a chance to evaluate solutions to this problem.By the third or fourth time your computer pops up a warning box while you’re trying to get something done, you probably just dismiss it without paying it much attention. It turns out this is an almost universal truth of how we use computers, and there’s a neurological aspect. In an attempt to build a better warning message, a team of researchers from Brigham Young University, the University of Pittsburgh, and Google employed a functional MRI (fMRI) to study how the brain reacts to these popups.

Samsung is still lying about the encryption on its Smart TVs

When news broke that Samsung’s Smart TV’s listened to conversations and sent them to a third-party server company, the Korean manufacturer countered by claiming that all data transmissions to and from its televisions were encrypted. When testing demonstrated that the data in question wasn’t encrypted (despite being sent via Port 443, which is typically used for HTTPS traffic), Samsung modified its stance, claiming that new TVs were encrypted properly but older sets were not. This, too, has now been proven false.

NSA, GCHQ colluded to steal SIM encryption keys for millions of phones

Edward Snowden’s data trove continues bearing fruit — and the implications of the latest release are dark for anyone who cares even slightly about mobile privacy. According to the once-secret documents, the NSA and its British counterpart, the GCHQ, engaged in a massive operation against one of the world’s largest mobile SIM card manufacturers, Gemalto. To understand the significance of this release it helps to know a bit about how SIMs are used. When you use 3G or 4G connections, the connection between your device and your cell phone carrier is encrypted. That encryption isn’t perfect, but cracking it is still time-consuming, particularly if the goal is to monitor millions of people simultaneously.

Prominent developer criticizes HTTP/2 protocol, claims politics drove adoption process

The Internet Engineering Task Force (IETF) completed work on the Hypertext Transfer Protocol 2 (HTTP/2) standard earlier this week. This new protocol will replace current versions of HTTP (1.0 and 1.1) and is the largest single update to the standard since it debuted more than 25 years ago. Most analysts and websites that have covered the announcement positively, but at least one major developer, Poul-Henning Kamp, has publicly spoken out against the project.

Lenovo PCs ship with adware that destroys system security, breaks HTTPS

Lenovo is selling PCs equipped with a pre-installed adware package that destroys the security of HTTPS and creates a perfect man-in-the-middle (MTM) scenario against the host PC. The software in question is called Superfish Visual Discovery, and its basic function — it injects advertising into browser sessions — is bad enough. Superfish’s five-alarm functionality is that it installs its own signed root certificates to a user’s operating system. What this means, in essence, is that Superfish substitutes its own signed certificate for the certificate that’s supposed to be provided by the actual website.