I love Ice Cream, not security flaws!
The new feature (read: 'gimmick') in Android's new Ice Cream Sandwich OS 4.0 is fundamentally flawed.
I'm reminded of when I watched a demo of the latest Lenovo tech (three years ago) called VeriFace Face Recognition. It was being demo'ed with the, then, newly release Windows 7 allowing you to log into your computer simply by letting the Windows log-in prompt scan your face and use basic facial recognition to authenticate you.
This was swiftly proven insecure by simply printing a full page photo of somebody's face and letting the software pull the the recognizable points from the artificial medium.
ICS is basically flawed and vulnerable of the same exact circumvention methods... and with the widely available personal images found via Google+, Flickr, Facebook, etc... a simple bypass can be had with a swift CTRL + P or digital representation of that person via mobile device.
Below is the simplest way I could demonstrate this flaw with a YouTube video by somebody else. ![]()
Hijack an unsecured Facebook account with your cell phone!
Some of you might remember the Firesheep plugin for the Firefox web browser that took the internet by storm a while back. This week ushers in a new method of doing the same exact thing, but this time, using your Android powered cell phone!
FaceNiff installs on any rooted Android phone and lets you sniff your local WiFi connection for floating Facebook packets. Just like Firesheep, FaceNiff will then hijack any session not using an encrypted HTTPS session during their latest picture tagging of last nights drunken haze. Watch the video for the fun: