Zach Jeffers Blogs are hypocritically useless

25Oct/110

I love Ice Cream, not security flaws!

The new feature (read: 'gimmick') in Android's new Ice Cream Sandwich OS 4.0 is fundamentally flawed.

I'm reminded of when I watched a demo of the latest Lenovo tech (three years ago) called VeriFace Face Recognition. It was being demo'ed with the, then, newly release Windows 7 allowing you to log into your computer simply by letting the Windows log-in prompt scan your face and use basic facial recognition to authenticate you.

This was swiftly proven insecure by simply printing a full page photo of somebody's face and letting the software pull the the recognizable points from the artificial medium.

ICS is basically flawed and vulnerable of the same exact circumvention methods... and with the widely available personal images found via Google+, Flickr, Facebook, etc... a simple bypass can be had with a swift CTRL + P or digital representation of that person via mobile device.

Below is the simplest way I could demonstrate this flaw with a YouTube video by somebody else. :)

8Jun/110

Taking the face out of FaceBook

If you haven't heard, FaceBook is in the midst of enabling their latest "hey-that's-cool-but-invasive" feature. Facial recognition of user photos will start auto tagging you on any pictures you are found to be in. This is initiated by somebody tagging you in a photo. The system then does it's facial recognition techniques and starts having fun spamming your link across the system.

Here is how you disable the new feature:

  1. Go to the "Account" tab
  2. Click on "Privacy settings"
  3. Click "Customise settings"
  4. Scroll to "Things others share"
  5. Click "Edit settings" next to "Suggest photos of me to friends"
  6. Choose "Disable" or "Enable" from the dropdown
3Jun/110

Hijack an unsecured Facebook account with your cell phone!

Some of you might remember the Firesheep plugin for the Firefox web browser that took the internet by storm a while back. This week ushers in a new method of doing the same exact thing, but this time, using your Android powered cell phone!

FaceNiff installs on any rooted Android phone and lets you sniff your local WiFi connection for floating Facebook packets. Just like Firesheep, FaceNiff will then hijack any session not using an encrypted HTTPS session during their latest picture tagging of last nights drunken haze. Watch the video for the fun: