SD Phone Home - New Potential Honey Stick Threats
This week I heard about two interesting devices.
The first is a story of a digital camera that was stolen (click HERE). The owner was surprised to receive an email with pictures of the thieves. Apparently, the owner had forgotten that they had a $100 special SD card with Wi-Fi built in, called Eye-Fi (click HERE), and the ability to upload files to the owner’s site. It actually sends its data via email or upload to a file repository. It’s not clear to me exactly how this works yet, but if it can do it without spending cycles on the finder’s computer it would solve a lot of the privacy and liability issues I’ve written about in my paper.
Another thing I heard about this week was the Trackstick II Personal Tracker (click HERE). It looks like a USB Drive that has GPS tracking on board, and track and store its own location and movement information. However, I’m not sure if this one can store user files or data, and it doesn’t look like it can “phone home”. But it’s only a matter of time…
If a “phone home” program was added to it in case of loss, I’d see this as having some liability issues, if the finder’s computer were damaged during the program’s unauthorized execution.
It looks like we’ll be seeing a lot more devices integrating different technologies. All the more reason to be very careful what you stick into your computer. If you thought Double-click’ and web bugs had privacy issues, just wait until your new camera registers itself and sends your picture and PC configuration to their server.for more “personalized” support services.
Or what about something like Napster for cameras? Camster anyone? Will you be able (or knowlegeable enough) to prevent your camera from “sharing” your photos and files with other devices nearby. After all, sharing sounds good, right? A lot of manufacturers have not figured out that allowing open access and sharing by default in new devices usually creates serious and fast-spreading privacy and security issues.
Latest Honey Stick Statistics - 42% of Lost USB Drives Are Accessed
While it has been a while since I updated the statistics on www.honeystickproject.com, there was still lots of activity. Stream 1 is now active with 8 sticks deployed in Las Vegas, Ottawa and Toronto (for a total of 33), and half of those have been accessed.
This is becoming a fun project, finding places to drop them as we travel around the globe. Thanks to Mike Sues for sponsoring devices for Stream 1. I’m aiming for 1,000 deployed devices, so I can say there is some statistical significance in these results that people will notice. But it is already an interesting response rate.
What does this data mean? I have some ideas, but I’d like to hear your thoughts. Feel free to comment below on this post.
Scott Wright