Microsoft is urging users to abandon telephone-based multi-factor authentication (MFA) solutions like one-time codes sent via Short Message Service (SMS) and voice calls and instead replace them with newer MFA technologies, like app-based authenticators and security keys.

The warning comes from Alex Weinert, Director of Identity Security at Microsoft. For the past year, Weinert has been advocating on Microsoft's behalf, urging users to embrace and enable MFA for their online accounts.

In a blog post last year, citing internal Microsoft statistics, Weinert said that users who enabled multi-factor authentication (MFA) ended up blocking around 99.9% of automated attacks against their Microsoft accounts.

But in a follow-up blog post, Weinert says that if users have to choose between multiple MFA solutions, they should stay away from telephone-based MFA.

The Microsoft exec cites several known security issues, not with MFA, but with today's state of the telephone networks.

Weinert says that both SMS and voice calls are transmitted in cleartext and can be easily intercepted by determined attackers, using techniques and tools like software-defined-radios, FEMTO cells, or SS7 intercept services.

SMS-based one-time codes are also phishable via open source and readily-available phishing tools like Modlishka, CredSniper, or Evilginx.

Further, phone network employees can be tricked into transferring phone numbers to a threat actor's SIM card – in attacks known as SIM swapping – allowing attackers to receive MFA one-time codes on behalf of their victims.

On top of these, phone networks are also exposed to changing regulations, downtimes, and performance issues, all of which impact the availability of the MFA mechanism overall, which, in turn, prevents users from authenticating on their account in moments of urgency.

SMS and voice calls are the least secure MFA method today.

All of these make SMS and call-based MFA "the least secure of the MFA methods available today," according to Weinert.

The Microsoft exec believes that this gap between SMS & voice-based MFA "will only widen" in the future.
As MFA adoption increases overall, with more users adopting MFA for their accounts, attackers will also become more interested in breaking MFA methods, with SMS and voice-based MFA naturally becoming their primary target due to its extensive adoption.

Weinert says that users should enable a more robust MFA mechanism for their accounts, if available, recommending Microsoft's Authenticator MFA app as a good starting point.

But if users want the best, they should go with hardware security keys, which Weinert ranked as the best MFA solution in a blog post he published last year.
​
This preference for app or security key alternatives for MFA shouldn't mean that users should disable SMS or voice-based MFA for their accounts without substituting another MFA approach. SMS MFA is still way better than no MFA at all.

There are a lot of encrypted USB flash drives out there. You plug them in, and either there's an on-screen popup that asks for your passcode, or some sort of physical keypad that is used to gain access.

But what about transferring the unlocking mechanism to a mobile device – such as a smartphone or your Apple Watch?

This is precisely what the iStorage datAshur BT hardware-encrypted USB flash drive does.

Visually, the iStorage datAshur BT looks like any other USB flash drive. It has a tough epoxy-like exterior that gives the drive a water- and dust-resistant rating of IP57 (protected against damage from dust ingress, and water resistant to 1 meter).

The datAshur BT comes in capacities from 16GB to 128GB.

Data on the datAshur BT is fully encrypted using AES-XTS 256-bit hardware encryption, which is FIPS 140-2 Level 3 compliant design and technology. Brute force is defended against by a built-in data wipe if there are too many wrong attempts made.

Everything is protected by a 7-15-character password or a biometric unlock such as Face ID/Facial recognition, Touch ID/Fingerprint, or IRIS scanning from a smartphone or tablet. The drive communicates using Bluetooth to any smartphone/tablet (iOS/Android) or Apple Watch. The Bluetooth channel is secured by a FIPS validated encryption layer and is only used for connection purposes. There is also support for 2FA using SMS.

The drive itself is completely host independent, so it will work with Windows, Mac, Linux, Chrome, and so on, VDIs such as Citrix and VMWare, and also with embedded systems such as medical devices, TVs, drones, printers, scanners, or pretty much anything with a USB port.
​
Prices for the iStorage datAshur BT range from $103 to $181, depending on the capacity.

Amazon has become a ubiquitous part of the modern world, but now it may even make its way into rental properties. Recently, Amazon unveiled its Alexa for Residential program. This program will make it easy for landlords to include Amazon and Alexa-powered devices in rental units across the country, including the Echo Dot and other products.

The idea is that Alexa’s smart speakers will be available from day one in rental properties. Even before renters move in, Alexa will be able to help with self-guided tours by providing information about square footage, monthly rent, and more. Renters can link their Amazon accounts to the speaker to access all of Alexa’s features. Once a renter moves out, property managers can reset the speakers without removing their connections to existing smart-home devices.

Amazon has taken numerous steps to ensure its position as the default smart home platform, viewing itself as a utility like lights and plumbing. In 2018, the homebuilding company Lennar began including Alexa and smart locks in its new builds. Amazon has also created partnerships with hotels and college dorms to bring its devices into these spaces. By doing this, Amazon places itself at the front of the pack and makes it more difficult for its competitors – Google Assistant and Siri – to claim their part of the spotlight.

On the other hand, re-using smart assistants that other people have used creates privacy concerns. Amazon addressed these concerns by saying that property managers cannot access customer data. Renters do not have to worry about their landlords listening in on them. By default, voice recordings are deleted daily and are inaccessible to human reviewers. If a renter links their Amazon account to a rental Alexa, they will have access to the platform’s full suite of privacy features.
​
The moves by Amazon to bring it into more spaces as a service will likely help grow the already-impressive market lead that Alexa has over the competition, especially given the partnerships Amazon has formed with companies like Iotas, Stratis IoT, and Sentient Property Services. Amazon will also be opening up the potential for partnerships with more companies.

                                      A world where contactless and socially distant solutions
                              are preferred has set the stage for robots to rise to the occasion.
 
The COVID-19 outbreak has given way to an era of innovation as entrepreneurs develop tools and services to meet new needs. Though there might have been concerns about automation and the future of work before the current health crisis, the pandemic has shown how robots are benefiting us while the world grapples with the novel coronavirus.

Post-contagion, the global industrial robotics market is expected to grow from $44.6 billion in 2020 to $73 billion by 2025, according to ResearchAndMarkets.com.

The safety provided by robots, as well as the fact that robotic solutions are helping businesses stay open, are making them popular companions in the current climate.

Here are three opportunities for robotics that have arisen from the COVID-19 outbreak.

Keeping Supply Chains Going. Shipping and delivery have seen challenges since the onset of the novel coronavirus outbreak. Robotics and automation can help U.S. manufacturers increase in-house manufacturing to mitigate global supply chain risks. Instead of outsourcing, companies can then rely on robotic material handling and delivery to keep businesses running.

Further down the chain, robots are also able to drop off packages and groceries to consumers safely. As contactless and online shopping experiences are on the rise, robotic and sterile delivery options are now desirable.

Automating Service. Social distancing rules are being kept in place with robot waiters and robot concierges. From greeting customers to serving food, robots can enable restaurants and hospitality businesses to stay open safely.

Robots can help reduce the number of staff that need to be at work physically. As human counterparts try to reduce their exposure to risks, robots can efficiently obtain registration and check-in information and return used cutlery.

Cleaning and Sanitizing. Robots can also safely sanitize workspaces and common areas. In health services, semi-autonomous or remotely monitored robots can disinfect large surfaces quickly, removing the need for cleaners to be exposed to the risk of contagion.
​
Robotic solutions can also disinfect areas more efficiently and more frequently than manual cleaning.

The fitness industry is in the midst of a digital transformation. Fitness, like just about every industry from transportation to leisure, has witnessed the emergence of digital as a force for change, and brick and mortar gyms are having a tough time keeping pace. Entire companies have been successfully launched to capitalize on the rise in digital fitness, as evidenced by the popularity of companies such as MIRROR Home Fitness, Peloton, FiiT, and SWEAT. These are just a few fitness providers that have leveraged digital technology to engage audiences that are looking for customized fitness experiences that meet their individual schedules and routines.

We have Jane Fonda to thank for bringing fitness into the home back in the ’80s with her Original Workout video on VHS that went on to become the biggest selling video of all time. Fast forward 40 years, and we can thank technological innovation for taking home fitness to a new level.

But there is another factor at play which speaks to the preferences of Generation Y/millennials and Generation Z, who account for almost 50% of all health club members: These consumers have a preference for on-demand services and are less attracted to locking in annual membership fees. Remember, it was the recurring annuity stream of yearly membership fees that attracted private equity to brick and mortar gyms, which need stable and predictable cash flow to service debt and to cover high operating expenses. Working out at home or in private sessions with a personal trainer (in-person or virtual) doesn’t require an annual membership.

Paying as you go is where the market is moving. Facilitating this trend is the emergence of mobile apps that provide fitness trainers and coaches with a business-in-a-box so professionals in all aspects of fitness, but who are not necessarily astute in how to run a business, can manage scheduling, client on-boarding, invoicing, payment processing, and communication. The many thousands of certified trainers who have been laid off from gyms are now empowered to run their businesses thanks to cloud-hosted back offices and video conferencing capabilities that provide real-time delivery of services.

Disruption creates winners and losers in any industry. Sometimes disruption is a gradual process, and the eventual losers don’t detect the shifting landscape for periods that can extend for years. Think of Kodak and digital photography or Sony and its inability to capitalize on the success of the Walkman, thereby allowing Apple to become the dominant player in digital music. Disruption has been underway in the fitness industry for several years, but until recently, it has been a slow and steady disruption.

COVID-19 accelerated the pace of disruption in fitness, and studios and clubs, both small and large, are increasingly vulnerable. 24-Hour Fitness recently filed for bankruptcy, citing Coronavirus-related causes. With 420 clubs in the US, 24-Hour Fitness is the second largest fitness chain after LA Fitness. With the filing, the company announced it would permanently shut down 100 of its gyms, leaving roughly one million members to find a new place to exercise. Also, Town Sports, owner of Boston Sports Club, and several other club brands announced they would likely file for bankruptcy in the coming weeks. Gold’s Gym filed for bankruptcy in May.

Demand for fitness isn’t going anywhere but up. The $30 billion fitness industry has been growing 3 – 4% annually for the last ten years. How it is delivered, however, is changing before our eyes. The often-quoted expression “Never let a good crisis go to waste” speaks perfectly to the opportunity in the industry today.

Stuck at home, trainers and consumers have had to adapt and get creative about how they think about fitness. Many have also discovered a new meaning of community through virtual experiences that were never seriously considered just 12 months ago. No surprise that MIRROR and Peloton have experienced record sales during the pandemic because they provide consumers a workout experience that feels pretty close to being in a room surrounded by fellow workout enthusiasts. And now that they have gotten into the routine of working out from home, either with a trainer or on-demand through an app, many will never go back to a traditional gym.
​
The implications of COVID on the fitness industry offer insights into the way several industries will shift as a result of the shelter in place orders. Restaurants will get more creative about take-out options that engage the diner with the preparation, travel experiences may turn to staycations, and the beauty industry may have to move to home services or even more training than doing for their customers. The winners in every case will be the ones that are agile and ready to adapt to the change.

No one disputes that cars, trucks, and SUVs will become increasingly connected over the next decade. From Amazon Alexa compatibility to navigation-linked speed limiters, the list of internet-powered features you’ll one day use during your commute grows every year.

Some technologies will make driving more convenient, especially when it becomes a tedious task. That, however, is just the start. Your car might save your life by becoming a doctor – no medical school training required.

In a recent interview, Steve Surhigh, the vice president and general manager of automotive cloud services for Samsung-owned Harman, explained how a car could monitor the driver’s health.

Eyes On The Driver. Keeping an eye on the driver is nothing new; millions of cars already do it. Mercedes-Benz inaugurated Attention Assist technology on the 2009 E-Class, and the on-going race toward autonomy has created vehicles that literally look you right in the eyes.

Cadillac’s Super Cruise system relies on a driver-facing camera to tell whether the driver is paying attention. If it notices you’re looking down at a smartphone or looking nowhere because you’re dozing off, it emits visual and audible warnings prompting you to stay focused and wake up. In some cases, the automated system might even take control.

Surhigh says Harman can build wellness monitoring technology on these foundations.

Teledoctors. “Some carmakers are talking about a teledoctor-type service. So, if there is a system that monitors the driver’s vital signs, and it detects something is noticeably wrong, having a teledoctor available could be part of the vehicle’s connectivity package,” Surhigh explained. “Not only can you monitor vitals, but you can also be proactive in terms of responding to an issue, whether that’s something that would be heart rate-based or based on blood sugar levels.”

Are you curious about how your car can monitor your heart rate? Look no further than the nearest gym. Sensors in the steering wheel, similar to those found on treadmills or stationary bikes, could track your pulse. Alternatively, Surhigh says, your car could receive this information from wearable devices, like smartwatches and fitness trackers. Data could be shared via Bluetooth or in-car 5G. Ford has even floated the idea of burying six pulse sensors in the driver’s seat.

“Carmakers are already integrating technology that monitors driver attentiveness. Once you get some of those foundational use cases built, the incremental costs of being able to do other things are very manageable. At that point, it’s more of a software type of build than one related to hardware,” explained Surhigh.

The possibilities don’t end at being able to track the driver’s heart rate. It’s not far-fetched to imagine mandatory breathalyzer-based ignitions for motorists who have a long history of driving under the influence, for example.

Whether you’ll tick the “heart rate monitor” box on an options list depends on your profile. If you’re a 24-year old buying a Volkswagen GTI, there’s a good chance you’re more interested in a surround-sound system and Amazon Alexa compatibility. If you’re an 84-year old in the market for a Ford Expedition? Well, I’m not going to generalize, but there’s a better chance you’ll be concerned about your pulse than someone born 60 years after you.

Although pulse tracking isn’t for everyone, it’s one of several dozen functions car companies are looking at integrating into their infotainment systems.
​
“The digital experience is replacing a lot of what previously differentiated carmakers, whether it was horsepower or some other vehicle experience linked to the engine, the braking system, or other components,” Surhigh said. “Now, they’re largely looking at the car’s digital components for differentiation.”

The very first contact tracing app powered by Google and Apple's exposure notification APIs has gone live in Switzerland.

As announced on Twitter by EPFL yesterday, 'SwissCovid' is now undertaking a large scale pilot, with hopes that it will pave the way for public availability by mid-June.

As of today, employees at @EPFL, @ETH_en, @vbs_ddps, and some hospitals and cantonal administrations can download the digital proximity tracing application #SwissCovid. This large-scale pilot paves the way for public availability by mid-June. https://t.co/E9hl43g8Ca #COVID19 #DP3T

In an announcement the institute stated:

Several thousand people in Switzerland can now download "SwissCovid," the official application for tracing contacts at risk of transmission of COVID-19 if they wish. "This is the first time that the operating system updates from Google and Apple enable its deployment and testing on such a large scale," says Professor Edouard Bugnion, Vice-President for Information Systems at EPFL. He was at the heart of discussions with Google and Apple to have them adopt the "DP3T" protocol led by the two Swiss Federal Institutes of Technology. Alfredo Sanchez, project manager, notes that "this gives great responsibility to the Swiss testers, as many other countries intend to adopt the same protocol later on."

One important footnote is that while the pilot is ongoing, the Swiss parliament will deliberate revisions to the law on epidemics. MPs must debate and approve the scheme before it is offered to the public, however recent research has suggested that as many as 70% of Swiss residents support the program.

This is the first large-scale testing of an app that uses Apple and Google's exposure notification technology. As per the two companies' stipulations, the operation is also decentralized:
​
SwissCovid operates in a "decentralized" way, which means that the operations that are essential from a privacy point of view are not carried out on a centralized server, but on each phone. The app uses Bluetooth to exchange and record the ephemeral proximity identifiers of other phones in the vicinity. These identifiers are kept on the phone unless a person is tested positive for COVID-19. In that case, their doctor will give them a single-use code that allows them to voluntarily share the ephemeral keys on their own phone that correspond to the days when the person was contagious. These keys are sent to a server managed by the Swiss administration.

Smartphone manufacturers have been launching “folding” devices with great fanfare, though, with high price tags and low demand, these units have not become market hits.

As an alternative, a smart start-up, castAway, has now announced a new device to add a second screen to your existing smartphone!

The castAway case enables you to open multiple apps at once, copy/paste, and access files and photos from either screen with ease.

The team responsible for creating the castAway screen smartphone case have added new perks for people to enjoy via Indiegogo, enabling backers to now order customizable mods that will be interchangeable with their castAway case, including a Qi wireless charging battery, a wallet w/ Qi wireless charging battery, and a Universal Case that will allow people to use all of castAways mods with ANY phone case they choose.

A quote from the company said, “We heard you loud and clear. After listening to your feedback, we’re excited to announce that we have expanded castAway into a full platform. We’re still delivering a second-screen experience — but now you can customize your case with a variety of accessories as well to meet the demands of your daily life. “

“A second monitor used to be a luxury, and now it’s a necessity. Juggling between apps and screens is how things go today. Adding a second screen to a PC is easy, but what about a second one for your smartphone? It’s not like you leave the need for multitasking behind when you are away from your desktop, out in the world doing things.”

The castAway case adds a second, ultra-slim screen to your existing iPhone or Android smartphone. The second screen is a powerful Chromium-based tablet that lets you multitask while on the go.”

Features of castAway include:

• castAway case connects with any iOS or Android phone and continues to work even when detached from your smartphone.  
• Features a dual boot option that lets you quickly turn it into a larger keyboard, trackpad, or game controller for your phone.  
• It is fully-equipped with a hi-res capacitive touch screen, WiFi, Bluetooth, front and back-facing cameras, & audio jack.  
• Integrated SD slot allows you to expand storage and offload photos from your phone  
• The built-in battery can do double duty and be used to boost your smartphone.

When the tablet is detached from your smartphone, your phone will look and feel like it would in any other high-end protective case. The hinge design also simplifies the task of supporting the myriad of smartphones. The smartphone side of the case is a custom fit for each major model type. That said, there are many unique (lower volume) phones for which we are developing a universal case back that works with the hinge. The castAway case will be available in 3 model sizes. Currently, the castAway is priced at $249, with delivery promised in October 2020.

Attackers can steal data from Thunderbolt-equipped PCs or Linux computers, even if the computer is locked and the data encrypted, according to security researcher Björn Ruytenberg (via Wired). Using a relatively simple technique called “Thunderspy,” someone with physical access to your machine could nab your data in just a few minutes with a screwdriver and “easily portable hardware,” he wrote.

Thunderbolt offers breakneck transfer speeds by giving devices direct access to your PC’s memory, which also creates several vulnerabilities. Researchers previously thought those weaknesses (dubbed Thunderclap), could be mitigated by disallowing access to untrusted devices or disabling Thunderbolt altogether but allowing DisplayPort and USB-C access.

However, Ruytenberg’s attack method could get around even those settings by changing the firmware that controls the Thunderbolt port, allowing any device to access it. What’s more, the hack leaves no trace, so the user would never know their PC was altered.

If you intend to use Thunderbolt connectivity, it is strongly recommended that you Connect only your Thunderbolt peripherals; never lend them to anybody; avoid leaving your system unattended while powered on, even when screen-locked; avoid leaving your Thunderbolt peripherals unattended; ensure appropriate physical security when storing your system and any Thunderbolt devices, including Thunderbolt-powered displays; consider using hibernation (Suspend-to-Disk) or powering off the system completely. Specifically, avoid using sleep mode (Suspend-to-RAM).

He developed something called an “evil maid attack,” referring to an attacker who gets physical access to a PC in a hotel room, for instance. “All the evil maid needs to do is unscrew the backplate, attach a device momentarily, reprogram the firmware, reattach the backplate, and the evil maid gets full access to the laptop,” Ruytenberg told Wired. “All of this can be done in under five minutes.”

The attack only requires about $400 worth of gear, including an SPI programmer and $200 Thunderbolt peripheral. The whole thing could be built into a single small device. “Three-letter agencies would have no problem miniaturizing this,” Ruytenberg said.

Intel recently created a Thunderbolt security system called Kernel Direct Memory Access (DMA) Protection that would stop Ruytenberg’s Thunderspy attack. However, that protection is only available on computers made in 2019 and later, so it’s lacking in any models manufactured before that. Also, many PCs manufactured in 2019 and later from Dell, HP, and Lenovo aren’t protected, either. This vulnerability might explain why Microsoft didn’t include Thunderbolt in its Surface laptops.

Intel just released a blog post giving its perspective on the issue.

Apple computers running macOS are unaffected by the vulnerability unless you’re running Boot Camp, according to Ruytenberg.
​
The researchers disclosed the vulnerabilities to Intel on February 10th, 2020, and Apple on April 17th. To find out if you’re vulnerable, there is a verification tool called Spycheck. To protect yourself, you should “avoid leaving your system unattended while powered on, even if screen-locked,” Ruytenberg wrote, avoid using sleep mode and ensure the physical security of your Thunderbolt peripherals.

In a triumph for the nascent industry of “satellite servicing,” an aging communications satellite has returned to service in geostationary orbit.

Northrop Grumman announced recently that its Mission Extension Vehicle-1, or MEV-1, has restored the Intelsat 901 satellite and relocated it into a position to resume operations.

“We see increased demand for our connectivity services around the world, and preserving our customers’ experience using innovative technology such as MEV-1 is helping us meet that need,” Intelsat Chief Services Officer Mike DeMarco said in a news release.

After launching on a Proton rocket last October, Northrop Grumman’s servicing vehicle used its mechanical docking system to latch onto Intelsat 901, at an altitude of 36,000km above Earth. Before this, no two commercial spacecraft had ever docked in orbit before.

Since it docked, the MEV-1 servicer has assumed navigation of the combined spacecraft stack, reducing the satellite’s inclination by 1.6 degrees and relocating it to a new orbital location, at 332.5° east. Intelsat then transitioned about 30 of its commercial and government customers to the satellite two weeks ago. The transition of service took approximately six hours and was successful.

Based on the agreement between Northrop and Intelsat, MEV-1 will provide five years of life extension services to the satellite before moving it into a graveyard orbit. MEV-1 will then be available to provide additional mission extension services, Northrop said, including orbit raising, inclination corrections, and inspections. Northrop is already building a second MEV to service another Intelsat satellite, 1002, later this year.

This satellite servicing milestone comes as both low-Earth orbit as well as geostationary space – where large, expensive communications satellites are often placed high above the planet to hold their position over the ground – are becoming more crowded. The availability of a service such as that offered by MEV-1 offers satellite providers both the ability to extend the lifetime of aging assets, but also to potentially remove those they have lost control of from the ground.
​
These kinds of services are generally seen in the space community as vital to keeping orbital space as decluttered as possible in the coming decades, so it is good that this demonstration case worked out well.