Implantable medical devices like this pacemaker can be wirelessly reconfigured
This is great for the patients that they don't need surgery but it also brings
serious security concerns here at the University of Birmingham we are working
to make sure that these devices are secure. My research focuses on embedded
devices security just like this defibrillator or smart cars like the
Oyster card. As part of our research we analyze every device we can get our
hands on and we look for security vulnerabilities in them. As part of my
research I have identified vulnerabilities in the chip that is used
in the oyster card which allowed me for instance to top up the credit on the
card and then travel for free. [Kit] did you do that? [Flavio] we did not travel for free because
that would be illegal but we informed the manufacturer and transport
for London and we demonstrated that it was possible to
travel for free and this was some time ago and by now
they have replaced the chip in all of the Oyster cards and now the system is
much more secure and and your money is not at stake because attackers could
have actually stolen your credit from your card. Other things we have studied
are car keys and with this remote in the car keys and we demonstrated that it's
possible for most cars out there to actually open the cars and start the
engine without having access to the to the real car key and again we have
informed all of the manufacturers about these vulnerabilities and they have now
updated their security systems now cars are harder to steal.
We have also looked into banking apps and the way they communicate to the
the banks and we found some serious vulnerabilities in this connection
which allowed an attacker in maybe in the same Wi-Fi network to retrieve the
users credentials and once they have that they could you know deplete
someone's bank accounts and again we together with the government we talked
to the banks and they have been able to update the banking apps and then now
people's bank accounts are more secure because of that. As you can see in our
discipline is it's really hard to prove that a particular product is secure the
way that security evolves is by this exercise where we look into security
system with find vunerabilities we sort them out we fix them and then
the manufacturers produce a new version of the product which is more and
more secure raising the bar for fraud for attackers that want to compromise
the system. So here this is Kit who is a PhD student in our team and she will tell
you a little bit about her research. So I'm just starting my second year the thing
I'm looking at is fault injections so if you've got something like maybe a bank
card you might want to try and inject a fault in it like make it go wrong and in
the process of making something go wrong you get a you get a wrong output and
sometimes you can use that output to work out the cryptography or the kind of
the secret on the bank card and if you can work out the secret on the bank card
maybe you can use the bank card without needing to know the pin number and
that's the area of research that I'm looking into is if someone does a fault
on something how can we find out what they've done and whether or not that can
be used to get the secret out of the bank card so I'm particularly looking at
fault injection into hardware devices. Okay if you like what
we have been describing please leave us a comment below