Narrator: In this lesson,
we're going to talk about connectivity options
for your mobile devices and wearables.
Specifically, we're going to discuss NFC,
RFID, Infrared, Bluetooth, and Tethering.
The first connectivity option we need to discuss is NFC
or near-field communication.
Now, NFC devices use a radio frequency
that sends an electromagnetic charge,
contain the transaction data over a short distance,
usually just a few inches.
Now, many mobile devices have features
like tap to transfer,
where if two NFC enabled smartphones touch up
against each other,
they can automatically transfer information.
Now, NFC is also heavily used in mobile payments.
In the old days, we would actually pull out our credit card,
our debit card, or even cash to pay for our morning coffee.
But these days, we simply pull out our smartphones
or our smart watches and hold them up to an NFC reader.
Whether using Apple Pay, Samsung Pay, or Google Pay,
a mobile device user could pull out their phone
at tap it on a sensor to have their credit card
or bank account automatically debited
for their purchase price.
This technology is usually going to be paired
with a mobile wallet, which contains digital versions
of our different debit or credit cards.
Now, each of these are going to be stored inside
of Apple Pay, Samsung Pay
or Google Pay to conduct the transaction on our behalf.
In addition to making payments with mobile devices,
many businesses now use mobile devices
as part of their point of sale or POS systems.
These systems act like a register,
but they can be used anywhere.
For example, if you've gone into an Apple Store recently,
you've noticed that they don't have a standard register
for checkout.
Instead, their associates walk around
with iPhones and a card reader
and they take your payment from anywhere within the store.
Now, these devices are really convenient for businesses
that are often in different locations like food trucks
or people who sell items at a convention or fair.
Now, due to NFCs very short distances, many people assume
that it is a safe technology to use,
but it does in fact have some vulnerabilities.
For example, some high-gain antennas
can actually pick up the radio frequency signals omitted
by NFC devices from several feet away instead
of just the 2 to 4 inches
that are advertised as it was initially designed.
Now, this means an attacker could ease drop
on the communication from further away and go unnoticed.
Another common attack is where an attacker attempts
to skim information from an NFC device in a crowded area
by using an RFID skimmer.
This device will simply collect all the NFC signals
that it can inside an area.
So if a person is hanging out near the checkout area,
they may be skimming the NFC transactions using a skimmer
and a high-gain antenna and you'd never even know it.
Our second connectivity option
that we need to discuss is RFID.
Now, RFID or radio-frequency identification
is a form of radio frequency transmission
that's been modified for use in authentication systems.
In RFID system,
two components called the tags and readers
are going to be used.
This is heavily used in inventory tracking systems
and authentication systems.
In inventory tracking systems, an RFID tag
is placed on an object like a shipping container or a pallet
and then readers are used to identify that container
or a pallet as it goes throughout
and is put in a warehouse loaded on a truck
or moves along its designated logistical route.
Another commonplace to find RFID technology
is an enterprise authentication system
such as the employee's identification badges.
Now, an RFID tag can be embedded
into that employee's identification badge
and use as a possession factor in authentication.
Now, because it uses radiofrequency though,
there is a danger that signal could be captured
by an attacker and then retransmitted.
For this reason,
if you're going to use RFID as an authentication system,
you should always do it
as part of a two-factor authentication system.
And include a second authentication factor
like a PIN or a password.
The third connectivity option we're going to discuss
is an older technology and it's known as Infrared.
Now, it's still used in some organizations
and it's known as Infrared Data or IrDA.
IrDA is going to allow two devices to communicate
using line of sight communication in the infrared spectrum.
Now, infrared was actually quite popular about 20 years ago
for connecting wireless mouse and keyboards
before Bluetooth started taking over.
Now, infrared does require a line of sight connection.
This makes it a bit more secure than using Bluetooth,
but it has a very low data rate.
Some current uses of infrared include light fidelity,
which is a moniker that uses LEDs instead of infrared
to transmit data in this spectrum.
The fourth connectivity option we have
is actually Bluetooth,
which replaced infrared for a lot of things.
Bluetooth has become a common method
of connecting between desktops, laptops, and mobile devices
with all sorts of different peripherals
like mouse and keyboards and headphones.
When these devices are connected to the system,
a personal area network connection is going to be created
over the 2.4 GHz frequency band.
And this allows wireless connectivity
between the peripheral and the device.
Now, Bluetooth is very convenient,
but it does introduce some vulnerabilities.
The first is known as bluejacking.
Bluejacking occurs when unsolicited messages
are sent to a Bluetooth-enabled device.
To prevent this, devices should not be put
into discoverable mode unless we're actively connecting
to a new peripheral.
When we finish that configuration,
we should turn discoverability mode back off.
Bluesnarfing is another vulnerability,
and bluesnarfing occurs
when somebody makes an unauthorized access
to a device through the Bluetooth connection.
In this case, the attacker tries to take data off
of a device using that Bluetooth connection.
If we're in a high security environment,
it is better to disable Bluetooth altogether
and simply use cabled mouse, keyboards,
and headsets to eliminate this vulnerability.
Now, more modern threat to Bluetooth is known as BlueBorne.
BlueBorne is an attack that allows an attacker
to gain complete control over device
without even being connected to the target device.
This is due to a vulnerability
in the Bluetooth protocol itself
has been shown to work in Windows, Android,
and Apple devices.
Now, Tethering is the ability
to share the cellular data internet connection
from a smartphone to multiple other devices.
Usually by creating a Wi-Fi hotspot,
a Bluetooth connection between a phone and a laptop,
or a direct USB connection between two devices.
Most commonly, this is done from your smartphone
to your tablet or laptop.
Now, when you're doing this,
most smartphones will now allow tethering
to one or more devices,
especially if you're using it as a Wi-Fi hotspot.
This technology has some amazing utility
for the business traveler, but it also does have some risks.
For example, you need to be wary of connecting
to other people's hotspots.
These devices could be set up as a form of on-path attack
where the provider of the free Wi-Fi
is actually capturing all the traffic
that's being set over it,
such as the login and password information
for work related, banking or other social media websites.
To best protect yourself,
always connect to the trusted wireless network
that you know, like your home, office,
or personal hotspot network.