Security

A laptop filled with six of the world’s most dangerous viruses sold for more than $1 million

Written by

The Verge:

Some of the world’s greatest artworks are known for their elaborate backstory or complex history, but not many are actively dangerous to those who own them. ‘The Persistence of Chaos’ might be an exception. Created by internet artist Guo O Dong, this piece of art is an ordinary laptop filled with six of the world’s most dangerous pieces of malware. It’s perfectly safe — as long you don’t connect to your Wi-Fi or plug in a USB.

This is incredible to me. Who would buy this? But sell it did, and for about $1.35M.

Here’s a link to the original art installation page.

The continuing war to fingerprint iPhones

Written by

SensorID:

When you visit a website, your web browser provides a range of information to the website, including the name and version of your browser, screen size, fonts installed, and so on. Ostensibly, this information allows the website to provide a great user experience. Unfortunately this same information can also be used to track you.

Cross domain tracking is a well known problem, and Apple is on top of it. But read on.

We have developed a new type of fingerprinting attack, the calibration fingerprinting attack. Our attack uses data gathered from the accelerometer, gyroscope and magnetometer sensors found in smartphones to construct a globally unique fingerprint.

Dear advertisers, no one wants this to happen. You can tell because the tunnels you dig keep getting blocked. No one ever write’s a blog post begging for newer ways to cross domain track.

Following our disclosure, Apple has patched this vulnerability in iOS 12.2.

Once again, Apple has our backs.

The most expensive lesson of my life: Details of the SIM port hack that stole north of $100K

Written by

Sean Coonce:

I lost north of $100,000 last Wednesday. It evaporated over a 24-hour time span in a “SIM port attack” that drained my Coinbase account. It has been four days since the incident and I’m gutted. I have zero appetite; my sleep is restless; I am awash in feelings of anxiety, remorse, and embarrassment.

And:

The ability to port your SIM card to another device is a service that mobile carriers provide to their customers. It allows a customer to request their phone number be transferred to a new device. In most cases, this is a perfectly legitimate request; this happens when we upgrade to a new phone, switch mobile carries, etc.

And:

A “SIM port attack”, however, is a malicious port performed by an unauthorized source — the attacker. The attacker ports your SIM card to a phone that they control. The attacker then initiates the password reset flow on your email account. A verification code is sent from your email provider to your phone number — which is intercepted by the attacker, as they now control your SIM card.

Part of the issue was the author’s investment in crypto-currency, making his loss irreversible. But this goes beyond that. The loss could just as easily have been via his bank account, or currency transfer mechanisms. Pretty riveting read.

It’s almost impossible to tell if your iPhone has been hacked

Written by

Motherboard:

Hackers have been breaking into iPhones allegedly using a powerful spy tool sold to governments and taking advantage of a previously unknown vulnerability in the popular messaging app WhatsApp.

The hacking tool, as well as the WhatsApp exploit, were made by the infamous Israeli hacking and surveillance tool vendor NSO Group, according to The Financial Times, which first reported the story on Monday.

And:

“The simple reality is there are so many 0-day exploits for iOS,” Stefan Esser, a security researcher that specializes in iOS, wrote on Twitter. “And the only reason why just a few attacks have been caught in the wild is that iOS phones by design hinder defenders to inspect the phones.”

And:

As of today, there is no specific tool that an iPhone user can download to analyze their phone and figure out if it has been compromised. In 2016, Apple took down an app made by Esser that was specifically designed to detect malicious jailbreaks. Moreover, iOS is so locked down that without hacking or jailbreaking it first, even a talented security researcher can do very little analysis on it.

Not clear to me if that “0-day exploits” comment is true. After all, if you don’t have the tools to break in, how would you know. But the article does make interesting points. Are there exploit-detecting tools running behind the scenes on iOS, reporting back to Apple if anything is amiss? Or is it more like, the vault is so secure we don’t need guards?

How hackers and scammers break into iCloud-locked iPhones

Written by

Motherboard:

In each of these muggings, the perpetrator allegedly held the victim up at gunpoint, demanded that they pull out their iPhone, and gave them instructions: Disable “Find My iPhone,” and log out of iCloud.

And:

A stolen iPhone which is still attached to the original owner’s iCloud account is worthless for personal use or reselling purposes (unless you strip it for parts), because at any point the original owner can remotely lock the phone and find its location with Find My iPhone. Without the owner’s password, the original owner’s account can’t be unlinked from the phone and the device can’t be factory reset. This security feature explains why some muggers have been demanding passwords from their victims.

And:

In practice, “iCloud unlock” as it’s often called, is a scheme that involves a complex supply chain of different scams and cybercriminals. These include using fake receipts and invoices to trick Apple into believing they’re the legitimate owner of the phone, using databases that look up information on iPhones, and social engineering at Apple Stores. There are even custom phishing kits for sale online designed to steal iCloud passwords from a phone’s original owner.

Fascinating read, especially the coverage of phishing. Incredible balance, with the makers who make valuable things on one end, and the people seeking to convert those efforts into illicitly gotten cash on the other.

A “blockchain bandit” is guessing private keys and scoring millions

Written by

Wired:

What if an Ethereum owner stored their digital money with a private key—the unguessable, 78-digit string of numbers that protects the currency stashed at a certain address—that had a value of 1?

To Bednarek’s surprise, he found that dead-simple key had in fact once held currency, according to the blockchain that records all Ethereum transactions. But the cash had already been taken out of the Ethereum wallet that used it—almost certainly by a thief who had thought to guess a private key of 1 long before Bednarek had.

And:

That initial discovery piqued Bednarek’s curiosity. So he tried a few more consecutive keys: 2, 3, 4, and then a couple dozen more, all of which had been similarly emptied. So he and his colleagues at the security consultancy Independent Security Evaluators wrote some code, fired up some cloud servers, and tried a few dozen billion more.

Seems such an obvious tack to take. And reinforces my avoidance of blockchain backed currency. Perhaps I simply lack the sophistication to travel in such currencies. But when I read stories about people losing their life savings to stolen or misplaced blockchain currency accounts, it just scares me off.

This is a great read.

Princeton IoT Inspector lets you see what your smart home devices are up to

Written by

Ben Lovejoy, 9to5Mac:

Smart home devices are potentially one of the bigger security threats since there is no easy way to check what they are up to on your network. That’s a problem Princeton University has set out to solve, with the Princeton IoT Inspector.

And:

The tool is Mac-only for now. Using it, you can see:

  • a list of all the IoT devices on your home network
  • when they exchange data with an external server
  • which servers they contact
  • whether those connections are secure

Nice find. I’ve long thought about a user friendly device you could add to your network, have it build a list of devices you know about, give them names (such as Dave’s Switch, or Emma’s Mac, etc.), then have it automatically report (send you a text, perhaps) whenever a new, unknown device hopped onto your network.

To extend that idea, how about adding in the ability to detect cellular communications, within a short radius, reporting on those devices as well.

There are lots of solutions out there that do some of these things, but none I’ve found that do all of them, and none in a particularly friendly, efficient way. Please do weigh in if you know of something along these lines.

In the meantime, this Princeton tool is a nice one to explore. Though it’s not part of the Mac App Store, so do so at your own risk.

We built an ‘unbelievable’ (but legal) facial recognition machine

Written by

New York Times:

To demonstrate how easy it is to track people without their knowledge, we collected public images of people who worked near Bryant Park (available on their employers’ websites, for the most part) and ran one day of footage through Amazon’s commercial facial recognition service. Our system detected 2,750 faces from a nine-hour period (not necessarily unique people, since a person could be captured in multiple frames). It returned several possible identifications, including one frame matched to a head shot of Richard Madonna, a professor at the SUNY College of Optometry, with an 89 percent similarity score. The total cost: about $60.

And:

if you’re an adult in America, there’s more than a 50 percent chance that you’re already in a law enforcement facial recognition database, according to researchers at Georgetown.

This is a riveting read.

Apple to unlock iPhone NFC to read secure data from passports

Written by

NFC World:

Apple will expand the iPhone’s NFC chip reading capabilities before the end of 2019 so that it can be used to read data stored in security chips like those used in passports, according to comments made by the UK government.

And:

The iPhone’s NFC functionality is currently restricted so that it is only able to read NDEF data, so the UK government has been unable to make its EU Exit app available to EU citizens with an iPhone.

The app is available currently on Android devices only.

And:

“I’m also pleased to confirm that Apple will make the identity document check app available on their devices by the end of the year,” says Home Secretary Sajid Javid.

NFC tag reading was added to Apple Watch and iOS with the release of iOS 11. This appears to be expanding the type of tags iOS can read so the UK government can use an iOS app to verify identities.

Watch Samsung’s brand new Galaxy S10 face unlock get defeated by a video on another phone

Written by

[VIDEO] Lewis Hilsenteger, of Unbox Therapy, holds a video of himself up to the Galaxy S10. The video unlocks the phone.

I immediate thought of this scenario:

  • Bad actor takes video of victim’s face
  • Bad actor steals victim’s Galaxy S10
  • Bad actor unlocks the Galaxy S10

I can think of many more, but what’s the point of face unlock if it is so easily defeated?

The video is embedded in the main Loop post. Jump to about 2 minutes in to see this for yourself. Oh Samsung.

Cellebrite iPhone hacking tool is selling on eBay for $100 — And it’s leaking data

Written by

Forbes:

The U.S. federal government, from the FBI to Immigration and Customs Enforcement, has been handing millions to Cellebrite to break into Apple and Google smartphones. Mr. Balaj (Forbes agreed not to publish his first name at his request) and others on eBay are now acquiring and trading Cellebrite systems for between $100 and $1,000 a unit. Comparable, brand-new Cellebrite tools start at $6,000.

More importantly:

Rather than return the UFEDs to Cellebrite so they can be properly decommissioned, it appears police or other individuals who’ve acquired the machines are flogging them and failing to properly wipe them. Cybersecurity researchers are now warning that valuable case data and powerful police hacking tools could have leaked as a result.

This was one of the scenarios that emerged, back in late 2015, during the Congressional hearings that followed the San Bernardino shooting, asking Apple to build a golden key to allow law enforcement to unlock any iPhone on-demand. The concern then was that the golden key might get into the wrong hands, risking the data and privacy of the larger iPhone community.

How hackers and scammers break into iCloud-locked iPhones

Written by

Motherboard:

In 2013, Apple introduced a security feature designed to make iPhones less valuable targets to would-be thieves. An iPhone can only be associated to one iCloud account, meaning that, in order to sell it to someone else (or in order for a stolen phone to be used by someone new) that account needs to be removed from the phone altogether. A stolen iPhone which is still attached to the original owner’s iCloud account is worthless for personal use or reselling purposes (unless you strip it for parts).

And:

The iCloud security feature has likely cut down on the number of iPhones that have been stolen, but enterprising criminals have found ways to remove iCloud in order to resell devices. To do this, they phish the phone’s original owners, or scam employees at Apple Stores, which have the ability to override iCloud locks. Thieves, coders, and hackers participate in an underground industry designed to remove a user’s iCloud account from a phone so that they can then be resold.

This is a fascinating deep dive into the sophisticated black market that evolved for the sole purpose of defeating iCloud security locks.

What I learned from the hacker who spied on me

Written by

[VIDEO] Joanna Stern got a hacker to try to break into her various webcams. The video is embedded in the main Loop post.

Is putting tape over your webcam justified, or more like putting on a tinfoil hat? I’m in the former camp.

Clearly, keeping up with your various system updates will throw plenty of roadblocks in the way of a hacker, but plenty of people don’t do this.

Google: Can you spot when you’re being phished?

Written by

Think you can tell if you’re being phished? Take Google’s quiz, see if you get a perfect score.

Note that when they ask you to enter a name and email at the beginning, it’s fine to just make one up. They want to use the info in the quiz, not harvest the data.

Mis-configured clouds overtake ‘phishing’ as top source of breached data

Written by

The linked “Notes on Security in 2019” was pulled together by former Chief Security Officer at Box and current partner at Andreessen Horowitz Joel de la Garza.

The whole read is interesting (and short), but this bit jumped out at me:

When the numbers are finally crunched for 2018 it’s likely that mis-configured cloud services will overtake phishing attacks as the number one source of breached personal records.

There have been a number of large breaches in the last year resulting from cloud service configuration errors — and there aren’t indications that this trend is changing.

I’m reminded of Willie Sutton being asked why he robs banks. “Because that’s where the money is”.

Same with the shift to the cloud. That’s where the data is.

Be safe on the internet, an open source checklist

Written by

This is a really well organized list of habits and resources to improve your online privacy and security. Spend a few minutes just scanning the list. Are you following these habits? If not, dig in a bit, follow the links.

And that thing about freezing your credit? Sound advice.

Super Micro says review found no malicious chips in motherboards

Written by

Reuters:

Computer hardware maker Super Micro Computer Inc told customers on Tuesday that an outside investigations firm had found no evidence of any malicious hardware in its current or older-model motherboards.

That outside firm was Nardello & Co. From the Nordello web site:

Nardello & Co. is a global investigations firm with experienced professionals handling a broad range of issues including the FCPA/UK Bribery Act and other corruption-related investigations, civil and white collar criminal litigation support, asset tracing, strategic intelligence and political risk assessment, computer forensics and reputational due diligence.

Digging a bit more, this seems to fall into their Digital Investigations & Cyber Defense Division, headed by Mark Ray. From Mark Ray’s page:

Mark was a Director in PricewaterhouseCoopers’s Incident Response practice and led the firm’s US Cyber Threat Intelligence Center. Prior to joining PwC, Mark had a distinguished career as a Special Agent with the FBI’s Cyber Division, where he led several of the FBI’s most preeminent criminal and national security cyber investigations.

Impressive CV. Wondering where this goes from here. Bloomberg sticking to their guns?

As a reminder, here’s a link to the original Bloomberg article that started this all.

Massive two-factor code, password reset link, text message database exposed

Written by

TechCrunch:

The exposed server belongs to Voxox (formerly Telcentris), a San Diego, Calif.-based communications company. The server wasn’t protected with a password, allowing anyone who knew where to look to peek in and snoop on a near-real-time stream of text messages.

And:

Worse, the database — running on Amazon’s Elasticsearch — was configured with a Kibana front-end, making the data within easily readable, browsable and searchable for names, cell numbers and the contents of the text messages themselves.

And:

Often, app developers — like HQ Trivia and Viber — will employ technologies provided by firms like Telesign and Nexmo, either to verify a user’s phone number or to send a two-factor authentication code, for example. But it’s firms like Voxox that act as a gateway and converting those codes into text messages, to be passed on to the cell networks for delivery to the user’s phone.

Interesting to see how those two-factor requests are outsourced and where those text messages come from. Check out those sample searches in the article. A database like this is searchable in real time, making it easy for someone to monitor changes, steal accounts. A serious point of vulnerability.

Some iPhone users finding their Apple ID accounts have been inexplicably locked, requiring password resets

Written by

Benjamin Mayo, 9to5Mac:

We haven’t quite yet worked out the pattern or the cause but we have received many reports of users waking up to find that their Apple ID has been locked, and plenty more are complaining on social media.

And:

You will know if your account has been locked because iOS will present an alert in settings that says some Apple ID settings must be updated.

I’ve seen lots of reports of people complaining about being locked out of their Apple ID accounts. Not clear if this is related to a single security event, such as a particularly widely spread phishing scheme or a security break-in, or if this is some internal issue at Apple.

Download your personal data from Apple’s updated privacy portal

Written by

A couple of links associated with Apple’s updated privacy portal:

A snippet:

Apple, as a matter of company policy, believes privacy is a fundamental human right. From Tim Cook at the very top to engineers on the front line, this belief permeates Apple and drives the company’s product development process every bit as much as the technology itself. As much as Apple is designing for experience and for accessibility, the company is also designing for security and privacy.

The more I read, the more I learn about the big tech companies, I do believe this about Apple, and I do believe Apple is the only company of the majors that has this commitment.

Everything you wanted to know about Activation Lock and iCloud Lock

Written by

Oleg Afonin, ElcomSoft:

Activation Lock, or iCloud Lock, is a feature of Find My iPhone, Apple’s proprietary implementation of a much wider protection system generally referred as Factory Reset Protection (FRP). Factory Reset Protection, or “kill switch”, is regulated in the US via the Smartphone Theft Prevention Act of 2015. The Act requires device manufacturers to feature a so-called “kill switch” allowing legitimate users to remotely wipe and lock devices. The purpose of the kill switch was to discourage smartphone theft by dramatically reducing resale value of stolen devices.

According to Apple, “Activation Lock is a feature that’s designed to prevent anyone else from using your iPhone, iPad, iPod touch, or Apple Watch if it’s ever lost or stolen. Activation Lock is enabled automatically when you turn on Find My iPhone. … Even if you erase your device remotely, Activation Lock can continue to deter anyone from reactivating your device without your permission. All you need to do is keep Find My iPhone turned on, and remember your Apple ID and password.”

Follow the headline link, nice explainer.

Interesting take on Facebook Portal

Written by

Benjamin Mayo:

When a normal person sees a Portal, I don’t think they are going to turn a blind eye to it because of the existential fears of personal data exploitation. There are a handful of reasons why this product is going to fail in the market, but I don’t see privacy worries as a legitimate death-on-arrival poison.

I have to say, I don’t worry so much about the exploitation of my data, as much as I worry about Big Brother looking over my shoulder; The surveillance aspect more than the profiling aspect.

The key marketing point that Facebook is pushing here is video calls, through Messenger. I don’t get it. It just seems so much easier to talk on something that you can hold in your hand — be it a phone, tablet, or laptop in your lap — that you can freely move around with.

I totally agree with this take. I see little appeal to a non-portable video conferencing device. I do think Benjamin is right on this: The Facebook Portal will face an uphill battle in both perceived usability and security fears.

A future where everything becomes a computer is as creepy as you feared

Written by

Farhad Manjoo, New York Times:

More than 40 years ago, Bill Gates and Paul Allen founded Microsoft with a vision for putting a personal computer on every desk.

No one really believed them, so few tried to stop them. Then before anyone realized it, the deed was done: Just about everyone had a Windows machine, and governments were left scrambling to figure out how to put Microsoft’s monopoly back in the bottle.

This sort of thing happens again and again in the tech industry.

And:

The industry’s new goal? Not a computer on every desk nor a connection between every person, but something grander: a computer inside everything, connecting everyone.

And:

At a press event last month, an Amazon engineer showed how easily a maker of household fans could create a “smart” fan using Amazon’s chip, known as the Alexa Connect Kit. The kit, which Amazon is testing with some manufacturers, would simply be plugged into the fan’s control unit during assembly. The manufacturer also has to write a few lines of code — in the example of the fan, the Amazon engineer needed just a half-page of code.

And that’s it. The fan’s digital bits (including security and cloud storage) are all handled by Amazon. If you buy it from Amazon, the fan will automatically connect with your home network and start obeying commands issued to your Alexa. Just plug it in.

All of this is happening without any sort of oversight. Over time, we’ll have built a dystopiaNet that rides along the regular internet, unregulated, free of any sort of protections, while we whistle happily away.

Good read.

How to delete your Google+ account

Written by

Washington Post:

Hundreds of thousands of accounts on Google’s long-suffering social media service, Google+, may have been affected by a security flaw, the company said Monday, exposing personal information such as names and email addresses.

In the wake of the accidental exposure, Google said it is planning to shut down Google+ for consumers. But that will not happen for about 10 months. If you are wondering whether you still have a Google+ account — and if so, how to delete it — you can follow these instructions.

If nothing else, good to know how to tell if you have a Google Plus profile tied to your Google account.

Apple’s letter to Congress

Written by

This is the actual letter Apple sent to Congress calling the recent Bloomberg account of compromised servers and a spy chip untrue.

This is interesting both for the content of the letter (it’s short, an easy read) and the fact that you are seeing a copy of the actual letter.

TidBITS: Why SMS is not reliable for two factor authentication

Written by

Glenn Fleishman, TidBITS:

Many Web sites and apps now offer two-factor authentication (2FA), which requires you to enter a short numeric code—the so-called second factor—in addition to your username and password. These temporary codes are either sent to you via text message or are generated by an authentication app. In iOS 12 and macOS 10.14 Mojave, Apple has streamlined entering such codes when sent via an SMS text message, reducing multiple steps and keyboard entry to a single tap or click.

I explain just below how this new feature works, but I also want to raise a caution flag. SMS is no longer a reliable way to send a second factor because it’s too easy for even small-time attackers to intercept those messages.

Read the article, especially the section titled “It’s Easy to Hijack SMS Codes”.

Apple’s new proprietary software locks kill independent repair on new MacBook Pros

Written by

Jason Koebler, Motherboard:

Apple has introduced software locks that will effectively prevent independent and third-party repair on 2018 MacBook Pro computers, according to internal Apple documents obtained by Motherboard. The new system will render the computer “inoperative” unless a proprietary Apple “system configuration” software is run after parts of the system are replaced.

According to the document, which was distributed to Apple’s Authorized Service Providers late last month, this policy will apply to all Apple computers with the “T2” security chip, which is present in 2018 MacBook Pros as well as the iMac Pro.

I’m looking forward to reading a response from Apple on this issue. I can’t imagine, if true, that this is an effort from Apple to keep all those sweet, sweet repair dollars all to themselves. I’d expect this has something to do with protecting the chain of security, preventing malware from somehow gaining a foothold.

Grain of salt.

Apple strongly denies Bloomberg report of Chinese spy chips in hardware

Written by

From this morning’s Bloomberg report titled The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies:

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design. Amazon reported the discovery to U.S. authorities, sending a shudder through the intelligence community. Elemental’s servers could be found in Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships. And Elemental was just one of hundreds of Supermicro customers.

And:

One official says investigators found that it eventually affected almost 30 companies, including a major bank, government contractors, and the world’s most valuable company, Apple Inc. Apple was an important Supermicro customer and had planned to order more than 30,000 of its servers in two years for a new global network of data centers. Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons.

Apple’s response to Bloomberg:

“On this we can be very clear: Apple has never found malicious chips, ‘hardware manipulations’ or vulnerabilities purposely planted in any server,” Apple wrote. “We remain unaware of any such investigation,” wrote a spokesman for Supermicro, Perry Hayes. The Chinese government didn’t directly address questions about manipulation of Supermicro servers, issuing a statement that read, in part, “Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.” The FBI and the Office of the Director of National Intelligence, representing the CIA and NSA, declined to comment.

And another Apple reply, from this CNBC article:

Apple has issued strong denials of the report, stating: “We are deeply disappointed that in their dealings with us, Bloomberg’s reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple.”

The Bloomberg article is a fascinating read. Scary possibilities, and amazing that someone figured this out.

How potentially dangerous fake Apple products reach the US consumer market

Written by

Kevin McCoy, USA Today:

The knockoff power adapters and chargers, which Apple says could cause electrical shocks, allegedly traveled from a manufacturer in Hong Kong to Amazon.com, with stopping points at the Brooklyn location and New Jersey electronics companies.

And:

From outward appearances, the Apple-like products seemed genuine.

However, the chargers and adapters lacked adequate insulation and had improper spacing between the high voltage and low voltage circuits, creating risks of overheating, fire or electrical shocks, Apple charged in a 2016 federal court lawsuit. The case ended with confidential settlements in late May.

And:

Twelve of 400 fake iPhone adapters tested in a study unrelated to those in Apple’s lawsuit were so badly constructed that they posed “a risk of lethal electrocution to the user,” U.S.-based safety standards leader UL warned.

When I first came across this article, I was pretty sure Amazon would be part of the equation. In addition to the obvious safety hazard issues, I also wonder if there are some counterfeits with embedded malware, just waiting for an unsuspecting device to be plugged in. One reason I zealously guard the USB bricks that come in the iPhone and Apple Watch boxes.

Dulles Airport surprises passengers with facial-recognition boarding

Written by

Aaron Boyd, NextGov:

The new veriScan system developed by the Metropolitan Washington Airports Authority—with guidance from U.S. Customs and Border Protection—scans the faces of travelers approaching the gate. The system then compares the photo to a gallery that includes images of that person—either their passport photo for U.S. citizens or the photo taken of foreign nationals when they entered the country. The process eliminates the need for an airline employee to manually check every boarding pass and passport while boarding a plane.

I can only assume this is the first of many US airports to gain this technology. Slowly, the massive databases are connecting, sucking data from the ever widening network of facial sensors.