Researchers Hack Mobile Data Communications

 

Researchers plan to show today how to break the encryption that protects information sent over the General Packet Radio Service (GPRS), a standard commonly used to send data to and from mobile devices, and from other devices such as smart meters. This breach makes it possible to listen in on data communications such as e-mail, instant messages, and Web browsing on smart phones, as well as updates from automated industrial systems. 

The researchers, who will make their announcement at the Chaos Communication Camp, a hacker event taking place near Berlin, Germany, previously cracked the Global System for Mobile Communications (GSM), which is used to carry calls among 80 percent of the world's mobile phones. GPRS is an older technology that often supplements GSM, for example when faster 3G connections are unavailable. Smart phones, including the iPhone, use GPRS when operating on Edge networks (when the network connection says "E" rather than "3G"). Phones that don't support 3G use GPRS all the time. Both GSM and GPRS are used worldwide, though in the United States some major carriers, including Verizon and Sprint, use a competing standard. 

Phones might be the most familiar devices affected by the research, says Karsten Nohl, founder of Security Research Labs, a Berlin-based research consultancy that conducted the work. But the standard is also used in some cars, automated industrial systems, and electronic tollbooths. "It carries a lot of sensitive data," Nohl says.

Security researchers haven't looked at the GPRS standard much in the past, Nohl says, but since more and more devices are using GPRS, he believes the risk posed by poor security is growing.

Nohl's group found a number of problems with GPRS. First, he says, lax authentication rules could allow an attacker to set up a fake cellular base station and eavesdrop on information transmitted by users passing by. In some countries, they found that GPRS communications weren't encrypted at all. When they were encrypted, Nohl adds, the ciphers were often weak and could be either broken or decoded with relatively short keys that were easy to guess. 

The group generated an optimized set of codes that an attacker could quickly use to find the key protecting a given communication.  The attack the researchers designed against GPRS costs about 10 euros for radio equipment, Nohl says.

GPRS has not suffered very many security problems in the past, says Jukka Nurminen, a professor of data communications at Aalto University in Finland who spent 25 years at the Nokia Research Center. If the researchers have truly achieved what they claim, Nurminen says, many mobile communications could be much less secure. Depending on mobile operator and subscription plan, some devices maintain a GPRS connection at all times, particularly those whose users access e-mail and instant message applications from their phones. 

However, Nurminen adds, it might be possible to mitigate the risk by encrypting communications when they are sent, using common e-mail and Web-browsing tools. He notes that GPRS security is also affected by regulations in different countries, and that some laws undermine security by requiring governments to be able to break into communications if necessary.  

The GSM Association, a London-based organization representing mobile operators, handset makers, and other industry interests, regulates GPRS as well as GSM. The organization says it is reviewing Nohl's research but has not yet learned enough to comment. 

Nohl says companies will be negligent if they ignore the risks. He suggests that mobile applications take steps now to use encryption such as SSL, which already protects much of the sensitive information sent over the Internet. Nohl hopes that cellular network companies will require better authentication among devices and base stations communicating over GPRS. He also believes the ciphers used by the standard should be upgraded.

Read More

Thin Displays as Wristbands

The U.S. Army is testing a prototype "watch" that's lightweight and thin and has a full-color display. This display is built on flexible materials encased in a rugged plastic case and can be worn on a wristband to display streaming video and other information. It uses newly developed phosphorescent materials that are efficient at converting electricity into red, blue, and green light, which means the display needs less power to work.

Most phones, laptops, and TVs today use liquid-crystal displays (LCDs) controlled by electronics built on glass. To make more energy-efficient displays that are controlled by flexible electronics, which are lightweight and won't shatter like glass, many companies are turning to organic light-emitting diodes (OLEDs). The pixels in OLED displays replace the layers of electronics and filters in LCDs with organic dye molecules that emit light in response to electrical current.

For consumers, flexible OLEDs promise portable electronics with beautiful screens that don't drain battery life and won't shatter when dropped. But so far, no companies have developed economically viable manufacturing methods for producing flexible OLEDs with long enough lifetimes and consistent quality. The U.S. military has been funding development with the aim of providing soldiers with rugged, thin communications devices that can display maps and video without adding too much weight to their load.

The new display prototypes use efficient OLED materials developed by Universal Display of Ewing, New Jersey, and are built on foil-backed electronic controls developed by LG Display, headquartered in Seoul, South Korea. The devices were designed by L-3 Display Systems of Alpharetta, Georgia. The display is 4.3 inches. As part of military demonstration tests, the device has been used to stream real-time video from unmanned air vehicles.

"These prototypes represent not so much one major advance but continued progress on many fronts," says Janice Mahon, vice president of technology development at Universal Display. Those fronts include the OLED materials themselves, the electronics that control them, and the integration and packaging of the device.

The first generation of OLED materials, used today in glass-backed cell-phone displays and some small TVs, can convert only 25 percent of electrical current into light; the rest is lost as heat. Universal Display is designing and developing materials that work by a different mechanism and that have a theoretical efficiency of 100 percent. The prototypes for the Army use a full set of phosphorescent materials; the companies have not released specifications about power consumption, but Mahon says displays made with these materials use one-fourth the power of a conventional OLED.

Samsung Mobile Display, the biggest maker of OLED displays, currently uses Universal Display's red phosphorescent materials in its products; Samsung and other companies are currently evaluating green materials. Phosphorescent materials that work with higher energy light such as blue tend to be less stable over time and have been slower in coming. The companies have not disclosed information on the expected lifetime of the all-phosphorescent displays.

Universal Display applied the light-emitting layer to electronic controls made by LG Displays. The electronics are an array of amorphous-silicon transistors built on stainless steel foil instead of glass. Other companies, including Hewlett-Packard and Samsung, are developing flexible amorphous-silicon transistor arrays, mostly on sheets of plastic. Working with metal poses some challenges because the surface is rough, which can disrupt the structure of the transistors, but metal can withstand higher processing temperatures than plastic can. That's an important trait when it comes to laying down the silicon. High-temperature processing results in silicon crystal that's not only higher quality but also more stable over time.

"The broader story is that we're starting to see some good-looking demos of flexible OLED displays," says Nicholas Colaneri, who heads the Flexible Display Center at Arizona State University. Sony and Samsung Mobile Display have both demonstrated flexible displays built on sheets of plastic; both companies have been tight-lipped about these technologies. But, Colaneri notes, "just because you can do it doesn't mean you can afford to do it."

A major hurdle remains before displays like the prototype made for the Army will arrive on store shelves. Amorphous-silicon transistor arrays can be made at temperatures suitable for flexible electronics, and the LCD industry has created a lot of infrastructure for making them. But over time, they're not the best electronics for controlling OLEDs. The electrical currents required to switch OLED pixels burn out these transistors; the pixels that are on most frequently start to malfunction.

Canadian startup Ignis Innovation is developing software and other controls to extend the lifetime of the transistor arrays by ensuring that no single pixel is on too often. Colaneri says its initial prototypes are promising. In the meantime, Colaneri and other researchers are developing alternative transistor materials such as metal oxides to make OLED electronics that won't burn out.

The companies that made the Army prototype are not disclosing the metal-silicon electronics used to run it, but say they have met the Army's specifications.

Read More

A Flexible Color Display

Researchers at HP Labs are testing a flexible, full-color display that saves power by reflecting ambient light instead of using a backlight. The prototype display's pixels are controlled by fast-switching silicon transistors printed on top of plastic. If the technology can be commercialized, the display will compete with liquid crystal screens as well as other low-power color flexible displays in the works.

"Our goal is to make a display with the color saturation of newsprint that can be manufactured for about $10 per square foot," says Carl Taussig, director of the Information Surfaces Lab at HP's Palo Alto, CA, research center. At this price, reflective color displays could replace paper for applications such as signs and billboards, Taussig says, although he estimates that this will take a year or two at least.

HP is collaborating with Phicot, a subsidiary of Ames, IA-based Powerfilm, which prints high-performance transistors on plastic. HP plans to target both the e-reader and tablet PC markets.

The e-reader screen market is dominated by E-Ink, a company based in Cambridge, MA, that makes black-and-white reflective displays incorporating tiny microcapsules. E-Ink's screens have the look of paper, do not need a backlight, and do not require any power once the pixels have switched between black and white. But it is also too slow to show video and, as yet, is only available in black and white.

In contrast, Apple's iPad uses a more conventional liquid crystal display. This means it produces vibrant color, but it is also expensive, power-hungry, and vulnerable to glare. The display is also relatively fragile because it's built on top of glass. Many manufacturers believe there is still a market for low-power reflective displays.

Flexible display manufacturers are watching how consumers respond to the iPad. But they're also working to develop robust reflective displays built on plastic that use less battery life without giving up the functionality of LCDs.

"Color will make all the difference," says Nick Colaneri, director of the Flexible Display Center at Arizona State University, which partners with most of the major display manufacturers on technology development. Without color, reflective displays will be limited to niche markets, he says. Using plastic transistor arrays, which promise better durability, will also be key, he says, although major manufacturing challenges remain.

"The first company to get one of these out will have a strong position, but at the end of the day it comes down to cost," Colaneri says. "There are several radically different approaches to manufacturing, and it's too early to say what the costs will be."

E-Ink is developing its own color technology, which uses side-by-side red, blue, and green filters. This means that, at any given time, each pixel might only be reflecting light from one third of its total area, which can compromise the brightness of the display.

HP hopes to deliver a brighter color reflective display technology by stacking red, green, and blue pixels in the same area. "If you want to show red, you can make the entire display red," says Taussig.

The challenge in stacking pixels is that light is lost as it travels into and out of the stack display. "If you get loss at each layer, you get a huge overall loss, so we're engineering the light path to prevent that," says Taussig. HP's best approach so far is to stack layers of red, green, and blue dye between electrically active mirrors that control whether or not light passes through each layer.

"The drawback is that it's complicated," says Taussig. With every layer that must be added during manufacturing, there's more potential for errors. So the company is also developing a single-layer multicolor reflective display that uses luminescent materials to harvest light and convert it into different colors, which are then re-emitted.

A potential advantage for HP is its association with Phicot, which already makes high-performance display backplanes by printing silicon on plastic using a roll-to-roll process. "We've got to get the glass out of there," Colaneri says.

Korean display company LG and Taiwanese company Prime View International are also printing silicon transistors on top of flexible materials, and both these companies have promised fully flexible displays in the coming year.

"Phicot's approach is completely different," says Colaneri. Instead of going through multiple rounds of etching to create a transistor array, which entails multiple opportunities for error, Phicot uses a single-step, three-dimensional lithography technique. Eliminating manufacturing steps is particularly important when working with plastic: if it bends or warps during the printing process, the layers won't line up with one another. If HP can clear these and other manufacturing hurdles, its reflective display technology could be appearing soon on a billboard near you.

Read More

Energy-Harvesting Displays

Adding solar cells to liquid-crystal displays could help recover a significant amount of energy that's ordinarily wasted in powering them. Two research groups have created light filters that double as photovoltaic cells, a trick that could boost the battery life of phones and laptops.

Over 90 percent of the displays sold this year will use liquid-crystal display (LCD) technology. LCDs are, however, tremendously inefficient, converting only about 5 percent of the light produced by a backlight into a viewable image. The LCD in a notebook computer consumes one-third of its power.

This type of screen remains dominant because manufacturers can make LCDs inexpensively on a huge scale. More energy-efficient kinds of displays either are too expensive to manufacture or cannot produce high-quality images. "The LCD is very inefficient, but it works," says Jennifer Colegrove, an analyst at Display Search, a market-research and consulting firm.

Two independent groups—one at the University of California, Los Angeles, the other at the University of Michigan—are tackling two of the biggest culprits of wasted light in LCDs: polarizers and color filters. 

Polarizers filter out light that is incompatible with the liquid-crystal shutters in an LCD pixel, accounting for 75 percent of the total light wasted by LCD screens, and conventional color filters toss out two-thirds of the light that hits them. The two research groups have created plastic photovoltaic versions of these two display components, which convert light into electricity.

"We want to take an energy-wasting component that everybody uses and turn it into an energy-saving one," says Yang Yang, professor of materials science and engineering at UCLA. Yang's group created plastic solar cells that can act as polarizers. The researchers simply rub one layer in the solar-cell film with a cloth to align all the molecules in one direction. This alignment turns the cell into a polarizer that converts into electricity some of the light that doesn't pass through.

Yang's work is part of a three-year project being funded by Intel; in the coming year, his team plans to integrate the photovoltaic polarizer into a working display. In a paper published online in the journal Advanced Materials, the team reports that its polarizer can convert into electricity 3 or 4 percent of the light that's normally wasted by a filter. Yang expects to get this up to about 10 percent by tinkering with the materials used. 

The photovoltaic polarizers can harvest ambient light too, so they could potentially help charge a phone when it's not in use. "When the phone sits, it could work in the background, collecting energy and recycling it back to the battery," says Youssry Botros, program director at the Intel Labs Academic Research Office.

The second group, led by Jay Guo of the University of Michigan, is developing energy-harvesting color filters. Color filters are used in many types of displays, but the ones made by Guo's team are appropriate for use in reflective "electronic paper" screens. These contain arrays of sub-pixels that absorb ambient light and then reflect red, green, or blue light. 

Guo and colleagues combined a common polymer solar-cell material with a kind of color filter that his group invented last year. The photovoltaic color filter converts into electricity about two percent of the light that would otherwise be wasted. 

Guo estimates that full displays incorporating this photovoltaic filter could generate tens of milliwatts of power, enough to make a difference to the life of a cell phone battery. The photovoltaic color filter is described in a paper published online in the journal ACS Nano.

"It's an intriguing idea," says Gary Gibson, a scientist developing reflective color displays at HP Labs in Palo Alto, California. Low brightness is a recurring problem for color electronic paper. If the color filter proves practical, says Gibson, energy harvested from ambient light could be used to power a backlight and make the display brighter.

Read More

Why Google Wants Motorola

Google announced today that it has agreed to acquire the smart-phone manufacturer Motorola Mobility for $12.5 billion.

In a statement, Google said the deal was largely driven by the need to acquire Motorola's patent portfolio, which it said would help it defend Android against legal threats from competitors armed with their own patents. This issue has come to the fore since a consortium of technology companies led by Apple and Microsoft purchased more than 6,000 mobile-device-related patents from Nortel Networks for about $4.5 billion, in early July. Battle lines are being drawn around patents, as companies seek to protect their interests in the competitive mobile industry through litigation as well as innovation.

However, as people increasingly access the Web via mobile devices, the acquisition could also help Google remain central to their Web experience in the years to come. As Apple has demonstrated with its wildly popular iPhone, this is far easier to achieve if a company can control the hardware, as well as the software, people carry in their pockets. Comments made by Google executives hint that Motorola could also play a role in shaping the future of the Web in other areas—for instance, in set-top boxes.

Motorola is by far Google's largest acquisition, and it takes the company into uncertain new territory. The deal is also likely to draw antitrust scrutiny because of the reach Google already has with Android, which runs on around half of all smart phones in the United States.

Motorola, which makes the Droid smart phone, went all-in with Google's Android platform in 2008, declaring that all of its devices would use the open-source mobile operating system.

Before his departure as Google CEO, Eric Schmidt had begun pressing Google employees to shift their attention to mobile. Cofounder and new CEO Larry Page seems determined to maintain this change of focus. In a conference call this morning, he told investors, "It's no secret that Web usage is increasingly shifting to mobile devices, a trend I expect to continue. With mobility continuing to take center stage in the computing revolution, the combination with Motorola is an extremely important event in Google's continuing evolution that will drive a lot of improvements in our ability to deliver great user experiences."

Motorola engineers have extensively modified Google's basic Android platform for its devices. For example, the company designed Motoblur, a user interface that pulls together Twitter, Facebook, and other social sites, into a single stream of data, and this has been a major selling point for  the company's phones.
With input from Google, these sorts of modifications could get more juice—and might feature Google products more prominently. Motoblur, for example, might get an extra shot of Google+ integration.

"Google already had a big role to play in 50 percent of the smart phones being sold," says technology and strategy consultant Chetan Sharma, president of Chetan Sharma Consulting. If Google uses the Motorola acquisition to grow the Android platform further, he says, "it is quite likely that their share will get to the 70 to 75 percent range. Essentially, this means they will have a huge say in how the mobile Internet is developed and implemented by the [manufacturers]."

Page also pointed to Motorola's expertise with other Web-connected devices found around the home, saying, "I think there's an opportunity to accelerate innovation in the home business by working together with the cable and telco industry as we go through a transition to Internet protocol."

Sanjay Jha, chairman and CEO of Motorola Mobility, agreed, saying, "Our home business is uniquely positioned to capitalize on the convergence of mobile and home environments in partnership with our key customer."

Google executives have stressed that the acquisition will not put other manufacturers of Android devices at a disadvantage. Google worked with HTC to build its Nexus One smart phone, and with Samsung to build the Nexus S. The company says Motorola Mobility will operate as a separate company and will have to bid for contracts to make future Nexus phones, just like everyone else.

 Other smart-phone manufacturers support the deal as a way to protect Android against patent lawsuits, and Google has posted quotes from them online. HTC issued a statement that said, "This is a positive development to the Android ecosystem, which we believe is beneficial to HTC's promotion of Android phones. The partnership between HTC and Google remains strong and will not be affected by this acquisition."

Even so, Google may struggle to counter the perception that Motorola Mobility will get special privileges with Android. Sharma believes Google will eventually have to do more to placate other manufacturers if Android is to remain popular. "Long-term, I feel Google will divest the hardware business, and thus it will be less of a threat to the likes of Samsung and HTC," he says.

Read More

Personal Security

Many medical implants, such as insulin pumps and pacemakers, are equipped with wireless radios that let doctors download data about the patient's condition and adjust the behavior of the implant. But these devices are vulnerable to hackers who can eavesdrop on stored data or even reprogram the implant, causing, for example, a pacemaker to shock a heart unnecessarily. While it may be possible to engineer new, more secure implants, millions of people are walking around with vulnerable devices that can't be replaced without surgery. An anti-hacking device presented this week at the annual SIGCOMM communications conference in Toronto may offer them a solution. 

Created by researchers from MIT and the University of Massachusetts, Amherst, the laptop-sized device, called "the shield," emits a jamming signal whenever it detects an unauthorized wireless link being established between an implant and a remote terminal (which can be out of sight and tens of meters away).  Although no attack of this kind is known to have occurred , "it's important to solve these kinds of problems before the risk becomes a tenable threat," says Kevin Fu, an associate professor of computer science at UMass and one of the developers of the shield. Fu was Technology Review's Young Innovator of the Year in 2009 for his work in uncovering the previously unsuspected danger that hackers pose to implant wearers.

The key innovation is the new radio design that the shield uses for jamming. "If you just do simple jamming [broadcasting radio noise on a given frequency], then the attacker doesn't get the information, but the doctor doesn't either," says Dina Katabi, another developer of the shield and an associate professor of electrical engineering and computer science at MIT. Instead, the shield allows a jamming signal to be broadcast while it simultaneously receives data signals from the implant and relays them over a secure link. So doctors can still download data and confirm adjustments even while the shield is jamming an attacker.

Normally, trying to get a radio to detect data while it's broadcasting on the same frequency is like attaching a hearing aid to a megaphone on full blast and expecting the hearing aid to pick up a nearby conversation. Earlier attempts to make radios capable of simultaneously transmitting and receiving on the same frequency relied on a carefully spaced trio of antennas. But at the frequencies used in medical devices (about 400 megahertz), this spacing would result in a jamming device far too big for a person to carry. Instead, the researchers worked out how to use two closely spaced antennas: one for receiving and the other for broadcasting the jamming signal. The trick is to feed an "antidote" signal to the jamming signal into the receiving antenna, canceling out the jamming noise. 

In tests with cardiac implants in an environment meant to simulate the human body (a one-centimeter-thick layer of bacon placed on top of the implant, and four centimeters of lean ground beef below), the shield was able to completely block unauthorized communications with standard medical terminals, such as a hacker might buy secondhand from an online auction site. Even if the hacker builds his own terminal capable of transmitting a signal 100 times as powerful as the shield's jamming broadcast, the shield can still block communications until the terminal gets within five meters of the implant. Then the shield can't ward off attacks—but it can at least alert a patient that an attack is happening. 

Although the prototype shield, built out of two off-the-shelf software radios, is cumbersome, it could be miniaturized into something that could be worn around the neck or as a bracelet. The researchers are discussing possible commercialization of the technology with one medical-device manufacturer. A problem yet to be overcome is that telecommunications regulations in the United States and elsewhere generally discourage jamming equipment. Katabi hopes the U.S. Federal Communications Commission would be flexible: "They are a relatively agile agency, and they've generated waivers before for medical devices to encourage innovation and solve problems," she says. 

The researchers believe that the shield may be a better alternative to building encryption directly into implants. "Imagine you have an implant with a secret decryption key," says Katabi. "Your doctor knows the secret key, but you're traveling and there's an emergency and you're taken into a foreign hospital. The doctor there doesn't have access to the secret key." However, with a wearable jammer, the hospital could remove the shield, allowing unencrypted access during the emergency.

Not all security researchers agree with that analysis. "There are security methods that don't require a doctor to have the key," says Jay Radcliffe, a security researcher who has also studied wireless attacks on implanted devices. Rather than trying to "bolt on security as an afterthought," Radcliffe argues, the burden should fall on device manufacturers to design in security from the beginning. Still, for existing devices, Radcliffe thinks the shield could offer an interim solution.

Read More

Five Ways Apple Should Spend Its $76 Billion

Last week, Apple reported that it now has reserves of $76 billion in cash, short term securities and long term securities. As many wags pointed out, that's more than the cash-strapped U.S. government has left. On Tuesday, Apple also briefly surpassed Exxon Mobil to become the world's most highly valued company, at more than $340 billion in stock-market valuation.
With tens of billions of dollars to throw around and super-high investor confidence, shouldn't Apple reinvest in some cutting-edge R&D that could make it even more successful?
Apple has already shown the value of introducing unique new technologies for its products: the iPhone's advanced touchscreen and the MacBook's one-piece aluminum case, for example. Apple has also begun bringing CPU chip design and production closer to home, giving it another technological advantage.
So it wouldn't be a stretch for Apple to spend some of its cash on bringing new technologies into existence that competitors couldn't touch. Never mind buying Hulu or some other company. Here are five ways could Apple actually invent the future, and thwart other makers of phones, tablets, and computers.
5. Color screens that work in the sunshine
As much as I love printed books, I'd much rather tote a skinny little iPad for my on-the-go reading. But here in sunny Los Angeles, I can't see the color screen when I try to read outdoors. There's no way to read a book on a tablet at the beach, or in the park.
Of course mobile displays for reading in direct sunlight are already available, such as those on Amazon's Kindle, but they're only black-and-white, and they refresh at a painfully slow, page-turning speed. Now that a large chunk of my media consumption is in color, these displays don't cut it. Surely a daytime color display isn't impossible. With Apple's spare cash, could a breakthrough be around the corner?
4. Wireless network quality
Before Steve Jobs unveiled the original iPhone in 2007, he and his company pulled off a feat most pundits would have considered impossible: They got AT&T to change the way its voicemail system worked. Instead of forcing users to listen to all messages in order—a throwback to cassette-tape answering machines, and also good for getting customers to run up their minutes—the iPhone let its users view all messages onscreen at once and play only those they tapped.
But iPhone owners still complain bitterly about the quality of wireless service. AT&T drops calls, and Verizon won't let you make a voice call and use an Internet app at the same time. The audio quality of voice calls on any phone, through any carrier, seems to have gotten worse rather than better. If Apple could fix these issues, iPhone calls could become a premium feature rather than a joke. It might require a multi-billion-dollar investment in wireless network infrastructure, but we know who's got the money to spend.
3. Hands-free interfaces
Yes, I've figured out how to swipe at the latest version of Mac OS X. But you know what would be even better? Being able to wave at my iPhone instead of having to fumble with the keypad. Once you've tried Oblong Technology's hands-free interface, even a touchscreen seems dated.
The only problem is that Oblong's system is still too expensive for the mass market. Apple is legendary for turning Xerox's high-end mouse-and-menu workstations into affordable Macintoshes in the early 1980s. Couldn't they do the same with a hands-free interface?
2. Education
Another form of R&D: Give your products to a whole bunch of kids. In 2002, Apple began helping the state of Maine leapfrog its students ahead of wealthier states by giving Maine's schools a special deal on notebooks. Every seventh- and eighth-grader in Maine gets an Apple laptop that they can take home after school. Classrooms have wireless networks. Not only are the kids learning to use the tools they'll someday encounter in real-world jobs, but they're also being trained to prefer Apple over Windows. Apple has long focused on the educational market for both ideological and marketing reasons. Now would be a good time for a big national giveaway on MacBooks or iPads for future geniuses—and future customers.
1. Reinvent the battery
What's the biggest problem with your phone, laptop, or music player? It runs out of juice when you're nowhere near a power supply to recharge it. Even with a less thirsty CPU, energy-saving software, and premium batteries packed into as much internal space as possible, Apple's products can't hold enough power for a full day of heavy use for most customers.
Battery technology has advanced much more slowly than chips and displays. Apple's approach to product design—don't just think outside the box, replace the box entirely—could change the way mobile gadgets are powered. Is there a battery technology waiting to be discovered that blows past lithium-ion tech?
Could a new kind of battery be recharged without a special power adapter, or even without a wall socket? If my phone is about to conk out, could I get it to last a few minutes longer by shaking it? I'm fond of my Android phone, but its less-than-all-day battery life has caused me plenty of problems, and before day's end I often run down both the battery in the phone and the spare battery I carry with me. If Apple offered an iPhone that I could use in the real world for a week without a recharge, I'd switch on the spot.
Of course, what has made Apple so special for decades isn't fulfilling my wishes, but going beyond them. Dear Steve Jobs: Please bring me yet another gadget I would never have even thought of. Now more than ever, you can afford to do that.

Read More

New System Swaps the Cash Register for an iPhone

 

Square, a new startup based in San Francisco and headed by Twitter cofounder Jack Dorsey, opened its doors amid much hype and fanfare last week. But some experts are already questioning whether the company will be able to sustain itself.

The startup hopes to make it make it big by allowing virtually anyone to accept credit card payments by connecting a simple reader to a mobile device. Dorsey, Square's CEO, envisions the technology being used by small businesses, street vendors, and even individuals who want to sell a couch on Craigslist or collect money from a friend.

However, some experts question whether the device will find a niche in the mobile payments market and say the startup will face a challenge trying to win consumer confidence with such a novel approach. "In retrospect, PayPal's biggest innovation was putting together a system to protect both their users and themselves against fraud," says Charles Kahn, a professor of finance at the University of Illinois at Urbana-Champaign. "Before a system like this has any effect on consumer behavior it will have to convince consumers that their cards are protected."

To take a payment with Square, a user swipes a credit card's magnetic stripe through a small reading device that plugs into a phone's audio jack. The reader is currently compatible with the iPhone, but Square is working on versions for Android and Blackberry phones. Dorsey says the device communicates through the audio jack because it's cheaper to manufacture that way and because it should allow Square's technology to work on a wider variety of mobile devices. After the card is swiped, the user submits his signature using the touchscreen. And if the user chooses to enter an e-mail address, the system will send an electronic receipt.

Only the person who is receiving payment needs to have an account with Square, and the company hasn't yet set a pricing structure. But Dorsey says the pricing will allow for different levels of customer involvement. Someone who wants to use the service once for a yard sale should be able to get started easily and cheaply, while a small business might upgrade to a more full-featured version of Square.

"The credit card stack is quite complicated," Dorsey says. "We tried to find a simplest path to the parties who really need to be involved. We're taking a lot of the upfront cost away from the process."

Dorsey notes that Square uses encrypted protocols to send transaction information, and doesn't store card information on the seller's device. The device is subject to the same regulations as any other payment system.

Read More

Can Video Kill the Credit-Card Form?

The days of tediously having to punch in credit-card details whenever you make an online purchase may be numbered, thanks to a new payment system that turns any webcam into a credit-card reader.

Created by San Mateo, California-based Jumio, the new system, called Netswipe, not only makes online transactions simpler, but also improves security, says company CEO Daniel Mattes. The company's management team includes Facebook cofounder Eduardo Saverin.

Netswipe prompts a customer to hold up his credit card to his webcam. An on-screen video feed guides the customer to hold it within a template so it can capture the details. "It takes about a quarter of a second to read," says Mattes. To complete the transaction, the customer types in the three-digit verification number on the back of the card.

For security reasons, Jumio does not store an image of a user's credit card, or the credit-card details.

Mattes says Jumio has spent the last two years developing the algorithms and secure video streaming technology that make this possible. The company has worked with multiple universities and computer vision institutes and has accrued more than a million training samples to ensure its card reading and verification is fast and accurate.

Steven Murdoch, a computer security researcher at Cambridge University, says the system could be more convenient, but adds: "It has some issues, too, though, in that someone with a picture of your card might be able to use it as a counterfeit card."

Mattes says the system is designed to make this near impossible. "Jumio's technology analyzes credit cards to determine whether they're plastic and not paper," he says. This involves scanning the numbers and letters on the card to determine whether they're properly embossed, and checking card-specific features such as holograms.

Five large online merchants are preparing to implement Netswipe, Mattes says, and smaller companies can sign up to use it. "Smaller merchants simply need to embed a single line of code on their e-commerce website to offer their clients the option to pay with Netswipe," says Mattes. A mobile app version will be available in the next few months.
A number of other startups hope to shake up the payment industry. For example, Square has developed a small magnetic credit-card reader that plugs into the audio jack of an iPhone, iPad, or Android device. Not requiring the merchant to pay for extra hardware could be a significant advantage for Netswipe, says Murdoch, but he adds that, like Square, "one of the most important factors in whether Jumio succeeds is what deal they can negotiate with the banks which process the merchant side of the transactions."

Read More

An Ultra-High-Definition 3-D TV

 
New electronics enable a jump in performance in a
prototype display made by Samsung

Samsung has shown off a prototype of an ultra-high-definition 3-D television. The 70-inch prototype uses a novel electronic circuitry to control eight million pixels. It's not likely to go into volume production soon, and there isn't any content to display on it, says Paul Semenza, a senior analyst at Display Search. But at last month's Society for Information Display conference in Los Angeles, the display drew crowds and garnered a best-in-show award.

Samsung is the latest TV manufacturer to demonstrate a technology that uses a type of backplane—the array of transistors used to switch the pixels on and off—based on metal oxide semiconductors. These materials offer higher performance than the amorphous silicon widely used today, without increasing costs. In April, manufacturer Sharp announced it will begin manufacturing displays based on metal oxide transistor arrays by the end of the year at its plant in Kameyana, Japan.

It wouldn't have been possible to make the ultra-high-definition display using a conventional backplane, says Sangheon Kenneth Koo, director of LCD marketing at Samsung Semiconductor. That's because making the pixels smaller requires making each of the controlling transistors smaller, too. And the amorphous silicon used in conventional backplanes doesn't conduct electrons fast enough for this kind of miniaturization.

Metal oxide semiconductors conduct electrons very rapidly, and they can be deposited using relatively inexpensive methods. The hurdle has been figuring out which mixtures of metals to use and how exactly to work with them on today's equipment, says Randy Hoffman, a senior engineer at HP. The leading material is now a mixture of indium, gallium, and zinc called IGZO.

Semenza speculates that Sharp might be planning to take advantage of the high pixel densities enabled by metal oxide backplanes to make crisper mobile displays. Based on the size of the equipment at the company's Kameyana production line, he speculates that the company may be aiming to provide a high-resolution tablet display, perhaps for the next generation of Apple's iPad. "The high-water mark for this," says Semenza, "is the retina display" in the latest iPhone, which uses an expensive backplane based on another form of silicon transistor called low-temperature polysilicon. Metal oxide transistor arrays are less expensive to make and provide the necessary performance. Sharp might be able to offer a very good performance alternative to the retina display at a lower price, says Semenza.

Volume manufacturing of metal oxide backplanes could also be a boon for richly colored, energy-efficient organic light-emitting diode displays (OLEDs). These displays have been incorporated into some mobile devices and small high-end televisions, but they tend to be expensive. Part of the problem is that they can't be made with conventional backplanes: the high currents needed for these devices burn out amorphous-silicon transistors. So, OLED makers have been using the expensive polysilicon backplanes. Replacing those with metal oxide backplanes could make OLEDs more competitive.

Other qualities of metal oxides will be attractive in future display technologies, says HP's Hoffman. Every layer in a display tends to absorb some light and decrease overall efficiency and brightness. But metal oxides are transparent, so displays with these backplanes should get more light out and operate more efficiently. Hoffman expects this to be a particular advantage in reflective displays. HP is working on a flexible display that integrates a metal oxide backplane with a full-color reflective display.

Read More

Putting Location-Based Ads to Work

Ads targeted to a person's location are an advertiser's dream.
The reality is more complicated.

The spread of smart phones that track their owners' precise location seems like a wonderful development for advertisers. These devices could enable completely new kinds of digital marketing that make ads more relevant, meaningful, and effective. At the Location Based Marketing Summit, held last week in New York City, experts discussed the promise--and teething problems--facing this new section of the advertising industry.

Search engines already use positioning information from smart phones to deliver search results--and search ads--that are more relevant to a person's location. And location-based games, such as Foursquare and SCVNGR, which let users "check in" or perform other activities at locations to earn points or rewards, could enable new ways of reaching customers. These companies can make deals with local businesses to show users special offers when they are nearby.

According to a March 2010 survey conducted by the Mobile Marketing Association, 10 percent of all cell-phone users access location-based services at least once a week, and about 50 percent of those people have clicked on a location-based ad, or interacted with it in some other way.

Some early results suggest that location-based marketing could be every bit as effective as the industry dreams. A survey conducted in May 2010 by Placecast, a location-based advertising company based in San Francisco, found that 80 percent of consumers who have opted in to use a location-based service were receptive to being contacted by companies with offers based on their location. Placecast's data suggests that one-third of those who use location-based services have entered a store in response to a mobile ad, and 27 percent have been influenced to buy something.

Placecast's CEO Alistair Goodman notes, however, that the type of product being offered and its cost can have a huge impact on how effective a mobile ad is. For example, 33 percent of Placecast's survey respondents expressed interest in getting offers related to fashion and beauty, but 50 percent were interested in restaurant promotions.

Big brands such as Starbucks and Charmin are already exploring location-focused phone apps. Charmin has created an application that locates public bathrooms and lets users rate how clean and well-maintained they are. But experts at the New York event note that it's hard to determine whether many apps actually influence consumers' buying decisions.

Jed Rice, vice president of market development for Boston-based Skyhook Wireless, which provides location information, says it's important to find ways to measure the effects of these and other campaigns. Rice says that location-based services have a lot to offer small local businesses, which can make sure their ads are going to customers who are close enough to actually act on them. However, he says big brands are needed for the industry to take off.

In order to capture big brands' interest beyond throwaway experiments, Rice says, it's important to be able to analyze campaigns effectively. For example, even when a location-based ad campaign isn't likely to cause an impulse buy, services will need to show that the advertising was useful. He estimates it will take at least another year before businesses discover ways to measure the effectiveness of location-based ads.

Goodman noted that small businesses can watch for changes in foot traffic, but large businesses might have more trouble measuring how a campaign is affecting sales. Products such as Coca-Cola or Pringles are already being purchased by many consumers in many locations, and location-based services will need to find ways to demonstrate the value of adding the element of location to the companies' national marketing campaigns.

Andrew Turner, chief technology officer of Arlington, Virginia-based Fortius One, which offers a Web-based location analysis platform, says other types of information might make location-based advertising more effective and measurable. His company's software tracks how fast a person is moving. If she is going at walking speed, this might suggest she's open to receiving suggestions of things to look at in the area. But if she's traveling at driving speed, it's much less likely that an ad targeted to her location will be effective.

Read More

Using Wi-Fi for Navigating the Great Indoors

A phone can locate you indoors to within a few paces by
combining Wi-Fi signals and the jolt of your footsteps.

The arrival of GPS receivers in cell phones led to a boom in location-based apps and services—everything from maps that show you where you are, to new kinds of social networking. But step inside a building and GPS often fails. Now a startup has technology that enables devices to know their position inside a building to within a few steps, and it hopes this could lead to a second wave of indoor location-aware services.

WiFiSLAM, which publically demonstrated its technology for the first time last week, enables a phone to work out its position by combining the "fingerprint" of nearby Wi-Fi networks with information taken from a device's accelerometers and compass. The company was founded by students from Stanford University, with the aid of the university's StartX accelerator program for startups.

Mobile devices already use Wi-Fi networks to refine outdoor GPS fixes by accessing databases maintained by companies including Skyhook and Google, created by driving around "sniffing" for wireless networks. However this technology can today only allow accuracy of 10 meters at best and is primarily aimed at outdoor use.

The technology is typically accurate to within a "couple of steps" of your current location, says Anand Atreya, cofounder of WiFiSLAM: "This accuracy will change how you interact with indoor environments." The technology could aid with navigation inside large and complex buildings such as hospitals or airports, he says, adding that app developers will likely find more imaginative uses, too.

"Think about going to the supermarket," says Atreya. "We can provide information relevant to the product right in front of you." Another possibility is allowing users to find the nearest store clerk, as long as that person is also being tracked.

When a gadget using WiFiSLAM wants to know its location, it analyzes the signal strengths and unique IDs of all the Wi-Fi networks around it. That is matched against a reference data set for the area either accessed over the Internet, or stored on the device. The estimate of location can be sharpened if a gadget moves slightly, because WiFiSLAM's algorithms can gather multiple fingerprints. Compass data and accelerometer signals capturing a person's footsteps are also used to refine the accuracy of subsequent location fixes as a person moves around. 

WiFiSLAM needs similar data to be gathered in advance inside a particular building before it can offer location fixes. A person running another special app must walk around a building a few times, entering every room at least once. Algorithms originally developed for robot navigation process the changing pattern of Wi-Fi fingerprints and footsteps to re-create the path the person covered. That trace is then manually associated with a map of the place so that WiFiSLAM can tell a user in that environment where they are.

Other technology that uses Wi-Fi to for location sensing relied on expensive additional equipment, says Atreya. "I could walk into your building and have Wi-FI location working within an hour," he says, claiming this will allow WiFiSLAM to be rapidly adopted by many places.

Eladio Martin, a researcher at University of California, Berkeley, is part of a team developing another Wi-Fi-based location app that's accurate to 1.5 meters. Like WiFiSLAM's, Martin's team uses Wi-Fi fingerprinting and needs no equipment other than a cell phone, although it is currently just an academic project.

"Public buildings and especially those related to health care are some of the main candidates for the implementation of this technology," he says. Martin is not familiar with WiFiSLAM's implementation, but says that academic work published by members of the company suggests they could reduce the computational load of calculating traces from Wi-Fi fingerprints, which would make the technology more scalable.

WiFiSLAM plans to deploy the technology in a number of hospitals—including Stanford hospital—as well as shopping malls. The technology will initially take the form of stand-alone apps for navigation, for example, an app provided by a particular mall. However, the technology could eventually be built into apps with more general mapping

Read More

Rise of the Point-and-Click Botnet

In 2005, a Russian hacker group known as UpLevel developed Zeus, a point-and-click program for creating and controlling a network of compromised computer systems, also known as a botnet. Five years of development later, the latest version of this software, which can be downloaded for free and requires very little technical skill to operate, is one of the most popular botnet platforms for spammers, fraudsters, and people who deal in stolen personal information.
Last week, the security firm NetWitness, based in Herndon, VA, released a report highlighting the kind of havoc the software can wreak. It documents a Zeus botnet that controlled nearly 75,000 computers in more than 2,400 organizations, including the drug producer Merck, the network equipment maker Juniper Networks, and the Hollywood studio Paramount Pictures. Over four weeks, the software was used to steal more than 68,000 log-in credentials, including thousands of Facebook log-ins and Yahoo e-mail log-ins.
"They had compromised systems inside both companies and government agencies," says Alex Cox, a principal analyst at NetWitness.
A survey conducted by another security firm--Atlanta-based Damballa--found Zeus-controlled programs to be the second most common inside corporate networks in 2009. Damballa tracked more than 200 Zeus-based botnets in enterprise networks. The largest single botnet controlled using the Zeus platform consisted of 600,000 compromised computers.
The Zeus software is less important for its conquests than for its high regard among cybercriminals. "Zeus is incredibly popular with people that want to tinker and start their own small business, if you will," says Gunter Ollman, vice president of research for Damballa.
A group of four or five developers started working on Zeus in 2005. The following year they released the first version of the program, a basic Trojan designed to hide on an infected system and steal information. In 2007, the group came out with a more modular version, which allowed other underground developers to create plug-ins to add to its functionality.
The latest Zeus platform allows users to build custom malicious software to infect target systems, manage a far-flung network of compromised machines, and use the resulting botnet for illegal gain. The construction kit contains a program for building the bot software and Web scripts for creating and hosting a central command-and-control server.
Independent developers have created compatible "exploit packs" capable of infecting victims' systems using vulnerabilities in the operating system or browser. Other developers focus on creating plug-in software to help would-be cybercriminals make money from a Zeus botnet. Some add-ons focus on phishing attacks--delivering the images and Web pages needed to create fraudulent banking sites, for example. Other add-ons give bot operators the tools to create spam campaigns. "There is a whole cottage industry around creating add-ons for Zeus," says Don Jackson, a security researcher with the Counter Threat Unit at SecureWorks, a company based in Atlanta
The availability of the source code for Zeus has attracted many developers, says Jackson. Online miscreants looking to control their own botnet start with Zeus, because it is simple to use, he says, while the add-ons and extensions satisfy more sophisticated users. "It's very easy to use right out of the gate," Jackson says. "But when you add the advanced functionality that costs thousands of dollars, then it becomes a tool for advanced operators."
Even the basic Zeus kits include obfuscation techniques to help escape detection by antivirus software and other security measures. In one experiment, consultant Alex Heid of Information Security Services found that only about half of antivirus software detected a known Zeus payload. After employing some simple techniques for masking the code, the detection rate dropped even further, to 10 percent. "The cybercrime technologies are advancing faster than the security technologies," Heid says.
Once Zeus has compromised a system, it gives the user no sign that it's there, according to Jackson. "What does Zeus look like when it infects your computer? Well, stare at your computer now, and that's what it looks like," Jackson says. "It's designed to do its job and do it successfully and do it silently."
While both Damballa and NetWitness sell technologies and services for detecting compromises on corporate networks, they do not provide software for end users.
"Most enterprises that we work with have a large number of users, so they basically give up on defending their computers," Ollmann says. "You make the best attempt with antivirus and firewalls, but they accept that some percentage of their systems are going to be infected, so they focus on detecting and rebuilding the (compromised) systems rather than defending against all threats."
Cox adds that focusing on the communications between infected systems and a command-and-control server is usually the best way to catch infections. "Understanding what normalcy looks like on your network so you can pinpoint abnormality is what is really important in the current threat environment," he says. "Don't trust only your existing security controls, and get eyes on your network."

Read More

Most Malware Tied to 'Pay-Per-Install' Market

A shadowy industry lets spammers and other
cybercriminals pay their way into your computer.

New research suggests that the majority of personal computers infected with malicious software may have arrived at that state thanks to a bustling underground market that matches criminal gangs who pay for malware installations with enterprising hackers looking to sell access to compromised PCs.
Pay-per-install (PPI) services are advertised on shadowy underground Web forums. Clients submit their malware—a spambot, fake antivirus software, or password-stealing Trojan—to the PPI service, which in turn charges rates from $7 to $180 per thousand successful installations, depending on the requested geographic location of the desired victims.
The PPI services also attract entrepreneurial malware distributors, or "affiliates," hackers who are tasked with figuring out how to install the malware on victims' machines. Typical installation schemes involve uploading tainted programs to public file-sharing networks; hacking legitimate websites in order to automatically download the files onto visitors; and quietly running the programs on PCs they have already compromised. Affiliates are credited only for successful installations, via a unique and static affiliate code stitched into the installer programs and communicated back to the PPI service after each install.
In a new paper researchers from the University of California, Berkeley, and the Madrid Institute for Advanced Studies in Software Development Technologies describe infiltrating four competing PPI services in August 2010, by surreptitiously hijacking multiple affiliate accounts. The team built an automated system to regularly download the installers being pushed by the different PPI services.
The researchers analyzed more than one million installers offered by PPI services. That analysis led to a startling discovery: Of the world's top 20 types of malware, 12 employed PPI services to buy infections.

"Going into this study, I didn't appreciate that PPI is potentially the number one vector for badness out there," said Vern Paxson, associate professor of electrical engineering and computer sciences at UC Berkeley. "We have a sense now that botnets potentially are worth millions [of dollars] per year, because they provide a means for miscreants to outsource the global dissemination of their malware."

The researchers set out to map the geographic distribution of malware being pushed by these services, so they devised an automated way to download installers. They used services such as Amazon's EC2 cloud computing platform, and "Tor," a free service that lets users communicate anonymously by routing their connections through multiple computers around the world, to trick the pay-per-install program into thinking requests were coming from locations around the globe.
The system classified the collected malware by type of network traffic each sample generated when run on a test system. The researchers said they took precautions to prevent affiliate accounts from being credited with the test installations.

The analysis of the PPI services indicates that they most frequently target PCs in Europe and the United States. These regions are wealthier than most others, and offer affiliates the highest per-install rates.
But the researchers surmise that there are factors beyond price that may influence a PPI client's choice of country. For example, a spambot such as Rustock requires little more than a unique Internet address to send spam, whereas fake antivirus software relies on the victim to make a credit card or bank payment, and thus may need to support multiple languages or purchasing methods.
The team also found that PPI programs almost always installed bots that engage infected systems in a variety of "click fraud" schemes, involving fraudulent or automated clicks on ads to falsely generate ad revenue.

One unexpected finding may help explain why PCs infected with one type of malware often quickly become bogged down with multiple infections: Downloaders that are part of one scheme often fetch downloaders from another. In other words, affiliates from one PPI service themselves sometimes act as clients of other services. Consequently, many of the installers pushed by affiliates will overwhelm recipient PCs with many types of malicious software.

"We speculate that some of these multi-PPI-service affiliates are arbitrageurs, trying to take advantage of pricing differentials between the (higher) install rates paid to the affiliates of one service for some geographical region versus the (lower) install rates charged to clients of another PPI service," the researchers wrote.

This dynamic lends an inherent conflict of interest to the PPI market that hurts both clients and affiliates: The more installations an affiliate provides, the larger the payment received. But the more malware is installed, the greater the likelihood that the owner of an infected system will notice a problem and take steps to eradicate the malware.

PPI services have ominous implications for coordinated efforts to shut down botnets. In recent months, security researchers, Internet service providers, and law enforcement agencies have worked together to dismantle some of the world's biggest botnets. In March, for example, Microsoft teamed with security firms to cripple the Rustock botnet, long one of the most active spam botnets on the planet.

The Berkeley researchers argue that even if defenders can clean up a botnet—by hijacking its control servers and even remotely disinfecting PCs—the controller of that botnet can rebuild it by making modest payments to one or more PPI services.
"In today's market, the entire process costs pennies per target host—cheap enough for botmasters to simply rebuild their ranks from scratch in the face of defenders launching extensive, energetic takedown efforts," the researchers wrote.

Read More

A New Kind of Smart-Phone Connection

Several smart-phone manufacturers are developing plans to launch U.S. handsets that can connect to other devices when tapped together, or act as electronic wallets by instantly paying for goods when waved over a reader.

The technology to make this possible--Near Field Communications (NFC)--is a step beyond the contactless radio-frequency identification (RFID) technology used in many transit systems or security access cards for buildings. NFC uses the same high-frequency radio waves as RFID and can make a connection over a distance of up to around 10 meters. It is also compatible with existing RFID systems. But NFC devices can both send and receive data--something that will enable many new applications when coupled with the computational power of a smart phone.

"I think 2011 will be the inflection point for NFC--that's when we should see volume availability of handsets in the U.S.," said Didier Serra, founder of Inside Contactless, which makes chips and software for NFC devices, at the CTIA Enterprise & Applications meeting in San Francisco. Shipping a product with NFC hardware in large volumes takes a company around 18 months, he said and "the work started around nine months ago." he said.

Small-scale trials have already taken place in various U.S. cities in recent years. In late 2007, Sprint handed out Samsung NFC phones in San Francisco that allowed people to use transit and make payments in stores; Visa is now running trials in New York and Los Angeles, among other cities, of a gadget made by DeviceFidelity that slides into a smart phone's memory slot to give it NFC capabilities.

Nokia, the world's largest phone manufacturer, announced in June that all of its smart phones would gain NFC capabilities in 2011; Samsung has been testing handsets for some time, and Apple is widely rumored to be preparing an iPhone with NFC.

Apple could have an advantage over other handset makers, said Avivah Litan, a Gartner analyst specializing in banking and payments technology. She recently coauthored a report on the possible strategy of the Cupertino, California, company's move into contactless payments. "Apple already has a closed system of its own in iTunes that can act as a money transmitter," said Litan. "They don't want to become a bank--the way you get money into your iTunes account may be through your credit or debit card or a bank account--but they would handle the payment." Litan said she expects the firm to unveil an NFC-packing iPhone next year, citing a suite of relevant patents filed by the company and recent hires who have relevant experience.

All future NFC phones should be compatible with existing contactless payment and transport systems introduced by banks and others, for example, those used on transit systems in Boston and Los Angeles, and at 7-11 and Office Depot stores. But that infrastructure isn't pervasive enough to make that the main selling point of contactless handsets, said Serra.

"NFC enables more than just payments," he said. "Think about being able to exchange information by tapping your device against someone else's." He expects manufacturers to initially pitch the technology as a way to connect a phone with another handset and device--for example, making it possible to tap a Bluetooth headset to a phone to have the two instantly pair.

"I think people will see a lot of value in that," said Mohamed Awad of the NFC Forum, an industry body that has created specifications for NFC. "You can just tap a handset on a printer or laptop and it just connects. It's so natural." Although NFC can be used to transfer data at up to 424 kilobits per second--perhaps enough to transfer a document for printing, said Awad--it works best as a "helper" for setting up a higher-bandwidth Bluetooth or Wi-Fi connection.

The NFC Forum is already working on certifying the first wave of NFC devices for the U.S. market, according to Awad. "We've got a batch of products coming through today," he said.

However, as Serra points out, smart-phone manufacturers and carriers are now heavily dependent on third-party developers. "For NFC to be successful, the industry has to be app-centric and allow creative developers to provide ideas and apps that users want," he said. Social networking apps that enable people to exchange information or play games using NFC are one possible example, and this could play an important role in making the technology popular, he said.

However, consumers will also have to feel assured that NFC is safe, said Jean-Louis Carrara of the security firm Gemalto, which makes chips for smart cards and SIM cards. "People will be interested in the security of their phones, their personal information, and their payment data," he said, adding that NFC will likely make smart phones even more attractive to hackers. "Malware is rising on smart phones already," he notes.

Read More

New System Swaps the Cash Register for an iPhone

Square, a new startup based in San Francisco and headed by Twitter cofounder Jack Dorsey, opened its doors amid much hype and fanfare last week. But some experts are already questioning whether the company will be able to sustain itself.

The startup hopes to make it make it big by allowing virtually anyone to accept credit card payments by connecting a simple reader to a mobile device. Dorsey, Square's CEO, envisions the technology being used by small businesses, street vendors, and even individuals who want to sell a couch on Craigslist or collect money from a friend.

However, some experts question whether the device will find a niche in the mobile payments market and say the startup will face a challenge trying to win consumer confidence with such a novel approach. "In retrospect, PayPal's biggest innovation was putting together a system to protect both their users and themselves against fraud," says Charles Kahn, a professor of finance at the University of Illinois at Urbana-Champaign. "Before a system like this has any effect on consumer behavior it will have to convince consumers that their cards are protected."

To take a payment with Square, a user swipes a credit card's magnetic stripe through a small reading device that plugs into a phone's audio jack. The reader is currently compatible with the iPhone, but Square is working on versions for Android and Blackberry phones. Dorsey says the device communicates through the audio jack because it's cheaper to manufacture that way and because it should allow Square's technology to work on a wider variety of mobile devices. After the card is swiped, the user submits his signature using the touchscreen. And if the user chooses to enter an e-mail address, the system will send an electronic receipt.

Only the person who is receiving payment needs to have an account with Square, and the company hasn't yet set a pricing structure. But Dorsey says the pricing will allow for different levels of customer involvement. Someone who wants to use the service once for a yard sale should be able to get started easily and cheaply, while a small business might upgrade to a more full-featured version of Square.

"The credit card stack is quite complicated," Dorsey says. "We tried to find a simplest path to the parties who really need to be involved. We're taking a lot of the upfront cost away from the process."

Dorsey notes that Square uses encrypted protocols to send transaction information, and doesn't store card information on the seller's device. The device is subject to the same regulations as any other payment system.

By creating a Square account, payers can obtain extra features, too, Dorsey says. For example, a user can arrange to receive a text message every time his credit card is charged using Square. Or he can upload a picture that will display to the seller whenever the user's credit card is swiped. "We put a big focus on how to get the payer involved in managing security," Dorsey says.

Still, some experts are skeptical of Square's prospects. Jon Paisner, a senior analyst at Yankee Group who studies mobile transactions, says the need to plug in an extra piece of hardware to use Square might prevent people from adopting it. Paisner also worries that the device won't be sturdy enough in the long-term, and that audio jacks may not stand up to this kind of unintended use.

Paisner thinks there is potential for payments via mobile phones to take off in the United States and United Kingdom, but he thinks near-field wireless communication technology, which would allow users to make payments by tapping a phone against a reader, is more promising.

Mark Beccue, a senior analyst at Abi Research who studies consumer mobile technology, also has reservations. "What puzzles me is, what market we are addressing here?" he says. "I saw a video of using [Square] in a coffee shop and thought, 'Don't they have a cash register?' " Beccue concedes that the product may work for certain niches, such as markets or art fairs, but he doesn't think it has mainstream appeal. He suggests that most small businesses will prefer traditional point-of-sale systems for managing credit cards, and that ATMs are convenient enough that individuals aren't likely to turn to Square to pay each other.

Pilot tests of Square are being conducted in San Francisco, Los Angeles, New York, and St. Louis. Dorsey says the company hopes to open to the public in early 2010.

Read More

Google Wallet: Who'll Buy In?

Google announced an app and a number of partnerships that could help it become a key gatekeeper in mobile electronic payments—a space that many expect to boom over the next few years.

Google Wallet, announced today at an event in New York, is a app that lets users tap their smart-phone in stores to pay for purchases using near-field communication (NFC) technology—but only after they've entered their credit or debit card details. A related product called Google Offers will let users send coupons to their virtual wallets, via a Google search, for instance, or an advertising billboard using NFC.

Ubiquitous and increasingly sophisticated smart phones make mobile payments possible, and many companies are vying to play a role in the development of the underlying technology. Last November, AT&T, Verizon, and T-Mobile announced a similar mobile payments platform called Isis, and recently they revealed plans to partner with Visa and MasterCard.

Several startup companies are also jostling for a place in the market. Among them is Square, which provides technology that lets smart phones take credit-card payments. Apple, meanwhile, is rumored to be working on a NFC payments system for the iPhone that could be tied to users' iTunes accounts.

"Your phone will be your wallet. Just tap, pay, and save," said Stephanie Tilenius, Google's vice president of commerce, at the New York announcement.

Google has partnered with a number of major retailers, as well as Citibank, MasterCard, and the merchant processing service First Data in field tests, beginning today, and plans to release the product this summer in San Francisco and New York. Retail partners include Macy's, Subway, Walgreens, Toys"R"Us, Noah's Bagels, Peet's Coffee & Tea, Foot Locker, The Container Store, and American Eagle Outfitters.

One problem for Google could be a lack of suitable devices. Currently, there is just one Android device with NFC technology built in: the Nexus S, and only those devices running on Sprint's network will be compatible. Sprint plans to release several other NFC-equipped Android phones later this year.

Bill Maurer, professor of anthropology and law at the University of California, Irvine, who studies payments systems, says there may also be cultural and behavior hurdles. "It's really just a very different way of paying, and we have lots of ways of paying that work just

Alistair Newton, a research vice president at Gartner Research who researches mobile payment systems, points out that there is little customer and retailer demand for mobile payment systems, and there have been few success stories so far. Many have tried to implement NFC swipe-as-you-go payments in the past, he notes, particularly in Asia and Europe, with little success.

"This Google application is really going to be a supplementary payment utility for those consumers who chose to use it," he says. He also suspects that many people won't want to try it because "people are inherently quite conservative about money."

Another obstacle will be convincing retailers to buy new point-of-sale terminals to read the NFC phones. While some retailers have already signed on to accept Google Wallet, it may not be enough. "For this thing to really scale and be accepted everywhere, every merchant is going to need a new point-of-sale system that can read NFC, and that's a really big commitment," says Maurer.

But he believe Google may succeed where others have failed if NFC becomes widespread on smart phones, and if the company can encourage developers to create apps that use the technology—an app that lets restaurant customers split a bill, for example.

Newton believes Google Offers could also be vital to the strategy. "The one area where we see the mobile payments working is where you see a convergence between mobile payments and loyalty and coupon [programs]," he says.

"I think there's a strong and robust future for mobile payments, but it isn't going to happen overnight, and it isn't going to be for everyone," he adds.

Read More