Slashdot Mirror
The Black Hat Wi-Fi Exploit
Joe Barr writes to tell us that while many have heard that an Apple was exploited in order to install a rootkit at the recent BlackHat security conference, most people don't know the details of how it works. This is no mistake, it seems that the researchers who demonstrated the flaw were intentionally vague. Some theorize that this is in response to the real or perceived threat of legal action similar to the situation with previous Blackhat presenter, Michael Lynn.
Actually, you WERE told how to prevent an attack. Maybe not outright, but it was there. The original slashdot report http://it.slashdot.org/article.pl?sid=06/08/03/129 234 said that "Machines are vulnerable if they have wireless enabled and are set to connect to any available wireless network". This is enough information to secure your system. Simply tell it not to connect to any available wireless network. Only allow it to connect networks you have specified. Tada. No cash needed for this fix.
You can throw money at me instead, if you feel the need.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Without any detailed disclosure, sure, the craftiest people will determine how to perform said exploits. However, there are very, very few of these compared to the script kiddies that will show up if you hand out the source and/or a road map to every Tom, Dick, and Harry. At least they're giving Apple (and others) a chance to address the problem by pointing out that there IS a problem.
I'm not buying the people who are upset at a lack of full disclosure because they are "unable to protect themselves". If there was a way to protect yourself, sure, perhaps you could tell people how to do it. However, judging from the presentation itself (at Defcon), there really IS no way other than mutilation of the driver itself (see the slide with the nintendo DS) to quickly defend one's system. Not only would this significantly break a lot of things, most users wouldn't know the first thing about doing it.
The root causes as outlined in the presentation were a combination of a poorly planned and thought out protocol (802.11) and a quick-to-market rash of sloppy driver implementations, and it's going to take nothing less than at least a driver patch (or in a fantasy world, an overhaul of existing wireless protcools...802.11 lite if you will).
So quit accusing the presenters of being motivated by greed, stupidity, or other such notions - the best way to secure users at this point is to speak with the manufacturers directly and attempt to achieve a patch, not to detail how to break in to every last miscreant on the planet. The authors are starting to do this by their dealings with Apple.
Oh, and for those of you that missed the FAQ at the end of the presentation:
-Yes, it affects the kernel, which means it's >= root/Administrator on any system
-It's a driver/spec implementation issue, which means it's not an OS-specific problem. The use of an Apple machine in order to show that "any" platform is at risk was meant to illustrate this.
-The money slide was a joke meant to show how lightly many people were taking this issue. I have no way of proving the intentions of the presenters, of course, but I believe this was the case - they stated their intention was to get this problem addressed through discussion, not money.
All in all, easily my favorite defcon session (unless you count the shots of 151 distilled through peppers). Thanks, guys!
Actually the researchers explicitly mentioned that the card does not need to associate with an access point to be exploited.