Slashdot Mirror
Researcher Creates Handheld Hacking Tool
Kickball Notches writes "Immunity's Dave Aitel plans to start selling a portable hacking device equipped with hundreds of exploits. The wireless handheld, called Silica, comes equipped with more than 150 exploits from Canvas and an automated exploitation system that allows simulated hacking attacks from the palm of your hand. It supports 802.11 (Wi-Fi) and Bluetooth wireless connections and is based on Linux."
Something like this could be easily used in conjunction with vulnerabilities like the recent Atheros 802.11 wireless device driver exploit. Of course, many wireless attacks like this will still be targeted, and won't be widespread, because of one huge reason: proximity. Even the co-discoverer of the Atheros driver vulnerability, David Maynor, said:
;-)
The thing to keep in mind here is that this really isn't a problem yet. You won't see any WLAN viruses' base on driver level exploits any time soon for one very important reason, proximity. We wanted these issued raised and fixed before the distance of a wifi connection for your average user will be measured in kilometers instead of the meters it is today.
Don't go rip your wifi cards out just yet, but you should always adhere to good security techniques. Even without a driver level exploits man-in-the-middle attacks over wifi networks are a threat that you can mitigate by doing things like verifying the SSL certs for things you can connect to and don't do anything you want to remain personal or private over clear text on these access points. Also, for things like instant messaging, grab something like Adium X that supports encrypted IM conversations across multiple platforms. I know iChat does as well, but I am a big fan of something called OTR (http://www.cypherpunks.ca/otr/) which Adium supports.
And no, this wasn't a "Mac OS X"(-specific) or "MacBook" vulnerability; it is a vulnerability in the Atheros driver code, which, according to the presenters themselves, is exploitable on other platforms, including Windows and Linux. Mac OS X was chosen to prove a point, and unfortunately the "point" that many ordinary people ended up getting was that all "MacBooks" and only "MacBooks" were vulnerable to some kind of scary 802.11 attack, and worse, that setting the machine to not auto-associate with access points would solve the problem (it doesn't). Some interesting points from a SecurityFocus mailing list about the Atheros exploit:
* The exploit is running in kernel space and can do _anything_ it wants. It's not running as root because that would involve running under the kernel. In Intel terms, this is ring 0 stuff.
* Firewalls, "preferred networks" and other OS-level mitigation is worthless. The packets don't have to contain any IP data, they are pure 802.11{b|g} frames. The OS doesn't see the packet because it would have to get past the (exploited) device driver.
* The exploit doesn't require associating to an AP, being associated to an AP, anything. It just requires the wireless device to be on.
What this really illustrates is that when you let third-party, proprietary, unaudited code into a privileged capacity on an OS, it could indeed be an avenue for attack.
And now that attack can come from a dedicated device running in someone's pocket.
(Personally, I see no reason why hardware device makers should keep driver code proprietary, much less the hardware specifications needed to produce an open source driver. After all, isn't their bread and butter the hardware itself?)
This device could also associate with a wireless access point normally, and launch penetration tests against any hosts reachable on the network as well. TFA notes that the device is also equipped with ethernet and USB connectivity as well. Sounds like a neat little device, that could have other functionality as well.
CmdrTaco said:
I'm confused. I can't really see why this is much use except for hacking things with wifi but no internet connection and the like or what? And it gives a cool 007 look that no noe should give a crap about. Look I can hack while eating lunch at Mac Donald's with my ready to use exploits! I'm a genious!
+1 Agree -1 Disagree
Hack-O-Matic seems more 133t. Instead of Silica...
:-)
The articles headline is "'Pen' Testing in the Palm of Your Hand". Wikipedia describes pen testing as "a method of evaluating the security of a computer system or network by simulating an attack by a malicious cracker. The process involves an active analysis of the system for any weaknesses, technical flaws or vulnerabilities. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities."
For real 'pen testing', stick with what all the hackers already know. Worry about a handy tool to do it with, after you've dealt with tried and tested measures.
Someone at the FTC, FCC and BSA has to check for alt.2600 postings and such...?
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
I'm buying one of these tools and super-gluing it to my TV B Gone. Then I'm going to walk into CNN headquarters and completely change the way America gets her news.
It is especially important to note the Bluetooth abilities in this context. IF properly tweaked, one hacker could wander around a major public event and automatically attempt to break into every Bluetooth device in range. You can get within range of thousands of people.
I wonder what errors this device has that need ironing out. Would it be able to detect its own security holes? (Ow, head asploding)
Information wants a fueled airplane waiting at the hangar and no one gets hurt.
a machete. TIBHAW,TTV.
They say the first thing to go is your penis. Well, it's either that or your brain. I forget which...
Since it's a pen-based device, should the users of this product be classified as "script kiddies"?
Don't delay! Buy now! The first 10 buyers will also receive an official Immunity Canvas' McGyver Swiss Army knife* (with lock-picking add-ons) and a t-shirt bearing the sentence "Look, mom: I'm a hacker!" in the front and "kick me" in the back.
* Parents: this is a safe product; to prevent injury, the Immunity Canvas' McGyver Swiss Army knife is manufactured in non-toxic plastic.
The article doesn't specify details, but it sounds like what you can do with a Sharp Zaurus. You need to be selective, but you can get linux running with something like metasploit without too much effort. This unit's got more RAM and disk I'm sure, but it's hardly revolutionary.
There is no reasonable defense against an idiot with an agenda
:wq
it's called a hatchet. (Thank you, I'll be here till 5, be sure to tip your admin!)
the mods may say you posted flamebait, but to me it's a flame that warms my heart. rock on, brother! --chebucto
The word is PLANE, as in those big metal things that fly.
If you want to see Snakes on a PLAIN then go to Nebraska. They have lots of them there.
There is no reasonable defense against an idiot with an agenda
:wq
Not to be confused with Insomniac's Dave Attell, although both equally fond of the back door.
https://www.eff.org/https-everywhere
And they sure are sick of those m----- f----- snakes on those m------ f----- plains. Forgive me.
You won't see any WLAN viruses' base on driver level exploits any time soon for one very important reason, proximity.
One of the proposed uses is to turn it on and mail it to the site in question. It can perform "tests" (including man-in-the-middle attacks) "while sitting on the CEO's desk".
Or in the mail rooom. On in the inbox of somebody on vacation.
Of course that means it (or a similar device) could be shipped in the same way. It could run for a couple weeks (or until the battery is exhausted), rooting around the company's wireless LAN and shipping the result out the internet to the attacker's safe drop. Then (or when the package it opened) it could purge its own software and self-destruct or turn itself into something innocent appearing, such as a promotional toy. (Perhaps it could sucker somebody into recharging it.) Or it could be built into some other object and never discovered.
If the IT staff isn't on the edge of their seats about searching for rogue WiFi devices and/or sniffing network traffic it could have weeks to work undetected. Even if they ARE on the ball and have the cutting-edge stuff it can snag a lot of interesting stuff at computer speeds in the time it takes to hunt it down and kill it or succesfully cut it off from all outside contact (including masquerading as a legitimate device).
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
...Oh, never mind.
...not as cool as the one the Warbears use .
Finally a feature from movies becoming reality ;-)
Pixel image editor - http://www.kanzelsberger.com
Metasploit has been successfully running on Zaurus for over 2 years... And has more exploits (not two thirds DoS's like Canvas)... And the exploits actually work... And its free...
I'm actually looking for a good mobile device right now, which doesn't have to have these security tools, but be a general-purpose geek tool. Unfortunately, I've yet to find a good one. It seems most companies are trying to woo consumers with flashyness and power instead of mobile usefulness.
What I want is a portable device the size of the old Libretto or Picturebook, with all the modern memory card type slots, wi-fi, ethernet, phone, USB, Firewire, PC-card, and anything else needed to interface with common devices and perhipherals. I don't want to have to carry a bunch of dongles and USB cables to use common hardware I might run into. I don't want a fast processor and memory, I just want the hardware interfaces and the longest possible battery life in a very small package.
All the mini-notebook makers out there seem intent on trying to cram as much processor power and memory into a small package, which incidentally results in them running so hot they could burn you, and shortens battery life to lunch-break length. What are you going to do with a Athlon 64, play WoW on a 8-inch screen?
*sigh* maybe this device will be different, but seeing as how it says "Currently it supports 802.11 (Wi-Fi) and Bluetooth wireless connections or optionally Ethernet via USB", it doesn't sound like it.
I saw this at Defcon in the Immunitysec booth. Dave had some nice demos going on, and he was also showing offn t.html
Visualsploit http://www.immunitysec.com/documentation/vs_nipri
Silica is a full port of Canvas onto the Nokia, not "allows simulated hacking attacks", instead "full exploitation framework".
Canvas licensing creams Core Impact (3kish vs. 30k).
Is it considered bad karma to reply to your own AC with a joke and get +5 for it? Just sayin'!
Next they'll have a Windows version: it will come preloaded with 150 viruses, worms, and network security tools. Just put it in your shirt pocket, walk through your office and infect coworkers' PCs.
I don't know if "... and is based on Linux." is really that positive for the Linux reputation :)
Privacy is terrorism.
if this is too widely used it could have a negative impact on computer security as people running penetration tests may get lazy and simply run through the tests that this handheld device supports rather than carrying out an exhaustive security analysis.
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
Ok, so are half the security researchers on the planet going to be working against this, while the other half work on updating it?
Sweet, now it is time for Deus Ex LARPing! Grab my crossbow and sunglasses and I'm set.
Yes, I know testing your security is a good thing, making sure you have everything save and "hacker-proof." Not that things could EVER be totally hacker-proof.
But selling a hacker tool? Isn't that like advertising your p2p service by saying you can get copyrighted material on it? Or saying that your pistol is great for killing people? Shouldn't that be wrong?
"Here! Take this CD! You can crack any encryption scheme anywhere! But remember, its just for knowledge sake and you can't use it! We will not be held responsible for your actions! GOOD LUCK!"
o_O
"A portable hacking device equipped with hundreds of exploits and an automated exploitation system will go on sale in the United States in October."
^^ They call it a hacking device in the first sentence. They go on to say its for security testing, and that law enforcement and businesses have shown interest, and that it's $3000--which would stop a lot of script kiddies and small time hackers. Maybe its just me that feels odd about the hacking tool in the first place. I feel odd about lock picks! I know that they're supposed to only be sold to keymakers (Are you the keymaster?) and locksmiths. But you always find a small ad in the back of some cheap magazine for x-ray glasses, super strength pills and lock picks. What's to say these hacking tools won't?
VCRs can be used for piracy. Guns can be used to kill. This hacking tool can be used to hack people's computers. They have good uses, too. But which of those uses would be more likely and more prevelant?
Reminds me of this
for future google queries TIBHAW, TTV == Thanks, I'll be here all week, try the veal.
Pfft. I used hundreds of tools like this when I was in UNATCO way back in the 2050s.
Multitools I think the were called.
Oh, I that it was a transendental plane of meditation.
The Kruger Dunning explains most post on
I was just thinking today that, with the Max Media dock and Linux, you could do something like this on your DS lite. Not a lot of practical use for the average user, but useful for comprehensive penetration testing.
When did the future switch from being a promise to a threat? -C. Palahniuk
Finally, I'll be able to run that damn gate bypass...
Didn't the **AA say that a while ago?
Or, should I say HAXX0RZZ...
Flappinbooger isn't my real name
a beowulf cluster of these babies.
Dave,
Since you're here: why such a high price-tag? I'd say that it's to prevent kiddies from using it, but I'm curious whether the cost of putting it together would be so high.
Anyway, congrats on the good idea.
Utinam logica falsa tuam philosophiam totam suffodiant!
I've not put Metasploit on mine, but I can't see why it's not possible. Here are some of the things I ave installed:
u sheader&page=zaurus/zaurusmain
Nmap
Zethereal
Ettercap
Ngrep
TCPDump
Kismet
Nmap
THC-Hydra
Nemessis
http://www.irongeek.com/i.php?submenu=zaurus/zaur
All on a Zaurus 5500 and for a lot cheaper than the asking price of this new toy.
Irongeek's Hacking Videos / Security Videos and Articles
Hardware *was* those companies' bread and butter a long time ago, when hardware was a big bunch of complicated dedicated chip cummunicating together. All the secret was in the hardware. And due to the diversity of OSes back then, a company had better to show specification in order to catch more market (An old ATI SVGA card I had back then was packaged together with complete register specifications so one could hack it's own drivers in adition to the few packaged in (Windows, AutoCAD, etc.)).
Today, hardware is mostly a third party chip slapped on a reference board. The company that sells them (like D-Link) get the chip and the drivers in the same package (like, say, from realtek) they don't develop anything and thus don't have anything to document.
And nowadays, more and more of those chips aren't dedicated chip, but in fact some highly programmable chip with somewhat customized IO ports and special hardware (connectors, antenas, etc.) connected to the Port. Most of the magic is in the drivers and the firmware (look at how much gizmo - like routers - today are a plain SoC with special IO. Some run linux, most run secret software). And such chip producer have a lot of incentive NOT publish standarts, because :
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Sonic Drive Inn's credit card machines that they have on every stall runs on wireless.
i did that on my linux running ipaq a couple of years ago, only news here is that now you can get one preloaded. it took me days getting linux to run on that old ipaq :)