Researcher Creates Handheld Hacking Tool

Kickball Notches writes "Immunity's Dave Aitel plans to start selling a portable hacking device equipped with hundreds of exploits. The wireless handheld, called Silica, comes equipped with more than 150 exploits from Canvas and an automated exploitation system that allows simulated hacking attacks from the palm of your hand. It supports 802.11 (Wi-Fi) and Bluetooth wireless connections and is based on Linux."

Comments

Nifty

[daveschroeder]

Something like this could be easily used in conjunction with vulnerabilities like the recent Atheros 802.11 wireless device driver exploit. Of course, many wireless attacks like this will still be targeted, and won't be widespread, because of one huge reason: proximity. Even the co-discoverer of the Atheros driver vulnerability, David Maynor, said:

The thing to keep in mind here is that this really isn't a problem yet. You won't see any WLAN viruses' base on driver level exploits any time soon for one very important reason, proximity. We wanted these issued raised and fixed before the distance of a wifi connection for your average user will be measured in kilometers instead of the meters it is today.

Don't go rip your wifi cards out just yet, but you should always adhere to good security techniques. Even without a driver level exploits man-in-the-middle attacks over wifi networks are a threat that you can mitigate by doing things like verifying the SSL certs for things you can connect to and don't do anything you want to remain personal or private over clear text on these access points. Also, for things like instant messaging, grab something like Adium X that supports encrypted IM conversations across multiple platforms. I know iChat does as well, but I am a big fan of something called OTR (http://www.cypherpunks.ca/otr/) which Adium supports.

And no, this wasn't a "Mac OS X"(-specific) or "MacBook" vulnerability; it is a vulnerability in the Atheros driver code, which, according to the presenters themselves, is exploitable on other platforms, including Windows and Linux. Mac OS X was chosen to prove a point, and unfortunately the "point" that many ordinary people ended up getting was that all "MacBooks" and only "MacBooks" were vulnerable to some kind of scary 802.11 attack, and worse, that setting the machine to not auto-associate with access points would solve the problem (it doesn't). Some interesting points from a SecurityFocus mailing list about the Atheros exploit:

* The exploit is running in kernel space and can do _anything_ it wants. It's not running as root because that would involve running under the kernel. In Intel terms, this is ring 0 stuff.

* Firewalls, "preferred networks" and other OS-level mitigation is worthless. The packets don't have to contain any IP data, they are pure 802.11{b|g} frames. The OS doesn't see the packet because it would have to get past the (exploited) device driver.

* The exploit doesn't require associating to an AP, being associated to an AP, anything. It just requires the wireless device to be on.

What this really illustrates is that when you let third-party, proprietary, unaudited code into a privileged capacity on an OS, it could indeed be an avenue for attack.

And now that attack can come from a dedicated device running in someone's pocket. ;-)

(Personally, I see no reason why hardware device makers should keep driver code proprietary, much less the hardware specifications needed to produce an open source driver. After all, isn't their bread and butter the hardware itself?)

This device could also associate with a wireless access point normally, and launch penetration tests against any hosts reachable on the network as well. TFA notes that the device is also equipped with ethernet and USB connectivity as well. Sounds like a neat little device, that could have other functionality as well.

"hand-held hacking tool" aka...

[Esion Modnar]

a machete. TIBHAW,TTV.

I've already got a portable hacking device...

[wwiiol_toofless]

it's called a hatchet. (Thank you, I'll be here till 5, be sure to tip your admin!)

Re: First Post SNAKES ON A PLAIN!

[Lxy]

The word is PLANE, as in those big metal things that fly.

If you want to see Snakes on a PLAIN then go to Nebraska. They have lots of them there.

Immunity's Dave Aitel

[StikyPad]

Not to be confused with Insomniac's Dave Attell, although both equally fond of the back door.

Proximity is no problem.

[Ungrounded Lightning]

You won't see any WLAN viruses' base on driver level exploits any time soon for one very important reason, proximity.

One of the proposed uses is to turn it on and mail it to the site in question. It can perform "tests" (including man-in-the-middle attacks) "while sitting on the CEO's desk".

Or in the mail rooom. On in the inbox of somebody on vacation.

Of course that means it (or a similar device) could be shipped in the same way. It could run for a couple weeks (or until the battery is exhausted), rooting around the company's wireless LAN and shipping the result out the internet to the attacker's safe drop. Then (or when the package it opened) it could purge its own software and self-destruct or turn itself into something innocent appearing, such as a promotional toy. (Perhaps it could sucker somebody into recharging it.) Or it could be built into some other object and never discovered.

If the IT staff isn't on the edge of their seats about searching for rogue WiFi devices and/or sniffing network traffic it could have weeks to work undetected. Even if they ARE on the ball and have the cutting-edge stuff it can snag a lot of interesting stuff at computer speeds in the time it takes to hunt it down and kill it or succesfully cut it off from all outside contact (including masquerading as a legitimate device).

Re:But does it run... oh wait

[HTH NE1]

I see this as being very useful in big cities where warwalking is easy. Imagine the data you could gather by walking around Manhatten for a day with this device.

Forget warwalking, think about warsmailing (war snail-mailing). Activate one of these devices and drop it in at the post office addressed to yourself. It'll ride in postal delivery vehicles, stopping in front of each house long enough to do some serious searching until it reaches yours. Then unwrap and see what you've harvested. Only cost is the postage and packing, virtually no gas or calories from you. Well, and the battery charge. Include a GPS device.

It will help to be near the end of the delivery route. Maybe address it to a house that doesn't exist and it'll come back undeliverable (though it risks not coming back at all).

Variations would be to use UPS, FedEx, etc., especially how their routing systems take it into interesting business areas. Route influencing could be done by including legitimate packages.

If anyone does this, please let me know of the results. I don't have the ability to do this, so I'm putting it out there for others to try. I've only just thought of it. (I'll be Googling for "warsmailing".)

Note: this opportunity will only last (in the US) until the DoHS decides that any packages with detectably active electronics or EM emissions must be intercepted and detonated, and they may be doing this already. Other countries may vary.