Slashdot Mirror
Attacking Game Consoles On Corporate Networks
A pair of security researchers speaking at DefCon demonstrated how video game consoles, which are becoming increasingly common break room or team-building toys, can open vulnerabilities in corporate networks.
"[They] found that many companies install Nintendo Wii devices in their work places, even though they don’t let you walk into the company with smartphones or laptops. (Factories and other sensitive work locations don’t allow any devices with cameras). By poisoning the Wii, they could spread a virus over the corporate network. People have a false sense of security about the safety of these game devices, but they can log into computer networks like most other computer devices now. In the demos, the researchers showed they could take compromised code and inject it into the main game file that runs on either a DS or a game console. They could take over the network and pretty much spread malware across it and thereby compromise an entire corporation. The researchers said they can do this with just about any embedded device, from iPhones to internet TVs."
You know, you could just not plug the game console into network. There is no reason why a break room and especially team-building games need an internet connection.
Perhaps with the homebrew scene? Being able to run arbitrary code on a PS3 (not under the now defunct OtherOS) would be a great help!
Now they're going to take away our Wii :(
Couldn't you pretty much just replace the word "Wii" with the word "Windows" and have an equally valid article?
Hooray for trolling!
Monstar L
There are probably much easier ways to perform targeted attacks against most organizations. But imagine someone bribing disgruntled wallmart/other low-wage chain employees into replacing cartridges and discs with what they are told are "just pirate copies that'l most likely play perfectly, no harm done really, you'l get a cut off the sales of the originals up front."
Emotions! In your brain!
The researchers will claim that are doing something productive, and have a point to that. But for the other 99.9999% of the population this type of stuff is just party-breaking.
Is like wen a researcher get out of the blue and strong-force a open source game dev to fix "important bugs". Now, the problem with what is important for a researcher, and what is important for a game dev is different. A single researcher (can I say hacker?) can efectivelly "DoS" a single game developer sending hole bugs, and forcing that game dev to ignore everything else and focus on that bug.
Yes, I said force. Something very nice about these researchers is that force everyone to share his idea of what is important. If you disagree, will make the hole public, so you are forced to fix that potential hole.
Yes, researchers do a important work, but that don't make then LESS A BUCH OF ASSHOLES.
-Woof woof woof!
Wii consoles at work? Never heard of that before. I must be working at the wrong place.
Freedom is drinking a beer in the park when you're supposed to be at work.
Exactly HOW do you "poison a Wii"?
The real concern isn't game consoles its network printers. Pretty much every company has at least one these days on their network and most of the machines assume its trusted. All someone would have to do is modify the firmware on one of the printers to start cracking the network. Getting access to the printer would be pretty easy in many cases. Many companies out source their printing to a third party that fixes them and supplies them with ink and paper. All someone would have to do is pretend to be fixing a printer and they're in.
Now we have to worry about our company Wii's! What is this internet coming to....
If an attacker can even get to such a device, doesn't that imply the network has already been compromised? Perhaps not to the level of full control, but enough to target any device, not just game consoles. Or is the OP assuming physical access to these consoles?
Any properly fire walled device should be protected for the most part. That said, giving anyone physical access to a network device on your internal network exposes this type weakness. It's a bit ridiculous to state it's on the internal network and then get everyone riled up that it has access to said network resources. The simple fact remains that any network connected device could do this.
TFA states that they could do this with a pirated version of a game. Although this may be much more common in a home environment, I'm thinking a work supplied device that never leaves the office would be a bit harder to do this to? Some simple physical restraints or claims to limit what media can be placed into it, and proper firewall controls to prevent unauthorized browsing should mitigate this is a big exposure.
How is this different from any workstation?
This story is only a story if your Network Admin knows nothing about network admin.
Plenty of places make their sysadmins set up the network hardware, but the problem is that we're sysadmins, not network admins. It's annoying as all hell, but the fact is that plenty of businesses will forego hiring a networking expert simply because they don't think they need to.
:-P (In retrospect, if I had gotten EoIP to work in the first place like I had planned, it should have worked)
Given a network and adequate hardware, even I can point out what an appropriate topology would be for the setup, but I just don't know how to do it. I understand the concept of VLANs, routing, DHCP relay, etc., but I just don't know how to configure the hardware. I really wish I did, too, but on the same token I'd rather spend my time and effort working on hardware and OS level stuff and just be able to tell the network guru[s] how I'd like the connectivity to play out.
...To give you an idea of my networking ignorance: In spite of the fact that I know VLAN tagging is a modification to ethernet frames themselves (i.e., I know they're a subset of 802.3), I spent god knows how long trying to forward VLAN traffic over a wireless (or 802.11) connection. It wasn't until I called the VoIP provider that I realized what foolishness I had been pursuing for the better part of an hour
Boot Windows, Linux, and ESX over the network for free.
Read the comments below the article. They're far more entertaining than the article itself.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Your argument makes about as much sense as complaining about the lack of dildos and handcuffs in the rest room, because how else can one play orgy games?
There's a few US Senators that would like to have a word with you.
That's why you put it in it's own special little DMZ. Give it access to nothing but the Internet.
not only that the frimwere is tied to warranty / high cost software maintenance planes. Even some of the printer that use a windows pc for rip and other stuff are locked down so you can't install windows updates no HP or who ever as to do them.
Everything in the article seems to require getting the user to download compromised code and run it on a game system. If you're stupid enough to download random software and run it, you're going to open yourself up to malware regardless of what OS or hardware you do it on.
This has been covered over and over again since at least the mid 90's. The times are changing and the consoles are different but it is the same concept.
http://www.geek.com/articles/games/black-hat-dreamcast-is-choice-console-for-information-warfare-2002082/
How about the games console just gets removed from the break room again?
How about key employees quit and go to a company that has a better stocked break room? Competition isn't just about keeping customers; it's also about keeping employees.
Given that proper firewalling and DMZs should be in place, they should put it on a restricted network along with guests laptops and other devices that don't really need to be in the corporate network. Nowadays it's simpler to setup such an environment even using windows with NAP http://en.wikipedia.org/wiki/Network_Access_Protection
I made a funny!