Attacking Game Consoles On Corporate Networks

A pair of security researchers speaking at DefCon demonstrated how video game consoles, which are becoming increasingly common break room or team-building toys, can open vulnerabilities in corporate networks. "[They] found that many companies install Nintendo Wii devices in their work places, even though they don’t let you walk into the company with smartphones or laptops. (Factories and other sensitive work locations don’t allow any devices with cameras). By poisoning the Wii, they could spread a virus over the corporate network. People have a false sense of security about the safety of these game devices, but they can log into computer networks like most other computer devices now. In the demos, the researchers showed they could take compromised code and inject it into the main game file that runs on either a DS or a game console. They could take over the network and pretty much spread malware across it and thereby compromise an entire corporation. The researchers said they can do this with just about any embedded device, from iPhones to internet TVs."

Comments

Re:Wii at work?

[Rennt]

Indeed. Inventing a hypothetical scenario then claiming you've discovered a real vulnerability seems to be par for the course at this year's DefCon. Disappointing.

Re:Don't plug it to internet

[TheCarp]

I guess thats one way to "solve" the "problem". Sort of like, if you define concentration camps as a homeland; then Hitler was a zionist!

While you could do all that, my whole point was, this is a pretty simple problem to deal with. You can easily allow the wii or any other device, access to the internet but NOT the internal LAN. Its done all the time for certain types of devices. In fact, the WII is even a simpler case; often such hosts need to allow for internal connections initiated by machines on the LAN, but are not able to go the other way. The Wii doesn't even need that.

-Steve