Slashdot Mirror
4G and CDMA Reportedly Hacked At DEFCON
An anonymous reader writes "At the DEFCON 19 hacking conference it seems that a full man-in-the-middle (MITM) attack was successfully launched against all 4G and CDMA transmissions in and around the venue, the Rio Hotel in Las Vegas. This MITM attack enabled hackers to gain permanent kernel-level root access in some Android and PC devices using a rootkit, and non-persistent user space access in others. In both cases, whoever launched this attack on CDMA and 4G devices was able to steal data and monitor conversations. For now the only evidence that such an attack occurred is a Full Disclosure mailing list post, but in the next few hours and days, depending on the response from cellular carriers, we should know whether it's real or not."
And that ladies is geeks...Is why you only gamble at Harrah's!
...but something is telling me shit just got real. Wowzers, see what happens when nerdlingers all congregate in one place!?!?
for sticking with my RAZR! BWAHAHAHAH...
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
This will be interesting if it is true. Maybe this will delay the rollout of smartphones to combat soldiers...
Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
Someone better hope they get a lenient sentence instead of getting some time in pound me in the ass prison.
Achieving MITM status is a very different thing from installing a rootkit, in my mind. The summary left out how the two could be connected but the article mention something about it:
Coderman’s report suggests that, like Wi-Fi MITM, which regularly harasses surfers at DEF CONs and other hacker conventions, the attackers were able to inject custom packets into the 4G and CDMA data stream. These forged packets allowed the attackers to create on-screen prompts that, if clicked, installed a rootkit on the PC or Android device.
So, to install the rootkit, you also need to exploit a bug in the user. Where do I file the bug report?
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
Which "4G" technology are we talking? WiMAX? LTE? AT&T&Tmobile's HSPA cranked up to 11?
Anybody want my mod points?
Nothing is secure.
that I'm not alone out there ;)
I was thinking the same thing. Kinda ties in with the previous /. story about Why The US Will Lose a Cyber War.
It's tempting to deploy every new gadget that looks useful, but the military (rather, the gov't in general) has a spotty record in new-tech security.
XML is like violence. If it doesn't solve your problem, you're not using enough of it. --AC
Let me take a moment to point out that using the wifi or atms at the hotel as well as making software updates during DEF CON all are squarely in the category of "babytown frolics".
Why in god's name would anyone be willing to go to that with electronics? For god's sake, just take a pad and pencil! Even if you manage not to become part of a hilarious proof-of-concept hack to startle the audience into realizing how easy it is to X and Y someone's Z by forging an A with a malformed B, and avoid being targeted by some Russian mobster who's thrown out a dragnet for data on -other- people's new techniques ( and sure, credit card numbers and personal info, as long as were in there already, the place is still probably surrounded by black vans full of studious FBI, NSA, DHS, and CIA ( east AND west ) agents, all trying to hack, monitor, and watchlist you on completely separate orders and agendas. It's got to be just... a shitstorm. Am I wrong?
Border router security, hard shell soft core, perimeter defense: However you call it, it's all bogus. The network must not be trusted, especially when it's got wireless components. IPSec was the right idea. Shame it doesn't get any use. Somehow the illusion that you can make the network trusted is even more prevalent among users and operators of mobile networks.
This is DEFCON, it's like putting every army and mercenary group in the world in one room without disarming them first. There is a reason why the DEFCON wireless network is described as the most hostile network on earth, it's more hostile than the internet itself.
We wanted this stuff cracked, and now it is !! HORRAY !! Now it's on to the next unproductive task !! Like submitting crap disquised as news to slashdot !!
If you put candy in a bowl in a room full of children- they will eat it. If you put whiskey in a room full of frat-boys- they will drink it. If you put technology in a room full of hackers- they will hack it. If you put Michael Jackson in a room full of children- he will behave admirably. I don't see much surprise here.
"That's the way to do it" - Punch
Most cell phone companies use the suffix G to add respectability to what is otherwise a meaningless number.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
... or any other country with atrocious data package rates.
I shut my Android's data option off before arrived, primarily for costs reasons, but also for security reasons. I'm sure there were plenty other foreign travelers who had there data disabled for duration of their stay.
:wq
I'm sure he's responsible for this somehow. Probably because he can't innovate!!
The CB App. What's your 20?
Verizon can't figure out why I tried a smartphone and went back to a "regular" phone as soon as my contract was up. The data plans are too expensive, they want you to pay extra for tethering, they have data caps, and the devices are way too intrusive (see iPhone location scandal or Android's WiFi surveillance). You couldn't pay me money to carry a smart phone around unless there was one I rooted and installed a custom version of *nix on it (like some WiFi routers).
This points that the last bastion of security (secure transport layers provided by the transporter) is no longer viable. MITM is apperently practical on most wireless networks, even the adnvaced cellular ones. In that case, you MUST authenticate every location every app goes to. This means EVERYONE needs certs. I wish there was more info on Moxie's new tool because it may be an absolute necessity in the very near future. (Unless the CAs are going to start giving out free certs.)
I do security
I can't even come up with a sufficient analogy to describe how wrong your comment is.
Like entering a bicycle in a Formula 1 race because you don't like going fast?
My beliefs do not require that you agree with them.
It's WiMax that's fallen. It was already cracked open as of the last Defcon. Some other cool stuff is being done with it too. The WiMax authentication system is a joke.
I do hope the authors realize that 4G is not LTE, but the technology that comes after it. Without reading the article it sounds like Verizon just had it's ass kicked.
What's commonly advertised as 4G right now is still 3G.
the carriers will fix this by rolling out... 5G!!!
People were talking about this at the pool on Saturday night. FWIW someone mentioned that the Verizon network had the same IPSEC key for all of their towers. The attack vector was probably along those lines.
As a Verizon user with a Blackberry I wasn't particularly concerned. If someone is interested in my SMS messages, more power to them. The only other app running on my phone besides email is Gmail, and that uses SSL. I suppose they could capture the login session and crack it at their leisure, but I went ahead and changed my password after the con.
By all means, take electronics.
Take your second-string laptop with a fresh, patched, minimal install of your OS and nothing else. Take a new pay-as-you-go dumbphone with a blank address book.
And when it's over, re-format the laptop and recycle the phone.