Slashdot Mirror
4G and CDMA Reportedly Hacked At DEFCON
An anonymous reader writes "At the DEFCON 19 hacking conference it seems that a full man-in-the-middle (MITM) attack was successfully launched against all 4G and CDMA transmissions in and around the venue, the Rio Hotel in Las Vegas. This MITM attack enabled hackers to gain permanent kernel-level root access in some Android and PC devices using a rootkit, and non-persistent user space access in others. In both cases, whoever launched this attack on CDMA and 4G devices was able to steal data and monitor conversations. For now the only evidence that such an attack occurred is a Full Disclosure mailing list post, but in the next few hours and days, depending on the response from cellular carriers, we should know whether it's real or not."
for sticking with my RAZR! BWAHAHAHAH...
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
This will be interesting if it is true. Maybe this will delay the rollout of smartphones to combat soldiers...
Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
Achieving MITM status is a very different thing from installing a rootkit, in my mind. The summary left out how the two could be connected but the article mention something about it:
Coderman’s report suggests that, like Wi-Fi MITM, which regularly harasses surfers at DEF CONs and other hacker conventions, the attackers were able to inject custom packets into the 4G and CDMA data stream. These forged packets allowed the attackers to create on-screen prompts that, if clicked, installed a rootkit on the PC or Android device.
So, to install the rootkit, you also need to exploit a bug in the user. Where do I file the bug report?
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
Which "4G" technology are we talking? WiMAX? LTE? AT&T&Tmobile's HSPA cranked up to 11?
Anybody want my mod points?
that I'm not alone out there ;)
I was thinking the same thing. Kinda ties in with the previous /. story about Why The US Will Lose a Cyber War.
It's tempting to deploy every new gadget that looks useful, but the military (rather, the gov't in general) has a spotty record in new-tech security.
XML is like violence. If it doesn't solve your problem, you're not using enough of it. --AC
Let me take a moment to point out that using the wifi or atms at the hotel as well as making software updates during DEF CON all are squarely in the category of "babytown frolics".
Why in god's name would anyone be willing to go to that with electronics? For god's sake, just take a pad and pencil! Even if you manage not to become part of a hilarious proof-of-concept hack to startle the audience into realizing how easy it is to X and Y someone's Z by forging an A with a malformed B, and avoid being targeted by some Russian mobster who's thrown out a dragnet for data on -other- people's new techniques ( and sure, credit card numbers and personal info, as long as were in there already, the place is still probably surrounded by black vans full of studious FBI, NSA, DHS, and CIA ( east AND west ) agents, all trying to hack, monitor, and watchlist you on completely separate orders and agendas. It's got to be just... a shitstorm. Am I wrong?
This is DEFCON, it's like putting every army and mercenary group in the world in one room without disarming them first. There is a reason why the DEFCON wireless network is described as the most hostile network on earth, it's more hostile than the internet itself.
If you put candy in a bowl in a room full of children- they will eat it. If you put whiskey in a room full of frat-boys- they will drink it. If you put technology in a room full of hackers- they will hack it. If you put Michael Jackson in a room full of children- he will behave admirably. I don't see much surprise here.
"That's the way to do it" - Punch
Most cell phone companies use the suffix G to add respectability to what is otherwise a meaningless number.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
... or any other country with atrocious data package rates.
I shut my Android's data option off before arrived, primarily for costs reasons, but also for security reasons. I'm sure there were plenty other foreign travelers who had there data disabled for duration of their stay.
:wq
I'm sure he's responsible for this somehow. Probably because he can't innovate!!
The CB App. What's your 20?
And that ladies is geeks...Is why you only gamble at Harrah's!
Sorry to burst your bubble, but Caesar's Entertainment owns both Harrah's and the Rio. Hope your Faraday cage fits ar the Blackjack table.
This points that the last bastion of security (secure transport layers provided by the transporter) is no longer viable. MITM is apperently practical on most wireless networks, even the adnvaced cellular ones. In that case, you MUST authenticate every location every app goes to. This means EVERYONE needs certs. I wish there was more info on Moxie's new tool because it may be an absolute necessity in the very near future. (Unless the CAs are going to start giving out free certs.)
I do security
I can't even come up with a sufficient analogy to describe how wrong your comment is.
Like entering a bicycle in a Formula 1 race because you don't like going fast?
My beliefs do not require that you agree with them.
For what it's worth, I still can't parse what your original post said, nor do I get the joke even after explanation.
It's WiMax that's fallen. It was already cracked open as of the last Defcon. Some other cool stuff is being done with it too. The WiMax authentication system is a joke.
DEFCON is at one casino, so this guy was like, "hurr you should go to a different casino if you are joe sixpack otherwise these hackers will get you." (no disrespect, I'm sure the OP was being comical)
No, it is bullshit.
If this were true someone would have posted captured conversations or some sort of proof. Why just make the claim without any evidence to back it up?
This is just a sad attempt at instilling fear.
No proof, no hack.
the carriers will fix this by rolling out... 5G!!!
People were talking about this at the pool on Saturday night. FWIW someone mentioned that the Verizon network had the same IPSEC key for all of their towers. The attack vector was probably along those lines.
As a Verizon user with a Blackberry I wasn't particularly concerned. If someone is interested in my SMS messages, more power to them. The only other app running on my phone besides email is Gmail, and that uses SSL. I suppose they could capture the login session and crack it at their leisure, but I went ahead and changed my password after the con.
Spoken like someone that truly has zero clue.
Man can make it, man can break it, it's just that simple.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
And this is what is wrong with people.. no proof no hack.. talk about a false sense of security..
There are various kinds of hackers.. those who do it for fun and bragging rights, and those who do it for nefarious purposes..
Those who do it for nefarious purposes.. generally do not brag, and go all out trying to hide what they did, otherwise the methods they use tend to get closed rather quickly.
It should be noted that this particular attack (base station impersonation) was actually demo'd and performed last year during blackhat and defcon.
I came, I conquered, I coredumped
My first defcon was defcon 3.
No proof, no hack.
http://www.defcon.org/html/defcon-18/dc-18-speakers.html#Paget
GSM != ( CDMA || 4G )
I'm underwhelmed.
Keep it secret, pwn everyone quietly.
First rule of hacking - you don't say shit.
DEFCON is for poseurs.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
It should be noted that this particular attack (base station impersonation) was actually demo'd and performed last year during blackhat and defcon.
I highlighted the important part that you should have been paying attention to.