Slashdot Mirror
Researcher Wows Black Hat With NFC-based Smartphone Hacking Demo
alphadogg writes "At the Black Hat Conference in Las Vegas Wednesday, Accuvant Labs researcher Charlie Miller showed how he figured out a way to break into both the Google/Samsung Nexus S and Nokia N9 by means of the Near Field Communication (NFC) capability in the smartphones. NFC is still new but it's starting to become adopted for use in smartphone-based purchasing in particular. The experimentation that Miller did, which he demonstrated at the event, showed it's possible to set up NFC-based radio communication to share content with the smartphones to play tricks, such as writing an exploit to crash phones and even in certain circumstances read files on the phone and more."
Workaround: Blacklist the kernel module used for NFC?
To offset political mods, replace Flamebait with Insightful.
Are fuzzing tools really that hard to write?
[Fuck Beta]
o0t!
Ironic. The technical tools to solve all these problems exist, but if they were used properly, even the gov't. couldn't break in.
So which do you want? An inherently weak system that allows civil monitoring, or something so secure it'd be as anonymous as cash. After all, this is *cash* we are talking about replacing here.
The gov't. has a "thing" about encrypting wireless communications ...
If it is, hopefully it won't be by Christmas.
Another network or communications port = another attack vector.
The question is why to vendors think they need to keep adding new communication methods faster than they can test and debug those ports?
make imaginary.friends COUNT=100 VISIBLE=false
While TFA does say:
he managed to break into the Nokia 9 when his home-made NFC-based device is in very close proximity to the targeted smartphone ... NFC works at near-contact range
It doesn't give any actual numbers or distance measurements. Would be nice to have some actual facts and details on this. Suffice to say, if someone walks up next to me waving an unknown device around my crotch, I'm going to be a bit suspicious. The article also doesn't mention what modifications, if any, were made to the target phones. A few posters here have mentioned NFC being turned off by default. Does his methods force NFC on, or work without it? But I guess reporting accurately and completely would make this mostly a non-issue, which doesn't garner nearly as many clicks.
This signature is false.
One, both sides of the conversation should know "something" about who they are talking to before engaging or continuing a transaction.
"Enough" may be nothing more than making sure a man-in-the-middle hasn't taken over the conversation.
Second, any conversation has to begin at a minimum trust level - basically "I don't trust you, you don't trust me, here's my name-of-the-day, what should I call you today?" level.
Some people have suggested public key cryptography. While this is cool, it may be simpler to use "out of band" communication to verify identities. Since phones have cameras and screens, these can provide the necessary out of band communications.
Scenario:
Say I'm at the Burger Bar and I want to buy something using my phone. My phone doesn't trust the radio signal pretending to be Burger Bar's, and Burger Bar doesn't trust that my phone isn't someone else's phone nearby.
So I use my phone to take a picture of a display at the Burger Bar order counter. This picture has a QR code for Burger Bar's public key or web site that has the public key, as well as a second, changing QR code that is my transaction ID plus some randomness. I encrypt all of this plus my made-up-on-the-spot public key plus a made-up QR code using Burger Bar's public key. I display this QR code on my phone and put it in range of the small camera at the register. Burger Bar's computer checks the QR code against what I just transmitted to verify it's my phone it's talking to.
Now we can talk to each other securely and, thanks to the ordinary security cameras that show me holding my phone close to the order counter, in a difficult-to-repudiate way.
I didn't have to give Burger Bar my phone's serial number. I didn't have to give it any identification beyond what our banks need to transact business, just as if I were using a traditional credit card or debit card payment. If we are using bit-coin or something similar, I didn't even have to give them that much - true anonymity.
Now I go enjoy my meal. Oh wait, this is Burger Bar we are talking about. Now I go ingest my mass quantities.
Burger Bar really doesn't have to use its own public key. Like me, it can make up one for this transaction. It's the taking-a-picture of the public key and transaction code that make this secure against a radio-only intercept. If there is a risk that the transaction code picture or my phone's on-screen QR code will be intercepted, it's easy enough to let the two devices look at each other in a way that's very difficult to "peek into."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I second the motion!
My favorite fuzzer was for the original Mac; it just fed random keyboard and mouse inputs:
http://folklore.org/StoryView.py?project=Macintosh&story=Monkey_Lives.txt
The Nexus S in question was only running Gingerbread, the latest version of Android to be exploitable in this way. All Nexus S devices have had Ice Cream Sandwich available via OTA update for a long time, and most are getting Jelly Bean now. I'd imagine the number of vulnerable devices in the wild is incredibly low.
I've played with distances using a few different smart cards, a USB NFC reader, and a nexus S. I couldn't get a smartcard to read through the front of the phone or the side. I could get a USB NFC reader to detect if smartphone was placed face down. From the back it is about 3 inches with a USB reader, 1-2 inches with a smartcard.
NFC is also a battery hog. I don't see having it running all the time.
I've long thought that NFC was a disaster waiting to happen - or really a never-ending series of disasters, just as each one is patched-over a new one will appear.
The problem is that NFC's functionallity is all out of proportion to the problem it is intended to solve. It's kind of like adding a video display when all you need is an LED indicator light. NFC is supposed to handle short and fast communications between devices that are in very close proximity. Stuff like exchanging v-cards, electronic payments at the register, kickstarting ad-hoc wifi connections, etc.
None of that stuff requires radio communications and even though NFC is designed for broadcast ranges of a couple of centimeters, that never stops the bad guy from using high-powered transmitters and ultra-sensitive antennas to do their dirty work from a more comfortable and non-obvious location.
I believe that almost everything that NFC is likely to ever be useful for could also be done with no extra hardware. Just use the camera already built into every smart-phone to take a picture of a 2d-barcode displayed by the other device. That gets you physical access controls limited by line of site and a window of opportunity limited to the second or so that the user explicitly presses the camera button.
When information is power, privacy is freedom.
The discussion about single point login got me thinking. Rather than having some server out there become a single point of failure, how about a device you carry with you that stores the multitude of logins and passwords? Smart phones seem capable of just that.
Has anyone come across using NFC on a phone as a login/password authentication method? Store all of your login and passwords on the phone. Then when prompted for login info (website, laptop login, etc), you use your phone.
Yeah, a whole new security nightmare. But the idea still appeals to me.
The world is made by those who show up for the job.
was the vulnerable one and that Charlie Miller would hack an iPhone.
Heh.
The General of the NSA was going to cum in during a Wagner Waltz and masturbate his way to the hearts and minds of the attended.
Where Out Thou O'Great Good Nazi?
LoL
Regardless of what the default NFC state is, we've been hearing NFC is the nifty next thing for these phones. Google made a huge deal about it at Google IO.
Stating that NFC is secure because you can turn it off is analogous to claiming SSH1 is secure because it can be turned off. It's not secure; you're just ameliorating the problem - not to mention losing the desired functionality.
Besides, what are all the people who bought those Nexus Q's supposed to do now?
#DeleteChrome
Unfortunately, like most web sites, slashdot brings this article way too sensational, omitting most of the facts that make this a lot less impressive and worrisome.
First, at least on Android devices, NFC is only enabled when the screen is on and unlocked. That means that nobody can just walk by you and communicate to your device over NFC. You need to be already working with your phone.
Second, there is the range. NFC typically only works one or two inches away, and the two devices interacting need to be aligned properly as well. Somebody literally needs to put a phone back to yours to make this work. Of course, range could be expanded a bit with some seriously large gear, but it is still extremely difficult to align to such a small antenna from a distance. And remember, your phone's screen needs to be and unlocked. You'll notice when someone comes that close to you or your phone.
Third, you can't just pull data from an Android device over NFC. You need to confirm that you want to push data. What Charlie did was to push a web link over NFC to a remote device. Because there was a bug in webkit on the remote device (only on 4.0.1), this allowed him to execute code. If he had entered the URL manually, or scanned a QR code, the same would have happened. It's true that Android does not ask for confirmation when *receiving* data over NFC. That said, most users would click *yes* anyway on such confirmations. And there are more effective ways to exploit webkit bugs (sending mass e-mails, just putting a link to the malicious URL on a popular website).
to drop a nuke on Las Vegas.