Slashdot Mirror
Researcher Wows Black Hat With NFC-based Smartphone Hacking Demo
alphadogg writes "At the Black Hat Conference in Las Vegas Wednesday, Accuvant Labs researcher Charlie Miller showed how he figured out a way to break into both the Google/Samsung Nexus S and Nokia N9 by means of the Near Field Communication (NFC) capability in the smartphones. NFC is still new but it's starting to become adopted for use in smartphone-based purchasing in particular. The experimentation that Miller did, which he demonstrated at the event, showed it's possible to set up NFC-based radio communication to share content with the smartphones to play tricks, such as writing an exploit to crash phones and even in certain circumstances read files on the phone and more."
Workaround: Blacklist the kernel module used for NFC?
To offset political mods, replace Flamebait with Insightful.
Are fuzzing tools really that hard to write?
[Fuck Beta]
o0t!
Ironic. The technical tools to solve all these problems exist, but if they were used properly, even the gov't. couldn't break in.
So which do you want? An inherently weak system that allows civil monitoring, or something so secure it'd be as anonymous as cash. After all, this is *cash* we are talking about replacing here.
The gov't. has a "thing" about encrypting wireless communications ...
If it is, hopefully it won't be by Christmas.
Another network or communications port = another attack vector.
The question is why to vendors think they need to keep adding new communication methods faster than they can test and debug those ports?
make imaginary.friends COUNT=100 VISIBLE=false
Colorado Movie Theater Massacre
âoeThere is already conjecture that James Holmes may have been involved in mind-altering neuroscience researchâ
Colorado Movie Theater Massacre
July 20th, 2012
http://cryptogon.com/?p=30455
Where Did Robert Holmes, Father of James Holmes, Work Before 2000?
I would be interested in knowing where Robert Milton Holmes, the father of James Holmes, worked before 2000. If anyone has this information, please send it to me.
On his Linkedin profile Robert Holmes lists a University of California, Berkeley Ph.D. in Statistics from 1981. He currently works for FICO, but also lists working for HNC Software from 2000 to 2002. (HNC Software was acquired by FICO.)
We have a DARPA link in HNC Software.
This is from a 1999 company profile for HNC Software:
HNC Software Inc. is San Diegoâ(TM)s largest software company and develops predictive software solutions for business-to-consumer service companies. These solutions allow companies to make more intelligent and profitable decisions and are marketed to industries- including financial, insurance, retail, telecommunications and the Internet.
Like many San Diego-based software companies, HNC Software Inc. traces its origins to the defense industry. When the company was launched in 1986, it focused on defense-related research and development. But over the years as defense budgets shrank not only in San Diego, but nationwide, HNC quickly realized that in order to succeed and grow, other commercial applications had to be found for its products.
â¦
But perhaps the most exciting frontier awaiting exploration and commercial development by HNC is in an area that scientists still know very little about: the human brain. HNC is working on a long-term research project launched in 1998 that is jointly funded by HNC and the Defense Advanced Research Projects Agency (DARPA), part of the U.S. Defense Department, to investigate âcortronic neural networks,â(TM) a concept originally proposed by Robert Hecht-Nielsen, HNCâ(TM)s co-founder and chief scientist.
HNC hopes to develop new capabilities in the areas of textual, aural and visual representation, and to actually build three new predictive, neural-net based systems: one that reads, interprets and searches text more effectively; a second recognizing speech and other sounds, enabling users to perform audio searches; and a third that can scan for and interpret images. The ultimate goal is to integrate all three systems. The net result â" machines that someday might be able to reason like humans.
âoeThis is the most important scientific challenge of our time, and finding the answer will be the adventure of the millennium,â says Hecht-Nielsen.
â"
James Holmes: Accused Colorado Shooter Is Grandson of Decorated Veteran, Has Mamily Roots in Monterey County
Via: Contra Costa Times:
James Holmes, the man believed responsible for killing 12 people Friday during one of the largest mass shooting in U.S. history, is the grandson of a decorated military veteran who was a respected educator at prestigious York School in Monterey.
Lt. Col. Robert M. Holmes, who served in the Okinawa campaign during World War II, retired in 1963 as the last commander of the Nike missile group in San Francisco Bay. He was one of the first Turkish language students at the Army Language School, now the Defense Language Institute, graduating in 1948, a school spokesman confirmed Friday.
After his military retirement, Holmes taught math and science at York School for 17 years. He died in 1990. His wife, Mary Jane Crawford Holmes, attended Stanford University and worked at the Monterey City Library, Fort Ord Library and Pacific Grove High School before finishing her career as librarian and college counselor at York School. She died in 2010.
A 1945 graduate of Pacific Grove High School, she was also a member of numerous historical soci
While TFA does say:
he managed to break into the Nokia 9 when his home-made NFC-based device is in very close proximity to the targeted smartphone ... NFC works at near-contact range
It doesn't give any actual numbers or distance measurements. Would be nice to have some actual facts and details on this. Suffice to say, if someone walks up next to me waving an unknown device around my crotch, I'm going to be a bit suspicious. The article also doesn't mention what modifications, if any, were made to the target phones. A few posters here have mentioned NFC being turned off by default. Does his methods force NFC on, or work without it? But I guess reporting accurately and completely would make this mostly a non-issue, which doesn't garner nearly as many clicks.
This signature is false.
One, both sides of the conversation should know "something" about who they are talking to before engaging or continuing a transaction.
"Enough" may be nothing more than making sure a man-in-the-middle hasn't taken over the conversation.
Second, any conversation has to begin at a minimum trust level - basically "I don't trust you, you don't trust me, here's my name-of-the-day, what should I call you today?" level.
Some people have suggested public key cryptography. While this is cool, it may be simpler to use "out of band" communication to verify identities. Since phones have cameras and screens, these can provide the necessary out of band communications.
Scenario:
Say I'm at the Burger Bar and I want to buy something using my phone. My phone doesn't trust the radio signal pretending to be Burger Bar's, and Burger Bar doesn't trust that my phone isn't someone else's phone nearby.
So I use my phone to take a picture of a display at the Burger Bar order counter. This picture has a QR code for Burger Bar's public key or web site that has the public key, as well as a second, changing QR code that is my transaction ID plus some randomness. I encrypt all of this plus my made-up-on-the-spot public key plus a made-up QR code using Burger Bar's public key. I display this QR code on my phone and put it in range of the small camera at the register. Burger Bar's computer checks the QR code against what I just transmitted to verify it's my phone it's talking to.
Now we can talk to each other securely and, thanks to the ordinary security cameras that show me holding my phone close to the order counter, in a difficult-to-repudiate way.
I didn't have to give Burger Bar my phone's serial number. I didn't have to give it any identification beyond what our banks need to transact business, just as if I were using a traditional credit card or debit card payment. If we are using bit-coin or something similar, I didn't even have to give them that much - true anonymity.
Now I go enjoy my meal. Oh wait, this is Burger Bar we are talking about. Now I go ingest my mass quantities.
Burger Bar really doesn't have to use its own public key. Like me, it can make up one for this transaction. It's the taking-a-picture of the public key and transaction code that make this secure against a radio-only intercept. If there is a risk that the transaction code picture or my phone's on-screen QR code will be intercepted, it's easy enough to let the two devices look at each other in a way that's very difficult to "peek into."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I second the motion!
My favorite fuzzer was for the original Mac; it just fed random keyboard and mouse inputs:
http://folklore.org/StoryView.py?project=Macintosh&story=Monkey_Lives.txt
The Nexus S in question was only running Gingerbread, the latest version of Android to be exploitable in this way. All Nexus S devices have had Ice Cream Sandwich available via OTA update for a long time, and most are getting Jelly Bean now. I'd imagine the number of vulnerable devices in the wild is incredibly low.
I've played with distances using a few different smart cards, a USB NFC reader, and a nexus S. I couldn't get a smartcard to read through the front of the phone or the side. I could get a USB NFC reader to detect if smartphone was placed face down. From the back it is about 3 inches with a USB reader, 1-2 inches with a smartcard.
NFC is also a battery hog. I don't see having it running all the time.
I've long thought that NFC was a disaster waiting to happen - or really a never-ending series of disasters, just as each one is patched-over a new one will appear.
The problem is that NFC's functionallity is all out of proportion to the problem it is intended to solve. It's kind of like adding a video display when all you need is an LED indicator light. NFC is supposed to handle short and fast communications between devices that are in very close proximity. Stuff like exchanging v-cards, electronic payments at the register, kickstarting ad-hoc wifi connections, etc.
None of that stuff requires radio communications and even though NFC is designed for broadcast ranges of a couple of centimeters, that never stops the bad guy from using high-powered transmitters and ultra-sensitive antennas to do their dirty work from a more comfortable and non-obvious location.
I believe that almost everything that NFC is likely to ever be useful for could also be done with no extra hardware. Just use the camera already built into every smart-phone to take a picture of a 2d-barcode displayed by the other device. That gets you physical access controls limited by line of site and a window of opportunity limited to the second or so that the user explicitly presses the camera button.
When information is power, privacy is freedom.
The discussion about single point login got me thinking. Rather than having some server out there become a single point of failure, how about a device you carry with you that stores the multitude of logins and passwords? Smart phones seem capable of just that.
Has anyone come across using NFC on a phone as a login/password authentication method? Store all of your login and passwords on the phone. Then when prompted for login info (website, laptop login, etc), you use your phone.
Yeah, a whole new security nightmare. But the idea still appeals to me.
The world is made by those who show up for the job.
This only applies to old versions of Android (pre-Honeycomb) and phones that have NFC chips. Considering basically every Android phone that has an NFC chip has Ice Cream Sandwich available to it (and, soon, Jelly Bean), this is a non-issue.
was the vulnerable one and that Charlie Miller would hack an iPhone.
Heh.
The General of the NSA was going to cum in during a Wagner Waltz and masturbate his way to the hearts and minds of the attended.
Where Out Thou O'Great Good Nazi?
LoL
Regardless of what the default NFC state is, we've been hearing NFC is the nifty next thing for these phones. Google made a huge deal about it at Google IO.
Stating that NFC is secure because you can turn it off is analogous to claiming SSH1 is secure because it can be turned off. It's not secure; you're just ameliorating the problem - not to mention losing the desired functionality.
Besides, what are all the people who bought those Nexus Q's supposed to do now?
#DeleteChrome
Unfortunately, like most web sites, slashdot brings this article way too sensational, omitting most of the facts that make this a lot less impressive and worrisome.
First, at least on Android devices, NFC is only enabled when the screen is on and unlocked. That means that nobody can just walk by you and communicate to your device over NFC. You need to be already working with your phone.
Second, there is the range. NFC typically only works one or two inches away, and the two devices interacting need to be aligned properly as well. Somebody literally needs to put a phone back to yours to make this work. Of course, range could be expanded a bit with some seriously large gear, but it is still extremely difficult to align to such a small antenna from a distance. And remember, your phone's screen needs to be and unlocked. You'll notice when someone comes that close to you or your phone.
Third, you can't just pull data from an Android device over NFC. You need to confirm that you want to push data. What Charlie did was to push a web link over NFC to a remote device. Because there was a bug in webkit on the remote device (only on 4.0.1), this allowed him to execute code. If he had entered the URL manually, or scanned a QR code, the same would have happened. It's true that Android does not ask for confirmation when *receiving* data over NFC. That said, most users would click *yes* anyway on such confirmations. And there are more effective ways to exploit webkit bugs (sending mass e-mails, just putting a link to the malicious URL on a popular website).
to drop a nuke on Las Vegas.