Slashdot Mirror
Researcher Wows Black Hat With NFC-based Smartphone Hacking Demo
alphadogg writes "At the Black Hat Conference in Las Vegas Wednesday, Accuvant Labs researcher Charlie Miller showed how he figured out a way to break into both the Google/Samsung Nexus S and Nokia N9 by means of the Near Field Communication (NFC) capability in the smartphones. NFC is still new but it's starting to become adopted for use in smartphone-based purchasing in particular. The experimentation that Miller did, which he demonstrated at the event, showed it's possible to set up NFC-based radio communication to share content with the smartphones to play tricks, such as writing an exploit to crash phones and even in certain circumstances read files on the phone and more."
Workaround: Blacklist the kernel module used for NFC?
To offset political mods, replace Flamebait with Insightful.
Ironic. The technical tools to solve all these problems exist, but if they were used properly, even the gov't. couldn't break in.
So which do you want? An inherently weak system that allows civil monitoring, or something so secure it'd be as anonymous as cash. After all, this is *cash* we are talking about replacing here.
The gov't. has a "thing" about encrypting wireless communications ...
Very easy, actually. The focus of a huge portion of my work is dedicated to writing or improving fuzz technology for security testing. I could write a basic fuzzer for almost anything in 20 minutes...
Another network or communications port = another attack vector.
The question is why to vendors think they need to keep adding new communication methods faster than they can test and debug those ports?
make imaginary.friends COUNT=100 VISIBLE=false
One, both sides of the conversation should know "something" about who they are talking to before engaging or continuing a transaction.
"Enough" may be nothing more than making sure a man-in-the-middle hasn't taken over the conversation.
Second, any conversation has to begin at a minimum trust level - basically "I don't trust you, you don't trust me, here's my name-of-the-day, what should I call you today?" level.
Some people have suggested public key cryptography. While this is cool, it may be simpler to use "out of band" communication to verify identities. Since phones have cameras and screens, these can provide the necessary out of band communications.
Scenario:
Say I'm at the Burger Bar and I want to buy something using my phone. My phone doesn't trust the radio signal pretending to be Burger Bar's, and Burger Bar doesn't trust that my phone isn't someone else's phone nearby.
So I use my phone to take a picture of a display at the Burger Bar order counter. This picture has a QR code for Burger Bar's public key or web site that has the public key, as well as a second, changing QR code that is my transaction ID plus some randomness. I encrypt all of this plus my made-up-on-the-spot public key plus a made-up QR code using Burger Bar's public key. I display this QR code on my phone and put it in range of the small camera at the register. Burger Bar's computer checks the QR code against what I just transmitted to verify it's my phone it's talking to.
Now we can talk to each other securely and, thanks to the ordinary security cameras that show me holding my phone close to the order counter, in a difficult-to-repudiate way.
I didn't have to give Burger Bar my phone's serial number. I didn't have to give it any identification beyond what our banks need to transact business, just as if I were using a traditional credit card or debit card payment. If we are using bit-coin or something similar, I didn't even have to give them that much - true anonymity.
Now I go enjoy my meal. Oh wait, this is Burger Bar we are talking about. Now I go ingest my mass quantities.
Burger Bar really doesn't have to use its own public key. Like me, it can make up one for this transaction. It's the taking-a-picture of the public key and transaction code that make this secure against a radio-only intercept. If there is a risk that the transaction code picture or my phone's on-screen QR code will be intercepted, it's easy enough to let the two devices look at each other in a way that's very difficult to "peek into."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've played with distances using a few different smart cards, a USB NFC reader, and a nexus S. I couldn't get a smartcard to read through the front of the phone or the side. I could get a USB NFC reader to detect if smartphone was placed face down. From the back it is about 3 inches with a USB reader, 1-2 inches with a smartcard.
NFC is also a battery hog. I don't see having it running all the time.
Here are some videos. He represents the phones as unmodified, though running an old version.
The distance isn't so much of an issue because he was able to use an NFC tag, not a transmitter, not an active device of any kind, but a mere tag to cause the phone to switch on its bluetooth radio and give him a sudoer's command line over the BT radio. An attacker could hide an NFC tag in a table or at waist level in a public place, or in a tag that's disguised to be legitimate, where people are liable to stand for more than 10 seconds: the tag cracks the phone open, and then someone with a laptop within BT distance conducts a brief session to grab what they can, or install a rootkit.
Don't blame me, I voted for Baltar.
I've long thought that NFC was a disaster waiting to happen - or really a never-ending series of disasters, just as each one is patched-over a new one will appear.
The problem is that NFC's functionallity is all out of proportion to the problem it is intended to solve. It's kind of like adding a video display when all you need is an LED indicator light. NFC is supposed to handle short and fast communications between devices that are in very close proximity. Stuff like exchanging v-cards, electronic payments at the register, kickstarting ad-hoc wifi connections, etc.
None of that stuff requires radio communications and even though NFC is designed for broadcast ranges of a couple of centimeters, that never stops the bad guy from using high-powered transmitters and ultra-sensitive antennas to do their dirty work from a more comfortable and non-obvious location.
I believe that almost everything that NFC is likely to ever be useful for could also be done with no extra hardware. Just use the camera already built into every smart-phone to take a picture of a 2d-barcode displayed by the other device. That gets you physical access controls limited by line of site and a window of opportunity limited to the second or so that the user explicitly presses the camera button.
When information is power, privacy is freedom.
The discussion about single point login got me thinking. Rather than having some server out there become a single point of failure, how about a device you carry with you that stores the multitude of logins and passwords? Smart phones seem capable of just that.
Has anyone come across using NFC on a phone as a login/password authentication method? Store all of your login and passwords on the phone. Then when prompted for login info (website, laptop login, etc), you use your phone.
Yeah, a whole new security nightmare. But the idea still appeals to me.
The world is made by those who show up for the job.
The near field is within the first 1.5 wavelengths of the frequency used. It has certain special properties related to it having a higher (proportionally) density of virtual photons entangled with the source antenna than does the far field.
(A connection on the near field will actively change the resistance and resonance characteristics of the signalling antenna, where a far field connection will not.)
Giving a set distance is moot. Saying it is near field is accurate, and sufficient. The distance in which NFC is possible is inseperable from the chosen comm frequency. A very short wavelength frequency will have a very tiny near field. A long wavelength frequency will have a very large near field.
Cellular devices in the ghz band will have only a few millimeters around the antenna as the NFC reception range.
The deal that I would consider to be the threat, is that you can't have a near field without a far field. The far field will also have broadcasted data encoded into it, and will travel much further. It could well be intercepted.
Regardless of what the default NFC state is, we've been hearing NFC is the nifty next thing for these phones. Google made a huge deal about it at Google IO.
Stating that NFC is secure because you can turn it off is analogous to claiming SSH1 is secure because it can be turned off. It's not secure; you're just ameliorating the problem - not to mention losing the desired functionality.
Besides, what are all the people who bought those Nexus Q's supposed to do now?
#DeleteChrome
Unfortunately, like most web sites, slashdot brings this article way too sensational, omitting most of the facts that make this a lot less impressive and worrisome.
First, at least on Android devices, NFC is only enabled when the screen is on and unlocked. That means that nobody can just walk by you and communicate to your device over NFC. You need to be already working with your phone.
Second, there is the range. NFC typically only works one or two inches away, and the two devices interacting need to be aligned properly as well. Somebody literally needs to put a phone back to yours to make this work. Of course, range could be expanded a bit with some seriously large gear, but it is still extremely difficult to align to such a small antenna from a distance. And remember, your phone's screen needs to be and unlocked. You'll notice when someone comes that close to you or your phone.
Third, you can't just pull data from an Android device over NFC. You need to confirm that you want to push data. What Charlie did was to push a web link over NFC to a remote device. Because there was a bug in webkit on the remote device (only on 4.0.1), this allowed him to execute code. If he had entered the URL manually, or scanned a QR code, the same would have happened. It's true that Android does not ask for confirmation when *receiving* data over NFC. That said, most users would click *yes* anyway on such confirmations. And there are more effective ways to exploit webkit bugs (sending mass e-mails, just putting a link to the malicious URL on a popular website).