Slashdot Mirror
Scientists Demonstrate Virus That Spreads Across Wi-Fi Access Points
An anonymous reader writes "Researchers at the University of Liverpool have shown for the first time that WiFi networks can be infected with a virus that can move through densely populated areas as efficiently as the common cold spreads between humans. The team designed and simulated an attack by a virus, called 'Chameleon,' that not only could spread quickly between homes and businesses, but avoided detection and identified the points at which WiFi access is least protected by encryption and passwords. The research appears in EURASIP Journal on Information Security."
The technical details are explained in the journal article.
Scientists rabid
Spreading viri like fur
Are a damaging habit
Against which suds can ensure
Burma Shave
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Sure it's easy to model the spread of a virus. It's another thing entirely to write one that can run on every commodity access point, with sufficient CPU power to crack all nearby passwords / keys.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
We shall call it...the Flappy Bird Flu.
You're welcome.
I wanted to do something like that on network-attached postscript printers a few years back, but didn't have an easy way to open a network socket in PostScript. My virus would have moved from printer to printer and done nothing else except replace every instance of the word "Strategic" with the word "Satanic" on printed documents.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
captcha: babyhood
In the past the news was just about listening, tracking and mapping ...The aircraft are able to identify suspects using 'voice-prints' ...
"aircraft are all fitted with sophisticated surveillance equipment. "
http://www.dailymail.co.uk/new...
Then the wifi mapping news e.g. "mapped the Wi-Fi fingerprint of nearly every major town in Yemen".
https://firstlook.org/theinter... (10 Feb 2014)
Expect more interest in any wifi network at a home, suburb and country based network level.
Domestic spying is now "Benign Information Gathering"
"This attack replaces the firmware of an existing AP and masquerades the outward facing credentials."
What mechanism does the attack us to keep the current configuration while replacing the firmware. Does the attack work by cracking WPA passwords. Would this attack work against the maximum length of sixty three character passwords.
How do they know it spread, then?
Who the hell writes these headlines. These scientists didn't demonstrate shit, they ran a simulation for crying out loud.
..when I worked at a large University, we had a massive AppleTalk/EtherTalk network with a ton of zones, most of which had LaserJet printers.
A cow-orker in another department and I wanted to come up with software that would let us dump files to these printers and somehow masquerade our source info so nobody would know it was us.
Too bad this probably pre-dated Goatse.
Yes I read TFA, not the technical report though. Too technical for me.
It says the virus works by replacing the firmware of wifi routers. That sounds to me like they're tricking the router into accepting an over-the-air update. Which I suppose is limited to 1) a specific make and type of router and 2) knowing the OTA password for that router (or using a default that's not changed). So that sounds plausible for certain specific networks, not where there is a large number of different routers with different firmware and different passwords (or other security vulnerabilities).
What is not explained at all though is how the thing jumps from router to router, and I can't really think of a way this may happen. These things normally do not communicate wiht one another, and devices normally communicate to only one router at the time. Can anyone with deeper understanding explain this?
This is not science or IT security, it is pure PR crackpot FUD conjecture. The "Chameleon" virus doesn't exist. Please read my paper on my fake bluetooth virus. Bluetooth is MUCH more pervasive than Wifi. More cell phones than Wifi, more cars, and about the same number of computers. In my model, they all get infected and your wireless speakers, phones and computers play "It's a Small World" 24/7 until we all go crazy. It ends a lot like 28 Days later.
I don't post often, but when I do, I post as Anonymous Coward.
Big time complex to make it work on more than one model.
Easy to fix this permanently in standard future AP hardware:
1 - Require a jumper to be installed for any firmware writes to even be possible (really cheap).
2 - For devices where it is possible to modify program RAM and run that without changing program storage, have a checksum run in hardware and reboot the device if the checksum fails. The checksum value can only be changed when the jumper is on.
Not that you're wrong, but I think you may be carrying it to far. Most APsand routers use one of two operating systems. The firmware on various models of Linksys routers , for example, is extremely similar and not that different from many Netgear models. So it's entirely likely that a single exploit works on about 25% of the units in a given city. In fact, we KNOW of several exploits that each work on 25% - the factory default passwords, telnetenable, etc. If the malware package looked for four or five different exploits, it could very well be effective against half of the APs in the city.
As the subject says, there's no message here. Just a thumbs up to khasim's post.
..but still as concerning to read about the second time around :)
That would cause a complete meltdown in the DOD if that ever made it inside the Pentagon.
It is very difficult to type while ROFLCoptering in a puddle of spewed Mountain Dew!
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
As a more general rule scientists need a crash course in naming their research. I wonder how this one went - "Hey, we're researching a computer virus that behaves like a real-world biological virus and we'll call it Chameleon, because LOGIC!"
Just tell me this - does it make a screen go all blocky and distorted as it slowly takes over your computer?
This has to be a joke, right? Obviously if i had a worm able to infect every other node in a network it would spread like wildfire according to its rules and the networks physical limitations. The only hard (practically impossible?) thing would be to come up with one able to compromise all kinds of APs with varying firmware you would encounter in the wild. And if they avoid "hard" ones like WPA protected networks, then in most neighbourhoods there will be far far too few APs to latch on to (herdimmunity?).
Yea, I did the same thing with verizon actiontec routers. They are just silly unix machines peeps. I noticed that the linux wireless driver they were using could be put in RF mode and was capable of injection attacks to surrouding networks and cracking the neighbooring APs. They made it much easier than that though from a viral standpoint because they issued their routers with WEP keys calculated based on their mac address. Hacking the propriatary rmt file format to load my modified roms took a bit to figure out (cuzz no lamers like the posters of this article ever posted some original stuff like that hah). Anywho. Lame been done before - enjoy the publicity girls
So what do we tell people to do to prevent this type of attack. We need something simple enough that ordinary (non-./ers) can do it. Here's my thoughts:
WPA2 without Wi-Fi Protected Setup (to avoid a vulnerability)
A customized SSID not matching: http://en.wikipedia.org/wiki/Rainbow_table
A random pass phrase of 13 characters
Anything else for a simple-as-possible, end-user setup criteria?
"This paper analyses and proposes a novel detection strategy for the 'Chameleon’ WiFi AP-AP virus."
The virus uses the AP's web interface to trigger a firmware upgrade, and then provides a malicious firmware that contains code that spreads the virus. If this is the first time someone did that I'm going to kick myself for not going into security research. Given the plethora of open source AP firmware that already supports many commodity APs it should be trivial to do something like this. All you need is a sufficiently dense collection of APs that are compatible with your malicious firmware. We all already know that a poorly secured AP is a great attack vector, even without malicious firmware you can redirect all of the client's traffic through your own routers and you have your self a classic man in the middle.
The main point of this research is to show that they developed better detection methods that don't compromise any of the AP's client's expectation of privacy.