Slashdot Mirror
Scientists Demonstrate Virus That Spreads Across Wi-Fi Access Points
An anonymous reader writes "Researchers at the University of Liverpool have shown for the first time that WiFi networks can be infected with a virus that can move through densely populated areas as efficiently as the common cold spreads between humans. The team designed and simulated an attack by a virus, called 'Chameleon,' that not only could spread quickly between homes and businesses, but avoided detection and identified the points at which WiFi access is least protected by encryption and passwords. The research appears in EURASIP Journal on Information Security."
The technical details are explained in the journal article.
Sure it's easy to model the spread of a virus. It's another thing entirely to write one that can run on every commodity access point, with sufficient CPU power to crack all nearby passwords / keys.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
We shall call it...the Flappy Bird Flu.
You're welcome.
I wanted to do something like that on network-attached postscript printers a few years back, but didn't have an easy way to open a network socket in PostScript. My virus would have moved from printer to printer and done nothing else except replace every instance of the word "Strategic" with the word "Satanic" on printed documents.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
In the past the news was just about listening, tracking and mapping ...The aircraft are able to identify suspects using 'voice-prints' ...
"aircraft are all fitted with sophisticated surveillance equipment. "
http://www.dailymail.co.uk/new...
Then the wifi mapping news e.g. "mapped the Wi-Fi fingerprint of nearly every major town in Yemen".
https://firstlook.org/theinter... (10 Feb 2014)
Expect more interest in any wifi network at a home, suburb and country based network level.
Domestic spying is now "Benign Information Gathering"
"This attack replaces the firmware of an existing AP and masquerades the outward facing credentials."
What mechanism does the attack us to keep the current configuration while replacing the firmware. Does the attack work by cracking WPA passwords. Would this attack work against the maximum length of sixty three character passwords.
Would your average well coded antivirus behavioural detection software care a lot if your wifi rebooted a few times? ...
No new data into the 'protected' OS, no OS changes, packets flowing in, out, network seems the same
Domestic spying is now "Benign Information Gathering"
..when I worked at a large University, we had a massive AppleTalk/EtherTalk network with a ton of zones, most of which had LaserJet printers.
A cow-orker in another department and I wanted to come up with software that would let us dump files to these printers and somehow masquerade our source info so nobody would know it was us.
Too bad this probably pre-dated Goatse.
A simulation to help understand that from one site e.g. an embassy you could create a private redundant 24/7 wifi network deep into a city to an area of interest.
Counter surveillance efforts would see everyday random wifi use... missing the bust of a key logger days, weeks, months later.
Domestic spying is now "Benign Information Gathering"
Yes I read TFA, not the technical report though. Too technical for me.
It says the virus works by replacing the firmware of wifi routers. That sounds to me like they're tricking the router into accepting an over-the-air update. Which I suppose is limited to 1) a specific make and type of router and 2) knowing the OTA password for that router (or using a default that's not changed). So that sounds plausible for certain specific networks, not where there is a large number of different routers with different firmware and different passwords (or other security vulnerabilities).
What is not explained at all though is how the thing jumps from router to router, and I can't really think of a way this may happen. These things normally do not communicate wiht one another, and devices normally communicate to only one router at the time. Can anyone with deeper understanding explain this?
This is not science or IT security, it is pure PR crackpot FUD conjecture. The "Chameleon" virus doesn't exist. Please read my paper on my fake bluetooth virus. Bluetooth is MUCH more pervasive than Wifi. More cell phones than Wifi, more cars, and about the same number of computers. In my model, they all get infected and your wireless speakers, phones and computers play "It's a Small World" 24/7 until we all go crazy. It ends a lot like 28 Days later.
No, they proved they can invent made up scary data. I think this is actually stolen straight from Schneier's site. It's pure movie plot silliness. https://www.schneier.com/blog/...
Not that you're wrong, but I think you may be carrying it to far. Most APsand routers use one of two operating systems. The firmware on various models of Linksys routers , for example, is extremely similar and not that different from many Netgear models. So it's entirely likely that a single exploit works on about 25% of the units in a given city. In fact, we KNOW of several exploits that each work on 25% - the factory default passwords, telnetenable, etc. If the malware package looked for four or five different exploits, it could very well be effective against half of the APs in the city.
As the subject says, there's no message here. Just a thumbs up to khasim's post.
Or, you know, use WPA2.
I am Audience.
Require a jumper to be installed for any firmware writes to even be possible
Consumer equipment is designed with "plug and play" as its overriding objective. This won't fly because companies want to sell to people barely capable of plugging all the right cables into all the right holes. We're doomed to live with the proliferation of insecure living room equipment until such a point as paying attention to security is taught in kindergarten.
Someone had to do it.
Have it ping a specific site, telling that site "Hi, I'm totally fine!" which is a code word for "pwned!"
Just make sure it is using normal communications channels and your regular AV software, that doesn't know this specific signature yet, won't be able to detect it.
And in the "production" version you have it do something else entirely of course.
From TFA I understand that not only did they ran a computer simulation, they actually wrote the worm and ran it in a controlled environment, observing it spreading between access points.
That would cause a complete meltdown in the DOD if that ever made it inside the Pentagon.
It is very difficult to type while ROFLCoptering in a puddle of spewed Mountain Dew!
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
That whoosh generated a sonic boom or something.
You can't be ahead of the curve, if you're stuck in a loop.
Just tell me this - does it make a screen go all blocky and distorted as it slowly takes over your computer?
Yea, I did the same thing with verizon actiontec routers. They are just silly unix machines peeps. I noticed that the linux wireless driver they were using could be put in RF mode and was capable of injection attacks to surrouding networks and cracking the neighbooring APs. They made it much easier than that though from a viral standpoint because they issued their routers with WEP keys calculated based on their mac address. Hacking the propriatary rmt file format to load my modified roms took a bit to figure out (cuzz no lamers like the posters of this article ever posted some original stuff like that hah). Anywho. Lame been done before - enjoy the publicity girls
"This paper analyses and proposes a novel detection strategy for the 'Chameleon’ WiFi AP-AP virus."
The virus uses the AP's web interface to trigger a firmware upgrade, and then provides a malicious firmware that contains code that spreads the virus. If this is the first time someone did that I'm going to kick myself for not going into security research. Given the plethora of open source AP firmware that already supports many commodity APs it should be trivial to do something like this. All you need is a sufficiently dense collection of APs that are compatible with your malicious firmware. We all already know that a poorly secured AP is a great attack vector, even without malicious firmware you can redirect all of the client's traffic through your own routers and you have your self a classic man in the middle.
The main point of this research is to show that they developed better detection methods that don't compromise any of the AP's client's expectation of privacy.