18 ms·
DEF CON 19 - hackers get hacked
- iwwr 15y agoThe atmosphere seems to be so rife with paranoia that it looks best not to take any digital device with you there.
- JonnieCache 15y agoA pen and paper would probably do just fine for taking the odd note. However I'd probably take a cheap old laptop off ebay, bought for the event and then discarded afterward. I'd feel I was missing out if I wasn't able to at least dip a packet sniffer into the famously hellish torrent of exploits I've heard so much about. I'd never take any of my personal machines though.
- khafra 15y agoOne year I took a pocket-sized notebook and a slide rule. The next year I took an iPhone and a eee PC. I experienced the same level of hacking both times.
- scarmig 15y agoWow, what'd they do to the slide rule?
- jevinskie 15y agoSpeaking of packet sniffers, DEFCON would be, by far, the best event to try out a Wireshark packet dissector 0-day!
- marcinw 15y agoThere's plenty of those to go around...
- jconnop 15y agoThat's a little extreme. Unless you expect them to get into your low level hardware (BIOS etc), just format it clean afterwards.
- shin_lao 15y agoAlways have an obscure old phone with almost no feature (except voice and text). Generally the OS is so minimal that there's little room for an exploit, and by little room I mean that you will not have enough memory to add your rootkit.
- eli 15y agoThe Motorola RAZR (and probably similar phones) have serious exploits and backdoors. See: http://news.cnet.com/2100-1029-6140191.html http://news.cnet.com/2100-1029-6140191.html
- ugh 15y agoYou hopefully also don't have any phone conversations or send any text messages you mind becoming public? GSM is thouroughly broken.
- ZoFreX 15y agoIf you're in the UK, take a phone with a Three sim card in it, they can't connect at all without 3G.
- arethuza 15y agoIs 3G really that much more secure than GSM? http://eprint.iacr.org/2010/013.pdf http://eprint.iacr.org/2010/013.pdf
- ZoFreX 15y agoFrom what I've been told, yes, but I could be utterly wrong.
- ugh 15y agoThat works for you, it won't work for everyone. UMTS and LTE don't have the capacity to replace GSM, not even close, they can barely keep up with the growth of additional demand. GSM is broken and here to stay for a long, long time.
- drink 15y agoSo it's clear: this post claims that there is a man-in-the-middle attack possible over 4G networks that allows an attacker to own and capture data from an Android device, including texts and calls. If this is true, and if the media gets around to this, enterprise deployments of Android devices are truly screwed.
- elliottcarlson 15y agoOr he connected to a wifi network masked as a mobile broadband connection that you would usually connect to.
- ay 15y agoYou can't mask wifi as a mobile broadband connection. (If you know how to do it, please share - I'd be interested to know!) I'd venture to guess they hacked some of the femtocell gear, or maybe used for the evil the gear from openbts project. It's sad, really. These people are not too stupid at least in the technology area. It would be so great to have their skills directed at making the world good. Like, providing the connectivity somewhere in the villages in lalaland far away. Alas.
- bonzoesc 15y agoI think doing it in a place where people will (eventually) figure it out helps. Hav fun at someone's expense, but get the genie out of the bottle and in front of the public a bit faster so we know it can be done and get it fixed. Some of my friends bring burner/throwaway/blank phones to Defcon, and this is why.
- ay 15y agoI agree with the fact that doing it at Defcon is ten times better than doing it at, say, LeWeb. But I question the overall value of this activity for the society, compared to other things.
- 15y ago
- someone13 15y agoWith all due respect to "coderman", but I think that I'd like to see some proof of what he's mentioning. If what he says is true, someone has created a system that automatically man-in-the-middles all mobile connections, and then intelligently exploits them with increasingly more sophisticated exploits? Please forgive me if I'm a little skeptical.
- kevindication 15y agoFriend of mine came back from Defcon complaining of some of the exact same symptoms as those listed by coderman and said he'd be DBANning his phone later.
- munin 15y agofunny story, there was an android SW upgrade on verizon that weekend. i was halfway across the world and i accepted. i guess i'm boned! :( powerful mitm
- drzaiusapelord 15y agoYeah, I hate to say it, but as an android user half those symptoms are typical, especially in heavily congested areas, and the other half could be explained with a half-cooked update, which is also typical.
- kalleboo 15y agoI'd like to know what he means by "4G". HSDPA (could probably be done really easily with a hacked AT&T femtocell)? WiMAX? LTE?
- borism 15y agohe mentions CDMA, so I guess it's WiMax
- ConstantineXVI 15y agoThat doesn't really mean anything. Sprint's the only CDMA carrier that's deployed WiMAX, Verizon and MetroPCS have both deployed LTE. And there's nothing implying he's talking about the same phones, so he could just as easily be talking about HSPA ("4G")
- trotsky 15y agoIt's a pretty good troll, but the chances of it being true are very low. I think someone attended the excellent talk: "Femtocells: a Poisonous Needle in the Operator's Hay Stack" [1] about 3G MITM and got inspired to have a bit of a laugh. This is so far into the "state sponsored only" realm that if you'd actually pulled it off and were bragging about it you'd provide some kind of proof instead of generic symptoms designed to make people paranoid. I'm pretty surprised at all the media outlets that are carrying this and people taking it at face value. Anyone can write up something and send it to a mailing list - remember that full disclosure is pretty much ground zero for security trolling. [1] http://www.slideshare.net/zahidtg/femtocells-a-poisonous-needle-in-the-operators-hay-stack http://www.slideshare.net/zahidtg/femtocells-a-poisonous-nee...
- windsurfer 15y agoSo the people who make the 3G and 4G standards made them pretty secure. Those are not broken. What's broken is the implementation. The carriers are not the ones developing the technology, so they do boneheaded things like making the client identifiers sequential or using the wrong verification schemes. I would be willing to bet that if there is some kind of exploit here, it's due to the specific implementation.
- interurban 15y agoExactly, it sounds as if the mitm attack wasn't based on hijacking a broadcast, but on redirecting data/voice/sms/etc. from a cracked device to a network of the attacker's choosing. The redirection wasn't based on fooling the phone into connecting , it was based on explicitly changing the network the phone connected to. A very interesting attack, but not interesting in the sense that cdma/wimax (perhaps LTE too?) is unsafe but in the sense that there are serious vulnerabilities in the network stack for android.
- kenotic 15y agoI think we need more clarity here. I would like to know what "4g" was MiTM. This makes a huge difference as it will lead to further research on that network.
- X-Istence 15y agoI heard that there was a hack that went on whereby someone was on the phone in the elevators at the Rio and their entire conversation was played over the speakers in the elevator bank. Friend of mine said he was in the elevator at the time and that it was hilarious. Could have been a bluetooth hack though. Also plenty of people on Sprint's network had full bars but could make absolutely no calls and data was extremely slow, but about half a block from the Rio everything worked perfectly again, now it could well be that they were handed off to a different tower, but people on AT&T and T-Mobile weren't having the same issues. DefCon this year was awesome. Plenty of fun to be had, and as more and more people start carrying around cell phones that are more powerful these attacks will continue to be developed and continue to be exploited.
- bonzoesc 15y ago> Also plenty of people on Sprint's network had full bars but could make absolutely no calls and data was extremely slow, but about half a block from the Rio everything worked perfectly again, now it could well be that they were handed off to a different tower, but people on AT&T and T-Mobile weren't having the same issues. I was definitely having the same issues on AT&T. Falling back to SMS instead of voice or Twitter for communication worked a lot better for coordinating things, although the lag was an issue.
- ssharp 15y agoI was in Vegas this past week, but not for Defcon and I was on the Strip, not at the Rio, and still had flaky service. However, I've always had flaky service when on the strip. I am able to make calls, but it would delay before the phone started ringing, texts messages would hang longer than usual, and 3G data transfers were painfully slow. But again, nothing out of the ordinary for that part of town.
- dotBen 15y agoSo I was at DEFCON 19 and I'm 90% sure my Sprint 4G Android was hacked. When I make calls there is a beep on the line every few minutes so I'm guessing someone managed to set up some recording of my calls. I've changed all my passwords and reflashed the phone back to factory defaults + latest copy of the firmware from HTC's website. Also, I only realized AFTER a few minutes of (failed) use that my Verizon 4G card was being MiTM'd as I had full strength but no connectivity. What I don't understand is how this vector occurred (on the Android phone) given it is no different to connecting over public (open) wifi - anyone can read packets and so the connections between Google Apps (for example) are supposed to be encrypted. My only guess is that my phone auto-downloaded a patch that was poisoned and the security failure here is that the phone assumes any patch fed to it over the mobile network must be trustworthy. :/
- shoota 15y agoNo they always check the signature before applying the patch.
- Domenic_S 15y agoCheck it against what? A pwned digest?
- shoota 15y agoUnless you're rooted the updates are checked with the public key to make sure they are signed with the correct private key. Unless Google lost their set of private keys it wouldn't be possible to modify the update. It's entirely possible there are other exploits but a modified update.zip is not a likely vector.
- avree 15y agoI'd be willing to bet that 90% of people at Defcon with Androids had them rooted. Many were probably running custom ROMs.
- guywithabike 15y agoCurious: were any iPhones/iPads hacked?
- blacksmith_tb 15y agoProbably by the carload, but not by this exploit, since they aren't using 4G...
- jamieb 15y agoThe advice i got from some barcamp peeps was "do not bring anything to DEFCON that you cant afford to get hacked". One fellow is a security consultant and the other manages networks for a financial institution. They could have been being dramatic for effect, but why risk it? I know enough about programming to know that I cannot secure my devices against a determined foe (unless you count the power button - but hey there's conspiracy theories there too right?). So the advice was: disposable pay-as-you-go phone and craigslist it afterwards. Same for laptop. Don't bring them home.