3 ms·

I couldn't find where anyone else had done this before with ham radio. That was another motivating factor. It was an interesting new (but, actually old) attack

I couldn't find where anyone else had done this before with ham radio. That was another motivating factor. It was an interesting new (but, actually old) attack vector. I've always been interested in weird attack vectors like this. I've read some fun research in the past about infrared communications, magnetic strips, etc. Things that are all around us but we don't really think of as attack vectors.

ImpulseGuided 4y ago
>I've read some fun research in the past about infrared communications, magnetic strips, etc. Things that are all around us but we don't really think of as attack vectors. Any particular source that you would recommend to start learning about these vectors?
- rickostuff 4y ago
  The resources that come to mind are actually all videos of Defcon talks by the same person (Major Malfunction aka Adam Laurie). They are pretty old now, but still interesting. Infrared Hacking: https://www.youtube.com/watch?v=61Fo-zg-DqI https://www.youtube.com/watch?v=61Fo-zg-DqI Magstripe Hacking: https://www.youtube.com/watch?v=ITihB1c3dHw https://www.youtube.com/watch?v=ITihB1c3dHw Satellite Hacking: https://www.youtube.com/watch?v=PyXZX63etog https://www.youtube.com/watch?v=PyXZX63etog These all hit the sweet spot for me of technologies we use all the time but don't really consider the security implications.
  - ImpulseGuided 4y ago
    Thank you very much for linking these. By the way, did you catch yesterday's thread on the Hack-a-Sat(ellite) CTF? >https://news.ycombinator.com/item?id=31559117 https://news.ycombinator.com/item?id=31559117 Also congratulations on passing the OSED. Reading your 5-part report it looks like you got your money's worth. Did you study for the OSED full-time or did you manage to complete all studying and tasks after work?
    - rickostuff 4y ago
      Thanks! I actually took three OffSec courses last year. The first one I did was the OSWP (wifi) as a sort of warm up because it's the easiest course they offer and I knew I could knock that out pretty quick. Then I took the OSEP course which was a ton of content. Finally I took the OSED which was another ton of content and the most technical of those three. My work gave me 40 hours of in-office time to last year for training. I can't recall if I used that 40 hours for the OSEP or OSED, but I know I used it for one of those two. However, I still put in a ton of hours on my own time too. It's just a lot of content to go through. 40 hours isn't enough time for either of those courses in my opinion. Having no children (and an understanding spouse) made it easier for me to dedicate a lot of personal time on the training. I love OffSec's stuff though and recommend it to anyone who is into offensive security and wants practical training.
amatecha 4y ago
Yeah, I've thought about this a lot with the increased popularity of digital modes. Especially those small programs made by one or two people, just as you identified. I mean, I crashed a friend's radio simply by sending him an SMS over DMR (seems like a known issue/limitation with the radio firmware). Even well-established products are susceptible to attacks. No different from any other modern tech I guess :)
- rickostuff 4y ago
  I'd like to spend some time digging into radio/tnc firmware for vulnerabilities but that's a bit over my head. I've managed to dump the firmware from my TNC but I haven't found a good way to get it disassembled yet. I've got a partial disassembly, but that's it. Unfortunately, I won't have more time to work on that for a few months.
hoppla 4y ago
I fuzzed the direwolf aprs software using AFL some years back, but nothing interesting showed up. I too found RCE over HAM intriguing. Good work!

ImpulseGuided 4y ago

>I've read some fun research in the past about infrared communications, magnetic strips, etc. Things that are all around us but we don't really think of as attack vectors. Any particular source that you would recommend to start learning about these vectors?

rickostuff 4y ago
The resources that come to mind are actually all videos of Defcon talks by the same person (Major Malfunction aka Adam Laurie). They are pretty old now, but still interesting. Infrared Hacking: https://www.youtube.com/watch?v=61Fo-zg-DqI https://www.youtube.com/watch?v=61Fo-zg-DqI Magstripe Hacking: https://www.youtube.com/watch?v=ITihB1c3dHw https://www.youtube.com/watch?v=ITihB1c3dHw Satellite Hacking: https://www.youtube.com/watch?v=PyXZX63etog https://www.youtube.com/watch?v=PyXZX63etog These all hit the sweet spot for me of technologies we use all the time but don't really consider the security implications.
- ImpulseGuided 4y ago
  Thank you very much for linking these. By the way, did you catch yesterday's thread on the Hack-a-Sat(ellite) CTF? >https://news.ycombinator.com/item?id=31559117 https://news.ycombinator.com/item?id=31559117 Also congratulations on passing the OSED. Reading your 5-part report it looks like you got your money's worth. Did you study for the OSED full-time or did you manage to complete all studying and tasks after work?
  - rickostuff 4y ago
    Thanks! I actually took three OffSec courses last year. The first one I did was the OSWP (wifi) as a sort of warm up because it's the easiest course they offer and I knew I could knock that out pretty quick. Then I took the OSEP course which was a ton of content. Finally I took the OSED which was another ton of content and the most technical of those three. My work gave me 40 hours of in-office time to last year for training. I can't recall if I used that 40 hours for the OSEP or OSED, but I know I used it for one of those two. However, I still put in a ton of hours on my own time too. It's just a lot of content to go through. 40 hours isn't enough time for either of those courses in my opinion. Having no children (and an understanding spouse) made it easier for me to dedicate a lot of personal time on the training. I love OffSec's stuff though and recommend it to anyone who is into offensive security and wants practical training.

amatecha 4y ago

Yeah, I've thought about this a lot with the increased popularity of digital modes. Especially those small programs made by one or two people, just as you identified. I mean, I crashed a friend's radio simply by sending him an SMS over DMR (seems like a known issue/limitation with the radio firmware). Even well-established products are susceptible to attacks. No different from any other modern tech I guess :)

rickostuff 4y ago
I'd like to spend some time digging into radio/tnc firmware for vulnerabilities but that's a bit over my head. I've managed to dump the firmware from my TNC but I haven't found a good way to get it disassembled yet. I've got a partial disassembly, but that's it. Unfortunately, I won't have more time to work on that for a few months.

hoppla 4y ago

I fuzzed the direwolf aprs software using AFL some years back, but nothing interesting showed up. I too found RCE over HAM intriguing. Good work!