4 ms·

> Been saying this for a while but the RF world is wildly under-explored on the consumer side. Not really, it is, but nobody gives a shit. Before zero-trust w

> Been saying this for a while but the RF world is wildly under-explored on the consumer side. Not really, it is, but nobody gives a shit. Before zero-trust was the latest cool buzzword on the block, there was the Jericho Forum[1]. I vividly recall attending a Jericho affiliated event where one speaker was banging on about how insecure those bluetooth phone dongles were. Nothing changes. Security remains an afterthought. But back to the topic at hand, security camera, home WiFi, asking for trouble really. There are some things for which you really should just run a damn cable. [1]https://en.wikipedia.org/wiki/Jericho_Forum https://en.wikipedia.org/wiki/Jericho_Forum

kjkjadksj 3y ago
Why do you think there are so few attacks given the wide surface and long known vulnerabilities here? Maybe there are simply even lower hanging fruit to further your scam or espionage than intercepting these communications?
- bri3d 3y ago
  Barrier to entry, mostly. Implementation of most RF attacks historically required expensive SDR equipment and strong knowledge in a highly specialized domain. Even many WiFi attacks which can be executed by off-the-shelf WiFi hardware require specialized driver/firmware hacking to execute, since most WiFi firmware isn't designed to send frames "out of turn" or with the wrong flags set. This is all evolving rapidly and I fully expect this to be one of the hottest topics in coming years. Flipper Zero is an obvious example of the change here - it was absolutely nothing new hardware or software wise, but providing easy access to standard BLE primitives and years-old sub-Ghz radio chipsets triggered a variety of meltdowns. More powerful SDRs and basic "building block" libraries for SDR are only becoming cheaper and more available every day.
- autoexec 3y ago
  I suspect that there are many many attacks, but we don't hear much about them because they go undetected. People are routinely being tracked via bluetooth for example but very few people think about it or bother to disable bluetooth because of it. Companies (and anyone else interested) just get to scoop up all that data and use it for whatever they feel like.

kjkjadksj 3y ago

Why do you think there are so few attacks given the wide surface and long known vulnerabilities here? Maybe there are simply even lower hanging fruit to further your scam or espionage than intercepting these communications?

bri3d 3y ago
Barrier to entry, mostly. Implementation of most RF attacks historically required expensive SDR equipment and strong knowledge in a highly specialized domain. Even many WiFi attacks which can be executed by off-the-shelf WiFi hardware require specialized driver/firmware hacking to execute, since most WiFi firmware isn't designed to send frames "out of turn" or with the wrong flags set. This is all evolving rapidly and I fully expect this to be one of the hottest topics in coming years. Flipper Zero is an obvious example of the change here - it was absolutely nothing new hardware or software wise, but providing easy access to standard BLE primitives and years-old sub-Ghz radio chipsets triggered a variety of meltdowns. More powerful SDRs and basic "building block" libraries for SDR are only becoming cheaper and more available every day.
autoexec 3y ago
I suspect that there are many many attacks, but we don't hear much about them because they go undetected. People are routinely being tracked via bluetooth for example but very few people think about it or bother to disable bluetooth because of it. Companies (and anyone else interested) just get to scoop up all that data and use it for whatever they feel like.