The Mobile Malware Connection

Today was Part II of the Taste of SANS Mobile Device Security and Ethical Hacking webcast trilogy, "The Mobile Malware Connection".  In this session we looked at the growing prevalence of mobile malware, primarily affecting Android devices but also appearing in iOS and BlackBerry devices as well.  Malware authors have been quick to realize the benefits of exploiting mobile devices, with opportunities to intercept security-related content over SMS messaging, and the ability to make a quick buck at a victim's expense.

Check out the presentation for more fun details about Android, iOS, BlackBerry and Windows Mobile devices.  The next and final session in this trilogy will be at 1PM ET on July 19 titled "2012: A Mobile Penetration Test" where we'll be looking at techniques for exploiting mobile devices, and their associated infrastructure to evaluate the risks to your organization.


June 21, 2012   Posted in: Android, Apple, BlackBerry, Malware, Mobile, Windows Phone  No Comments

Invasion of the Mobile Phone Snatchers

Slide Title Presentation PageToday I delivered the first of a trilogy of webcasts promoting my new course with the SANS Institute "Mobile Device Security and Ethical Hacking" (Security 575). In the presentation we look at the threat of lost or stolen mobile devices, examining how an attacker can use backup tools to extract data from mobile devices, bypass PIN authentication on Apple iOS and BlackBerry devices, and how to mitigate the impact of lost devices. Check it out!


June 1, 2012   Posted in: Android, Apple, BlackBerry, Hacking, iPhone, Mobile, Penetration Testing, Windows Phone  No Comments

Things I Wish Didn’t Tell Me

Amazon recently added a reporting function where you can get a CSV of your buying habits for any specified date period.  I took a few minutes to do some analysis.

Q: Will I sign up to renew my Amazon Prime account when it expires?



June 15, 2011   Posted in: Tool  No Comments

The Changing Wireless Attack Landscape

I'm en-route to the SANS Orlando 2011 conference, getting ready to teach SEC617 Ethical Hacking Wireless.  I'm really excited about some new material and a changing focus on the SEC617 course.

Over the past couple of years we've seen a definite change in wireless hacking techniques and tools.  While we are still seeing attacks against weak deployments of WPA/WPA2 and EAP-based authentication protocols, more and more wireless attacks are targeting "other" wireless protocols.


For the past year I've been spending a good deal of time working on the KillerBee suite of tools, designed to target weaknesses in IEEE 802.15.4 and ZigBee networks.  This has been a lot of fun, and interestingly has spawned other projects taking the KillerBee framework and extending it to new tools, such as the ZigBee-Security project, as well as upcoming integrated tools in the KillerBee repository (special thanks to Ryan Speers and Ricky Melgares for their awesome work!).  In addition, a recent project published at Blackhat Europe aims to develop some additional IEEE 802.15.4 attack techniques with a useful GUI interface and extensible interface through the SenSys project.

ZigBee/IEEE 802.15.4 hacking is interesting because:

  1. It isn't WiFi and there is a serious lack of security knowledge and analysis tools available to help people understand the threats and attack techniques;
  2. It interfaces with devices that often control kinetic systems, such as heating/cooling, mechanical systems, door lock controls and other juicy targets.
  3. Did I mention that it isn't WiFi?

Interest in attacking ZigBee is going to continue with its vital involvement in Smart Grid efforts, home and business automation, medical devices and more.  On top of that, hacking ZigBee and IEEE 802.15.4 is a lot of fun, and is reminiscent of early WiFi security deployments.


Ubertooth OneOn top of that, Bluetooth hacking is seeing a new significant supporter in the form of Mike Ossmann's Ubertooth project.  For many years, Bluetooth hacking has been very limited despite numerous vulnerabilities in the base specification and vendor implementations.  The problem has always been the lack of a flexible hardware platform with which to sniff and transmit arbitrary packets on a Bluetooth network.  With the custom and cost-effective hardware in Ubertooth however, we are going to see a new deluge of attack techniques against the Bluetooth networks that for years have been vulnerable without a big motivator to improve Bluetooth security.

Proprietary Wireless Attacks

In addition to attacks against ZigBee/IEEE 802.15.4 and Bluetooth, we are seeing lots of interesting attacks against proprietary wireless protocols, either through the use of Software Defined Radio tools such as the USRP, or through hardware hacking techniques.  The concept here is that we leverage simple hardware devices to build our own attack tools, or re-purpose existing hardware for our own attack purposes.

Sometimes the tools we use come in funny colors.  I call to your attention the IM-ME.  Through the efforts of Dave's Hacks, Travis Goodspeed and Mike Ossmann, we can take this Girl Power toy and turn it into a customized wireless hacking tool.  The picture below shows its use in sniffing a 475 MHz project I'm working on with a colleague that we'll debut sometime soon.

The picture of the left is my IM-ME interfacing with a GoodFET from Travis Goodspeed.  The GoodFET provides a very flexible interface to interact with various circuits and components as well as a framework in Python controlling devices.  Included in the GoodFET sources are scripts such as "goodfet.nrf", which allows you to use the Nordic 2401L transceiver to interact with a bunch of interesting devices.

The Changing Wireless Attack Landscape

The bottom line is that, while WEP deployments are drying up as easy targets, wireless hacking is not slowing down.  It's not a good idea to rest with the security achievements of EAP/TLS and your Wireless IDS system, when attack techniques move to other areas where monitoring systems are nonexistent.

We can respond to the changing wireless attack landscape in several ways:

  • Understand the risks: Make sure people in your organization understand the risks associated with various wireless technologies.  All wireless systems, from the presentation remotes used by executives to wireless keyboards to connected HVAC systems should be evaluated;
  • Build skills in hardware: Since a lot of emerging wireless attacks builds on the ability to repurpose hardware systems, it's a very good idea to build some skills with hardware attacks using tools such as the GoodFET, bus sniffing tools such as the TotalPhase Beagle, logic analyzers, etc.  More and more, attacks will start with customized hardware when targeting proprietary systems.
  • Participate in emerging projects: Keep an eye on projects such as KillerBee, UberTooth and GoodFET.  We'll continue to see interesting attacks and new techniques using these tools against non-WiFi systems.
  • Grow your analysis skills: Make sure you can adapt your analysis skills to wireless technology beyond WiFi including protocol analysis, exploiting cryptographic failures, data decoding and analysis, authentication failures and more.

If you are interested in picking up skills like this, a great way to pick up them up is in  the upcoming SANS vLive! session for SEC617, starting April 19.  From 7-10pm ET two days a week for 6 weeks I'm live teaching the course with all the demos, interaction and hands-on lab exercises you get from a conference event.  For another few weeks when you sign up with the registration code "WISPY_VL" you'll get a free WiSpy DBx spectrum analyzer as well, a must-have for any wireless geek.

Wireless attacks are changing, and we know that attackers are leveraging wireless creatively beyond exploiting weak WiFi networks.  Don't miss the chance to be at the forefront of this changing landscape.


March 27, 2011   Posted in: Uncategorized  No Comments

Pen Test Perfect Storm 6: We Love Cisco!

Today, Kevin Johnson, Ed Skoudis and I delivered the 6th part of the Pen Test Perfect Storm Trilogy: We Love Cisco!.

In the webcast, hosted by CORE Security Technologies, we discussed attack techniques against Cisco devices, combining wireless, network and web app techniques to exploit common network architectures. Topics include:

  • Enumerating SNMP Community strings
  • Retrieving Cisco router or switch configurations over SNMP
  • History of vulnerabilities in the Cisco Wireless LAN Controller
  • Exploiting Cisco Web App interfaces with Burp Proxy and Burp Intruder
  • Exploiting Cisco Voice VLAN's with voiphopper
  • A practical scenario, combining network, wireless and web app attack techniques

CORE is busy putting together the recording that you can download and watch at your leisure, but in the meantime you can grab the slides in the Presentations section, or directly here. All past presentations in PDF form are also available in the presentations section, or at the CORE Security Technologies webcast archive page.

Thanks to all who attended the webcast today!


March 23, 2011   Posted in: Cisco, Penetration Testing  No Comments

ISACA Review: Hacking Exposed Wireless 2nd Edition

Hacking Exposed Wireless 2nd Edition CoverA special thanks to Horst Karin for posting a great review of my new book, Hacking Exposed Wireless 2nd Edition on the ISACA website.

If you haven't already checked it out, you can browse the book through Amazon's Page Viewer. For the first time in print, we provided an in-depth coverage of attacking and exploiting WiFi as well as ZigBee, Bluetooth and DECT technology in the approachable and understandable Hacking Exposed style.

Be sure to check out our companion website to grab the online content and associated files for download.


December 9, 2010   Posted in: 802.11, Bluetooth, Exploit, Hacking, Linux, OSX, Penetration Testing, Security, ZigBee  One Comment

Packet Capture Payload Assessment

I posted an article over at on evaluating packet captures to determine if the traffic is encrypted using my pcaphistogram tool, or the magic of Scapy and Ent. Check it out.


November 29, 2010   Posted in: Packets  No Comments

GIAC GAWN Ethical Hacking Wireless Testing Aid

David Cash, one of my fabulous Ethical Hacking Wireless students in my SANS vLive! class, has been diligently working every week to maintain a comprehensive index and table of contents for all 6 days of course material. Not only is he a whiz at pwning wireless, he's pretty good at indexing, too.

David agreed to share this resource with his fellow students as a GIAC GAWN testing aid. For the GIAC exam for the Ethical Hacking Wireless class (GAWN), you are able to bring in any printed resource to the testing center. This includes all your books, hand-written notes, reams of whatever you printed from Wikipedia, etc.

With this resource, you'll be able to leverage your time answering questions more effectively. Organized by day/module/page#, this is a must-have resource for anyone taking the GAWN exam.

My sincere thanks to David for putting this resource together, and for being an awesome student in the vLive! SEC617 class. You can download the index material here.


NB: This index will be useful for anyone taking the exam who has *already* taken the class on the date this note is posted (8/6/2010). Students taking the class after this date will get an updated version of the course with new material, making the topic references inaccurate. Thanks!

August 6, 2010   Posted in: Administrative  2 Comments

Reflections on “hole196″

Last week at BlackHat, AirTight Networks security analyst Md Sohail Ahmad presented his findings on a vulnerability dubbed "hole196". Affecting WPA/WPA2 Enterprise networks, this issue allows an authenticated user to manipulate other clients on the network to establish ARP spoofing attacks, to impersonate data frames from the AP or to create a DoS attack against other users. This is all through leveraging a key shared among all of the authorized clients in a wireless LAN known as the Group Temporal Key (GTK). The "hole196" bit refers to page 196 of the IEEE 802.11-2007 specification indicating that the GTK does not prevent packet forgery attacks (from an insider).

The BlackHat presentation slides were distributed on the BlackHat conference CD, and since the slides lack any kind of a copyright notice, I think it's OK for me to mirror them here.

Initially, this flaw had some people concerned, since an early article published by Network World and Joanie Wexler indicated:

Clients who receive the message see the client as the gateway and "respond with PTKs", which are private and which the insider can decrypt, Ahmad explains.

If this attack could get a client to reveal their PTK, even requiring that the attack start from an insider perspective, then I'd be coding up an exploit tool instead of writing this post. This, however, appears to be a misquote by Wexler, or a misunderstanding by Ahmad. No-one has clarified this quote as far as I have seen.

The truth behind this issue is that, well, it's a non-issue for most organizations. Instead of mounting an ARP spoofing attack to implement a man-in-the-middle (which a wired IDS could detect), it can be done using this technique within the encrypted wireless network, evading network IDS detection. The best way to detect this attack is through a wireless IDS, of which AirTight is a leading vendor ("Yay, Capitalism!").

When significant wireless attacks emerge, I call my customers to remind them that I do get let out of my cave every now and then, and to help them understand their exposure to the attack. I don't believe "hole196" falls into the category of significant wireless attack, so it's back to the cave I go.

For a 2nd perspective, and an excellent technical write-up, please see Glenn Fleishman's article over at Ars Technica. In the meantime, contact me with any questions/concerns/comments.


August 3, 2010   Posted in: 802.11, Uncategorized  2 Comments

Evading IPS/IDS with TCP Checksum Forgery

Judy Novak, one of my early mentors and good friends, has posted an excellent article at on manipulating IPS/IDS with TCP checksum forgeries. She also details the effect of this crafty manipulation to Snort with great examples you can use on your own IPS/IDS.

TCP Checksum Forgery Example

Check out her article, and also check out the Scapy class she wrote for the SANS Institute. If you want to be a packet ninja, mastering Scapy with Judy will get you there fast.


August 1, 2010   Posted in: Defending, Hacking  Comments Closed