Check out the presentation for more fun details about Android, iOS, BlackBerry and Windows Mobile devices.  The next and final session in this trilogy will be at 1PM ET on July 19 titled "2012: A Mobile Penetration Test" where we'll be looking at techniques for exploiting mobile devices, and their associated infrastructure to evaluate the risks to your organization.

-Josh

-Josh

Q: Will I sign up to renew my Amazon Prime account when it expires?

A: YES!

-Josh

Over the past couple of years we've seen a definite change in wireless hacking techniques and tools.  While we are still seeing attacks against weak deployments of WPA/WPA2 and EAP-based authentication protocols, more and more wireless attacks are targeting "other" wireless protocols.

ZigBee

For the past year I've been spending a good deal of time working on the KillerBee suite of tools, designed to target weaknesses in IEEE 802.15.4 and ZigBee networks.  This has been a lot of fun, and interestingly has spawned other projects taking the KillerBee framework and extending it to new tools, such as the ZigBee-Security project, as well as upcoming integrated tools in the KillerBee repository (special thanks to Ryan Speers and Ricky Melgares for their awesome work!).  In addition, a recent project published at Blackhat Europe aims to develop some additional IEEE 802.15.4 attack techniques with a useful GUI interface and extensible interface through the SenSys project.

ZigBee/IEEE 802.15.4 hacking is interesting because:

1. It isn't WiFi and there is a serious lack of security knowledge and analysis tools available to help people understand the threats and attack techniques;
2. It interfaces with devices that often control kinetic systems, such as heating/cooling, mechanical systems, door lock controls and other juicy targets.
3. Did I mention that it isn't WiFi?

Interest in attacking ZigBee is going to continue with its vital involvement in Smart Grid efforts, home and business automation, medical devices and more.  On top of that, hacking ZigBee and IEEE 802.15.4 is a lot of fun, and is reminiscent of early WiFi security deployments.

Bluetooth

On top of that, Bluetooth hacking is seeing a new significant supporter in the form of Mike Ossmann's Ubertooth project.  For many years, Bluetooth hacking has been very limited despite numerous vulnerabilities in the base specification and vendor implementations.  The problem has always been the lack of a flexible hardware platform with which to sniff and transmit arbitrary packets on a Bluetooth network.  With the custom and cost-effective hardware in Ubertooth however, we are going to see a new deluge of attack techniques against the Bluetooth networks that for years have been vulnerable without a big motivator to improve Bluetooth security.

Proprietary Wireless Attacks

In addition to attacks against ZigBee/IEEE 802.15.4 and Bluetooth, we are seeing lots of interesting attacks against proprietary wireless protocols, either through the use of Software Defined Radio tools such as the USRP, or through hardware hacking techniques.  The concept here is that we leverage simple hardware devices to build our own attack tools, or re-purpose existing hardware for our own attack purposes.

Sometimes the tools we use come in funny colors.  I call to your attention the IM-ME.  Through the efforts of Dave's Hacks, Travis Goodspeed and Mike Ossmann, we can take this Girl Power toy and turn it into a customized wireless hacking tool.  The picture below shows its use in sniffing a 475 MHz project I'm working on with a colleague that we'll debut sometime soon.

The picture of the left is my IM-ME interfacing with a GoodFET from Travis Goodspeed.  The GoodFET provides a very flexible interface to interact with various circuits and components as well as a framework in Python controlling devices.  Included in the GoodFET sources are scripts such as "goodfet.nrf", which allows you to use the Nordic 2401L transceiver to interact with a bunch of interesting devices.

The Changing Wireless Attack Landscape

The bottom line is that, while WEP deployments are drying up as easy targets, wireless hacking is not slowing down.  It's not a good idea to rest with the security achievements of EAP/TLS and your Wireless IDS system, when attack techniques move to other areas where monitoring systems are nonexistent.

We can respond to the changing wireless attack landscape in several ways:

• Understand the risks: Make sure people in your organization understand the risks associated with various wireless technologies.  All wireless systems, from the presentation remotes used by executives to wireless keyboards to connected HVAC systems should be evaluated;
• Build skills in hardware: Since a lot of emerging wireless attacks builds on the ability to repurpose hardware systems, it's a very good idea to build some skills with hardware attacks using tools such as the GoodFET, bus sniffing tools such as the TotalPhase Beagle, logic analyzers, etc.  More and more, attacks will start with customized hardware when targeting proprietary systems.
• Participate in emerging projects: Keep an eye on projects such as KillerBee, UberTooth and GoodFET.  We'll continue to see interesting attacks and new techniques using these tools against non-WiFi systems.
• Grow your analysis skills: Make sure you can adapt your analysis skills to wireless technology beyond WiFi including protocol analysis, exploiting cryptographic failures, data decoding and analysis, authentication failures and more.

If you are interested in picking up skills like this, a great way to pick up them up is in  the upcoming SANS vLive! session for SEC617, starting April 19.  From 7-10pm ET two days a week for 6 weeks I'm live teaching the course with all the demos, interaction and hands-on lab exercises you get from a conference event.  For another few weeks when you sign up with the registration code "WISPY_VL" you'll get a free WiSpy DBx spectrum analyzer as well, a must-have for any wireless geek.

Wireless attacks are changing, and we know that attackers are leveraging wireless creatively beyond exploiting weak WiFi networks.  Don't miss the chance to be at the forefront of this changing landscape.

-Josh

In the webcast, hosted by CORE Security Technologies, we discussed attack techniques against Cisco devices, combining wireless, network and web app techniques to exploit common network architectures. Topics include:

• Enumerating SNMP Community strings
• Retrieving Cisco router or switch configurations over SNMP
• History of vulnerabilities in the Cisco Wireless LAN Controller
• Exploiting Cisco Web App interfaces with Burp Proxy and Burp Intruder
• Exploiting Cisco Voice VLAN's with voiphopper
• A practical scenario, combining network, wireless and web app attack techniques

CORE is busy putting together the recording that you can download and watch at your leisure, but in the meantime you can grab the slides in the Presentations section, or directly here. All past presentations in PDF form are also available in the presentations section, or at the CORE Security Technologies webcast archive page.

Thanks to all who attended the webcast today!

-Josh

If you haven't already checked it out, you can browse the book through Amazon's Page Viewer. For the first time in print, we provided an in-depth coverage of attacking and exploiting WiFi as well as ZigBee, Bluetooth and DECT technology in the approachable and understandable Hacking Exposed style.

Be sure to check out our companion website to grab the online content and associated files for download.

-Josh

-Josh

David agreed to share this resource with his fellow students as a GIAC GAWN testing aid. For the GIAC exam for the Ethical Hacking Wireless class (GAWN), you are able to bring in any printed resource to the testing center. This includes all your books, hand-written notes, reams of whatever you printed from Wikipedia, etc.

With this resource, you'll be able to leverage your time answering questions more effectively. Organized by day/module/page#, this is a must-have resource for anyone taking the GAWN exam.

My sincere thanks to David for putting this resource together, and for being an awesome student in the vLive! SEC617 class. You can download the index material here.

-Josh

NB: This index will be useful for anyone taking the exam who has *already* taken the class on the date this note is posted (8/6/2010). Students taking the class after this date will get an updated version of the course with new material, making the topic references inaccurate. Thanks!

The BlackHat presentation slides were distributed on the BlackHat conference CD, and since the slides lack any kind of a copyright notice, I think it's OK for me to mirror them here.

Initially, this flaw had some people concerned, since an early article published by Network World and Joanie Wexler indicated:

Clients who receive the message see the client as the gateway and "respond with PTKs", which are private and which the insider can decrypt, Ahmad explains.

If this attack could get a client to reveal their PTK, even requiring that the attack start from an insider perspective, then I'd be coding up an exploit tool instead of writing this post. This, however, appears to be a misquote by Wexler, or a misunderstanding by Ahmad. No-one has clarified this quote as far as I have seen.

The truth behind this issue is that, well, it's a non-issue for most organizations. Instead of mounting an ARP spoofing attack to implement a man-in-the-middle (which a wired IDS could detect), it can be done using this technique within the encrypted wireless network, evading network IDS detection. The best way to detect this attack is through a wireless IDS, of which AirTight is a leading vendor ("Yay, Capitalism!").

When significant wireless attacks emerge, I call my customers to remind them that I do get let out of my cave every now and then, and to help them understand their exposure to the attack. I don't believe "hole196" falls into the category of significant wireless attack, so it's back to the cave I go.

For a 2nd perspective, and an excellent technical write-up, please see Glenn Fleishman's article over at Ars Technica. In the meantime, contact me with any questions/concerns/comments.

-Josh

Check out her article, and also check out the Scapy class she wrote for the SANS Institute. If you want to be a packet ninja, mastering Scapy with Judy will get you there fast.

-Josh