I’m en-route to the SANS Orlando 2011 conference, getting ready to teach SEC617 Ethical Hacking Wireless. I’m really excited about some new material and a changing focus on the SEC617 course.
Over the past couple of years we’ve seen a definite change in wireless hacking techniques and tools. While we are still seeing attacks against weak deployments of WPA/WPA2 and EAP-based authentication protocols, more and more wireless attacks are targeting “other” wireless protocols.
ZigBee
For the past year I’ve been spending a good deal of time working on the KillerBee suite of tools, designed to target weaknesses in IEEE 802.15.4 and ZigBee networks. This has been a lot of fun, and interestingly has spawned other projects taking the KillerBee framework and extending it to new tools, such as the ZigBee-Security project, as well as upcoming integrated tools in the KillerBee repository (special thanks to Ryan Speers and Ricky Melgares for their awesome work!). In addition, a recent project published at Blackhat Europe aims to develop some additional IEEE 802.15.4 attack techniques with a useful GUI interface and extensible interface through the SenSys project.
ZigBee/IEEE 802.15.4 hacking is interesting because:
- It isn’t WiFi and there is a serious lack of security knowledge and analysis tools available to help people understand the threats and attack techniques;
- It interfaces with devices that often control kinetic systems, such as heating/cooling, mechanical systems, door lock controls and other juicy targets.
- Did I mention that it isn’t WiFi?
Interest in attacking ZigBee is going to continue with its vital involvement in Smart Grid efforts, home and business automation, medical devices and more. On top of that, hacking ZigBee and IEEE 802.15.4 is a lot of fun, and is reminiscent of early WiFi security deployments.
Bluetooth
On top of that, Bluetooth hacking is seeing a new significant supporter in the form of Mike Ossmann’s Ubertooth project. For many years, Bluetooth hacking has been very limited despite numerous vulnerabilities in the base specification and vendor implementations. The problem has always been the lack of a flexible hardware platform with which to sniff and transmit arbitrary packets on a Bluetooth network. With the custom and cost-effective hardware in Ubertooth however, we are going to see a new deluge of attack techniques against the Bluetooth networks that for years have been vulnerable without a big motivator to improve Bluetooth security.
Proprietary Wireless Attacks
In addition to attacks against ZigBee/IEEE 802.15.4 and Bluetooth, we are seeing lots of interesting attacks against proprietary wireless protocols, either through the use of Software Defined Radio tools such as the USRP, or through hardware hacking techniques. The concept here is that we leverage simple hardware devices to build our own attack tools, or re-purpose existing hardware for our own attack purposes.
Sometimes the tools we use come in funny colors. I call to your attention the IM-ME. Through the efforts of Dave’s Hacks, Travis Goodspeed and Mike Ossmann, we can take this Girl Power toy and turn it into a customized wireless hacking tool. The picture below shows its use in sniffing a 475 MHz project I’m working on with a colleague that we’ll debut sometime soon.
The picture of the left is my IM-ME interfacing with a GoodFET from Travis Goodspeed. The GoodFET provides a very flexible interface to interact with various circuits and components as well as a framework in Python controlling devices. Included in the GoodFET sources are scripts such as “goodfet.nrf”, which allows you to use the Nordic 2401L transceiver to interact with a bunch of interesting devices.
The Changing Wireless Attack Landscape
The bottom line is that, while WEP deployments are drying up as easy targets, wireless hacking is not slowing down. It’s not a good idea to rest with the security achievements of EAP/TLS and your Wireless IDS system, when attack techniques move to other areas where monitoring systems are nonexistent.
We can respond to the changing wireless attack landscape in several ways:
- Understand the risks: Make sure people in your organization understand the risks associated with various wireless technologies. All wireless systems, from the presentation remotes used by executives to wireless keyboards to connected HVAC systems should be evaluated;
- Build skills in hardware: Since a lot of emerging wireless attacks builds on the ability to repurpose hardware systems, it’s a very good idea to build some skills with hardware attacks using tools such as the GoodFET, bus sniffing tools such as the TotalPhase Beagle, logic analyzers, etc. More and more, attacks will start with customized hardware when targeting proprietary systems.
- Participate in emerging projects: Keep an eye on projects such as KillerBee, UberTooth and GoodFET. We’ll continue to see interesting attacks and new techniques using these tools against non-WiFi systems.
- Grow your analysis skills: Make sure you can adapt your analysis skills to wireless technology beyond WiFi including protocol analysis, exploiting cryptographic failures, data decoding and analysis, authentication failures and more.
If you are interested in picking up skills like this, a great way to pick up them up is in the upcoming SANS vLive! session for SEC617, starting April 19. From 7-10pm ET two days a week for 6 weeks I’m live teaching the course with all the demos, interaction and hands-on lab exercises you get from a conference event. For another few weeks when you sign up with the registration code “WISPY_VL” you’ll get a free WiSpy DBx spectrum analyzer as well, a must-have for any wireless geek.
Wireless attacks are changing, and we know that attackers are leveraging wireless creatively beyond exploiting weak WiFi networks. Don’t miss the chance to be at the forefront of this changing landscape.
-Josh