The Black Hat Wi-Fi Exploit 129
Joe Barr writes to tell us that while many have heard that an Apple was exploited in order to install a rootkit at the recent BlackHat security conference, most people don't know the details of how it works. This is no mistake, it seems that the researchers who demonstrated the flaw were intentionally vague. Some theorize that this is in response to the real or perceived threat of legal action similar to the situation with previous Blackhat presenter, Michael Lynn.
Video of the exploit (Score:2, Informative)
Re:Still fishy... (Score:2, Informative)
Not an apple wifi card. (Score:2, Informative)
So, which card was it? Considering that most companies only threaten legal action, and researchers usually ignore the threats, a good guess that this is a company that is known to not only threaten. One that ISS had problems with before. In short: I bet it was a Cisco card. Not an apple card but a Cisco one.
Was it root (Score:3, Informative)
My main reason for believing that he had the logged in user's access is due to the fact that wireless is not system wide on Apple, but is started when a user logs in. If you change users(fast user switching etc...) then all your network connections drop as the wireless is restarted with the new user.
Re:This seems a bit misleading... (Score:3, Informative)
Re:Was it root (Score:1, Informative)
Re:Was it root (Score:3, Informative)
Re:This seems a bit misleading... (Score:5, Informative)
You can throw money at me instead, if you feel the need.
Methods of Disclosure (Score:3, Informative)
I'm not buying the people who are upset at a lack of full disclosure because they are "unable to protect themselves". If there was a way to protect yourself, sure, perhaps you could tell people how to do it. However, judging from the presentation itself (at Defcon), there really IS no way other than mutilation of the driver itself (see the slide with the nintendo DS) to quickly defend one's system. Not only would this significantly break a lot of things, most users wouldn't know the first thing about doing it.
The root causes as outlined in the presentation were a combination of a poorly planned and thought out protocol (802.11) and a quick-to-market rash of sloppy driver implementations, and it's going to take nothing less than at least a driver patch (or in a fantasy world, an overhaul of existing wireless protcools...802.11 lite if you will).
So quit accusing the presenters of being motivated by greed, stupidity, or other such notions - the best way to secure users at this point is to speak with the manufacturers directly and attempt to achieve a patch, not to detail how to break in to every last miscreant on the planet. The authors are starting to do this by their dealings with Apple.
Oh, and for those of you that missed the FAQ at the end of the presentation:
-Yes, it affects the kernel, which means it's >= root/Administrator on any system
-It's a driver/spec implementation issue, which means it's not an OS-specific problem. The use of an Apple machine in order to show that "any" platform is at risk was meant to illustrate this.
-The money slide was a joke meant to show how lightly many people were taking this issue. I have no way of proving the intentions of the presenters, of course, but I believe this was the case - they stated their intention was to get this problem addressed through discussion, not money.
All in all, easily my favorite defcon session (unless you count the shots of 151 distilled through peppers). Thanks, guys!
Re:what a load of crap (Score:2, Informative)
I've got a Sonnet PCMCIA card in my PB400Mhz who's chipset is the same as the Apple Extreme Card, when I plug it in, it's found as an AirPort card and I had nothing to install to make it work!
Sad thing is, it's supposed to work on Windows 98/ME/2K/XP, but I did'nt manage to do so yet!
When to disclose exploits (Score:3, Informative)
This exploit was kept underwraps to allow vendors to release security fixes before the exploit spreads to every two-bit kiddy scripter around. It doesn't make much sense releasing information on how to implement this exploit when there really isn't too much you can do to stop it. It's the reason why the presentation was done on video and not live.
Of course, once the exploit is known to exist, it is only a matter of time before someone else finds it and implements it. I already know at least one person who is on his way to duplicate it, so the vendors better hurry up and fix the security hole. Apple and Microsoft can't take their merry ol' time fixing this one.
Re:Atheros at the exploiter side? (Score:2, Informative)
Re:This seems a bit misleading... (Score:3, Informative)
For those attackers that can replicate the exploit, yes, it does. However, in some cases, it can be considered ethical to not release the information.
For example, I took a wireless security class led by Joshua Wright, who some may know as the creator of several wireless attack tools such as asleap and lorcon (the latter was used by these researchers). During the class and in a presentation during the week, he demonstrated several tools that he refused to release due to their ability to cause mischief. Some of them had clear legal liability -- a tool designed for use at for-pay hotspots, for example. Some of them he simply deemed too dangerous to be released, such as the Bluetooth PIN cracker that he demonstrated in the presentation. He did provide some information on each tool and vaguely how they worked, but not enough to recreate the exploits.
What he did do is present some mitigating steps, such as using IPSEC VPNs at hotspots, or using Bluetooth PINs of at least eight (and preferably 12 or more) digits in length (but since many device PINs cannot be set by their owners, people should at least be aware of the issue). The presenters did the same thing here, providing a work-around that mitigates the problem for the moment until the situation can be solved at a larger scale.
Re:This seems a bit misleading... (Score:3, Informative)
Re:Why not demo it on multiple platforms then? (Score:3, Informative)
So no, it's not speculation that exploitable on other platforms, because the presenters themselves said it was, and specifically said they ultimately chose to demo it on the Apple platform for the reason stated above.
On that note, though, I do agree that the reasoning to use a third-party wireless card in the MacBook was shaky. They said they used it so as not to draw attention to the fact that the internal wireless card in the MacBook is vulnerable, even though they specifically state that the internal card is vulnerable. So how does this do anything to not draw attention to that, given that now, everyone thinks this is an exploit affecting only MacBooks, and not even any other Apple products with the Atheros card, much less any other platform under the sun?
John Gruber has a very good writeup on this issue here: http://daringfireball.net/2006/08/krebs_followup [daringfireball.net]
As for "why not demo it on multiple platforms", it sounds like this little exploit is not nearly as easy to set up and take advantage of as they imply. The above writeup also touches on the motives of the presenters as well ("if you watch those 'Get a Mac' commercials enough, it eventually makes you want to stab one of those users in the eye with a lit cigarette or something"). Yeah, no bias there!
Re:This seems a bit misleading... (Score:1, Informative)