Forgot your password?
typodupeerror

Researcher Creates Handheld Hacking Tool 69

Posted by ScuttleMonkey
from the how-many-till-the-it-guy-snaps dept.
Kickball Notches writes "Immunity's Dave Aitel plans to start selling a portable hacking device equipped with hundreds of exploits. The wireless handheld, called Silica, comes equipped with more than 150 exploits from Canvas and an automated exploitation system that allows simulated hacking attacks from the palm of your hand. It supports 802.11 (Wi-Fi) and Bluetooth wireless connections and is based on Linux."
This discussion has been archived. No new comments can be posted.

Researcher Creates Handheld Hacking Tool

Comments Filter:
  • Nifty (Score:5, Interesting)

    by daveschroeder (516195) * on Wednesday August 16, 2006 @05:04PM (#15922628)
    Something like this could be easily used in conjunction with vulnerabilities like the recent Atheros 802.11 wireless device driver exploit. Of course, many wireless attacks like this will still be targeted, and won't be widespread, because of one huge reason: proximity. Even the co-discoverer of the Atheros driver vulnerability, David Maynor, said:

    The thing to keep in mind here is that this really isn't a problem yet. You won't see any WLAN viruses' base on driver level exploits any time soon for one very important reason, proximity. We wanted these issued raised and fixed before the distance of a wifi connection for your average user will be measured in kilometers instead of the meters it is today.

    Don't go rip your wifi cards out just yet, but you should always adhere to good security techniques. Even without a driver level exploits man-in-the-middle attacks over wifi networks are a threat that you can mitigate by doing things like verifying the SSL certs for things you can connect to and don't do anything you want to remain personal or private over clear text on these access points. Also, for things like instant messaging, grab something like Adium X that supports encrypted IM conversations across multiple platforms. I know iChat does as well, but I am a big fan of something called OTR (http://www.cypherpunks.ca/otr/) which Adium supports.


    And no, this wasn't a "Mac OS X"(-specific) or "MacBook" vulnerability; it is a vulnerability in the Atheros driver code, which, according to the presenters themselves, is exploitable on other platforms, including Windows and Linux. Mac OS X was chosen to prove a point, and unfortunately the "point" that many ordinary people ended up getting was that all "MacBooks" and only "MacBooks" were vulnerable to some kind of scary 802.11 attack, and worse, that setting the machine to not auto-associate with access points would solve the problem (it doesn't). Some interesting points from a SecurityFocus mailing list about the Atheros exploit:

    * The exploit is running in kernel space and can do _anything_ it wants. It's not running as root because that would involve running under the kernel. In Intel terms, this is ring 0 stuff.

    * Firewalls, "preferred networks" and other OS-level mitigation is worthless. The packets don't have to contain any IP data, they are pure 802.11{b|g} frames. The OS doesn't see the packet because it would have to get past the (exploited) device driver.

    * The exploit doesn't require associating to an AP, being associated to an AP, anything. It just requires the wireless device to be on.


    What this really illustrates is that when you let third-party, proprietary, unaudited code into a privileged capacity on an OS, it could indeed be an avenue for attack.

    And now that attack can come from a dedicated device running in someone's pocket. ;-)

    (Personally, I see no reason why hardware device makers should keep driver code proprietary, much less the hardware specifications needed to produce an open source driver. After all, isn't their bread and butter the hardware itself?)

    This device could also associate with a wireless access point normally, and launch penetration tests against any hosts reachable on the network as well. TFA notes that the device is also equipped with ethernet and USB connectivity as well. Sounds like a neat little device, that could have other functionality as well.
    • I see this as being very useful in big cities where warwalking [wikipedia.org] is easy. Imagine the data you could gather by walking around Manhatten for a day with this device. I know that a while back 2600 made a color-coded map of open/secured wifi APs in Manhatten, but it would be even more interesting to learn which of those APs are suceptible to different attacks.

      It is especially important to note the Bluetooth abilities in this context. IF properly tweaked, one hacker could wander around a major public event and

      • Functionality errors and UI issues mostly. In terms of security it's just a Linux on ARM with SSHD turned off. CANVAS itself is pure Python, so although there may be overflows in there somewhere, it's not going to be an every-day occurance.

        The Nokia 770, the Sony Mylo, and the Trolltech Greenphone are just the start of how Linux + Wifi + mobile devices are going to change the world, imho. If you've done your development correctly you can do a LOT on these devices in very little time. It's the perfect thing
        • Dave,

          Since you're here: why such a high price-tag? I'd say that it's to prevent kiddies from using it, but I'm curious whether the cost of putting it together would be so high.

          Anyway, congrats on the good idea.
          • by daveaitel (598781)
            Because there's a lot of boring work that has to go into something like this, which means Immunity has to pay someone to do it, hence, we have to charge money to get it out the door.

            Imagine buying a thousand cheese sandwhiches, adding a garnish, and shipping them to people all around the world. Not cheap! And you didn't have to do any advertising or hire people to answer phone calls from customers who don't know which hole a sandwhich goes into, document all the parts of your sandwhich for people who like t
      • by HTH NE1 (675604) on Wednesday August 16, 2006 @06:43PM (#15923240)
        I see this as being very useful in big cities where warwalking is easy. Imagine the data you could gather by walking around Manhatten for a day with this device.

        Forget warwalking, think about warsmailing (war snail-mailing). Activate one of these devices and drop it in at the post office addressed to yourself. It'll ride in postal delivery vehicles, stopping in front of each house long enough to do some serious searching until it reaches yours. Then unwrap and see what you've harvested. Only cost is the postage and packing, virtually no gas or calories from you. Well, and the battery charge. Include a GPS device.

        It will help to be near the end of the delivery route. Maybe address it to a house that doesn't exist and it'll come back undeliverable (though it risks not coming back at all).

        Variations would be to use UPS, FedEx, etc., especially how their routing systems take it into interesting business areas. Route influencing could be done by including legitimate packages.

        If anyone does this, please let me know of the results. I don't have the ability to do this, so I'm putting it out there for others to try. I've only just thought of it. (I'll be Googling for "warsmailing".)

        Note: this opportunity will only last (in the US) until the DoHS decides that any packages with detectably active electronics or EM emissions must be intercepted and detonated, and they may be doing this already. Other countries may vary.
        • Dang you, now I have to get one of these. (and GPS) Hang on, wait a minute.... (MOM! Do I have a science fair project this year?)
          • by everett (154868)
            I'd hope you're a middle school or high school student, but I fear you may be a Ph.D candidate this being Slashdot. (Not that there is anything wrong with being 27 and still living with Mom and Dad.)
        • by Kadin2048 (468275)
          I had actually thought about doing something similar a while back. Actually I didn't want to do wireless transmit at all, I just wanted to mail a GPS receiver around and see if it picked up any sort of a trail.

          My main question is whether it would ever get much of a GPS signal. You could spend an awful lot of time and money putting together a project like that, only to have it spend its entire journey in steel-roofed buildings and metal trucks where it can't hear the satellites and not get any position fixes
        • by Kamineko (851857)
          I don't think I'll be smailing a $3,000 hackamajigger any time soon.


          When somebody invents a self booting open-source pen testing suite which you can lop on a cheap laptop, then I'll warsmail for you all you like. (Although, folks will typo with warm-sailing, so be aware ;)

    • by Ungrounded Lightning (62228) on Wednesday August 16, 2006 @05:30PM (#15922831) Journal
      You won't see any WLAN viruses' base on driver level exploits any time soon for one very important reason, proximity.

      One of the proposed uses is to turn it on and mail it to the site in question. It can perform "tests" (including man-in-the-middle attacks) "while sitting on the CEO's desk".

      Or in the mail rooom. On in the inbox of somebody on vacation.

      Of course that means it (or a similar device) could be shipped in the same way. It could run for a couple weeks (or until the battery is exhausted), rooting around the company's wireless LAN and shipping the result out the internet to the attacker's safe drop. Then (or when the package it opened) it could purge its own software and self-destruct or turn itself into something innocent appearing, such as a promotional toy. (Perhaps it could sucker somebody into recharging it.) Or it could be built into some other object and never discovered.

      If the IT staff isn't on the edge of their seats about searching for rogue WiFi devices and/or sniffing network traffic it could have weeks to work undetected. Even if they ARE on the ball and have the cutting-edge stuff it can snag a lot of interesting stuff at computer speeds in the time it takes to hunt it down and kill it or succesfully cut it off from all outside contact (including masquerading as a legitimate device).
      • by SatanicPuppy (611928) * <Satanicpuppy@gm[ ].com ['ail' in gap]> on Wednesday August 16, 2006 @06:02PM (#15923018) Journal
        Couple of weeks? For a wifi enabled hand held device? Where the hell do you buy your batteries?!?

        Unless it gets hooked up to some kind of battery array, I think we can safely peg the window for this thing at 24 hours at the extreme outside, though it's probably less than 12.

        Now, depending on how smart it is, you could have it come up for 5 or 10 minutes at a certain time when you know something good will be available (e.g The boss syncs his pda), but it would have to be some cron-esque computer scheduled job, and I'm not sure why any environment (other than maybe a retail environment) would be running a regular job across wireless.

        I think it'd be much more effective for the old Delivery Guy trick; something to keep in your pocket while you wander through the office, looking for someone to deliver your package to...Though I don't know how it is in other places, but where I work everything gets signed for in front, and a guard brings you your package. Of course, we don't use wireless either, so that's two for two.
        • I can get about 16-20 hours of runtime using wifi on my iPAQ H2215 with the extended battery; something like 24 hours of runtime while playing music and/or watching movies without wifi being on. (I have a sandisk 128MB CF+Wifi - it has no internal wifi.) Using something about the capacity and size of a laptop battery would definitely let you get obscene amounts of runtime. My iPAQ is nowhere near the most efficient PDA, either.
          • Can't find anything like technical specs on it, but its described as being "slightly larger than a regular pda", which seems like it would definitely require external battery to get above a day of uptime.

            I wonder as well about broadcast power vs battery life...In strictly passive mode it wouldn't matter, but trying an active MiM attack, you'd need to be broadcasting pretty strongly not to have the existing signal drown you out.
            • by Amouth (879122) on Wednesday August 16, 2006 @06:44PM (#15923253)
              you are thinking of sitting there and using it..

              if you don't have the screen on or the back light you can run for over a day and more if you only run wifi or bluetooth...

              i have a dell axim x30 with the extended battery - internal wifi .. i have turned on the wifi and logged into aim and forgot.. it went to sleep (cut the screen off) but it kept the wifi going.. came back to it a day later and the battery was at around 30-40

              if you design something to last you can pull it off..
    • Re: (Score:2, Informative)

      by BootNinja (743040)

      (Personally, I see no reason why hardware device makers should keep driver code proprietary, much less the hardware specifications needed to produce an open source driver. After all, isn't their bread and butter the hardware itself?)

      As far as wireless cards go, what I have heard is that many of the wireless manufactureres will not release proper specs because transmission strength is soft-coded into the driver. an open source driver would allow people to increase the strength of the signal broadcast by th

    • Closed source device (Score:3, Informative)

      by DrYak (748999)

      Personally, I see no reason why hardware device makers should keep driver code proprietary, much less the hardware specifications needed to produce an open source driver. After all, isn't their bread and butter the hardware itself?

      Hardware *was* those companies' bread and butter a long time ago, when hardware was a big bunch of complicated dedicated chip cummunicating together. All the secret was in the hardware. And due to the diversity of OSes back then, a company had better to show specification in order

  • CmdrTaco said:

    No MIMO-G. Less space than a nomad. Lame.
  • by Devv (992734)
    I'm confused. I can't really see why this is much use except for hacking things with wifi but no internet connection and the like or what? And it gives a cool 007 look that no noe should give a crap about. Look I can hack while eating lunch at Mac Donald's with my ready to use exploits! I'm a genious!
  • The articles headline is "'Pen' Testing in the Palm of Your Hand". Wikipedia [wikipedia.org] describes pen testing as "a method of evaluating the security of a computer system or network by simulating an attack by a malicious cracker. The process involves an active analysis of the system for any weaknesses, technical flaws or vulnerabilities. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities."

    For real 'pen testing', stick with what a
  • Someone at the FTC, FCC and BSA has to check for alt.2600 postings and such...?
  • Good. (Score:1, Funny)

    by Anonymous Coward
    I'm buying one of these tools and super-gluing it to my TV B Gone [google.com]. Then I'm going to walk into CNN headquarters and completely change the way America gets her news.
    • I'm buying one of these tools and super-gluing it to my TV B Gone. Then I'm going to walk into CNN headquarters and completely change the way America gets her news.
      Stopping Government propaganda in this manner would certainly be an act of terrorism.
    • You'll have much better luck with one of these Hacking Devices [wikipedia.org].
  • by Esion Modnar (632431) on Wednesday August 16, 2006 @05:17PM (#15922731)
    a machete. TIBHAW,TTV.
  • by Anonymous Coward

    (...) Immunity's Canvas product to allow security professionals to conduct pen tests while walking through office cubicles.

    Since it's a pen-based device, should the users of this product be classified as "script kiddies"?

    Don't delay! Buy now! The first 10 buyers will also receive an official Immunity Canvas' McGyver Swiss Army knife* (with lock-picking add-ons) and a t-shirt bearing the sentence "Look, mom: I'm a hacker!" in the front and "kick me" in the back.

    * Parents: this is a safe product; to prevent i

  • by Lxy (80823) on Wednesday August 16, 2006 @05:20PM (#15922754) Journal
    The article doesn't specify details, but it sounds like what you can do with a Sharp Zaurus. You need to be selective, but you can get linux running with something like metasploit without too much effort. This unit's got more RAM and disk I'm sure, but it's hardly revolutionary.
  • by wwiiol_toofless (991717) on Wednesday August 16, 2006 @05:21PM (#15922760)
    it's called a hatchet. (Thank you, I'll be here till 5, be sure to tip your admin!)
  • by StikyPad (445176) on Wednesday August 16, 2006 @05:24PM (#15922780) Homepage
    Not to be confused with Insomniac's Dave Attell [amazon.com], although both equally fond of the back door.
  • by Anonymous Coward
    ...Oh, never mind.
  • ...not as cool as the one the Warbears use [newgrounds.com] .
  • Finally a feature from movies becoming reality ;-)
  • Good portable device (Score:3, Interesting)

    by identity0 (77976) on Wednesday August 16, 2006 @05:54PM (#15922964) Journal
    I'm actually looking for a good mobile device right now, which doesn't have to have these security tools, but be a general-purpose geek tool. Unfortunately, I've yet to find a good one. It seems most companies are trying to woo consumers with flashyness and power instead of mobile usefulness.

    What I want is a portable device the size of the old Libretto or Picturebook, with all the modern memory card type slots, wi-fi, ethernet, phone, USB, Firewire, PC-card, and anything else needed to interface with common devices and perhipherals. I don't want to have to carry a bunch of dongles and USB cables to use common hardware I might run into. I don't want a fast processor and memory, I just want the hardware interfaces and the longest possible battery life in a very small package.

    All the mini-notebook makers out there seem intent on trying to cram as much processor power and memory into a small package, which incidentally results in them running so hot they could burn you, and shortens battery life to lunch-break length. What are you going to do with a Athlon 64, play WoW on a 8-inch screen?

    *sigh* maybe this device will be different, but seeing as how it says "Currently it supports 802.11 (Wi-Fi) and Bluetooth wireless connections or optionally Ethernet via USB", it doesn't sound like it.
  • I saw this at Defcon in the Immunitysec booth. Dave had some nice demos going on, and he was also showing off
    Visualsploit http://www.immunitysec.com/documentation/vs_niprin t.html [immunitysec.com]

    Silica is a full port of Canvas onto the Nokia, not "allows simulated hacking attacks", instead "full exploitation framework".

    Canvas licensing creams Core Impact (3kish vs. 30k).
  • by xtaski (457801)
    Next they'll have a Windows version: it will come preloaded with 150 viruses, worms, and network security tools. Just put it in your shirt pocket, walk through your office and infect coworkers' PCs.
  • positive? (Score:3, Interesting)

    by Fuzzums (250400) on Wednesday August 16, 2006 @06:12PM (#15923079) Homepage
    I don't know if "... and is based on Linux." is really that positive for the Linux reputation :)
  • if this is too widely used it could have a negative impact on computer security as people running penetration tests may get lazy and simply run through the tests that this handheld device supports rather than carrying out an exhaustive security analysis.
  • Sweet, now it is time for Deus Ex LARPing! Grab my crossbow and sunglasses and I'm set.
  • Pfft. I used hundreds of tools like this when I was in UNATCO way back in the 2050s [wikipedia.org].

    Multitools I think the were called.

  • I was just thinking today that, with the Max Media dock and Linux, you could do something like this on your DS lite. Not a lot of practical use for the average user, but useful for comprehensive penetration testing.
  • Finally, I'll be able to run that damn gate bypass...
  • Didn't the **AA say that a while ago?

    Or, should I say HAXX0RZZ...

For every complex problem, there is a solution that is simple, neat, and wrong. -- H. L. Mencken

Working...