36C3: All Wireless Stacks Are Broken

-

Your cellphone is the least secure computer that you own, and worse than that, it’s got a radio. [Jiska Classen] and her lab have been hacking on cellphones’ wireless systems for a while now, and in this talk gives an overview of the wireless vulnerabilities and attack surfaces that they bring along. While the talk provides some basic background on wireless (in)security, it also presents two new areas of research that she and her colleagues have been working on the last year.

One of the new hacks is based on the fact that a phone that wants to support both Bluetooth and WiFi needs to figure out a way to share the radio, because both protocols use the same 2.4 GHz band. And so it turns out that the Bluetooth hardware has to talk to the WiFi hardware, and it wouldn’t entirely surprise you that when [Jiska] gets into the Bluetooth stack, she’s able to DOS the WiFi. What this does to the operating system depends on the phone, but many of them just fall over and reboot.

Lately [Jiska] has been doing a lot of fuzzing on the cell phone stack enabled by some work by one of her students [Jan Ruge] work on emulation, codenamed “Frankenstein”. The coolest thing here is that the emulation runs in real time, and can be threaded into the operating system, enabling full-stack fuzzing. More complexity means more bugs, so we expect to see a lot more coming out of this line of research in the next year.

[Jiska] gives the presentation in a tinfoil hat, but that’s just a metaphor. In the end, when asked about how to properly secure your phone, she gives out the best advice ever: toss it in the blender.



from CommaFeed - Real Time Trends Network https://ift.tt/2F6epFV
via IFTTT

Comments

Post a Comment

Popular posts from this blog

Takeaways from the outcry over Dior’s Johnny Depp perfume ad: Tuesday Wake-Up Call

-
Welcome to Ad Age’s Wake-Up Call, our daily roundup of advertising, marketing, media and digital news. You can sign up to get an audio version of this briefing on your Alexa device. Dior pulls a perfume ad starring Johnny Depp Yet another luxury brand just had to backtrack after a culturally insensitive move. Dior on Friday pulled an ad for its “Sauvage” perfume, as Business of Fashion reports ; the spot starred Johnny Depp playing guitar in the desert while a Native American dancer, Canku One Star, performed in traditional dress. The company portrayed the spot as “an authentic journey deep into the Native American soul.” But the brand was quickly accused of cultural appropriation. Critics seemed most troubled by the juxtaposition of Native American imagery with the word "Sauvage"—which means “wild” in French, but which also evokes the history of labeling indigenous groups as “savages.”  LVMH-owned Parfums Christian Dior had apparently tried to proceed cautiously. It coo
Read more

When the coronavirus infodemic strikes

-
Image
Social media sites are stepping up their efforts in the war against misinformation… specifically, the coronavirus/COVID-19 infodemic . There’s a seemingly endless stream of potentially dangerous misinformation flying around online related to the COVID-19 pandemic, and that could have fatal results. It’s boomtown in fake-news land riding high on the wave of people being left with their tech devices 24/7. I myself regularly see everything posted online from “hand gel is an immunizer” (nope) and “children can’t be affected” (not true) to “UK rules mean domestic abuse survivors have to stay with their abusive spouse” (absolutely not true at all and hugely dangerous to claim).  We even have engineers being spat on thanks to 5G conspiracy theories potentially resulting in transmission of coronavirus . Turns out a global pandemic is a lightning rod for pushing people to conspiracy theories galore, to the extent that some folks have to go hunting for guides to wean their family members a
Read more

Patch, Or Your Solid State Drives Roll Over And Die

-
Image
Expiration dates for computer drives? That’s what a line of HP solid-state drives are facing as the variable for their uptime counter is running out. When it does, the drive “expires” and, well, no more data storage for you! There are a series of stages in the evolution of a software developer as they master their art, and one of those stages comes in understanding that while they may have a handle on the abstracted world presented by their development environment they perhaps haven’t considered the moments in which the real computer that lives behind it intrudes. Think of the first time you saw an SQL injection attack on a website, for example, or the moment you realised that a variable type is linked to the physical constraints of the number of memory locations it has reserved for it. So people who write software surround themselves with an armoury of things they watch out for as they code, and thus endeavour to produce software less likely to break. Firmly in that arena is the size
Read more