Wardialing, then Wardriving... and now, Warshipping! - Page 1
Forum section: electronics / general

author: windsmurf
author_rank: Frequent Contributor
timestamp: August 08, 2019, 04:42:23 am
content: "Warshipping" is a new kind of security threat, tested by the IBM X-Field Red team, and proven effective for hackers. Basically they ship a box with a hidden device (they used a battery-powered Raspberry Pi Zero W and IoT modem).https://securityintelligence.com/posts/package-delivery-cybercriminals-at-your-doorstep/

author: coppercone2
author_rank: Super Contributor
timestamp: August 08, 2019, 05:19:36 am
content: not for just the FBI anymoreon the other hand, mailing a flammable battery in cased in cardboard.. is.. pretty irresponsible. Connected to a shitty device no less.They should bring these up on arson charges lol

author: JoeO
author_rank: Frequent Contributor
timestamp: August 08, 2019, 05:56:24 pm
content: There is a better picture here.https://techcrunch.com/2019/08/06/warshipping-hackers-ship-exploits-mail-room/Regarding the flammable battery: " Reminds me of the old "Mission Impossible" TV series. The package self destructs.I don't think a crook would care if he/she burned down a building.

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 08, 2019, 06:29:05 pm
content: Quote from: windsmurf on August 08, 2019, 04:42:23 amWifi is publicly accessible by nature. If someone can compromise you by shipping a connecting device to you you already were in deep trouble.

author: windsmurf
author_rank: Frequent Contributor
timestamp: August 08, 2019, 08:37:00 pm
content: Quote from: Mr. Scram on August 08, 2019, 06:29:05 pmMany organizations try to limit wifi signals to work just within their buildings by strategic access point placement, tuning power output of each access point, and doing signal assessments.What this new "attack" vector introduces is a shipping package that can penetrate the perimeter protection and into buildings to do its work.Additionally, this device can be configured to act as a rogue Internet access-point that unsuspecting internal user might find and connect to, and have all traffic captured then sent off to the C&C (command and control) server for deeper analysis.Additionally these can be fitted with a microphone to capture and transmit verbal communications occurring within earshot of the shipped package.

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 08, 2019, 08:53:23 pm
content: Quote from: windsmurf on August 08, 2019, 08:37:00 pmIt's essentially security by obscurity and that's not how it should work. Especially wifi should be considered accessible by anyone. Like encryption shouldn't depend on a lack of knowledge about how it works wifi shouldn't depend on physical access. Assume the world has access to your wifi signals because it does. None of this is anything novel or anything people haven't been dealing with in the real world. Companies are strewn across multiple levels in shared buildings and nowhere near neatly segmented into discrete units. Rogue APs are outright old hat. It's just a security researcher coming up with a form factor which tickles the imagination but in reality does nothing new. Not to mention you aren't exactly covert when you literally mail your hardware to the people you attack. It's not quite subtle and you leave a steaming pile of leads and traceable material. There's a fair chance it'll be construed as a bomb threat and the feds will be out looking for you.

author: coppercone2
author_rank: Super Contributor
timestamp: August 08, 2019, 10:35:27 pm
content: yes, crooks don't care, which is why the court should charge with reckless endangerment etc in addition to whatever hacking charges.. discourages behavior because punishment is more severenot every hacker is a insane gangster that does not care if they will do 20 years

author: james_s
author_rank: Super Contributor
timestamp: August 08, 2019, 11:38:23 pm
content: I don't think making the punishment more severe discourages anything at all. Even if it's just a slap on the wrist nobody does something if they think they'll be caught.Just look at piracy, the punishment if caught pirating movies and such is absurdly severe, and yet it's so widespread that it's hard to find anyone who has never done it. Somebody who thinks they're smart enough that they won't be caught doesn't give a rat's ass what the punishment is. It just makes the authorities look like a bunch of idiots making mountains out of mole hills.

author: windsmurf
author_rank: Frequent Contributor
timestamp: August 08, 2019, 11:59:21 pm
content: Quote from: Mr. Scram on August 08, 2019, 08:53:23 pmThe article brings into light another physical access attack vector to think about, which is the point of the article."Wardriving" requires a person to be at a location to intercept signals.With Warshipping, a single person or entity can mail hundreds of these boxes all over the world to hack and gather information at specific target locations, as well as throughout the entire journey of the package. The traceability of the package is not relevant to the additional security risk that the article brings to focus, if the hidden device is discovered at all as part of packing material.Sure, you can blame it on wifi (or its lack of security), but that's not the point.

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 09, 2019, 12:17:51 am
content: Quote from: windsmurf on August 08, 2019, 11:59:21 pmIt's very much the point! If one makes stupid assumptions it's going to end in tears sooner or later. A compromised employee or visitor phone, a quadcopter on the roof or a number of other ways of achieving the same have been viable for a long time if your signal can't be received outright in the street like it is in almost all cases. Some fiddling with antennas can vastly increase the range of a network to unpredictable numbers. The premise of having a nearby relay or malicious AP is far from original, though we haven't seen this exact interpretation as it's rather obtuse to begin with but jives with romantic Hollywood spy notions.

author: windsmurf
author_rank: Frequent Contributor
timestamp: August 09, 2019, 12:35:01 am
content: Quote from: Mr. Scram on August 09, 2019, 12:17:51 amUhh, so what is your point? That wifi is insecure, don't use it?Again, the point of the article is to bring to light that this viable vector exists for a single person or entity to attack numerous targets from a great distance.There's nothing technically new, and this articles does not state that there is.

author: james_s
author_rank: Super Contributor
timestamp: August 09, 2019, 12:42:23 am
content: His point I think is obvious. You should always assume that your wifi signal is accessible to absolutely anybody because in most cases it is. You secure it by other methods rather than worrying about trying to keep it contained to the building.

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 09, 2019, 12:46:30 am
content: Quote from: windsmurf on August 09, 2019, 12:35:01 amThe point I've been making from the start. Assume your wifi network is accessible by the world at large and secure it accordingly like any sane administrator would. No truckload of malicious devices delivered to your mail room should make a difference. Attacking numerous targets from a great distance isn't very new either. The internet has been around for a while.

author: coppercone2
author_rank: Super Contributor
timestamp: August 09, 2019, 01:22:05 am
content: Quote from: blueskull on August 09, 2019, 12:44:01 amat least its not hidden

author: NiHaoMike
author_rank: Super Contributor
timestamp: August 09, 2019, 03:14:56 am
content: Quote from: james_s on August 08, 2019, 11:38:23 pmNot sure how movie piracy is most commonly done nowadays, but I'm under the impression that music piracy is way down thanks to Youtube having legal uploads of songs, even music videos released by the record companies themselves. Getting rid of the ads is as simple as using an adblocker. Using a downloader is getting more into a "gray" area, but arguably still less risk than downloading pirate copies from questionable websites or Bittorrent. Of which, uploading pirate copies appears to be the most risky of all (definitely illegal in most if not all major countries) and a clear incentive to use an "anonymous" internet connection like a public hotspot for that activity.BTW, I remember a proof of concept for "piggybacking" credentials on captive portals. A Wifi device broadcasts an AP NATed to the original hotspot. When an unsuspecting user logs in through the device, it gets logged onto the network with that user's credentials. Then the device can do whatever it wants, its activity apparently traced to the victim user...Quote from: Mr. Scram on August 09, 2019, 12:17:51 amLate on proof of concept by about 2 years, if not more.

author: james_s
author_rank: Super Contributor
timestamp: August 09, 2019, 03:27:44 am
content: Quote from: NiHaoMike on August 09, 2019, 03:14:56 amSame way it's been done for a decade or more. Torrent sites are alive and well, and usenet is still widely used, mostly for that purpose now I think, I don't really know as I haven't touched usenet in ages. I don't have numbers but it's certainly widespread. The various streaming services have I'm sure done more to reduce piracy than any sort of legal tactics. The media industry is very, very slowly realizing that the way to combat piracy is to offer a paid product at a reasonable price that is as or more convenient than the pirated product.The threat of punishment never seemed to be much of a deterrent, that was really the only point I was going for.

author: NiHaoMike
author_rank: Super Contributor
timestamp: August 09, 2019, 03:50:20 am
content: Quote from: james_s on August 09, 2019, 03:27:44 amI suspect because there are so many ways to hide and make it far more difficult to get caught, so that the RIAA/MPAA go for easier targets. VPNs, Tor, public hotspots, other open APs, to name a few. Adding to that, downloading pirate content is/was apparently legal in some countries.

author: MyHeadHz
author_rank: Regular Contributor
timestamp: August 09, 2019, 04:34:57 am
content: Quote from: NiHaoMike on August 09, 2019, 03:50:20 amYeah.... like in the US.The way the DMCA works is that hosts (youtube, or generally any website where users publish files) are effectively immune to prosecution as long as they respond to DMCA requests. In practice, they can live for years even if they don't respond. Newer sites simply don't let google/etc index their files, just encrypt everything, or both. Neither the users nor the sites can be prosecuted for removed files. Then the files are promptly re-uploaded. All the responsibility theoretically gets diverted to the uploader, which is always behind a logless VPN or equivalent, so they cannot be traced or prosecuted. Piracy is effectively legal here for all but the lowest-hanging of the technically illiterate fruit, where they are subsequently slapped on the wrist with an inconsequential warning letter. (And that's a worst-case scenario- the vast majority never even get that.) Then they google how to do it properly and join the ranks.edit: And as for warshipping...There could be significant security issues with similar techniques given how the military deals with packages. Some ebay scams use their strict rejection policies to bounce hot merchandise around while its being sold, so they don't get caught with hot potatoes.

author: windsmurf
author_rank: Frequent Contributor
timestamp: August 09, 2019, 05:25:08 am
content: Quote from: Mr. Scram on August 09, 2019, 12:46:30 amOk, the part that I disagree with, is your assumption that "No truckload of malicious devices delivered to your mail room should make a difference. "At my place of employment, it does make a difference, and this new vector is being considered by our IT Security team. Employees regularly receive personal packages directly to their desks. Sure, this kind of “snooping” has been viable for a while now, and I’m sure CIA, etc have already used it to good effect. The IBM team just proved its easy, can scale to hundreds of targets, cheap, and works well. The cat’s out of the bag.For one, our network team does a lot of engineering work to place the Cisco AP's strategically, walk the floors with signal meters and tune their output to contain to within our building walls as much as possible accessibility to our signals. We also only allow preapproved MAC addresses to connect to our AP’s. Then there’s private keys required, plus login credentials… and finally you’re connected to WIFI… but you still don’t have access to any servers yet, and limited Internet availability based on your login.All of our building are secured requiring card keys for entry and to get past many doorways or into elevators; building perimeters are watched by cameras and guards.I’m sure this is also now being taken more seriously at other firms as well… esp. defense contractors (if they didn’t already have package scanning/inspections/validations already) and high-tech (Amazon, Microsoft, Intel, etc) and perhaps even financial institutions.

author: scatha
author_rank: Regular Contributor
timestamp: August 09, 2019, 08:39:15 am
content: This sort of thing has been practical for years (both the hardware and most of the wifi exploit software) - I'm sure most people on this forum could build something similar during a lazy weekend. The reason no-one has is because it is dumb.The target wifi network has to be one where the hacker is unable (or too lazy) to obtain proximate access, is so poorly configured to be susceptible to these types of attack, and at the same time contains something of enough value to the hacker to be worth spending a reasonable amount of money constructing the device, commit a Federal crime by sending it via the mail, and suffer a very good chance of attribution. The intersection of that Venn diagram has to be very small indeed.

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 09, 2019, 01:32:41 pm
content: Quote from: windsmurf on August 09, 2019, 05:25:08 amThe cat has been out of the bag for years. If you start worrying about this now you're way behind the curve. Tuning a signal to stay within a wall is silly security theatre. Tempest exists for a reason and that's for regular cables and not intentional emitters. While Tempest includes distance as a defence it's silly to pretend wifi signals could be effective inside a building and unavailable outside of it unless you're in the middle of a desert with a well defended fence around it. Do you allow personal phones on the floor? That's a way more realistic and covert rogue AP. The other measures you mention are common counter measures and what you actually want to do though some would argue MAC filtering isn't effective either.https://en.m.wikipedia.org/wiki/Tempest_(codename)

author: windsmurf
author_rank: Frequent Contributor
timestamp: August 09, 2019, 06:30:22 pm
content: QuoteSecurity is always behind the threat curve. I think any new potential threat information should be studied for its potential.Sure, this kind of hack has been known for years, but it hasn't been published in the mainstream to this extent. This adds the dimension of more people attempting to utilize this method for hacking, and I'd argue it needs to be reassessed, not just by businesses, but especially by individuals who continue to run insecure wifi thinking their neighborhood is safe from wifi snooping and hacking.QuoteCisco RRM helps tune your signals for least signal intereference as well as aiding you in limiting signal propagation beyond the building perimeter. At least Cisco don't seem to think its silly to do so.https://www.cisco.com/c/dam/global/sv_se/assets/pdfs/smb/cdccont_0900aecd804909a5.pdfQuoteYes personal phones are allowed, and can be used as a rogue AP. But we don't allow personal phones on our wifi. The fact that personal phones are allowed on the floor doesn't dimish the security threat from warshipping. Our concern is more around signals intelligence and data collection rather than active hacking from the device itself, which could be used in combination with other hacking methods to develop an attack.Not likely to happen? Probably not. But it still needs to be considered.QuoteI used to argue that MAC filtering is useless, and this is widely published as useless, as MAC spoofing is easy. But what the security team has informed me is that it keeps unapproved and unsecured devices from users from connecting to our network, potentially spreading malware. Is it effective in this regard with our userbase? Yes. Is it foolproof? No, but that doesn't diminish its value.