If you could use texting to break networks, what could you do? Well, Don Bailey, with ISEC Partners, in his talk today at Blackhat, muses that you could break a lot, driving around and dropping in on various networks as you saw fit. Well, really his proof-of-concept collection of tools is aimed at educating mobile connected device manufacturers and users alike that the technology is here now to do “very bad things” if steps aren’t taken to address the issues.
In a marketplace where mobile products are increasingly network aware, it seems like connectivity is popping up in the least expected places. One example in the presentation is a product called “Glow Caps”, a slick, network aware cap that fits on a prescription bottle and monitors patient usage, how many pills are left, and other slick things. Seems innocuous enough.
Turns out in a brutally cost competitive hardware market, with equally brutal requirements to get product on shelves first, network security may be farther down on the list than other things like slick functionality. Don regaled the technically adroit in attendance with a cocktail of tools used to reverse engineer such simple network devices. He points out that many of them share similar components for network functionality, so if you can hack one device, you know an awful lot about a lot of other ones. Many of these types of devices don’t even encrypt control signals, making simple work out of reverse engineering attempts.
While low-cost network aware devices may be more likely to be easily hacked, the presentation then turned to more upscale network aware devices, in this case, cars. We saw a video of Don and a cohort by a late model car, plunking keys on a laptop, soon thereafter unlocking the doors and eventually starting the car…all by hacking the wireless networking functions normally used by the common wireless key fob. In the vein of responsibility to the manufacturer of the car, he left a few details out of how that was done, and has notified the manufacturer, who is taking steps to remedy the situation.
But how many hackers would be responsible and let the car manufacturer know? Wouldn’t an aspiring hacker be tempted to use the tactics to “borrow” a car or two for nefarious purposes? Certainly manufacturers, large and small alike, might benefit by wandering by isecpartners.com and seeing what’s out there, and how to protect their systems from similar hacks, you can bet someone from the “dark side” will be soon.
