Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers ship their exploits directly to their target’s mailroom

techcrunch.com

Post reply on HN
Print view View original

21–30 of 172 posts

Re: Hackers ship their exploits directly to their target’s mailroom

#21

Post by Retr0spectrum »

jki275 wrote: post #9
jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

There are numerous attacks to crack wifi hashes. In theory, a properly implemented hash should not be crackable -- but theory often does not match the real world.

No, any hash will be crackable, it just depends on how fast.

A well designed authentication protocol shouldn't expose any hashes to be cracked in the first place.

Re: Hackers ship their exploits directly to their target’s mailroom

#22

Post by est31 »

TheLastPass wrote: post #11
jason0597 wrote: post #8

>Once the warship locates a Wi-Fi network from the mail room or the recipient’s desk, it listens for wireless data packets it can use to break into the network. The warship listens for a handshake — the process of authorizing a user to log onto the Wi-Fi network — then sends that scrambled data over the cellular network back to the attacker’s servers, which has far more processing power to crack the hash into a reada…

If it's not a strong hash and the protocol doesn't include salting, it's not impossible. Rainbow tables exist. And they really only need to find a collision. Wi-Fi protocols, especially WEP, have had vulnerabilities similar to this before. Similar in the sense that if you sniffed enough traffic you could figure out the password (don't recall the specific mechanisms - but this could be one).

It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all.

[1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/

Re: Hackers ship their exploits directly to their target’s mailroom

#23

Post by el_benhameen »

Seems like doing this with a rooted phone would be even sneakier. You've got everything you need built in: battery, modem, etc. When it eventually does get opened, the mailroom person is going to think "oh someone ordered a phone" instead of "holy shit, this bunch of wires and circuit boards is maybe a bomb and definitely something I should tell the police about".

Re: Hackers ship their exploits directly to their target’s mailroom

#24

Post by magashna »

mikece wrote: post #4

Add one more item to the list of things to keep the Chief Security Officer up at night... though I've got to imagine this type of attack is at least a decade old even if it's only becoming well known right now. I've got to wonder if spear-phishers have been able to combine this type of attack with getting someone at a company to buy/accept and plug in some type of electronic novelty device...

Why even bother with a novelty? Send some USBs or even drop a few outside the building. Curiosity is a massive vulnerability

Re: Hackers ship their exploits directly to their target’s mailroom

#25

Post by fortran77 »

Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked.

Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock from the local "Chamber of Commerce". Put a camera and mic in there too to try to get passwords via audio or video surveillance. (Audio recordings of keyboards typing can be surprisingly effective if you have a big enough training set)

(On my way to DEFCON! See you all there!)

Re: Hackers ship their exploits directly to their target’s mailroom

#26

Post by TheSoftwareGuy »

fortran77 wrote: post #25

Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked. Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock…

Or just give them a giant wooden carving of the US presidential seal: https://en.wikipedia.org/wiki/The_Thing_(listening_device)

Re: Hackers ship their exploits directly to their target’s mailroom

#27

Post by gubsz »

fortran77 wrote: post #25

Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked. Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock…

How would you be able to pull out any information out of an audio recording of keyboard typing? Wouldn't the training set differ between keyboards too? Sounds interesting it it worked, do you have any sources?

Re: Hackers ship their exploits directly to their target’s mailroom

#28

Post by overcast »

mikece wrote: post #6
slowmotiony wrote: post #3

That seems like a lot of hassle and a pretty big federal crime for only being able to attack Wi-Fi networks. Why not just park your car outside and use a laptop?

How long can you sit outside a company running Kali Linux and a high gain antenna array before you attract attention? If you ship someone on the DevOps team a WiFi-connected plush toy that listens for webhooks from your CI/CD platform to make happy/sad noises when the build passes/fails -- AND THEY PLUG IT IN AND LEAVE IT ON -- then the ability to have passive access to the network for a long period of time will be l…

I suspect way longer than you think. Ten of thousands of small businesses don't pay attention to that stuff.

Re: Hackers ship their exploits directly to their target’s mailroom

#29

Post by [deleted] »

fortran77 wrote: post #25

Find someone who's out on leave for a while (just look for who's having a baby on IG) and ship the package to him/her! They won't discover it for weeks and you'll have plenty of time for your package to sit in the mailroom or on someone's desk. The danger is when the package is opened, the company may realize they've been hacked. Or have it there permanently: Ship an executive a fancy illuminated globe or desk clock…

[deleted]

Re: Hackers ship their exploits directly to their target’s mailroom

#30

Post by gvb »

Theodores wrote: post #7

IBM have a service to sell. Hence this 'fear'. Real world attacks using this method? Show me one. It is like putting superglue in locks. In theory anyone could invest in $5 of superglue and put a large building out of business for a few hours. It doesn't happen. But if you were an IBM type of company you could offer this as a service to companies wanting to test their contingency plans. Seems that is what is going on…

Agreed: this is an IBM "offensive operations unit" publicity piece. Key items from TFA:

* TFA quotes Charles Henderson, "who heads up the IBM offensive operations unit."

* "This newly named technique — dubbed “warshipping” — is not a new concept."

* "All of this could be done covertly without anyone noticing — so long as nobody opens the parcel."

A much more practical implementation of this attack vector is the "Malicious Raspberry Pi Power Strip" (article posted in 2012): https://hackaday.com/2012/10/04/malicious-raspberry-pi-power... Those could easily be shipped to end users who would be pretty likely to plug it in. Add a note in the box "from" the IT department and I bet it gets a very high percentage success rate.

Post reply on HN