Forgot your password?
typodupeerror
Security The Almighty Buck Wireless Networking

Researcher Wows Black Hat With NFC-based Smartphone Hacking Demo 95

Posted by samzenpus
from the unsafe-at-any-speed dept.
alphadogg writes "At the Black Hat Conference in Las Vegas Wednesday, Accuvant Labs researcher Charlie Miller showed how he figured out a way to break into both the Google/Samsung Nexus S and Nokia N9 by means of the Near Field Communication (NFC) capability in the smartphones. NFC is still new but it's starting to become adopted for use in smartphone-based purchasing in particular. The experimentation that Miller did, which he demonstrated at the event, showed it's possible to set up NFC-based radio communication to share content with the smartphones to play tricks, such as writing an exploit to crash phones and even in certain circumstances read files on the phone and more."
This discussion has been archived. No new comments can be posted.

Researcher Wows Black Hat With NFC-based Smartphone Hacking Demo

Comments Filter:
  • Hmm (Score:4, Insightful)

    by masternerdguy (2468142) on Thursday July 26, 2012 @06:04PM (#40784953)
    Workaround: Blacklist the kernel module used for NFC?
    • Re: (Score:3, Insightful)

      by sexconker (1179573)

      Solution: Don't buy a phones with NFC gimmickry, NFC gimmickry goes away.

      • by Anonymous Coward

        It's not gimmicky in the rest of the world that uses it actively with vending machines, train tickets, subways, etc.

        • I have a credit card for that. I have exactly zero desire to use my phone as a payment device.

          There's no real benefit in not carrying a credit card if you have to carry around your phone.
          If you're so dead set on not carrying shit, just memorize your credit card number and key it in.

      • Re:Hmm (Score:4, Funny)

        by sjames (1099) on Friday July 27, 2012 @01:46AM (#40787767) Homepage

        Even better, all we need to do is come up with a way to use NFC to share music and movies. Then the *AA won't rest until it's dead.

      • by fatphil (181876)
        Let me introduce you to the concept of a "switch" with settings we like to call "on" and "off". With said feature, you can have the NFC functionality enabled (or "on") when you specifically want it, and disabled ("off") the rest of the time. And the N9 has that.

        If you want to connect to any wireless network you're not in control of, then you are just as vulnerable from most facets of this attack as you are from using NFC. More so, as with NFC you actually have to be physically close to Malory.
        • by fatphil (181876)
          The Forbes and arstechnica write-ups are worth a read, and it appears that the bluetooth "off" switch is the problem. It's just plain ignored. You turn it off, NFC turns it back on without asking you. Braindead.

          Then again, Nokia's maemo devices have a long history of ignoring user preferences or choices because of braindead diktats made by people who were incapable of thinking through the consequences of their demands. (Yes, I'm ex-Nokia, and could write a book full of the horror-stories I've seen.)
        • Unless you have a physical switch you leave the door open for exploits and shittydumb apps, OEMs, carriers, and os vendors just plain ignoring your settings.

          • by fatphil (181876)
            But it was a conscious decision to permit software to over-ride a user's setting. That decision didn't have to be made.

            I'd like to know who made that decision in Nokia. I wish I'd had access to a RFID tag writer while I worked there, as my plan would have been to turn the useful tags that had helpfully been scattered around (things such as pulling up a bus timetable/route-planner as you went through the exit that led to the station) with goatse, or worse. Who knows, I may have discovered this exploit first
    • Re:Hmm (Score:4, Interesting)

      by socceroos (1374367) on Thursday July 26, 2012 @06:16PM (#40785063)
      I cannot believe..........no wait....I cannot understand why these things aren't being made with security at the forefront. Surely anyone with half a brain realises that every point of communication with a phone is a potential point of exploitation. LOCK IT DOWN PEOPLE - FOR BLINKY'S SAKE, THIS HAS BEEN GOING ON TOO LONG.
      • by Trillan (597339)

        Perhaps they are. It is remarkably difficult to secure a large code base.

        Though I would hope that NFC is new enough that it would be coded securely right from the start.

        • Re:Hmm (Score:5, Insightful)

          by socceroos (1374367) on Thursday July 26, 2012 @06:29PM (#40785209)
          I'm under no illusion that a large code base is hard to secure, but I'm still baffled^H^H^H^H^H^H^Hannoyed that when a new point of access to a device is born that it isn't done with utmost security in mind. We live in an age where the devices we own hold the keys to our lives, why aren't they as secure as they possibly can be short of not existing??
          • Re:Hmm (Score:5, Insightful)

            by jader3rd (2222716) on Thursday July 26, 2012 @06:51PM (#40785423)

            why aren't they as secure as they possibly can be short of not existing?

            Because first to market wins.

          • Wrong. It's not supposed to be as secure as *possible*, but as secure as *necessary*. And it apparently is: Even the world's leading experts were not able to break into current Android phones.
            • Firstly, you've got to be kidding. Android security has been broken multiple times since its inception and it will continue to happen. Secondly, "necessary" is a very subjective term, my friend.
              • Ah, sorry, of course my comment referred to NFC, as this is the topic at hand. And this article here in fact says they were not able to exploit NFC on current phones.
          • by thoth (7907)

            We live in an age where the devices we own hold the keys to our lives, why aren't they as secure as they possibly can be short of not existing??

            Because corporations and lazy and cheap, and security doesn't pad their bottom line in the all-consuming march for profits.

            It is less expensive for them to punt all security issues and instead rely on the government to make abusing the non-security of these devices "illegal".
            Yes that is ineffective, but before criticizing the government, consider the fundamental impossibility of fixing security problems by declaring the abuse illegal, and also consider the root problem is that corporations are basically irr

      • Re:Hmm (Score:5, Insightful)

        by Opportunist (166417) on Thursday July 26, 2012 @09:21PM (#40786467)

        Because security does not sell. It's that simple.

        Go out there and ask 1000 random people what they are looking for in a cell. NONE of them will say security. Not even at any point in that whole list of things they might mention.

        Security is a non-issue for pretty much every phone user out there save a few "computer people" who know what you just said: Any channel, if not properly secured, can and will be abused to compromise the confidentiality of the device using it.

        Problem is, I guess for at least 80% of the phone users out there reading half of the last sentence is enough to make their eyes glaze over. Doesn't take pictures, doesn't play MP3s, doesn't let me tell everyone I'm on the can on Facebook, so why'd I need it?

        Making code secure costs money and is no selling point. Well, it sure as hell would be with me and most likely you, but for every you or me, there's a thousand Bobs out there who prefer shiny.

        • I hate it, but you are right.

          At some point, the companies/people making these services available should 'do the right thing' - because, well, its the right thing to do. They're responsible for the world's privacy, they should take it seriously.

          I feel I'm being entirely unrealistic, but it is something to at least pursue with good conscience.
        • Re:Hmm (Score:4, Insightful)

          by chiguy (522222) on Friday July 27, 2012 @02:09AM (#40787821) Homepage

          Go out there and ask 1000 random people what they are looking for in a cell. NONE of them will say security.

          All true, security is not a selling point.

          But the reason people don't list it for cell phones is that security is assumed. Similar to if you asked me what I look for in a bank, security is not something I would list. I assume all banks offer adequate security. At least to the level required by law.

          What you're pointing out is the average user does not realize/understand how poor the security really is on their devices.

        • by Zet (178940)

          I predict that NONE of those surveyed will say "to be able to make phone calls"
          either.

          I think that security is something people don't think about very much, but they
          also buy the phone with the assumption that *surely* it would be made secure,
          ("they would be fools sell it to millions of people if it were not secure").

          And, to a reasonable extent they *are* made secure. But securing a device is a
          process, not a one-time event. It is an ever-escalating back and forth between
          having all known holes plugged and a

      • by smeaggie (1172215)

        I cannot believe..........no wait....I cannot understand why these things aren't being made with security at the forefront. Surely anyone with half a brain realises that every point of communication with a phone is a potential point of exploitation. LOCK IT DOWN PEOPLE - FOR BLINKY'S SAKE, THIS HAS BEEN GOING ON TOO LONG.

        For the nexus phone, the actual exploit was in the browser, NFC was just used to open the browser without the user being asked to do so. On the nokia, the actual exploit was in the bluethooth stack. This particular implementation allows bluetooth device pairing over NFC even if bluetooth is turned off on the phone, so now with NFC the exploit is reachable without the users knowledge. The exploit in the bluetooth stack allows for root access on the device. So the biggest problem with current NFC implementati

    • Re:Hmm (Score:5, Informative)

      by Emetophobe (878584) on Thursday July 26, 2012 @06:17PM (#40785071)

      You can disable NFC in the android settings.

      System Settings -> More... -> NFC (uncheck it).

      • Re:Hmm (Score:4, Informative)

        by SpzToid (869795) on Thursday July 26, 2012 @06:36PM (#40785253)

        The Nokia N9 is mentioned, and the NFC settings required for this exploit are turned off by default. I first read this detail on arstechnica.com and then double-checked on my own device; it is true.

        • Re:Hmm (Score:5, Informative)

          by SomePgmr (2021234) on Thursday July 26, 2012 @07:33PM (#40785785) Homepage

          Well, that's an important bit of info I didn't see in the article.

          And I suppose it's worth reminding everyone that this is NFC. Your phone would have to be in near-contact with the exploiting hardware. Not impossible I suppose, given that skimming happens with traditional payment cards.

          I didn't understand the two word description of the problem with Android, so I looked up that Ars article you mentioned...

          The Nexus Sâ"when running the Gingerbread (2.3), by far the most dominant Android installationâ"contains multiple memory-corruption bugs. They allow Millerâ"using nothing more than a specially designed tagâ"to take control of the application "daemon" that controls NFC functions. With additional work, he said the tag could be modified to execute malicious code on the device. Some, but possibly not all of those bugs were fixed in the Ice Cream Sandwich (4.0) version of Android, so the attacks may also work against that release and Jelly Bean (4.1) as well.

          Ah. So upgrade your phone.

          http://arstechnica.com/security/2012/07/android-nokia-smartphone-hack/ [arstechnica.com]

          • Getting close to a cell is trivial. Take for example every place where people have to sit close together like theaters or lecture halls. Hey, how about conferences, just go into one of the panels, sit down and presto.

            • by admdrew (782761)
              Very cool demo/exploit, but:
              http://www.androidcentral.com/android-nfc-hack-cool-not-new-or-dangerous [androidcentral.com]

              - majority of phones running exploitable version of Android don't support NFC
              - majority of phones supporting NFC have patched version of Android
              - future phones supporting NFC will all have patched version of Android
              • by marsu_k (701360)
                While I'm not worried about this exploit, I'm surprised they got it to work in the first place across multiple platforms. NFC seems to be not-so-standardized at the moment - recently when visiting my brother I tried to pair my S3 with a Nokia NFC speaker he has. All I got was the S3 to say it had spotted an unknown tag, something about Bluetooth (which is what the speaker ultimately uses for transmission), but nothing useful.
              • by sjames (1099)

                The more significant part is that the presenter plans to make the NFC fuzzing tool he created available

          • by tlhIngan (30335)

            And I suppose it's worth reminding everyone that this is NFC. Your phone would have to be in near-contact with the exploiting hardware. Not impossible I suppose, given that skimming happens with traditional payment cards.

            Given the NFC reader I've seen is just another box beside the PIN pad and card reader, it's actually a trivially-doable exploit. Peopla already swap out PIN pads and readers in order to capture PINs and swipes. Replacing an NFC thing should be easier still with one that not only grabs the d

      • The more interesting question is why do I have to turn it off if I don't want it and not turn it on if I want it?

        Why does every maker of Smartphones think I want all their new, and usually quite battery draining, bells and whistles? I dunno, I might be old fashioned, but a phone that can make phone calls is a good start for me. Put the rest in the manual and gimme a hint that it is there, and if I am interested I'll try it out and turn it on when I find the time to do that.

    • maybe NFC just needs something like a public key/private key handshake. the services you use would give you a public key (like banks, paypal, etc) so that hackers would have to have the institution's private key in order to break in. it could be made so that only insured/bonded institutions could offer NFC services that access vulnerable information. i'm probably overlooking something, but then it's time for that end of day coffee so i can wake up again. oh i know what it is. we can't even get ssl to work r
      • by wierd_w (1375923)

        The problem is that this is intended for one-off purchases, like vending machines.

        TPI will make that considerably less convenient, unless the device was issued unique certificates.

        In which case, there would be a sudden market for stolen device certificates for credit fraud purposes, which would exploit the broken security flag implementation of the android marketplace. (The ad supported freemium content requires phonehome powers to serve you ads, and the frequently ask for phonebook and local storage as wel

    • by MrHanky (141717)

      It's off by default on my Nokia N9. Also, it only works over really sort distances, like centimetres.

      • Re:Hmm (Score:5, Insightful)

        by socceroos (1374367) on Thursday July 26, 2012 @07:58PM (#40785959)
        That's what people said about RFID tags until people started skimming them at distances beyond a kilometre.
      • by jo_ham (604554)

        It's off by default on my Nokia N9. Also, it only works over really sort distances, like centimetres.

        So?

        The article itself mentions the N9 as a tested phone where this works, despite the NFC being off by default.

        Solution: fix bugs in Android (mostly done for these exploits in ICS and JB).

  • Are fuzzing tools really that hard to write?

    • by Keith111 (1862190)
      Very easy, actually. The focus of a huge portion of my work is dedicated to writing or improving fuzz technology for security testing. I could write a basic fuzzer for almost anything in 20 minutes...
      • by jmerlin (1010641)
        Would you mind starting a blog on it and posting the URL here? Those of us writing code and unit tests need to know how to fuzz our code really well, too.
  • eavesdropping (Score:2, Interesting)

    by Anonymous Coward

    Ironic. The technical tools to solve all these problems exist, but if they were used properly, even the gov't. couldn't break in.

    So which do you want? An inherently weak system that allows civil monitoring, or something so secure it'd be as anonymous as cash. After all, this is *cash* we are talking about replacing here.

    The gov't. has a "thing" about encrypting wireless communications ...

    • I agree with your point. But this isn't just about cash. NFC can be used for divers purposes - its like even shorter-range Bluetooth.
  • by gstrickler (920733) on Thursday July 26, 2012 @06:37PM (#40785265)

    Another network or communications port = another attack vector.

    The question is why to vendors think they need to keep adding new communication methods faster than they can test and debug those ports?

  • While TFA does say:

    he managed to break into the Nokia 9 when his home-made NFC-based device is in very close proximity to the targeted smartphone ... NFC works at near-contact range

    It doesn't give any actual numbers or distance measurements. Would be nice to have some actual facts and details on this. Suffice to say, if someone walks up next to me waving an unknown device around my crotch, I'm going to be a bit suspicious. The article also doesn't mention what modifications, if any, were made to the target phones. A few posters here have mentioned NFC being turned off by default. Does his methods force NFC on, or work without it? But I guess reporting accuratel

    • by witherstaff (713820) on Thursday July 26, 2012 @07:18PM (#40785659) Homepage

      I've played with distances using a few different smart cards, a USB NFC reader, and a nexus S. I couldn't get a smartcard to read through the front of the phone or the side. I could get a USB NFC reader to detect if smartphone was placed face down. From the back it is about 3 inches with a USB reader, 1-2 inches with a smartcard.

      NFC is also a battery hog. I don't see having it running all the time.

    • by iluvcapra (782887) on Thursday July 26, 2012 @07:22PM (#40785703)

      Here are some videos [forbes.com]. He represents the phones as unmodified, though running an old version.

      The distance isn't so much of an issue because he was able to use an NFC tag, not a transmitter, not an active device of any kind, but a mere tag to cause the phone to switch on its bluetooth radio and give him a sudoer's command line over the BT radio. An attacker could hide an NFC tag in a table or at waist level in a public place, or in a tag that's disguised to be legitimate, where people are liable to stand for more than 10 seconds: the tag cracks the phone open, and then someone with a laptop within BT distance conducts a brief session to grab what they can, or install a rootkit.

    • by MachDelta (704883)

      NFC is very short range. Centimeters. The devices would have to touch or very nearly touch, although modified attack hardware (stronger antennas) would probably allow some leeway.
      NFC is enabled by default on the Galaxy Nexus and (I believe) the Nexus S. But it's trivial to disable (Settings -> More -> NFC) and AFAIK cannot be forced on unless you compromise the device via some other vector (at which point, you're already screwed).
      Furthermore, the article on Ars states that most of the exploits were fo

    • by wierd_w (1375923) on Thursday July 26, 2012 @08:50PM (#40786309)

      The near field is within the first 1.5 wavelengths of the frequency used. It has certain special properties related to it having a higher (proportionally) density of virtual photons entangled with the source antenna than does the far field.

      (A connection on the near field will actively change the resistance and resonance characteristics of the signalling antenna, where a far field connection will not.)

      Giving a set distance is moot. Saying it is near field is accurate, and sufficient. The distance in which NFC is possible is inseperable from the chosen comm frequency. A very short wavelength frequency will have a very tiny near field. A long wavelength frequency will have a very large near field.

      Cellular devices in the ghz band will have only a few millimeters around the antenna as the NFC reception range.

      The deal that I would consider to be the threat, is that you can't have a near field without a far field. The far field will also have broadcasted data encoded into it, and will travel much further. It could well be intercepted.

  • by davidwr (791652) on Thursday July 26, 2012 @07:02PM (#40785503) Homepage Journal

    One, both sides of the conversation should know "something" about who they are talking to before engaging or continuing a transaction.

    "Enough" may be nothing more than making sure a man-in-the-middle hasn't taken over the conversation.

    Second, any conversation has to begin at a minimum trust level - basically "I don't trust you, you don't trust me, here's my name-of-the-day, what should I call you today?" level.

    Some people have suggested public key cryptography. While this is cool, it may be simpler to use "out of band" communication to verify identities. Since phones have cameras and screens, these can provide the necessary out of band communications.

    Scenario:

    Say I'm at the Burger Bar and I want to buy something using my phone. My phone doesn't trust the radio signal pretending to be Burger Bar's, and Burger Bar doesn't trust that my phone isn't someone else's phone nearby.

    So I use my phone to take a picture of a display at the Burger Bar order counter. This picture has a QR code for Burger Bar's public key or web site that has the public key, as well as a second, changing QR code that is my transaction ID plus some randomness. I encrypt all of this plus my made-up-on-the-spot public key plus a made-up QR code using Burger Bar's public key. I display this QR code on my phone and put it in range of the small camera at the register. Burger Bar's computer checks the QR code against what I just transmitted to verify it's my phone it's talking to.

    Now we can talk to each other securely and, thanks to the ordinary security cameras that show me holding my phone close to the order counter, in a difficult-to-repudiate way.

    I didn't have to give Burger Bar my phone's serial number. I didn't have to give it any identification beyond what our banks need to transact business, just as if I were using a traditional credit card or debit card payment. If we are using bit-coin or something similar, I didn't even have to give them that much - true anonymity.

    Now I go enjoy my meal. Oh wait, this is Burger Bar we are talking about. Now I go ingest my mass quantities.

    Burger Bar really doesn't have to use its own public key. Like me, it can make up one for this transaction. It's the taking-a-picture of the public key and transaction code that make this secure against a radio-only intercept. If there is a risk that the transaction code picture or my phone's on-screen QR code will be intercepted, it's easy enough to let the two devices look at each other in a way that's very difficult to "peek into."

    • by vux984 (928602) on Thursday July 26, 2012 @07:25PM (#40785721)

      Well, yes, that's all great...

      But the problem you need to solve is "paying for a burger with less effort than using a debit / credit card" while not being less secure.

      Your solution passes on being more secure, but fails dismally at being easier.

    • by Anonymous Coward

      this is about 2x more complicated than it needs to be. you don't need the nfc part at all to do this securely! also, the bitcoin wallet for android already does it.

    • by Anonymous Coward

      What about malicious QR codes?

    • by ghn (2469034)

      Nice write-up. Extremely complex and awkward in every way if you think of it in real life and according to the current state of technoloy.

      Here's my version of a secure transaction at Burger bar

      Ask for combo #1

      Hand of five dollar bill

      Get combo #1 and some change

      No trace left and no security risk.

      Sure, I need to acquire and carry said 5$ bill in a safe and secure manner, but they way I do it RIGHT NOW satisfies my need for privacy and security.

  • by Jah-Wren Ryel (80510) on Thursday July 26, 2012 @07:23PM (#40785707)

    I've long thought that NFC was a disaster waiting to happen - or really a never-ending series of disasters, just as each one is patched-over a new one will appear.

    The problem is that NFC's functionallity is all out of proportion to the problem it is intended to solve. It's kind of like adding a video display when all you need is an LED indicator light. NFC is supposed to handle short and fast communications between devices that are in very close proximity. Stuff like exchanging v-cards, electronic payments at the register, kickstarting ad-hoc wifi connections, etc.

    None of that stuff requires radio communications and even though NFC is designed for broadcast ranges of a couple of centimeters, that never stops the bad guy from using high-powered transmitters and ultra-sensitive antennas to do their dirty work from a more comfortable and non-obvious location.

    I believe that almost everything that NFC is likely to ever be useful for could also be done with no extra hardware. Just use the camera already built into every smart-phone to take a picture of a 2d-barcode displayed by the other device. That gets you physical access controls limited by line of site and a window of opportunity limited to the second or so that the user explicitly presses the camera button.

    • by Inda (580031)
      "that never stops the bad guy from using high-powered transmitters and ultra-sensitive antennas "

      I know pretty much nothing about NFC, but why can't the handshake, if there is such a thing, why can't it measure the distance between the two objects?

      1ms ping back means the objects are close
      10ms, the objects are too far away, handshake failure.
  • by jbeaupre (752124) on Thursday July 26, 2012 @07:28PM (#40785741)

    The discussion about single point login got me thinking. Rather than having some server out there become a single point of failure, how about a device you carry with you that stores the multitude of logins and passwords? Smart phones seem capable of just that.

    Has anyone come across using NFC on a phone as a login/password authentication method? Store all of your login and passwords on the phone. Then when prompted for login info (website, laptop login, etc), you use your phone.

    Yeah, a whole new security nightmare. But the idea still appeals to me.

  • Overrated... (Score:2, Insightful)

    by Anonymous Coward

    Unfortunately, like most web sites, slashdot brings this article way too sensational, omitting most of the facts that make this a lot less impressive and worrisome.

    First, at least on Android devices, NFC is only enabled when the screen is on and unlocked. That means that nobody can just walk by you and communicate to your device over NFC. You need to be already working with your phone.

    Second, there is the range. NFC typically only works one or two inches away, and the two devices interacting need to be alig

We warn the reader in advance that the proof presented here depends on a clever but highly unmotivated trick. -- Howard Anton, "Elementary Linear Algebra"

Working...