Researcher Wows Black Hat With NFC-based Smartphone Hacking Demo 95
alphadogg writes "At the Black Hat Conference in Las Vegas Wednesday, Accuvant Labs researcher Charlie Miller showed how he figured out a way to break into both the Google/Samsung Nexus S and Nokia N9 by means of the Near Field Communication (NFC) capability in the smartphones. NFC is still new but it's starting to become adopted for use in smartphone-based purchasing in particular. The experimentation that Miller did, which he demonstrated at the event, showed it's possible to set up NFC-based radio communication to share content with the smartphones to play tricks, such as writing an exploit to crash phones and even in certain circumstances read files on the phone and more."
Hmm (Score:4, Insightful)
Re: (Score:3, Insightful)
Solution: Don't buy a phones with NFC gimmickry, NFC gimmickry goes away.
Re: (Score:1)
It's not gimmicky in the rest of the world that uses it actively with vending machines, train tickets, subways, etc.
Re: (Score:1)
I have a credit card for that. I have exactly zero desire to use my phone as a payment device.
There's no real benefit in not carrying a credit card if you have to carry around your phone.
If you're so dead set on not carrying shit, just memorize your credit card number and key it in.
Re:Hmm (Score:4, Funny)
Even better, all we need to do is come up with a way to use NFC to share music and movies. Then the *AA won't rest until it's dead.
Re: (Score:3)
If you want to connect to any wireless network you're not in control of, then you are just as vulnerable from most facets of this attack as you are from using NFC. More so, as with NFC you actually have to be physically close to Malory.
Re: (Score:3)
Then again, Nokia's maemo devices have a long history of ignoring user preferences or choices because of braindead diktats made by people who were incapable of thinking through the consequences of their demands. (Yes, I'm ex-Nokia, and could write a book full of the horror-stories I've seen.)
Re: (Score:1)
Unless you have a physical switch you leave the door open for exploits and shittydumb apps, OEMs, carriers, and os vendors just plain ignoring your settings.
Re: (Score:2)
I'd like to know who made that decision in Nokia. I wish I'd had access to a RFID tag writer while I worked there, as my plan would have been to turn the useful tags that had helpfully been scattered around (things such as pulling up a bus timetable/route-planner as you went through the exit that led to the station) with goatse, or worse. Who knows, I may have discovered this exploit first
Re:Hmm (Score:4, Interesting)
Re: (Score:2)
Perhaps they are. It is remarkably difficult to secure a large code base.
Though I would hope that NFC is new enough that it would be coded securely right from the start.
Re:Hmm (Score:5, Insightful)
Re:Hmm (Score:5, Insightful)
why aren't they as secure as they possibly can be short of not existing?
Because first to market wins.
Re:Hmm (Score:5, Funny)
Damn, you beat me to it and cashed in the insightful mods.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
We live in an age where the devices we own hold the keys to our lives, why aren't they as secure as they possibly can be short of not existing??
Because corporations and lazy and cheap, and security doesn't pad their bottom line in the all-consuming march for profits.
It is less expensive for them to punt all security issues and instead rely on the government to make abusing the non-security of these devices "illegal".
Yes that is ineffective, but before criticizing the government, consider the fundamental impossibility of fixing security problems by declaring the abuse illegal, and also consider the root problem is that corporations are basically irr
Re: (Score:2)
Congratulations on missing the point.
Re:Hmm (Score:5, Insightful)
Because security does not sell. It's that simple.
Go out there and ask 1000 random people what they are looking for in a cell. NONE of them will say security. Not even at any point in that whole list of things they might mention.
Security is a non-issue for pretty much every phone user out there save a few "computer people" who know what you just said: Any channel, if not properly secured, can and will be abused to compromise the confidentiality of the device using it.
Problem is, I guess for at least 80% of the phone users out there reading half of the last sentence is enough to make their eyes glaze over. Doesn't take pictures, doesn't play MP3s, doesn't let me tell everyone I'm on the can on Facebook, so why'd I need it?
Making code secure costs money and is no selling point. Well, it sure as hell would be with me and most likely you, but for every you or me, there's a thousand Bobs out there who prefer shiny.
Re: (Score:2)
At some point, the companies/people making these services available should 'do the right thing' - because, well, its the right thing to do. They're responsible for the world's privacy, they should take it seriously.
I feel I'm being entirely unrealistic, but it is something to at least pursue with good conscience.
Re:Hmm (Score:4, Insightful)
Go out there and ask 1000 random people what they are looking for in a cell. NONE of them will say security.
All true, security is not a selling point.
But the reason people don't list it for cell phones is that security is assumed. Similar to if you asked me what I look for in a bank, security is not something I would list. I assume all banks offer adequate security. At least to the level required by law.
What you're pointing out is the average user does not realize/understand how poor the security really is on their devices.
Re: (Score:1)
I predict that NONE of those surveyed will say "to be able to make phone calls"
either.
I think that security is something people don't think about very much, but they
also buy the phone with the assumption that *surely* it would be made secure,
("they would be fools sell it to millions of people if it were not secure").
And, to a reasonable extent they *are* made secure. But securing a device is a
process, not a one-time event. It is an ever-escalating back and forth between
having all known holes plugged and a
Re: (Score:1)
I cannot believe..........no wait....I cannot understand why these things aren't being made with security at the forefront. Surely anyone with half a brain realises that every point of communication with a phone is a potential point of exploitation. LOCK IT DOWN PEOPLE - FOR BLINKY'S SAKE, THIS HAS BEEN GOING ON TOO LONG.
For the nexus phone, the actual exploit was in the browser, NFC was just used to open the browser without the user being asked to do so. On the nokia, the actual exploit was in the bluethooth stack. This particular implementation allows bluetooth device pairing over NFC even if bluetooth is turned off on the phone, so now with NFC the exploit is reachable without the users knowledge. The exploit in the bluetooth stack allows for root access on the device. So the biggest problem with current NFC implementati
Re:Hmm (Score:5, Informative)
You can disable NFC in the android settings.
System Settings -> More... -> NFC (uncheck it).
Re:Hmm (Score:4, Informative)
The Nokia N9 is mentioned, and the NFC settings required for this exploit are turned off by default. I first read this detail on arstechnica.com and then double-checked on my own device; it is true.
Re:Hmm (Score:5, Informative)
Well, that's an important bit of info I didn't see in the article.
And I suppose it's worth reminding everyone that this is NFC. Your phone would have to be in near-contact with the exploiting hardware. Not impossible I suppose, given that skimming happens with traditional payment cards.
I didn't understand the two word description of the problem with Android, so I looked up that Ars article you mentioned...
The Nexus Sâ"when running the Gingerbread (2.3), by far the most dominant Android installationâ"contains multiple memory-corruption bugs. They allow Millerâ"using nothing more than a specially designed tagâ"to take control of the application "daemon" that controls NFC functions. With additional work, he said the tag could be modified to execute malicious code on the device. Some, but possibly not all of those bugs were fixed in the Ice Cream Sandwich (4.0) version of Android, so the attacks may also work against that release and Jelly Bean (4.1) as well.
Ah. So upgrade your phone.
http://arstechnica.com/security/2012/07/android-nokia-smartphone-hack/ [arstechnica.com]
Re: (Score:3)
Getting close to a cell is trivial. Take for example every place where people have to sit close together like theaters or lecture halls. Hey, how about conferences, just go into one of the panels, sit down and presto.
Re: (Score:3)
http://www.androidcentral.com/android-nfc-hack-cool-not-new-or-dangerous [androidcentral.com]
- majority of phones running exploitable version of Android don't support NFC
- majority of phones supporting NFC have patched version of Android
- future phones supporting NFC will all have patched version of Android
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
The more significant part is that the presenter plans to make the NFC fuzzing tool he created available
Re: (Score:2)
Given the NFC reader I've seen is just another box beside the PIN pad and card reader, it's actually a trivially-doable exploit. Peopla already swap out PIN pads and readers in order to capture PINs and swipes. Replacing an NFC thing should be easier still with one that not only grabs the d
Re: (Score:3)
The more interesting question is why do I have to turn it off if I don't want it and not turn it on if I want it?
Why does every maker of Smartphones think I want all their new, and usually quite battery draining, bells and whistles? I dunno, I might be old fashioned, but a phone that can make phone calls is a good start for me. Put the rest in the manual and gimme a hint that it is there, and if I am interested I'll try it out and turn it on when I find the time to do that.
Re: (Score:3)
Re: (Score:3)
The problem is that this is intended for one-off purchases, like vending machines.
TPI will make that considerably less convenient, unless the device was issued unique certificates.
In which case, there would be a sudden market for stolen device certificates for credit fraud purposes, which would exploit the broken security flag implementation of the android marketplace. (The ad supported freemium content requires phonehome powers to serve you ads, and the frequently ask for phonebook and local storage as wel
Re: (Score:2)
It's off by default on my Nokia N9. Also, it only works over really sort distances, like centimetres.
Re:Hmm (Score:5, Insightful)
Re:Hmm (Score:4, Informative)
Have a look here [tombom.co.uk](PDF doc).
I know it has been demonstrated at 217 feet (well short of a kilometer but well more than the industry claimed) with a U.S. passport, but the paper above indicates 2 miles is theoretically possible.
Re: (Score:2)
It's off by default on my Nokia N9. Also, it only works over really sort distances, like centimetres.
So?
The article itself mentions the N9 as a tested phone where this works, despite the NFC being off by default.
Solution: fix bugs in Android (mostly done for these exploits in ICS and JB).
Re: (Score:2)
The N9 doesn't use Android, so your proposed 'fix' will not work. Idiot.
Like a man in orthopeadic shoes, I stand corrected. You're right, I'm a damn idiot.
Fuzzing (Score:2)
Are fuzzing tools really that hard to write?
Re: (Score:2)
Re: (Score:2)
eavesdropping (Score:2, Interesting)
Ironic. The technical tools to solve all these problems exist, but if they were used properly, even the gov't. couldn't break in.
So which do you want? An inherently weak system that allows civil monitoring, or something so secure it'd be as anonymous as cash. After all, this is *cash* we are talking about replacing here.
The gov't. has a "thing" about encrypting wireless communications ...
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Regardless of what the default NFC state is, we've been hearing NFC is the nifty next thing for these phones. Google made a huge deal about it at Google IO.
Stating that NFC is secure because you can turn it off is analogous to claiming SSH1 is secure because it can be turned off. It's not secure; you're just ameliorating the problem - not to mention losing the desired functionality.
Besides, what are all the people who bought those Nexus Q's supposed to do now?
It's a simple rule, really... (Score:3)
Another network or communications port = another attack vector.
The question is why to vendors think they need to keep adding new communication methods faster than they can test and debug those ports?
Fact? Who needs em. (Score:2)
While TFA does say:
he managed to break into the Nokia 9 when his home-made NFC-based device is in very close proximity to the targeted smartphone ... NFC works at near-contact range
It doesn't give any actual numbers or distance measurements. Would be nice to have some actual facts and details on this. Suffice to say, if someone walks up next to me waving an unknown device around my crotch, I'm going to be a bit suspicious. The article also doesn't mention what modifications, if any, were made to the target phones. A few posters here have mentioned NFC being turned off by default. Does his methods force NFC on, or work without it? But I guess reporting accuratel
My quick tests with NFC (Score:4, Informative)
I've played with distances using a few different smart cards, a USB NFC reader, and a nexus S. I couldn't get a smartcard to read through the front of the phone or the side. I could get a USB NFC reader to detect if smartphone was placed face down. From the back it is about 3 inches with a USB reader, 1-2 inches with a smartcard.
NFC is also a battery hog. I don't see having it running all the time.
Re:Fact? Who needs em. (Score:5, Informative)
Here are some videos [forbes.com]. He represents the phones as unmodified, though running an old version.
The distance isn't so much of an issue because he was able to use an NFC tag, not a transmitter, not an active device of any kind, but a mere tag to cause the phone to switch on its bluetooth radio and give him a sudoer's command line over the BT radio. An attacker could hide an NFC tag in a table or at waist level in a public place, or in a tag that's disguised to be legitimate, where people are liable to stand for more than 10 seconds: the tag cracks the phone open, and then someone with a laptop within BT distance conducts a brief session to grab what they can, or install a rootkit.
Re: (Score:2)
NFC is very short range. Centimeters. The devices would have to touch or very nearly touch, although modified attack hardware (stronger antennas) would probably allow some leeway.
NFC is enabled by default on the Galaxy Nexus and (I believe) the Nexus S. But it's trivial to disable (Settings -> More -> NFC) and AFAIK cannot be forced on unless you compromise the device via some other vector (at which point, you're already screwed).
Furthermore, the article on Ars states that most of the exploits were fo
Re:Fact? Who needs em. (Score:4, Informative)
The near field is within the first 1.5 wavelengths of the frequency used. It has certain special properties related to it having a higher (proportionally) density of virtual photons entangled with the source antenna than does the far field.
(A connection on the near field will actively change the resistance and resonance characteristics of the signalling antenna, where a far field connection will not.)
Giving a set distance is moot. Saying it is near field is accurate, and sufficient. The distance in which NFC is possible is inseperable from the chosen comm frequency. A very short wavelength frequency will have a very tiny near field. A long wavelength frequency will have a very large near field.
Cellular devices in the ghz band will have only a few millimeters around the antenna as the NFC reception range.
The deal that I would consider to be the threat, is that you can't have a near field without a far field. The far field will also have broadcasted data encoded into it, and will travel much further. It could well be intercepted.
Re: (Score:2)
They are probably relying on the fact that the falloff of the energy is inverse cube, and that total energy in the antenna is very very low.
Communication probably has more to do with antenna coupling than with actual carrier wave data.
However, signal only falls off to approaching zero. It never reaches it. It instead is more appropriately described as signal entropy, where the signal is lost to random fluctuations. However, a cleverly designed listening device inside the nearfield zone could get useful sign
Out-of-band comm + PKE = enough security (Score:5, Interesting)
One, both sides of the conversation should know "something" about who they are talking to before engaging or continuing a transaction.
"Enough" may be nothing more than making sure a man-in-the-middle hasn't taken over the conversation.
Second, any conversation has to begin at a minimum trust level - basically "I don't trust you, you don't trust me, here's my name-of-the-day, what should I call you today?" level.
Some people have suggested public key cryptography. While this is cool, it may be simpler to use "out of band" communication to verify identities. Since phones have cameras and screens, these can provide the necessary out of band communications.
Scenario:
Say I'm at the Burger Bar and I want to buy something using my phone. My phone doesn't trust the radio signal pretending to be Burger Bar's, and Burger Bar doesn't trust that my phone isn't someone else's phone nearby.
So I use my phone to take a picture of a display at the Burger Bar order counter. This picture has a QR code for Burger Bar's public key or web site that has the public key, as well as a second, changing QR code that is my transaction ID plus some randomness. I encrypt all of this plus my made-up-on-the-spot public key plus a made-up QR code using Burger Bar's public key. I display this QR code on my phone and put it in range of the small camera at the register. Burger Bar's computer checks the QR code against what I just transmitted to verify it's my phone it's talking to.
Now we can talk to each other securely and, thanks to the ordinary security cameras that show me holding my phone close to the order counter, in a difficult-to-repudiate way.
I didn't have to give Burger Bar my phone's serial number. I didn't have to give it any identification beyond what our banks need to transact business, just as if I were using a traditional credit card or debit card payment. If we are using bit-coin or something similar, I didn't even have to give them that much - true anonymity.
Now I go enjoy my meal. Oh wait, this is Burger Bar we are talking about. Now I go ingest my mass quantities.
Burger Bar really doesn't have to use its own public key. Like me, it can make up one for this transaction. It's the taking-a-picture of the public key and transaction code that make this secure against a radio-only intercept. If there is a risk that the transaction code picture or my phone's on-screen QR code will be intercepted, it's easy enough to let the two devices look at each other in a way that's very difficult to "peek into."
Re:Out-of-band comm + PKE = enough security (Score:5, Insightful)
Well, yes, that's all great...
But the problem you need to solve is "paying for a burger with less effort than using a debit / credit card" while not being less secure.
Your solution passes on being more secure, but fails dismally at being easier.
Re: (Score:2)
Have you ever seen your average order taker/waiter try to make change?
Re: (Score:1)
this is about 2x more complicated than it needs to be. you don't need the nfc part at all to do this securely! also, the bitcoin wallet for android already does it.
Re: (Score:1)
What about malicious QR codes?
Re: (Score:2)
Nice write-up. Extremely complex and awkward in every way if you think of it in real life and according to the current state of technoloy.
Here's my version of a secure transaction at Burger bar
Ask for combo #1
Hand of five dollar bill
Get combo #1 and some change
No trace left and no security risk.
Sure, I need to acquire and carry said 5$ bill in a safe and secure manner, but they way I do it RIGHT NOW satisfies my need for privacy and security.
Re: (Score:2)
Yup, exactly:
http://www.androidcentral.com/android-nfc-hack-cool-not-new-or-dangerous [androidcentral.com]
NFC is too Functional (Score:5, Interesting)
I've long thought that NFC was a disaster waiting to happen - or really a never-ending series of disasters, just as each one is patched-over a new one will appear.
The problem is that NFC's functionallity is all out of proportion to the problem it is intended to solve. It's kind of like adding a video display when all you need is an LED indicator light. NFC is supposed to handle short and fast communications between devices that are in very close proximity. Stuff like exchanging v-cards, electronic payments at the register, kickstarting ad-hoc wifi connections, etc.
None of that stuff requires radio communications and even though NFC is designed for broadcast ranges of a couple of centimeters, that never stops the bad guy from using high-powered transmitters and ultra-sensitive antennas to do their dirty work from a more comfortable and non-obvious location.
I believe that almost everything that NFC is likely to ever be useful for could also be done with no extra hardware. Just use the camera already built into every smart-phone to take a picture of a 2d-barcode displayed by the other device. That gets you physical access controls limited by line of site and a window of opportunity limited to the second or so that the user explicitly presses the camera button.
Re: (Score:2)
I know pretty much nothing about NFC, but why can't the handshake, if there is such a thing, why can't it measure the distance between the two objects?
1ms ping back means the objects are close
10ms, the objects are too far away, handshake failure.
NFC for authentication (Score:4, Interesting)
The discussion about single point login got me thinking. Rather than having some server out there become a single point of failure, how about a device you carry with you that stores the multitude of logins and passwords? Smart phones seem capable of just that.
Has anyone come across using NFC on a phone as a login/password authentication method? Store all of your login and passwords on the phone. Then when prompted for login info (website, laptop login, etc), you use your phone.
Yeah, a whole new security nightmare. But the idea still appeals to me.
Overrated... (Score:2, Insightful)
Unfortunately, like most web sites, slashdot brings this article way too sensational, omitting most of the facts that make this a lot less impressive and worrisome.
First, at least on Android devices, NFC is only enabled when the screen is on and unlocked. That means that nobody can just walk by you and communicate to your device over NFC. You need to be already working with your phone.
Second, there is the range. NFC typically only works one or two inches away, and the two devices interacting need to be alig