Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

DARPA Funding a $50 Drone-Droppable Spy Computer

Soulskill posted more than 2 years ago | from the this-is-how-you-name-your-device dept.

Security 86

Sparrowvsrevolution writes "At the Shmoocon security conference, researcher Brendan O'Connor plans to present the F-BOMB, or Falling or Ballistically-launched Object that Makes Backdoors. Built from just the disassembled hardware in a commercially-available PogoPlug mini-computer, a few tiny antennae, eight gigabytes of flash memory and some 3D-printed plastic casing, the F-BOMB serves as 3.5"-by-4"-by-1" spy computer. With a contract from DARPA, O'Connor has designed the cheap gadgets to be spy nodes, ready to be dropped from a drone, plugged inconspicuously into a wall socket, (one model impersonates a carbon monoxide detector) thrown over a barrier, or otherwise put into irretrievable positions to quietly collect data and send it back to the owner over any available Wi-Fi network. O'Connor built his prototypes with gear that added up to just $46 each, so sacrificing one for a single use is affordable."

cancel ×

86 comments

Sorry! There are no comments related to the filter you selected.

this is awesome (4, Funny)

masternerdguy (2468142) | more than 2 years ago | (#38846145)

But what happened to using cockroaches as the spies of the future?

Re:Cockroaches (5, Funny)

Lab Rat Jason (2495638) | more than 2 years ago | (#38846205)

They respond unfavorably to being impacted by a presidential shoe.

Re:Cockroaches (1)

Yvan256 (722131) | more than 2 years ago | (#38846323)

So does the spy listening to the audio signal coming in from the cockroach.

Re:Cockroaches (-1)

Anonymous Coward | more than 2 years ago | (#38846367)

Ooh, well done you for getting the reference. Aren't you clever?

Re:this is awesome (0)

Anonymous Coward | more than 2 years ago | (#38846585)

Keith Richards sued.

Funding (5, Funny)

TitusC3v5 (608284) | more than 2 years ago | (#38846191)

I drop F-bombs all the time, at a considerably cheaper cost.

Re:Funding (1)

Anonymous Coward | more than 2 years ago | (#38846437)

I guess that explains why your enemies developed those SOAP missiles. They're great for dealing with F-bombs. :)

Re:Funding (1)

Mister Transistor (259842) | more than 2 years ago | (#38846741)

SOAP got put on the shelf. Haven't you been paying attention to current affairs?

Re:Funding (0)

Anonymous Coward | more than 2 years ago | (#38846863)

I heard Congress was thinking about dropping the SOAP.

Report over WiFi??? (0)

Anonymous Coward | more than 2 years ago | (#38846223)

Is it normal for a warzone to have functioning WiFi?

Re:Report over WiFi??? (2)

ColdWetDog (752185) | more than 2 years ago | (#38846353)

Is it normal for a warzone to have functioning WiFi?

Sure, just like it's normal to take things that drop out of the sky and plug them into the wall.

Re:Report over WiFi??? or power (1)

WillAffleckUW (858324) | more than 2 years ago | (#38846515)

Is it normal for a warzone to have functioning WiFi?

Sure, just like it's normal to take things that drop out of the sky and plug them into the wall.

Well, if they're USB 3.0, sure.

Re:Report over WiFi??? (4, Insightful)

Esteanil (710082) | more than 2 years ago | (#38846669)

Sure, just like it's normal to take things that drop out of the sky and plug them into the wall.

Yup, that's normal.

According to a test run by Homeland Security:

Computer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers. And if the drive or CD had an official logo on it, 90% were installed.

Borrowed from Bruce Schneier ( http://www.schneier.com/blog/archives/2011/06/yet_another_peo.html [schneier.com] )

Re:Report over WiFi??? (1)

Mister Transistor (259842) | more than 2 years ago | (#38846771)

And if the drive or CD had an official logo on it, 90% were installed

What, like Vestron Video or Vivid Entertainment?

Re:Report over WiFi??? (5, Insightful)

icebike (68054) | more than 2 years ago | (#38846823)

Also Borrowed from the same source:

The problem is that the OS trusts random USB sticks. The problem is that the OS will automatically run a program that can install malware from a USB stick. The problem is that it isn't safe to plug a USB stick into a computer.

To which the proper response is:

The problem is the operating system you've chosen Mr. Schneier.

Re:Report over WiFi??? (2, Insightful)

Anonymous Coward | more than 2 years ago | (#38847051)

You know Mr. Schneier doesn't actually get to choose the OS for every machine in the world (much as he might like to), right? As long as some people (most of whom are neither the famous security analyst Bruce Schneier, nor any other Mr. Schneier) do in fact choose Windows for real installations, that makes Windows's trust of random USB sticks a real problem. What sort of security analyst do you suppose sticks their head in the sand?

Moreover, whatever OS you'd favor (I'd guess Linux, though with a 5-digit UID you've probably actually heard of other free *N*Xen) is likely vulnerable as well. No, not to the simple autorun approach, since it doesn't trust filesystems -- but it probably does trust USB sticks plugged in. Say the USB stick contains a hub, a mass storage device, and an HID* -- can you tell me your favored OS, in a typical desktop config, will not accept keystrokes and pointer commands from the HID?

* I'm sure it's obvious, but the HID could either inject a stored keystroke sequence (e.g. to download an exploit from the internet), or receive remote commands via RF -- combine with a TEMPEST rig to maximize shits and giggles.

Re:Report over WiFi??? (1)

subk (551165) | more than 2 years ago | (#38853189)

To which the proper response is:

The problem is the operating system you've chosen Mr. Schneier.

Umm... Windows has a policy kit. Have you heard of it?

Re:Report over WiFi??? (1)

EETech1 (1179269) | more than 2 years ago | (#38848317)

Maybe they build a mesh network! That's why they drop 1000.

Re:Report over WiFi??? (1)

ackthpt (218170) | more than 2 years ago | (#38846363)

Is it normal for a warzone to have functioning WiFi?

At the rate Iran is going, with creating its own walled-off internet you may find it, but it can't communicate out.

As for North Korea .. pfft. There's probably only one cell phone in the country and it's in the hands of Dear Chubby and absolutely no Star Bucks.

Re:Report over WiFi??? (3, Insightful)

masternerdguy (2468142) | more than 2 years ago | (#38846415)

They have limited access cyber cafes that run a government monitored and filtered internet via a North Korean Linux distribution. Linux being used as a tool of oppression really pisses me off.

Re:Report over WiFi??? (1)

i.r.id10t (595143) | more than 2 years ago | (#38847609)

Unfortunately for you, part of the definition of Free software is that the license can't discriminate against persons or groups, and the license can't discriminate against fields of endeavor.

Of course, with the "integrity of the author's source code" clause, Linus et. al could force Best Korea to use a name other than "Linux" (or whatever app/chunk-o-code/etc you care to think about) in order to protect the reputation of the name "Linux".

Re:Report over WiFi??? (2)

jamstar7 (694492) | more than 2 years ago | (#38846487)

As for North Korea .. pfft. There's probably only one cell phone in the country and it's in the hands of Dear Chubby and absolutely no Star Bucks.

Yeah, that'd be ample reason to invade them. Gotta be a bigtime market there for cheap throwaway cell phones, overpriced coffee and all the rest of the 'benefits' of 'civilisation'. They find any oil under Pyongyang yet?

Re:Report over WiFi??? (0)

Anonymous Coward | more than 2 years ago | (#38846607)

If there was oil, we'd be halfway there, but there's that little issue of the nukes, too.

The US doesn't attack anyone that could defend themselves or retaliate.

Re:Report over WiFi??? (1)

Goaway (82658) | more than 2 years ago | (#38846631)

What exactly are you imagining a "warzone" is in this day and age?

Re:Report over WiFi??? (3, Funny)

ColdWetDog (752185) | more than 2 years ago | (#38846885)

What exactly are you imagining a "warzone" is in this day and age?

Cleveland?

Re:Report over WiFi??? (1)

couchslug (175151) | more than 2 years ago | (#38846897)

"Is it normal for a warzone to have functioning WiFi?"

Soon, impatient one, soon....

Cheaper (1)

Anonymous Coward | more than 2 years ago | (#38846233)

If you really want to break the enemy send them a Nintendo Wii.

Re:Cheaper (2)

ackthpt (218170) | more than 2 years ago | (#38846467)

If you really want to break the enemy send them a Nintendo Wii.

The advice of Jimmy Buffett - Fly over and drop millions of five dollar bills. A week later, fly over and drop off mail order catalogs. Peace, full employement and um.. underwear.

Often wondred if that approach would actually be more effective.

Re:Cheaper (1)

artor3 (1344997) | more than 2 years ago | (#38847177)

Sadly, in most places where we might want to do such a thing, the local government/warlords would drive around, take all the money, and kill anyone who tried to keep some for themselves.

Really.... (2, Funny)

Anonymous Coward | more than 2 years ago | (#38846241)

They're calling it the F-BOMB? Fuck that.

Coverage? Can you hear me now? (4, Interesting)

Marxist Hacker 42 (638312) | more than 2 years ago | (#38846257)

"over any available Wi-Fi network."

In cities this may not be a problem (though who runs an unencrypted Wifi AP in the city?!!?!?) but in rural areas I suspect WIFI may be hard to come by. It needs a better backup.

Re:Coverage? Can you hear me now? (2)

ackthpt (218170) | more than 2 years ago | (#38846337)

"over any available Wi-Fi network."

In cities this may not be a problem (though who runs an unencrypted Wifi AP in the city?!!?!?) but in rural areas I suspect WIFI may be hard to come by. It needs a better backup.

So avoid AT&T territory...

Re:Coverage? Can you hear me now? (1)

Marxist Hacker 42 (638312) | more than 2 years ago | (#38846391)

Pretty easy on my brother's farm- there are loads of places where we have NO cell signals at all.

Re:Coverage? Can you hear me now? (0)

Anonymous Coward | more than 2 years ago | (#38846571)

How big is a 3g module? Does the enemy sell prepaid sim-cards by mail-order to foreign lands or could we do roaming? At least we could use this thing with 3g in our country against our citizens...

Seriously, though (and I didn't rtfa), wouldn't one want to ruggedize the board itself and not go with an off-the-shelf plug computer?

And as for great firewalls and government control of the internet and such, they could load it with FreedomBox [freedomboxfoundation.org] (sooner or later) to have it use TOR and mesh networking (later) and stuff. Possibly at least as ironic as any of the examples in that song...

It's like ra-e-ain
on your wedding day

It's the wo-o-orld bully
using freedombox to oppress you

isn't ironic, don't you think?

Re:Coverage? Can you hear me now? (1)

icebike (68054) | more than 2 years ago | (#38846779)

>Seriously, though (and I didn't rtfa), wouldn't one want to ruggedize the board itself and not go with an off-the-shelf plug computer?

Go ahead and read the article, we will wait.......

The article talks about a number of different things, wall-wart style from the plug computer that an insider can park in a broom closet, to the innocuous looking useful device (gas leak detector, smoke alarm) that you hope to dupe some local into picking up and plugging in.

The story also talked about AA battery powered devices which would just be tossed into the shrubbery or air dropped. Realistically these would never have enough battery power to last long enough to crack even basic wifi encryption, let alone transfer any meaningful amount of data. Probably intended to last just long enough for dumping a worm or virus onto the local wifi.

Re:Coverage? Can you hear me now? (0)

Anonymous Coward | more than 2 years ago | (#38847303)

Plug-in GSM modules can be had for $50 new (plus SIM card).

Re:Coverage? Can you hear me now? (1)

condition-label-red (657497) | more than 2 years ago | (#38847433)

Who's to say it would not be capable of cracking WEP, etc. to get access to encrypted APs? It seems that the encryption on many APs is (reasonably) crackable these days.

So, if I demonstrate dropping one of these... (1)

Trailer Trash (60756) | more than 2 years ago | (#38846315)

on TV will the FCC fine me?

Spook Backdoors in Cisco Routers (continued) (-1, Offtopic)

Anonymous Coward | more than 2 years ago | (#38846319)

Spook BackDoors In Cisco Routers
- Older news, but still relevant!!
    Please save this story and repost it everywhere
    Especially in Security Discussion Forum Sites
- You should use OpenBSD or a hardened Linux distro
    For a router, NOT these blackboxes offered with
    proprietary hardware & firmware!

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html [forbes.com]

"Special Report
Cisco's Backdoor For Hackers
Andy Greenberg, 02.03.10, 01:45 PM EST
The methods networking companies use to let the Feds watch suspects also expose the rest of us.

ARLINGTON, Va. -- Activists have long grumbled about the privacy implications of the legal "backdoors" that networking companies like Cisco build into their equipment--functions that let law enforcement quietly track the Internet activities of criminal suspects. Now an IBM researcher has revealed a more serious problem with those backdoors: They don't have particularly strong locks, and consumers are at risk.

In a presentation at the Black Hat security conference Wednesday, IBM ( IBM - news - people ) Internet Security Systems researcher Tom Cross unveiled research on how easily the "lawful intercept" function in Cisco's ( CSCO - news - people ) IOS operating system can be exploited by cybercriminals or cyberspies to pull data out of the routers belonging to an Internet service provider (ISP) and watch innocent victims' online behavior.

But the result, Cross says, is that any credentialed employee can implement the intercept to watch users, and the ISP has no method of tracking those privacy violations. "An insider who knows the password can use it without an audit trail and send the data to anywhere on the Internet," Cross says.

Cross told Cisco about his findings in December 2008, but with the exception of the patch Cisco released following the revelation of its router bug in 2008, the security flaws he discussed haven't been fixed. In an interview following Cross' talk, Cisco spokeswoman Jennifer Greeson said that the company is "confident in its framework." "We recognize that security is complicated," she said. "We're looking at [Cross'] findings and we'll take them into account."

Cisco isn't actually the primary target of Cross' critique. He points out that all networking companies are legally required to build lawful intercepts into their equipment.

Special Report
Cisco's Backdoor For Hackers
Andy Greenberg, 02.03.10, 01:45 PM EST
The methods networking companies use to let the Feds watch suspects also expose the rest of us.

ARLINGTON, Va. -- Cisco, in fact, is the only networking company that follows the recommendations of the Internet Engineering Task Force standards body and makes its lawful intercept architecture public, exposing it to peer review and security scrutiny. The other companies keep theirs in the dark, and they likely suffer from the same security flaws or worse. "Cisco did the right thing by publishing this," says Cross. "Although I found some weaknesses, at least we know what they are and how to mitigate them."

The exploitation of lawful intercept is more than theoretical. Security and privacy guru Bruce Schneier wrote last month that the Google ( GOOG - news - people ) hackings in China were enabled by Google's procedures for sharing information with U.S. law enforcement officials. And in 2004 and 2005, a group of hackers used intercept vulnerabilities in Ericsson ( ERIC - news - people ) network switches to spy on a wide range of political targets including the cellphone of Greece's prime minister.

All of that, argues IBM's Cross, means that Internet-related companies need to be more transparent about their lawful intercept procedures or risk exposing all of their users. "There are a lot of other technology companies out there that haven't published their architecture, so they can't be audited," he said in his Black Hat talk. "We can't be sure of their security as a result."

- http://search.forbes.com/search/colArchiveSearch?author=andy+and+greenberg&aname=Andy+Greenberg [forbes.com]

(C) forbes.com

Lest we forget Part 1:

https://www.networkworld.com/community/node/57070 [networkworld.com]

"Cisco backdoor still open
IBM researcher at Black Hat says opening for Feds exposes us
By Jim Duffy on Wed, 02/03/10 - 5:33pm.

The "backdoors" that Cisco and other networking companies implement in their routers and switches for lawful intercept are front and center again at this week's Black Hat security conference. A few years ago, they were cause celebre in some VoIP wiretapping arguments and court rulings.

This time, an IBM researcher told Black Hat conference attendees that these openings can still expose information about us to hackers and allow them to "watch" our Internet activity. Backdoors are implemented in routers and switches so law enforcement officials can track the Internet communications and activity of an individual or individuals under surveillance. They are required by law to be incorporated in devices manufactured by networking companies and sold to ISPs.

In this report from Forbes, IBM Internet Security Systems researcher Tom Cross demonstrated how easily the backdoor in Cisco IOS can be exploited by hackers. When they gain access to a Cisco router, they are not blocked after multiple failed access attempts nor is an alert sent to an administrator. Any data collected through the backdoor can be sent to anywhere -- not just merely to an authorized user, Forbes reports.

What's more, an ISP is not able to perform an audit trail on whoever tried to gain access to a router through the backdoor - that nuance was intended to keep ISP employees from detecting the intercept and inadvertently tipping off the individual under surveillance. But according to IBM's Cross, any authorized employee can use it for unauthorized surveillance of users and those privacy violations cannot be tracked by the ISP.

Cisco said it is aware of Cross's assertions and is taking them under consideration. To Cisco's credit, it is the only networking company that makes its lawful intercept architecture public, according to the recommendations of the IETF, the Forbes story states. Other companies do not, which means they may be susceptible to the same security flaws, or worse."

Lest we forget Part 2:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com]

"Cisco Security Advisory
A Default Username and Password in WLSE and HSE Devices
Advisory ID: cisco-sa-20040407-username
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com]
Revision 1.4
For Public Release 2004 April 7 16:00 UTC (GMT)
Contents

        Summary
        Affected Products
        Details
        Vulnerability Scoring Details
        Impact
        Software Versions and Fixes
        Workarounds
        Obtaining Fixed Software
        Exploitation and Public Announcements
        Status of This Notice: Final
        Distribution
        Revision History
        Cisco Security Procedures

Summary

A default username/password pair is present in all releases of the Wireless LAN Solution Engine (WLSE) and Hosting Solution Engine (HSE) software. A user who logs in using this username has complete control of the device. This username cannot be disabled. There is no workaround.

This advisory is available at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com] .

Affected Products

This section provides details on affected products.
Vulnerable Products

These products are vulnerable:

        The affected software releases for WLSE are 2.0, 2.0.2 and 2.5.
        The affected software releases for HSE are 1.7, 1.7.1, 1.7.2 and 1.7.3.

Products Confirmed Not Vulnerable

No other Cisco products are currently known to be affected by these vulnerabilities.

Details

A hardcoded username and password pair is present in all software releases for all models of WLSE and HSE devices.

This vulnerability is documented in the Cisco Bug Toolkit as Bug ID CSCsa11583 ( registered customers only) for the WLSE and CSCsa11584 ( registered customers only) for the HSE.

CiscoWorks WLSE provides centralized management for the Cisco Wireless LAN infrastructure. It unifies the other components in the solution and actively employs them to provide continual "Air/RF" monitoring, network security, and optimization. The CiscoWorks WLSE also assists network managers by automating and simplifying mass configuration deployment, fault monitoring and alerting.

Cisco Hosting Solution Engine is a hardware-based solution to monitor and activate a variety of e-business services in Cisco powered data centers. It provides fault and performance information about the Layer 2-3 hosting infrastructure and Layer 4-7 hosted services.

Vulnerability Scoring Details
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html [cisco.com] .

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss [cisco.com] .

Impact

Any user who logs in using this username has complete control of the device. One can add new users or modify details of the existing users, and change the device's configuration. Here are some more concrete examples of possible actions:

        For WLSE this means that an adversary can hide the presence of a rogue Access Point or change the Radio Frequency plan, potentially causing system-wide outages. The first action may cause long term loss of information confidentiality and integrity. The second action can yield Denial-of-Service (DOS).
        For HSE this may lead up to illegal re-directing of a Web site with the ultimate loss of revenue.
        In both cases the device itself may be used as a launching platform for further attacks. Such attacks could be directed at your organization, or towards a third party.

Software Versions and Fixes

When considering software upgrades, also consult http://www.cisco.com/go/psirt [cisco.com] and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

For WLSE, users need to install the WLSE-2.x-CSCsa11583-K9.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/wlan-sol-eng [cisco.com] ( registered customers only) . Installation instructions are included in the accompanying README file, WLSE-2.x-CSCsa11583-K9.readmeV3.txt, in that same download directory. This patch is applicable to WLSE 1105 and 1130 software releases 2.0, 2.0.2 and 2.5.

For HSE, users need to install the HSE-1.7.x-CSCsa11584.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/1105-host-sol [cisco.com] ( registered customers only) . Installation instructions are included in the accompanying README file, HSE-1.7.x-CSCsa11584.readme.txt, in that same download directory. This patch is applicable to HSE 1105 for versions 1.7, 1.7.1, 1.7.2, and 1.7.3.
Workarounds

There is no workaround.

Obtaining Fixed Software

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html [cisco.com] , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml [cisco.com] .

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com./ [www.cisco.com]
Customers Using Third-Party Support Organizations

Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers Without Service Contracts

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

        +1 800 553 2447 (toll free from within North America)
        +1 408 526 7209 (toll call from anywhere in the world)
        e-mail: tac@cisco.com

Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml [cisco.com] for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

Status of This Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Distribution

This advisory will be posted on Cisco's worldwide website at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com] .

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.

        cust-security-announce@cisco.com
        bugtraq@securityfocus.com
        first-teams@first.org (includes CERT/CC)
        cisco@spot.colorado.edu
        comp.dcom.sys.cisco
        firewalls@lists.gnac.com

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Revision History

Revision 1.4

2004-April-12

Fixed URL for Cisco.com Downloads under Obtaining Fixed Software section.

Revision 1.3

2004-April-08

Updated Software Versions and Fixes section.

Revision 1.2

2004-April-08

Updated to include WLSE 1105 in Software Versions and Fixes section.

Revision 1.1

2004-April-07

Correction in the Obtaining Fixed Software section.

Revision 1.0

2004-April-07

Initial public release.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html [cisco.com] . This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt [cisco.com] ."

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html?feed=rss_technology_security [forbes.com]

Cisco handholds hackers to backdoor
Routers are vunerable to wiretapping flaw
By Spencer Dalziel
Fri Feb 05 2010, 14:39

AN INSECURITY EXPERT at IBM reported to the Black Hat conference that he discovered Cisco routers are vulnerable to a potential surveillance backdoor.

According to Arstechnica, Tom Cross, security systems researcher at IBM, gave a presentation exposing the backdoor to demonstrate how the 'lawful intercept' function in Cisco's system can be targeted by hackers to gain access to data flowing through the routers.

Hackers aren't blocked after failed attempts to access a Cisco router and notification alerts aren't sent to the administrator. Making matters even worse, ISPs can't detect and track who the culprits might be because their employees aren't allowed to detect and intercept.

It is not entirely Cisco's fault. The 'lawful intercept' function was deployed after a US Federal Communications Commission (FCC) ruling a few years ago that allowed wiretapping by law enforcement agencies on all networking hardware. All telecommunications vendors had to build monitoring solutions into their hardware.

However this ruling meant all equipment with the lawful intercept functions had gaping holes that left them open to back door surveillance attacks.

Cross told Cisco about the problem in December and it issued a patch. But there are still a lot of vulnerable systems out there because network administrators haven't applied the patch.

Cisco's wiretapping system open to exploit, says researcher
By John Timmer | Published February 4, 2010 6:20 PM

To meet the needs of law enforcement, most telecommunications equipment includes hardware and software that allow for the monitoring of traffic originating with the targets of investigations. The precise capabilities are often dictated by formalized standards, which allow any hardware maker to implement a compliant system. Unfortunately, these standards often leave the hardware wide open to various attacks that leave regular users vulnerable, and provide savvy surveillance targets the opportunity to evade the snooping. An IBM researcher has put Cisco's system under the microscope at a Black Hat Conference, and found it comes up short.

Although the standard was designed to put Cisco hardware in compliance with EU directives, it has apparently been adopted by a number of other hardware makers. The presentation, described in detail by Dark Reading, describes how its reliance on SNMPv3, creates a variety of options for attack. For example, the protocol was initially vulnerable to a brute force attacks on its authentication system; although Cisco has patched that flaw, there's no way to determine how many unpatched machines remain in the wild.

SNMP also defaults to operating over UDP, and it's relatively easy to spoof things like the source address and port for that protocol. It's possible to use TCP instead, and even limit the addresses that can access the hardware, but the protocol doesn't specify either of these. Communications aren't encrypted by default, and the system won't notify administrators when a trace is activated or disabled, meaning that hackers could potentially set up or eliminate surveillance without anyone being aware of it.

The IBM researcher, Tom Cross, notified Cisco of the issues back in December, and recommends revisions to the standard that will ensure that it is more secure by default. That might be helpful, but it still wouldn't deal with the problems posed by unpatched systemsâ"Cross himself apparently recognizes that network administrators can be hesitant to risk the disruption of service that may come with updating major pieces of equipment.

Progress of World Wars? (1)

ackthpt (218170) | more than 2 years ago | (#38846325)

Once said, the next World War will be conducted with Nuclear weapons, the one following will be conducted with sticks and stones.

Looks like things are playing out a bit different.

The next World War to be conducted over networks by millions of tiny spybots?

Re:Progress of World Wars? (1)

Yvan256 (722131) | more than 2 years ago | (#38846475)

The wars of the future will not be fought on the battlefield or at sea. They will be fought in space, or possibly on top of a very tall mountain. In either case, most of the actual fighting will be done by small robots. And as you go forth today remember always your duty is clear: To build and maintain those robots.

Quote from an episode of The Simpsons.

Re:Progress of World Wars? (0)

Anonymous Coward | more than 2 years ago | (#38847935)

Yes. We know.

Do you have any insightful XKCDs to post?

Not welcome (1, Insightful)

Anonymous Coward | more than 2 years ago | (#38846339)

I hope we never meet. People who build stuff for the military are not welcome here. No, it's not cool that "one of us" gets DARPA funding. Security researcher? Arms dealer!

Re:Not welcome (2)

echo_kmem (982727) | more than 2 years ago | (#38846579)

Not all of 'us' feel as you do. Most of 'us' do it purely out of curiosity, not because we want to impress some stranger on a forum somewhere. Hackers make the world go round, money keeps the bills paid. So just because he won't be welcomed in your basement does not mean I won't invite him down to mine.

Re:Not welcome (1)

perryizgr8 (1370173) | more than 2 years ago | (#38846915)

imo, awesome new weapons tech == good

Re:Not welcome (1)

couchslug (175151) | more than 2 years ago | (#38846919)

Where is "here"?

The world has always been a nasty place and being able to wage war is useful.

Re:Not welcome (0)

Anonymous Coward | more than 2 years ago | (#38847085)

That's just like your opinion, man. I've got no problems with military research; wouldn't mind joining such a project myself.

Re:Not welcome (1, Insightful)

houstonbofh (602064) | more than 2 years ago | (#38847121)

The Internet was one of those things built for the military... Funded by DARP too. Doh!

Not as usable as you think (1)

girlintraining (1395911) | more than 2 years ago | (#38846347)

They might be great against an adversary that knows they're being actively surveilled or to gather data in real time, but there's nothing covert about this. You're not going to see them dropping these on targets of interest that they want to remain unaware that they're being watched.

Re:Not as usable as you think (0)

Anonymous Coward | more than 2 years ago | (#38846511)

For $46, you could drop a million of them. Now imagine having enough boots on the ground to *remove every single one of them.*

Re:Not as usable as you think (1)

frosty_tsm (933163) | more than 2 years ago | (#38847161)

For $46, you could drop a million of them. Now imagine having enough boots on the ground to *remove every single one of them.*

Or more realistically, the enemy will just relocate.

Re:Not as usable as you think (0)

Anonymous Coward | more than 2 years ago | (#38848061)

Only if he can get out from under a million spy computers

An interesting use for Raspberry Pi (1, Insightful)

scottbomb (1290580) | more than 2 years ago | (#38846433)

The article doesn't say, but I suspect the computer is Raspberry Pi. Throw in a cellphone-based modem, camera, and microphone and you've got yourself a spy.

Re:An interesting use for Raspberry Pi (1)

echo_kmem (982727) | more than 2 years ago | (#38846491)

I think the Raspberry Pi's are targeted for Schools and Developing Countries, I do not think they are available to the public, least at this time. PogoPlugs have been around a bit and seem to run twice as much as the suggested on the Raspberry Pi's. http://www.amazon.com/Pogoplug-Media-Sharing-Device-Remote/dp/B005DB6NG6/ref=dp_cp_ob_e_title_1 [amazon.com]

Re:An interesting use for Raspberry Pi (2)

Osgeld (1900440) | more than 2 years ago | (#38846731)

Nevermind the PI's are JUST NOW starting production, its in the fucking second sentence!

"Built from just the disassembled hardware in a commercially-available PogoPlug mini-computer"

now goto a website called google.com and type in PogoPlug and see what pops up ... now is that a Raspberry PI?

damnit man!

Re:An interesting use for Raspberry Pi (1)

element-o.p. (939033) | more than 2 years ago | (#38847115)

Raspberry Spi?

Re:An interesting use for Raspberry Pi (0)

Anonymous Coward | more than 2 years ago | (#38850875)

"Built from just the hardware in a commercially-available PogoPlug mini-computer"
I'm pretty sure it does say, and no, it's not an RPi. :)

Re:An interesting use for Raspberry Pi (1)

SpaceLifeForm (228190) | more than 2 years ago | (#38851825)

It is easier and cheaper just to con sheeple into paying for the phone. They will keep it charged so the spying package works properly.

Not exactly "drone deliverable" (0)

Anonymous Coward | more than 2 years ago | (#38846455)

The article had a pic of one disguised within a Carbon Monoxide Detector. That's not exactly a form-factor that could be deliverable by a drone, or is a drone the new DARPA employee?

I wouldn't mind doing some shady activities to get the attention of DARPA, and they can install one of these discreetly in my easy-chair and I'll induct enough electrical disturbance so they bring me another couple and I'll flash them together so I can run some shells for wget to point at their website endlessly like what LOIC does. I wonder if maybe their software runs like Tivo and I don't even need to replace all their shit but maybe just spawn another shell to run what I want and cripple their ssh/telnet and top and ps console tools to not show my wget process on the tasklist. hmmm, endless posibilities.

Re:Not exactly "drone deliverable" (1)

swalve (1980968) | more than 2 years ago | (#38848259)

I think the goal is to drop "interesting" things. A single CO detector isn't interesting, but maybe a case of them is. Someone sees a single thing sitting there, it looks suspicious. But you see a shipping case full of things? "Whoops, it fell off a truck."

Similar project with less hardware hacking (2)

bongk (251028) | more than 2 years ago | (#38846457)

I recently started a similar project based on the $23 TPLink TL-WR703N travel router. Without any need for soldering or other "hardware hacking" you can build a battery-operated network drop box running OpenWrt linux.
http://www.minipwner.com/ [minipwner.com]

There is a serial interface on the circuit board for the WR703N but you have to crack the box and do some soldering to connect to it. I've been toying with the idea to do just that to interface it with an arduino/parallax processor or sensors or whatever. I'm also playing with connecting a USB sound card and adding a microphone to record audio in the local range of the box.

Oblig (2)

pesho (843750) | more than 2 years ago | (#38846553)

Can you build a Beowulf cluster if a B52 carpet bombs you with these?

Hide them in cell phones (1)

PolygamousRanchKid (1290638) | more than 2 years ago | (#38846613)

Flood the market of the target country with modified cheap cell phones that include this capability hidden inside. Presto, involuntary Spy Nation! Maybe so US cell carriers have some experience that they could share here with the technology.

The higher ups in such countries will want to have contraband high-end smart phones. Stuff 'em with all kinds of spy goodies, including a remotely activated battery bomb. When some particularly nasty critter answers the phone, relieve him of the weight on his shoulders.

Re:Hide them in cell phones (2)

VortexCortex (1117377) | more than 2 years ago | (#38846743)

If you're going to perform an act of war, it would be best to target their military installations. Targeting the general public with Trojan Remote Detonation Phones just might cause a bit more backlash than needed.

Re:Hide them in cell phones (1)

I Read Good (2348294) | more than 2 years ago | (#38847071)

Not if you're fighting an insurgency made up of folks who are not affiliated with a military.

Wifi? That's secure. (0)

Anonymous Coward | more than 2 years ago | (#38846645)

I thought the whole point of bugging someone (spy wise, not by repeatedly poking them in the arm) was that they would not know about it.

Any monkey with a $25 Ralink adapter and a copy of Backtrack can pretty much uncover/uncloak and record just about any Wifi network out there. Yeah, it might be WPA2 encrypted, but there's nothing stopping you from figuring out where the source is or determining the presence of an unidentified emitter. I personally mapped out my entire house, and using a set of coloured heat maps I can practically draw a radius around an emission point to determine where my neighbours APs are located within their houses. So if my smoke alarm or CO2 detector was emitting an 802.11 compliant signal, I'd know about it. And you can be damned sure that- if that unit didn't explicitly market a Wifi feature- I'd take it out on the driveway and go Office Space on its ass.

This whole project reeks of another off-the-shelf military project, actually. I don't think they're using Wifi because they have to, but rather because it's cheap and you can get lots of cheap parts to build stuff with that happen to run on 802.11. Reminds me of an article I read once about a fairly hefty piece of military equipment. Some dude found some robotic parts in a warehouse, and wanted to know what they came off of because of the strange controls associated with the HID portion of what he bought. When he traced it back and found some more equipment from the same project for sale, among those things was a friggin' WRT54G Linksys router with a few cables soldered to it for remote status LEDs.

But I'm sure the defence contractor is charging a couple million for a lame idea and $30 worth of parts.

-AC

Re:Wifi? That's secure. (1)

swalve (1980968) | more than 2 years ago | (#38848263)

Not if the thing only turns on briefly, and the data is gone by the time they find it.

WTF (2, Insightful)

wbr1 (2538558) | more than 2 years ago | (#38846727)

If you drop it from a drone? Some retard is going to say oh, look a free carbon monoxide detector. I need to plug this into my mud hut next to my poppy field, how convenient! If you have to have them plugged in, why not just send them with the troops?

If we can make tracking devices that we use on whales, sharks, bears, etc, that are self powered, unobtrusive to the animal, and auto-upload to satellite or base station, we have to rely on some twerp plugging in the device -and- for free WiFi to be available for a military device? Pshaw.

And people complain about dropping DARPA funding. With idiotic projects like this we damn sure should.

Re:WTF (1)

Anonymous Coward | more than 2 years ago | (#38846945)

The carbon monoxide detector was merely a cited example. FTFA: "'It can fit whatever use case you want,' he says. 'Put it in a box of stale Triscuits in the office kitchen, and no one will touch it. Or hide it in a carbon monoxide detector and you can leave it there for months.'"

And people complain about dropping public education funding. With terrible reading comprehension like this we damn sure should.

Re:WTF (1)

wbr1 (2538558) | more than 2 years ago | (#38847047)

So, you are going to drop a stale box of Triscuits from a drone into a break room. What technology performs that miracle?

Re:WTF (0)

Anonymous Coward | more than 2 years ago | (#38850657)

Why do would you be limited to just those examples? If dropped by a drone near a small primitive village, you could disguise it as some animal turd. Probably nobody will take notice of it then and it could record the comings and goings for a very long time!

Re:WTF (1)

CAIMLAS (41445) | more than 2 years ago | (#38846993)

Strap a battery on it and they can drop it inside a rugged plastic case some unobtrusive solar collectors and it'd have days+ of runtime, capable of sitting in a field or roadside w/o anyone noticing.

Thumb drives (2)

JaneTheIgnorantSlut (1265300) | more than 2 years ago | (#38846773)

Why not just drop $1.00 thumb drives loaded with spying software? 95% of the folks that find them will simply plug them into their computers (home or work) and "you're in".

Domestic use (1)

enrevanche (953125) | more than 2 years ago | (#38846807)

It seems the real use of these would be domestic spying where wifi is more likely available. Even more likely is eventually equipping them with 3g or 4g. This would be usable in the US where for a fee they could get a wireless company or two to cooperate.

All have become enemies foreign and domestic (2, Funny)

Anonymous Coward | more than 2 years ago | (#38846809)

If I were ever impaneled on a jury and this sort of thing were submitted as evidence by the prosecution and the defendant were "majority", nullification.

I am WHITE
I eat PORK
I own PROPERTY
How DARE you treat those like me and those as one would the enemy for the sake of buying crude petroleum and selling Treasuries!

Re:All have become enemies foreign and domestic (0)

Anonymous Coward | more than 2 years ago | (#38846909)

I dare you to make less sense.

OMFG. (1)

Anonymous Coward | more than 2 years ago | (#38847087)

Okay, first, can we stop naming things so they'll come out with acronyms that mean funny things? As founder of the Society That Ostensibly Pushes Termination of Hilarious Atrocities Today, or S.T.O.P. T.H.A.T., I can tell you we work diligently to bring this kind of nonsense to a halt. Why can't the government come up with better names like in the old days, with Carnivore and Echelon, Blackhawk, and the Thud?

Second... how is that made from parts from a mini-computer? A Mini-computer is the size of a fridge. Have we forgotten that, and so now the microcomputer is just the computer, and now the "mini-computer" is the new, even smaller than a microcomputer? So I guess soon, they'll have computers you can fit into the gemstone setting on a ring, and they'll call THOSE microcomputers. This is particularly a shame because I was looking forward to nanocomputers, picocomputers, and femptocomputers. But I guess we're just going to keep reusing computer, mini-computer, and microcomputer.

Sad.

power (0)

Anonymous Coward | more than 2 years ago | (#38847193)

power is always a problem

Stupid Government (0)

Anonymous Coward | more than 2 years ago | (#38847455)

Our government is teaching the world, and eventually we will have infinitely cheap spybots patrolling the planet. You wont even know which ones belong to which government.

Geek's Paradise? (0)

Anonymous Coward | more than 2 years ago | (#38847649)

Electronic parts falling from the sky. It sounds like hacker manna. My first thought was actually that they could throw these in a melting pot and get some metals out of them; but I suspect you'd need way too many for it to be worth it.

BS (1)

Whiteox (919863) | more than 2 years ago | (#38847663)

because of SSID and passwords.

That term, "mini-computer"... (1)

jonadab (583620) | more than 2 years ago | (#38847743)

> Built from just the disassembled hardware in a ... mini-computer,
> ... the F-BOMB serves as 3.5"-by-4"-by-1" spy computer.

I don't think the summary author knows what it means.

3D printed casing? (1)

ajlitt (19055) | more than 2 years ago | (#38847957)

I'm glad they used the most modern technology to make something more fugly and less rugged than a $5 Bud box.

mass production approach (1)

Max_W (812974) | more than 2 years ago | (#38848697)

Why just not install the "F-bomb" into each operation system at the factory? Why spread them from airplanes? Nowadays almost each computer has got a mike and a camera.

And activate it only when necessary by a special encrypted signal from the central office. What could possibly go wrong?

Old idea from but you can soon make your own cheap (1)

Stu101 (1031686) | more than 2 years ago | (#38848867)

As above, this idea was first put onto paper with the set of books How to Steal a continent and was called a creeper box.

I wanted to do the same with a rasperberrypi when they first come out, as it again is dirt cheap and has all the requirements (save a compatable wifi). It has no moving parts, draws a very small amount of power.

The only issue I'd have is could a battery package be made small enough to provide several weeks of uptime without making it huge ?

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>