Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Scientists Demonstrate Virus That Spreads Across Wi-Fi Access Points

Soulskill posted about 6 months ago | from the proof-of-concept dept.

Security 68

An anonymous reader writes "Researchers at the University of Liverpool have shown for the first time that WiFi networks can be infected with a virus that can move through densely populated areas as efficiently as the common cold spreads between humans. The team designed and simulated an attack by a virus, called 'Chameleon,' that not only could spread quickly between homes and businesses, but avoided detection and identified the points at which WiFi access is least protected by encryption and passwords. The research appears in EURASIP Journal on Information Security." The technical details are explained in the journal article.

cancel ×

68 comments

Sorry! There are no comments related to the filter you selected.

Scientists Rabid (0)

smitty_one_each (243267) | about 6 months ago | (#46342031)

Scientists rabid
Spreading viri like fur
Are a damaging habit
Against which suds can ensure
Burma Shave

Re:Scientists Rabid (-1)

Anonymous Coward | about 6 months ago | (#46342655)

Nigger

Keyword; simulated (3, Insightful)

complete loony (663508) | about 6 months ago | (#46342097)

Sure it's easy to model the spread of a virus. It's another thing entirely to write one that can run on every commodity access point, with sufficient CPU power to crack all nearby passwords / keys.

Re:Keyword; simulated (3, Informative)

khasim (1285) | about 6 months ago | (#46342183)

My problems with TFA are:

1. Are they being paid by the word because they're throwing massive amounts of bullshit into it.

2.

A new form of compromised AP attack has been demonstrated and analysed in [4], called the 'Chameleon' attack, perpetrated by the Chameleon virus.

That would be a "worm". Not a "virus". And a worm that attacks WiFi routers is NOT new.

Re:Keyword; simulated (1)

noh8rz10 (2716597) | about 6 months ago | (#46342357)

can somebody clarify once and for all the difference between a worm and a virus? some concrete examples would be helpful too.

Re:Keyword; simulated (5, Informative)

khasim (1285) | about 6 months ago | (#46342437)

Worms hop from system to system without the need for any human interaction. They exploit vulnerabilities in services listening on ports. Worms need a network.

A virus infects other files with copies of itself. But an uninfected machine still needs someone to run one of those files on the uninfected machine to infect the uninfected machine.

Viruses are a lot less common now. Mostly you see trojans and worms and "blended" threats that are a mix of trojans and worms.

Re:Keyword; simulated (1)

gIobaljustin (3526197) | about 6 months ago | (#46342511)

That might be the case, but it might also not be the case.

good explanation. no message within (1)

raymorris (2726007) | about 6 months ago | (#46342657)

As the subject says, there's no message here. Just a thumbs up to khasim's post.

Re:Keyword; simulated (1)

BitZtream (692029) | about 6 months ago | (#46344593)

You're using your own personal definition of virus unlike the rest of the world.

A worm generally causes no damage and just likes to spread. Virii generally cause damage and spread.

For the most part however, they are the same thing and its really a matter of malicious intent that makes the difference.

For instance, the sendmail worm (which you probably aren't old enough to even know about) had the effect of a virus simply because it was so prolific and spread so quickly thanks to the backdoor built into sendmail. It broke many mail systems, because it spread onto itself as well as new hosts, and it was wicked fast about it (for the time) so it overloaded mail servers to a non-functional state.

Still a worm though, because that overload was a bug, not a feature.

Had the overload been intentional, it would have been a virus.

PLENTY of Viruses over the years moved from machine to machine without any human interaction at all. Its like you've been in your own little world the last 20 years.

Re:Keyword; simulated (1)

BitZtream (692029) | about 6 months ago | (#46344601)

I should have added:

When everything became networked, viruses no longer required human interaction and sneaker net to be prolific.

Re:Keyword; simulated (1)

Anonymous Coward | about 6 months ago | (#46345833)

No. You shouldn't have. You should have gone off and learned the subject matter you are trying to tech before trying to "teach" your misinformation to others.

Re:Keyword; simulated (3, Insightful)

Zero__Kelvin (151819) | about 6 months ago | (#46345777)

"You're using your own personal definition of virus unlike the rest of the world."

Oh, the irony. You just randomly made up your own definitions after accusing the (much more correct) OP of the same.

"A worm generally causes no damage and just likes to spread."

There is no stipulation regarding payload or lack therof for a worm. What makes it a worm rather than a virus is that it is an independant, stand alone program or file that doesn't attach itself to a host program or other file.

" Virii generally cause damage and spread."

Again, no payload stipulation is appropriate. What makes it a virus is that it attaches to a host program or other file and spreads by attaching to other host programs or files.

"Still a worm though, because that overload was a bug, not a feature."

Again, no. The RTM Worm was a worm because it did not attach to other programs; it was an independant program. Payload has absolutely nothing to do with it. The trouble it caused could have been quite intentional and that wouldn't change a thing. It was a worm regardless of the payload or lack therof.

Re:Keyword; simulated (2)

doas777 (1138627) | about 6 months ago | (#46345081)

Good distinctions, but a point of clarification. Worms are self contained and target Systems (OSs, embedded devices of particular make, etc). They contain all the code necessary to spread from system to system using whatever media they are designed for. Viruses target applications with communciations capabilities. A spam virus for instance generally targets an email client for instance. the virus requires the vulnerable application to transmit itself from vulnerable system to vulnerable system however; that code is not contained in the virus. Viruses do not require human interaction as a rule (some do, some don't). Automatic application updates and hardened code on the few types of applications capable of supporting a virus, have largely made them extinct. Trojans DO require human intervention, but are the most flexible. Worms and Viruses are peer-to-peer only, whereas Trojans are client-server. For instance Drive By Download attacks from malicious web sites are now the infection-vector of choice these days, because it requires as little human interaction as possible. The malware described here, would be a worm, because it is spreading of its own accord, and does not target a specific communications application.

Re:Keyword; simulated (0)

Anonymous Coward | about 6 months ago | (#46351045)

"blended" threats

Is that your way of saying that viruses and worms are, in fact, the same thing?

Re:Keyword; simulated (2)

FireFury03 (653718) | about 6 months ago | (#46344201)

Sure it's easy to model the spread of a virus. It's another thing entirely to write one that can run on every commodity access point, with sufficient CPU power to crack all nearby passwords / keys.

Doesn't need to do that: crack the wifi key and you now have access to the whole network. From there you can install on *any* insecure device on the network - be it the AP itself, a Windows workstation, a NAS, smart TV, printer, whatever. If the device in question has its own wireless NIC (which is frequently the case if you've infected something like a laptop or smartphone) then you can find another wifi network, crack that, install on any device you find therein, rinse and repeat. Especially good for devices like laptops and phones which physically move around so can probably infect geographically separated networks (think: home user bringing their infected phone into work - the phone doesn't need to already be authorised to log into the office wifi network for it to sit there all day, every day, cracking the damned thing!).

A Wifi Virus?! (3, Funny)

Anonymous Coward | about 6 months ago | (#46342101)

We shall call it...the Flappy Bird Flu.

You're welcome.

They called it what now? (0)

Anonymous Coward | about 6 months ago | (#46343383)

As a more general rule scientists need a crash course in naming their research. I wonder how this one went - "Hey, we're researching a computer virus that behaves like a real-world biological virus and we'll call it Chameleon, because LOGIC!"

Re:They called it what now? (1)

SpzToid (869795) | about 6 months ago | (#46343933)

That whoosh generated a sonic boom or something.

PostScript Virus (5, Funny)

Greyfox (87712) | about 6 months ago | (#46342161)

I wanted to do something like that on network-attached postscript printers a few years back, but didn't have an easy way to open a network socket in PostScript. My virus would have moved from printer to printer and done nothing else except replace every instance of the word "Strategic" with the word "Satanic" on printed documents.

Re:PostScript Virus (0)

Anonymous Coward | about 6 months ago | (#46342181)

A better suggestion is to replace the word cloud with the word butt like the Chrome extension.

Re:PostScript Virus (2)

NapalmV (1934294) | about 6 months ago | (#46342301)

Muahahaha you have to see it in action on the Wikipedia "Cloud computing" page. Just a sample: In common usage, the term "my butt" is essentially a metaphor for the Internet.

Re:PostScript Virus (1)

Samantha Wright (1324923) | about 6 months ago | (#46342611)

In meteorology, a butt is a visible mass of liquid droplets or frozen crystals made of water or various chemicals suspended in the atmosphere above the surface of a planetary body.[1] These suspended particles are also known as aerosols and are studied in the butt physics branch of meteorology.

I can see forever...

Back in 1990.. (2)

swb (14022) | about 6 months ago | (#46342337)

..when I worked at a large University, we had a massive AppleTalk/EtherTalk network with a ton of zones, most of which had LaserJet printers.

A cow-orker in another department and I wanted to come up with software that would let us dump files to these printers and somehow masquerade our source info so nobody would know it was us.

Too bad this probably pre-dated Goatse.

Re:Back in 1990.. (3, Funny)

Ol Olsoc (1175323) | about 6 months ago | (#46342637)

A cow-orker in another department and I wanted to come up with software

How exactly does one ork a cow?

Re:Back in 1990.. (3, Funny)

EvilIdler (21087) | about 6 months ago | (#46342961)

One orker on each side.

Re:Back in 1990.. (2)

antifoidulus (807088) | about 6 months ago | (#46343003)

Like you've never been drunk and desperate enough to do it.

Re:Back in 1990.. (1)

Ol Olsoc (1175323) | about 6 months ago | (#46354353)

Like you've never been drunk and desperate enough to do it.

We calls that stump breakin' them in this neck of the woods.

Re:Back in 1990.. (0)

Anonymous Coward | about 6 months ago | (#46348217)

A cow-orker in another department and I wanted to come up with software

How exactly does one ork a cow?

Looks like meat's back on the menu, boys!

Re:Back in 1990.. (3, Funny)

baKanale (830108) | about 6 months ago | (#46348521)

Very carefully.

Re:Back in 1990.. (1)

Badger Nadgers (2423622) | about 6 months ago | (#46350989)

Tend to agree... Googled ORCA COW. first result: "How Does SeaWorld Masturbate their Stud Killer Whales? "

"MadLibs: Buzzword Bingo Edition"! (1)

rts008 (812749) | about 6 months ago | (#46343135)

That would cause a complete meltdown in the DOD if that ever made it inside the Pentagon.

It is very difficult to type while ROFLCoptering in a puddle of spewed Mountain Dew!

Re:PostScript Virus (2)

AmiMoJo (196126) | about 6 months ago | (#46344515)

At college the admins used to spy on us regularly. We trolled them by creating files in DOS that had spaces in the name (alt-255) which they couldn't figure out how to open. Later we found that if you created a text file with a name like "hack.bat" that contained a few thousand 0x07 (bell) characters they would open it up and then immediately start hammering the keys as their editor tried to beep the speaker repeatedly for the next few days. Being DOS the only solution was to hit the hard reset button.

You could have all sorts of fun with Netware too, like creating fake log-in screens in QuickBasic to capture admin passwords. Since the filesystem had no protection it was easy to insert such a fake screen into autoexec.bat, followed by a call to the real login screen so they would just assume they typed something wrong.

Re:PostScript Virus (1)

BitZtream (692029) | about 6 months ago | (#46344617)

Your college admins were using DOS and not some UNIX? Sounds fishy

Re:PostScript Virus (1)

AmiMoJo (196126) | about 6 months ago | (#46346661)

I should point out that "college" in the UK is post-school, age 16 to 18. Then we go on to university, where we did have a mix of Windows/Netware and various Unix machines.

Re:PostScript Virus (1)

CSMoran (1577071) | about 6 months ago | (#46355637)

Being DOS the only solution was to hit the hard reset button.

Meh, you just map the int 00 vector onto int 05 and you're ready to go. Press "Print Screen" anytime to divide by zero and terminate current process.

There goes the neighborhood! (0)

Anonymous Coward | about 6 months ago | (#46342187)

captcha: babyhood

From mapping to .... (2)

AHuxley (892839) | about 6 months ago | (#46342199)

In the past the news was just about listening, tracking and mapping
"aircraft are all fitted with sophisticated surveillance equipment. " ...The aircraft are able to identify suspects using 'voice-prints' ...
http://www.dailymail.co.uk/new... [dailymail.co.uk]
Then the wifi mapping news e.g. "mapped the Wi-Fi fingerprint of nearly every major town in Yemen".
https://firstlook.org/theinter... [firstlook.org] (10 Feb 2014)
Expect more interest in any wifi network at a home, suburb and country based network level.

Attack replaces firmware .. (1)

DTentilhao (3484023) | about 6 months ago | (#46342261)

"This attack replaces the firmware of an existing AP and masquerades the outward facing credentials."

What mechanism does the attack us to keep the current configuration while replacing the firmware. Does the attack work by cracking WPA passwords. Would this attack work against the maximum length of sixty three character passwords.

Re: Attack replaces firmware .. (4, Informative)

Anonymous Coward | about 6 months ago | (#46342335)

The article states chameleon attacks weakly protected acess points. If it finds a hardened one, like WAP, it moves on. It is a worm, not a virus, but the authors couldn't compare it to human contageon that way. I count myself lucky I never cought a worm. Virus, yes.

Re: Attack replaces firmware .. (0)

Anonymous Coward | about 6 months ago | (#46342395)

I count myself lucky I never cought a worm. Virus, yes.

Aye. Rather have the flu than guinea worm.

It hides from detection? (0)

Anonymous Coward | about 6 months ago | (#46342271)

How do they know it spread, then?

Re:It hides from detection? (3, Insightful)

AHuxley (892839) | about 6 months ago | (#46342325)

Would your average well coded antivirus behavioural detection software care a lot if your wifi rebooted a few times?
No new data into the 'protected' OS, no OS changes, packets flowing in, out, network seems the same ...

Re:It hides from detection? (1)

wvmarle (1070040) | about 6 months ago | (#46342921)

Have it ping a specific site, telling that site "Hi, I'm totally fine!" which is a code word for "pwned!"

Just make sure it is using normal communications channels and your regular AV software, that doesn't know this specific signature yet, won't be able to detect it.

And in the "production" version you have it do something else entirely of course.

seriously (0)

Anonymous Coward | about 6 months ago | (#46342311)

Who the hell writes these headlines. These scientists didn't demonstrate shit, they ran a simulation for crying out loud.

Re:seriously (2)

AHuxley (892839) | about 6 months ago | (#46342361)

A simulation to help understand that from one site e.g. an embassy you could create a private redundant 24/7 wifi network deep into a city to an area of interest.
Counter surveillance efforts would see everyday random wifi use... missing the bust of a key logger days, weeks, months later.

Re:seriously (2)

markgamache (2811197) | about 6 months ago | (#46342447)

No, they proved they can invent made up scary data. I think this is actually stolen straight from Schneier's site. It's pure movie plot silliness. https://www.schneier.com/blog/... [schneier.com]

Re:seriously (1)

wvmarle (1070040) | about 6 months ago | (#46342927)

From TFA I understand that not only did they ran a computer simulation, they actually wrote the worm and ran it in a controlled environment, observing it spreading between access points.

Wondering how it really works (2)

wvmarle (1070040) | about 6 months ago | (#46342383)

Yes I read TFA, not the technical report though. Too technical for me.

It says the virus works by replacing the firmware of wifi routers. That sounds to me like they're tricking the router into accepting an over-the-air update. Which I suppose is limited to 1) a specific make and type of router and 2) knowing the OTA password for that router (or using a default that's not changed). So that sounds plausible for certain specific networks, not where there is a large number of different routers with different firmware and different passwords (or other security vulnerabilities).

What is not explained at all though is how the thing jumps from router to router, and I can't really think of a way this may happen. These things normally do not communicate wiht one another, and devices normally communicate to only one router at the time. Can anyone with deeper understanding explain this?

Re:Wondering how it really works (0)

Anonymous Coward | about 6 months ago | (#46342545)

How the fuck is this modded +3? WAP, not router. Jesus Christ, there's a fucking difference.

Re:Wondering how it really works (1)

khasim (1285) | about 6 months ago | (#46342591)

Can anyone with deeper understanding explain this?

Stop being so modest. You've already hit the important issues.

But if I may add to your post. Getting ACCESS over-the-air to do any of that requires 1 of 3 situations:

1. A "back door" installed by the vendor. That is an account (username/password) that is, SUPPOSEDLY, only known by the vendor. That gives root access. This varies from vendor to vendor and product to product. So anything based upon this would only be able to hit WiFi routers A, B & C from vendor X. Not a real risk.

2. A vulnerability in a running service that can be exploited to get root access. Again, this varies from vendor to vendor and product to product. So anything based upon this would only be able to hit WiFi routers A, B & C from vendor X. Not a real risk.

3. The victim changing what is usually a DEFAULT setting NOT to allow over-the-air root access. And then using a password that is crackable in less than X years. This seems to be what the paper is describing.

And then a LOT of WiFi routers within communication range of each other, all with scenario #3 (although different passwords). So that one cracked WiFi router can run a process (remember, hacked firmware) to find the password of another such router.

So, yeah, you had it right.

I'd say that there isn't really any way that this could work anywhere except in a lab. As a very badly designed "experiment".

a lot of commonalities, db of exploits easy (1)

raymorris (2726007) | about 6 months ago | (#46342641)

Not that you're wrong, but I think you may be carrying it to far. Most APsand routers use one of two operating systems. The firmware on various models of Linksys routers , for example, is extremely similar and not that different from many Netgear models. So it's entirely likely that a single exploit works on about 25% of the units in a given city. In fact, we KNOW of several exploits that each work on 25% - the factory default passwords, telnetenable, etc. If the malware package looked for four or five different exploits, it could very well be effective against half of the APs in the city.

Re:Wondering how it really works (1)

wvmarle (1070040) | about 6 months ago | (#46342653)

The one part that I still don't get though is the actual spreading, as normally those wifi routers do not talk to one another, at all. Or is this part of what the firmware does; instead of being an access point making it act like a device, so it can connect to another access point?

Re:Wondering how it really works (1)

khasim (1285) | about 6 months ago | (#46342721)

Or is this part of what the firmware does; instead of being an access point making it act like a device, so it can connect to another access point?

That's the way I'm reading it. The hacked firmware does BOTH. It still acts as a WiFi router so it isn't discovered.

But it ALSO acts as a client to connect to another WiFi router.

And it runs a new process to crack the password to that router's Over-the-Air root access.

And some means of uploading the hacked firmware to the newly cracked router.

Re:Wondering how it really works (1)

jargonburn (1950578) | about 6 months ago | (#46342799)

You are correct that the routers don't "talk" to each other by default. Some routers do offer a "wireless bridge" feature or similar that lets it connect to another access point for the purpose of sharing a network.
However, this is purely a software contrivance. The only difference between a router that can connect to another router's WiFi and one that can't, is that one of them has been programmed to be able to behave like a client.

Since the infection we're discussing is built on the idea of modifying a rouer's firmware (operating system), there's no reason it couldn't add that function.

When I first considered it, such an attack seemed like nonsense; seriously? Relying on vendor back-doors to gain root access? Exploit vulnerable services offered by various routers? Build the majority of the infected network by relying on default username/password combinations (although, that part I actually already could accept)?
Seemed far-fetched.

However, it's not that this infection needs to contain a crazy amount of code for pulling this off...it could probably rely on the assistance of remote C&C servers from which it could retrieve pre-patched compatible firmware that matched the router it was taking control of. It would allow it to download updated password lists and possibly collaborate in brute-force attacks on problematic vendor equipment. Heck, these access points could be the new zombie apocalypse! Now, it's not your computer that's spamming internet servers in DDoS attacks...IT'S YOUR WHOLE GODDAMN NETWORK. LOL.

Re:Wondering how it really works (1)

wvmarle (1070040) | about 6 months ago | (#46342883)

I'd say that there isn't really any way that this could work anywhere except in a lab. As a very badly designed "experiment".

A city it won't work, too many different wifi routers, too many software versions. Unless a certain make and model would be so dominating that you'd always have one nearby. Netgear and LinkSys may have such penetration, I see those names all over the place.

However it may work better within a large company as there they often use a single type of device, to keep maintenance easier. Those are also likely to be at the same patch level, contain the same backdoors and other vulnerabilities, and may even have the same (even if non-default) password. That may just work. Add to that initial remote infection over the Internet and the scenario becomes rather plausible.

Not easy, but considering we also had Stuxnet, it is definitely plausible.

Re:Wondering how it really works (0)

Anonymous Coward | about 6 months ago | (#46343429)

it is definitely plausible.

As targeted attack, certainly. But the chances of this virus surviving and spreading in the wild are rather slim.

Pure BS. Nothing to see here (5, Funny)

markgamache (2811197) | about 6 months ago | (#46342411)

This is not science or IT security, it is pure PR crackpot FUD conjecture. The "Chameleon" virus doesn't exist. Please read my paper on my fake bluetooth virus. Bluetooth is MUCH more pervasive than Wifi. More cell phones than Wifi, more cars, and about the same number of computers. In my model, they all get infected and your wireless speakers, phones and computers play "It's a Small World" 24/7 until we all go crazy. It ends a lot like 28 Days later.

It works just like in the movies! Trust me! (0)

Anonymous Coward | about 6 months ago | (#46342487)

I don't post often, but when I do, I post as Anonymous Coward.

More sensationalism to keep their jobs probably (0)

Anonymous Coward | about 6 months ago | (#46342561)

Big time complex to make it work on more than one model.

Easy to fix this permanently in standard future AP hardware:
1 - Require a jumper to be installed for any firmware writes to even be possible (really cheap).
2 - For devices where it is possible to modify program RAM and run that without changing program storage, have a checksum run in hardware and reboot the device if the checksum fails. The checksum value can only be changed when the jumper is on.

Re:More sensationalism to keep their jobs probably (1)

Buck Feta (3531099) | about 6 months ago | (#46342683)

Or, you know, use WPA2.

Re:More sensationalism to keep their jobs probably (1)

skids (119237) | about 6 months ago | (#46342693)

Require a jumper to be installed for any firmware writes to even be possible

Consumer equipment is designed with "plug and play" as its overriding objective. This won't fly because companies want to sell to people barely capable of plugging all the right cables into all the right holes. We're doomed to live with the proliferation of insecure living room equipment until such a point as paying attention to security is taught in kindergarten.

Re:More sensationalism to keep their jobs probably (0)

Anonymous Coward | about 6 months ago | (#46343643)

Don't even need to go that far. Just have a little button. Press it to temporarily enable firmware updates, when the update is done the switch status resets.

old news (0)

Anonymous Coward | about 6 months ago | (#46342787)

..but still as concerning to read about the second time around :)

Almost as bad as a Sandra Bullock movie (1)

EmagGeek (574360) | about 6 months ago | (#46344313)

Just tell me this - does it make a screen go all blocky and distorted as it slowly takes over your computer?

Is it a joke? (0)

Anonymous Coward | about 6 months ago | (#46344445)

This has to be a joke, right? Obviously if i had a worm able to infect every other node in a network it would spread like wildfire according to its rules and the networks physical limitations. The only hard (practically impossible?) thing would be to come up with one able to compromise all kinds of APs with varying firmware you would encounter in the wild. And if they avoid "hard" ones like WPA protected networks, then in most neighbourhoods there will be far far too few APs to latch on to (herdimmunity?).

Boring (1)

Ruck Ruckuss (3553293) | about 6 months ago | (#46345545)

Yea, I did the same thing with verizon actiontec routers. They are just silly unix machines peeps. I noticed that the linux wireless driver they were using could be put in RF mode and was capable of injection attacks to surrouding networks and cracking the neighbooring APs. They made it much easier than that though from a viral standpoint because they issued their routers with WEP keys calculated based on their mac address. Hacking the propriatary rmt file format to load my modified roms took a bit to figure out (cuzz no lamers like the posters of this article ever posted some original stuff like that hah). Anywho. Lame been done before - enjoy the publicity girls

Prevention (1)

bchat (267083) | about 6 months ago | (#46346237)

So what do we tell people to do to prevent this type of attack. We need something simple enough that ordinary (non-./ers) can do it. Here's my thoughts:

WPA2 without Wi-Fi Protected Setup (to avoid a vulnerability)
A customized SSID not matching: http://en.wikipedia.org/wiki/Rainbow_table
A random pass phrase of 13 characters

Anything else for a simple-as-possible, end-user setup criteria?

Misleading title is misleading (1)

EMG at MU (1194965) | about 6 months ago | (#46346721)

The first sentence of the abstract:

"This paper analyses and proposes a novel detection strategy for the 'Chameleon’ WiFi AP-AP virus."

The virus uses the AP's web interface to trigger a firmware upgrade, and then provides a malicious firmware that contains code that spreads the virus. If this is the first time someone did that I'm going to kick myself for not going into security research. Given the plethora of open source AP firmware that already supports many commodity APs it should be trivial to do something like this. All you need is a sufficiently dense collection of APs that are compatible with your malicious firmware. We all already know that a poorly secured AP is a great attack vector, even without malicious firmware you can redirect all of the client's traffic through your own routers and you have your self a classic man in the middle.

The main point of this research is to show that they developed better detection methods that don't compromise any of the AP's client's expectation of privacy.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>