Washers, dryers, refrigerators, and... Dogecoins?

Washers, dryers, refrigerators, and... Dogecoins?

As most people that are familiar with me know, I have always attempted to track the trends in next-gen Internet technology. Of all the new tech that has launched or been demoed in the past few years, only a few things have made an impression, such as: Disney Research's Botanicus Interacticus, wireless energy harvesting used by enOcean, and Visible Light Communication (IEEE 802.15.7). Bitcoin was not one of those things. 

It took me a while to trust Bitcoin (BTC). Obviously, there are a lot of reasons for and against BTC, and I wont waste time elaborating on them here. What I will say is that, as an information security professional, I was very cautious. The underlying technology behind BTC is very promising, which is why I eventually changed my mind. There is a massive amount of potential for applications that can be driven using the base concept of a secure block chain. 

The accountability and traceable nature of Bitcoin transactions won me over. But, to me, there was something still a bit lacking in Bitcoin's community. The BTC community seems to be a polarized environment where either criminals or professionals are pushing their particular brand of "instant-millionaire" dreams on the masses. I'm all for professionalism, but I also appreciate a bit of realism and perspective when it comes to technology such as this. 

It was about this time that I was introduced to Dogecoin. What started out as a joke currency based on an adorable Internet meme pounced on the Internet only a few short months ago. Dogecoin quickly gained traction worldwide, and has grown into a community of tens of thousands of users. Its current market value is somewhere just under 50 Million USD, an impressive feat for a currency that is only worth (at the time of writing) $0.0013 per coin. 

While the Dogecoin founders did not expect the currency to last, they are making smart decisions regarding the potential longevity of the coin. They've asserted that the coin will be uncapped, allowing new coins to be generated for the lifetime of the Dogecoin network. This is in contrast to other popular coins, such as Litecoin and Bitcoin, whose developers intend the currencies to have a finite number of coins. 

The Dogecoin founders also heavily invest their time and currency in philanthropy. They (and the Dogecoin community itself) have donated tens of thousands of dollars to very worthy causes such as: getting the Jamaican Bobsleigh team to Sochi, getting a luger to Sochi, and donating to a charity that provides service dogs to disabled children. This is the spirit that I was missing in Bitcoin. This is the grass-roots, community driven, charitably-minded attitude that Internet communities should be founded on. 

Over the past few years, I've asked myself countless times: How will the Internet of Things change the way we exchange money for services or goods? How will we connect the mundane every-day pieces of technology like washers, dryers, refrigerators, and the like, to secure global payment systems? 

This is how. The security and assurance that is provided by the underlying technologies within Bitcoin and Dogecoin will help create the distributed an decentralized payment environment that is necessary to facilitate The Internet of Things. Instantaneous, touchless, secure payments can occur over the Internet with little fear or loathing thanks to these revolutionary systems. 

And while Bitcoin builds hedge funds, boards of directors, and trading floors in NYC, communities like Dogecoin can actually make immediate and positive discernible change in our world. Small communities of dedicated, passionate users are often where we see the largest innovations. Dogecoin is an excellent example of this, and hopefully we see more positive work from their ranks in the near future. Even if Dogecoin won't become the Internet's currency, the lessons we learn from coins and communities such as these can be integrated into more resilient/popular coins like Bitcoin. 

Over the next few years I'm sure we will see an assortment of one-off coins making a name for themselves throughout the Internet. Regardless, I somehow doubt that we'll ever see a coin community quite like the Dogecoin community. 

As a result, I'm proud to announce that Capitol Hill Consultants LLC will accept Bitcoin and Dogecoin as payment for our security services, to support what we see as the Gold Standard of virtual currency, and a community that's simply too good not to love. 

Oh, and we accept Litecoin. 

To the Moon!

D

Remembering Barnaby

Two Floors Is Not Enough

When I moved to San Francisco two and a half years ago, I lived in a tiny hotel-room-turned-apartment in Pacific Heights. My then-fiancee was not yet able to move to California with me, so I moved on my own. Almost a year later, after a wedding in Denver, we were ready to settle into married life in California. We chose a gorgeous apartment in Nob Hill not too far from the Ritz Carlton and China Town. Aside from the amazing views, beautiful decor, and charming facade, the biggest benefit was that it was one of the only apartments available at the time that was big enough for Jessica, myself, and our 80 pound golden-doodle Jasper. Then, I found out the bad news. 

Being a cellular/RF/embedded security consultant, the last thing I needed to hear was that literally two floors directly above me lived the one and only Barnaby Jack. Out of all the apartment buildings in San Francisco, I just had to pick the one where the most brilliant embedded researcher I knew was only an antenna away from intercepting all my hard-earned research! Of course, this wasn't an actual concern for me. In reality, I had heard nothing but good things about Barnaby, but I had also encountered him only briefly in person. Regardless, it was a funny coincidence and I brushed it off as nothing more. 

Over the subsequent months, we'd bump into each other around the building, emit our brief pleasantries, and go on our way. But, the most hilarious encounter was actually outside our building at a place you'd never expect Barnes to be: a bar. 

Look At This Freaking Guy

After a particularly painful night of reverse engineering, I passed out around 4 or 5am, frustrated that I hadn't even achieved one iota of success. I awoke only a few hours later to my wife gently reminding me that I had agreed to spend the afternoon with her. I slowly rousted myself about, dehydrated and squinting, as I prepared for our afternoon. The first stop was Chantal Guillon, possibly the best shop for French macarons in the bay area. After a veritable injection of sugar, we proceeded to walk around the Hayes Valley neighborhood. From shop to shop, we paced, briefly stopping to glance at this and that. The purses, the cute small dogs, the shoppes with new fall fashions. I was barely holding it together when Jessica suggested we stop for some actual protein. 

Exhausted and ready for a nap, I was barely able to keep my eyes open. We wandered into a corner restaurant somewhere along Hayes and plopped into a table in the corner. Jessica faced the window to watch passers by as I faced toward the inside of the restaurant, attempting to shield my eyes from what, to me, was blinding sunlight. I'm sure everyone else considered this "the afternoon", but the light was so strong I had to keep my sunglasses on even indoors. 

Across the room I could see two figures huddled at the bar. A fashion forward and attractive young lady sat tapping her finger on her martini glass next to a huddled lump of a grin deeply inspecting what looked to be a glass full of scotch. Granted, this was barely after noon on a Tuesday, so I chuckled to myself "who would possibly be this drunk on a weekday". 

Then, I realized that the bartender, who was tending readily to these two giggling masses of clothing and grins, was staring at us. Now, this wasn't out of the ordinary, per se. My wife stands approximately six foot one with long brilliant red hair. I, on the other hand, am a short stocky black-Irish half-Spanish pool of exhaustion. We make for an odd pair and are often the subject of stares, smiles, and snickers. Because I often find this an amusing source of entertainment, it doesn't bother me. But, in this case, it bothered me. The two sharky grins kept looking over at us while swirling their swill in their hands, snarking at the bartender, who would then bare her teeth in our direction. I was too tired for this bullshit, so I had just about enough. I stood up and walked over to the bar. 

The bartender looked astonished as I walked a bee-line to the cackling two, but there I was - ready for battle. "Hey!", I said, as the hulking male turned from his chalice to meet my aggression. "Barnes?!" I practically broke out into laughter. 

"Holy shit, mate! That's you?!", he roared. Barnes didn't even recognize me any more than I could recognize him. For months of living in the same building and bumping into each other weekly, he was so off his kilter and I was so exhausted neither of us could recognize one another in a darkened bar, middle afternoon, on a Tuesday. We both blushed a bit at our error. Barnes remarked "I thought you looked ridiculous sitting over there with your sunglasses on indoors."

"Oh! I was up all night and I have really sensitive eyes....", I replied in that matter-of-fact way you react to something completely ridiculous you know you've done. 

"Fuck it! Let's have a drink, eh?!" The perpetual pirate, Barnes moved right on from the awkward start of our encounter to celebration. "You're drinking with me!" He motioned for the bartender, who now had a huge smile on her face realizing that a physical confrontation ending with a short black-Irish half-Spanish man to clean up off her floor mid-afternoon was not, indeed, in the works. 

The bartender poured two shots of top shelf liquor into glasses. I was too tired to remember the name, but I remember the way Barnes raised his glass and looked through it, almost inspecting the amber translucency for any potential misstep or soot. None could be found, and he motioned his glass to me. "To neighbors! And to a damn fine Tuesday afternoon!", he rallied. 

"Cheers, mate!", I teased, and we tossed back the booze. 

I never knew Barnaby well. But, to me, this afternoon was perfectly representative of him. He was a man who could turn sour milk into 18 year old scotch, with nothing but a smile and a wink. A man who lived each day to the fullest. And a man that would turn any enemy into an instant friend. 

Cheers, mate. 

Abusing WiFi-Based A-GPS To Achieve Extreme Low-Cost Targeted Tracking

When security consultants and analysts consider the use of modern-day tracking techniques, they think of two things: tracking devices and mobile phones. And that's fair. GPS tracking devices, such as the Zoombak, are cheaper and more effective than ever before. However, as I demonstrated in 2011, tracking devices are often poorly designed, easy to reverse, and insecure. This means that they can not only be found remotely, but they can be hacked.

Mobile phones are always a significant vector for location tracking, as they commonly move with a target. But, what if the target is only exposed while using a burner? The MSISDN or software on the mobile endpoint may not persist beyond exposure, making the endpoint a less desirable resource.

Advances in technology, however, provide an interesting alternative to these solutions that has not yet been widely discussed by privacy advocates. Though, the pieces of the puzzle have been available for some time. A significant decrease in the cost of microcontrollers (uC) and wireless components, coupled with the increase in use of peripheral technology, provides an interesting vector for abuse.

What if, for a couple of dollars, a tiny device could be constructed that allows for targeted tracking? This article describes a simple example of how and why this is possible.

The Wireless Photograph

An interesting device crossed my path on Woot in the past few months: the Eye-Fi. This product is a simple SD memory card, like you would use with any digital camera. Models are offered that support flash storage of 4GB to 16GB, along with a more interesting storage option: wireless image delivery.

Eye-Fi 802.11 enabled SD Card

At 3.3V, the Eye-Fi product line integrates three chip components: a microcontroller, a flash chip for image and application/configuration storage, and a Marvell 802.11 wireless chip. The internal layout of the product can be seen in this FCC filing from 2010. From this information, it is easy to determine that the Eye-Fi is meant to act as a wireless client driven by the power of a digital camera.

When the camera saves an image to the Eye-Fi, the Eye-Fi SD card transparently uploads the image over a WiFi network to a laptop, phone, or other endpoint on the same network. While gimmicky as a SD card, this product is exceptionally inventive because of the way it exploits power from a host device.

Alternative Use Cases

While writing to the network is certainly an important feat, an aside to this article would be the use of this design for fuzzing/testing of devices that read from an SD card (such as a firmware update). Reads from the SD card could be cached from the network in order to test multiple variations of a firmware image without the chore of having to copy each new image to an SD card. I'm looking at you Travis Goodspeed.

Assisted GPS and WiFi

Regardless, the design of the Eye-Fi brings to mind another technology: Assisted GPS (A-GPS). A-GPS helps devices determine their approximate physical location even when a Global Positioning System (GPS) beacon is unavailable. As many technologists know, A-GPS has evolved beyond the analysis of cellular beacons for location derivation. Today, alternative signals can be used as location control as well, such as 802.11.

Google Street View Car in Action

I'm sure that everyone remembers Google's trouble with WiFi, Street View, and Privacy. Google, along with many other companies, use WiFi to ascertain the physical position of a mobile device when GPS is no longer available. This means that they were collecting a giant database of WiFi access points across several countries around the world. 

Samy Kamkar, a security researcher, came up with a brilliant application that abused Google's web API  and allowed anonymous users to query for 802.11 access points. Google responded by blocking Samy's application and restricting queries to only users that are known to be associated with particular access points.

The Access Point That Wasn't

So, let's presume users can't query devices that they aren't associated with. I'm sure this is hardly the case as even if Google has solidified this issue, custom databases like Zoombak's, Skyhook, and others, have had similar issues to Google's but are far less vetted by the security industry. Regardless, let's step back for a minute and presume this "hole" is patched. What does a researcher do? 

Well, systems like Skyhook and Google don't actually attempt to log on to random WiFi access points. Instead, they simply take note of the location of the beacon along with the access point name (SSID) and the address (MAC/BSSID). This means that the access point (AP) doesn't have to function. In fact, it doesn't have to do anything except emit a valid beacon. 

What if technology similar to the Eye-Fi could be designed to emit a fake AP beacon instead of acting as a client? The "Fake-Fi" could simply emit a beacon intended to be picked up by devices that would pass on the beacon name and MAC to another authority, such as a Google location database.

Selecting a WiFi network on Android

For example, Android and iPhone devices that see the beacon could upload data describing the Fake-Fi access point to a centralized database. This means that everyone in range of the Fake-Fi is helping tell the world where this beacon is located. This makes for an interesting tracking opportunity without having to use a large amount of power, cellular infrastructure, or other complicated technologies. The Fake-Fi can be driven with two simple chips (a uC and an 802.11 chip) off a 3.3V power source for the cost of dollars, just like the Eye-Fi.

The Result

Using this methodology, researchers can poison technologies that are more likely to stay present on an individual's person. A USB cable, USB dongle, mouse, mini-keyboard, laptop power adapter, wall wart, or another commonly trafficked device can now become a beacon.

This is an extremely hard to detect attack as the components used are small and thin enough to fit on a SD Card. There is a large amount of potential host technologies for this technique and few ways to effectively detect them. A user may notice the addition of a WiFi access point in their range, but will they presume it originates from their own equipment, or will they presume a neighbor is the source of the beacon? An attacker can diminish the potential for inspection by lowering the beacon strength of the wireless signal, making it look as if the source is farther away than it actually is.

A common Samsung microSD Card in an Android phone

The SD card in a user's Android phone can even be replaced with this technology, turning the phone into a proxy for the tracking beacon without the user's knowledge. How's that for parasitic technology?

Read and Store

An alternative and purely passive methodology would be to use almost the exact same formula as the Eye-Fi technology: WiFi client. Except, instead of connecting to WiFi networks, the software on the uC could simply log the access points and their frequency to the flash storage. Access points with higher frequency (occurrence) would identify a user's location and could be searched for using the same technologies: Google, Skyhook, etc. 

However, this purely passive tracking technique would require physical access to the target's devices at two exposure points in time, rather than one, significantly increasing the risk of the operation. 

The Take Away

At Capitol Hill, we believe that desktops, laptops, and even BYOD, are no longer the only risks a group or individual must monitor. Instead, security analysts must consider the applicability of each potential wireless endpoint as a source for malicious or parasitic behavior. And, analysts must consider that not all devices are known - or can be known - in a particular environment.

Discovering, cataloging, and isolating, the risks of the wireless world is a growing challenge. At Capitol Hill, we help organizations identify and mitigate the risks introduced by the Bring Your Own Radio world through our years of embedded engineering and security expertise. Our team will help define what practical threats mean to your organization, how they can be detected, and the most fiscally effective ways of removing these risks. Contact us today to determine if our services are right for your organization at: info at capitolhillconsultants dot com.

Best,
Don A. Bailey
Founder