Steve Manzuik

The Digital Pickpocket

I am sure that everyone has seen the commercial where users of a specific brand of smartphone are passing a video back and forth by simply touching the devices together.  It is a very slick feature that obviously makes moving files between mobile devices an easy task to accomplish.

The technology being used to provide this feature is known as Near Field Communications (NFC).  This same technology, which is an extension to older Radio Frequency Identification (RFID) technology, is also being integrated in other facets of our lives under the banner of convenience.  Unfortunately, like anything where convenience is the priority, there are some potential security issues that the security community has been pointing out for years.  In this case we are talking about “Tap to Pay” credit cards, transit cards, and other cards that use NFC to broadcast payment information to payment terminals.

As previously mentioned, NFC is an extension to RFID technology.  RFID technology, typically used to track inventory, is (I am over simplifying here) essentially a small radio transmitter that requires little to no power.  The main difference, which according to many NFC vendors is a security feature, is that RFID allows for a longer range transmission than NFC.  Essentially NFC will work when the devices are inches apart while RFID can be meters apart.  If you want the real geeky details on exactly how NFC works I suggest that you give the ISO standard (ISO 18092) a read. 

To read a NFC transmission or even an RFID one for that matter one simply needs to have a receiver that is within range of the transmitting device.  I would like to tell you that this transmission is performed over cryptographically secured channels or that only an authorized receiver may pick up the transmission but unfortunately, this is not always the case.

This week we had an opportunity to talk with KOMO TV News Reporter Matt Markovich about NFC technology and some of the risks it presents when used as a payment mechanism.  I would say that my impression of Matt was that he is more technical that most reporters I have worked with in the past as when he approached Leviathan for assistance on his story, he already had a working test case that helps prove the threat.

What Matt was proving (video below) was that this technology of convenience is not secure from an eavesdropper or interception.  Essentially, a “bad guy” can build his own receiver and as long as he is within the necessary range read the transmission coming from the NFC enabled card.  In Matt’s test case, he uses Visa credit cards however, with a bit of customization work this can be extended to read other types of NFC enabled cards such as transit passes, and door locks.

When watching the video remember no vulnerability is being exploited this is simply leveraging a feature of the technology, not a bug.  NFC is after all simply a radio transmitter, there is no access control or authorization required to accept that radio transmission. 

It is also important to understand that this is different than some of the ways we have seen RFID technology leveraged by attackers.  In the past attackers have built low cost devices like this Proxmark one pictured below to read RFID enabled devices;

Proxmark Proxcard reader
Proxmark Proxcard reader

While a setup like this could easily and just as cheaply be built (less than 100$) to read NFC this is not exactly portable or discrete which are two things that an attacker will require due to the fact that in order to read the NFC chip the attacker must be within range which for NFC is no more than 4 inches.

In addition, the above setup assumes that, even if you follow one of the many online tutorials, you must have a level of competence when it comes to building your own electronics.  So, instead of going to all of this trouble and to insure a more stealthy mechanism for attack we go back to the beginning of this post and the wiz bang smartphone feature found on most Android smartphones that allows you to transfer data simply by touching the devices together.

Security researchers were quick to leverage   the native NFC support found in most Android phones plus the powerful features of the smartphone itself to make this attack stealthy and practical.  By simply running a custom, community supported version of the Android Operating system as well as publically available apps one can turn their smartphone in to a NFC receiver and accept a transmission.  Not only can one receive the transmission, which by the way contains all the data needed to “borrow” the target’s credit card details, but it can be saved and then replayed at a later date or relayed in real-time from the smartphone to make a purchase at any standard “tap to pay” terminal.

This is exactly what Matt did and demonstrates in the video and explains in this article.

The most common response to this sort of attack is typically something along the lines of; “yes, but you need to be within 4 inches to make this work.”  In fact, this is exactly what MasterCard said in response to the KOMO News inquires; "The circumstances under which it can occur in the real world are extremely rare."

This is absolutely true however thieves already have no problem performing a traditional pick pocket theft, so why not instead of actually taking the wallet simply bump in to your target and scan it. 

In cases like this, it is human nature to want to find someone or something to blame.  Before you assume that it is once again those “evil hackers” or organized criminal rings that are responsible remember – this is a feature not a bug.  The demonstration as done by Matt in the video is simply leveraging an existing feature.  This means that if you absolutely must find someone to blame, then you must pick whomever is responsible for implementing such an insecure way to transmit payment data.  Yes you guessed, the Payment Card Industry (PCI).  Let’s be clear, this “vulnerability” exists due to the fact that convenience has outweighed security.  The PCI wanted a way to insure that consumers can quickly pay for items without spending the extra few seconds fumbling with your wallet and counting that dirty paper cash stuff that no one seems to use anymore.

Could the Payment Industry implement NFC technology in a secure way?  The ISO standard does outline various provisions that may add security to the implementation however, considering the scale of this implementation there may be real world operational and technical hurdles that prevent this from happening.

Unfortunately, we will see more and more of this technology however, one of the best defenses today is to simply call your credit card company and ask them to issue you a card that does not support “tap to pay” or any other NFC technology.  Today, card issuers are honoring this request, of course eventually they may stop however, if enough consumers reject the technology perhaps change can be forced.

Failed 2010 Security Predictions

Failed Security Predictions from 2010

As most of us return from attempts to relax over the holiday season various self-proclaimed information security experts quickly scramble to do press interviews and write blog posts about their predictions on what to expect over the next twelve months when it comes to security. In a tongue in cheek Twitter post, security luminary and privacy expert Adam Shostack mused “My 2011 security prediction: 75% of predictions from people who offered predictions last year won't start with a review of how they did.”

So, before we make some predictions of our own (hey everyone is doing it) let’s review some of the more misguided and wrong predictions made by others this time last year. As I used Bing.com to search for last year’s predictions I quickly realized that not many “visionaries” were really willing to go out on a limb and predict anything that wasn’t already very obvious. So, for those that do make this list of completely off base and wrong predictions for the last twelve months, we applaud your bravery in going on the record with some truly ambitious predictions.

Taking the first two spots in our list is borderline charlatan and master of fear, uncertainty, and doubt, Verisigns very own overpaid mailing list moderator, Russ Cooper;

http://securityblog.verizonbusiness.com/2009/12/15/2010-security-predictions/

1.) RussCooper: “Social Media operators will gain more control over attackers”
This prediction was in direct contradiction with pretty much everyone else who made predictions in 2010. In fact, attacks via social networking sites clearly increased during 2010, and we have seen everything from malicious embedded ads, malicious applications, and of course the standard social engineering type attacks. While social networking sites attempt to make improvements to both security and privacy issues, they have not taken more control over attackers, and we have seen but the tip of the iceberg on how social networking can be leveraged in an attack.

2.) RussCooper: “Malware will not evolve”
I have two words for Russ on this prediction - Conficker and Aurora. Malware did in fact evolve and will continue to evolve. In fact those who want to make safe predictions can safely say that in 2011 Malware will continue to evolve as protection against said Malware also evolves. Malware protection has always been and will continue to be an arms race.

Next on our list we have a couple predictions that came from a Network World article written by Andreas M. Antonopoulos.

http://www.networkworld.com/columnists/2009/121609antonopoulos.html

3.) Andreas M Antonopoulos: “Self-propagating mobile phone worms and Trojans. Mobile security will get slightly worse as the proliferation of applications and smart devices broadens the attack surface. While we've seen worms on iPhone, they have not been self-propagating, depending on PCs to spread. Expect to see true self-propagating threats on iPhone and Android systems in 2010”

I suppose that this prediction is partially correct. Mobile and “smart” devices have grown in 2010. In fact Android devices specifically have exploded onto the scene. That said we still have not seen a large amount of attacks, malware, worms, or Trojans. I do think that this prediction will eventually become true as it is the obvious and natural evolution of threats.
Number four on our list is also from Andreas M. Antonopoulos and is very amusing and probably needs very little commentary to explain why it was completely incorrect.

4.) AndreasMAntonopoulos: “The Transportation Security Administration stops wasting billions of dollars in traveller delays by confiscating water bottles and removing shoes. Instead it focuses on real threats based on rational risk assessment, not security theater based on movie-plots (hat-tip Bruce Schneier). OK, unlikely, but I can dream, can't I?”
At least in this case the writer identified that they were in fact dreaming with this prediction, and I suppose we can respect the wishful thinking.

Halfway through our list of failed security predictions for 2010 at numbers five, six, and seven we have the analysts from Forrester Researcher.

http://biztech2.in.com/opinions/data-security/forresters-data-security-predictions-for-2010/72592/0

5.) Forrester: “In spite of the worldwide scope of botnets, we anticipate even more successes in the fight against all forms of cybercrime in 2010.”
I think all of us honestly wish that this prediction came true and while there have been some subtle wins for law enforcement in the fight against “cybercrime.” I think many would hardly consider this any form of success.

6.) Forrester: “Full disk encryption will continue its steady march into the enterprise, spurred on by breach disclosure laws”
While some more advanced enterprises may have implemented or thought of implementing full disk encryption, 2010 did not bring additional disclosure laws. Note that others who did not make this list did in fact predict more laws hitting the books in 2010, and there is no evidence of full disk encryption making any type of march into enterprises.

7.) Forrester: “Cloud data security concerns will begin to dissipate”
Much like the other Forrester predictions I am sure many of us wish that this one came true as well, but, sadly, 2010 brought multiple examples of why we should continue to be concerned about the security of the cloud and data stored in the cloud.

Coming in at number eight we have Tripwire who I almost ignored because it was painfully obvious that all of their predictions were aligned with their product offering and corporate messaging. This of course is a dangerous thing to do especially in this case where they were clearly dead wrong. They had others that were off base as well but also very clear attempts at peddling products. They will not make the list.

http://www.net-security.org/secworld.php?id=8647

8.) Tripwire: “Despite the hype of increased social networking threats, misconfigured ‘stuff’ (ie, servers, firewalls, laptops, etc) will be the real threat for companies to watch out for”
Obviously misconfigured devices are in fact a threat to an organization’s security, but threats via social networking were in the spotlight for 2010 and will probably only get worse in 2011.
Finishing off the list at numbers nine and ten we have predictions from Symantec and iDefense. Two companies who sell “Security Intelligence” that must have run out by the end of 2010 because these two predictions are clearly lacking.

http://www.symantec.com/connect/blogs/worst-yet-come-symantec-s-2010-security-predictions

9.) Symantec: “Mac and Mobile Malware Will Increase – The number of attacks designed to exploit a certain operating system or platform is directly related to that platform’s market share, as malware authors are out to make money and always want the biggest bang for their buck. In 2009, we saw Macs and smartphones targeted more by malware authors, for example the Sexy Space botnet aimed at the Symbian mobile device operating system and the OSX.Iservice Trojan targeting Mac users. As Mac and smartphones continue to increase in popularity in 2010, more attackers will devote time to creating malware to exploit these devices.”
This prediction is almost a duplicate of our third item on this list but worth mentioning, because Symantec went as far to expand from just mobile devices to Apple Mac devices. While it is very obvious that Apple’s “we are more secure” add campaign was nothing more than creative marketing and nowhere near reality, we still have not seen the predicted increase in OS-X related malware. Yes, we have seen some samples both in the lab and in the wild, but there was not a clear increase that justifies calling this out as a threat to worry about. Will it happen eventually? Maybe, but not yet.

http://blogs.verisign.com/idefense/2009/12/2010-prognostications.html

10.) iDefense: “There will be more Windows 7 vulnerabilities in 2010 than all of the Windows Vista vulnerabilities discovered in the three years since its release.”
I am truly at a loss to try and explain how a company who sells an intelligence service and purchases zero day vulnerabilities could come up with such a ridiculous prediction. A quick and non-scientific search of OSVDB (www.osvdb.org) for all Windows Vista vulnerabilities from January 2007 until December 2010 yields eighty-four (84) results. While a search for the same time period for Windows 7 yields thirty-seven (37). Granted this does not include any reported and yet to be fixed vulnerabilities, but, clearly, this prediction was off the mark.

Now that we have spent almost 1400 words poking fun at others we will stop. Our predictions for 2011 will be in a separate post coming soon.

Welcome to our Blog

Welcome to Leviathan Security Group’s blog. If you need or want to know more about the minds behind Leviathan Security you can read about us here. Our goal with this Internet space is to share our opinions and ideas on Information Security topics. We will periodically write about high to low level technical topics and everything between and maybe some things outside. Posts, like this first one, will sometimes be limited to as few words as necessary, while you can expect us to go much deeper on other topics.

You can also find Leviathan Security Group on Twitter - http://twitter.com/LeviathanSec. Be sure to watch for many of our experts speaking at a security conference near you.

Thanks to everyone who supported us over the years. Hopefully this spot will inform and generate discussions.

Cheers,
Leviathan Security Group