Help
Subscribe to The Blog of BOB!
2 Comments
Posted by
Mighty BOB! 
As for me, the Blog of BOB! will be your source for my ramblings and linkage to cool stuff from around the net without me cluttering up the Off Topic section with a zillion topics.
Case in point:
I like to browse around wired.com (online home of Wired Magazine) and I just came across two interesting stories about security bypass hacks.
In the first article, hackers have figured out a way to replace security camera feed footage with their own footage, such as from the same camera captured earlier, just like in the movies. Here's a snippet:
Wired.com said:
LAS VEGAS - Technology has caught up with Hollywood heist films in a new hack being demonstrated at DefCon Friday, which involves hijacking IP video streams and seamlessly replacing them with new content.
In its simplest form, the hack - conducted with two free tools developed by researchers at Sipera Systems' Viper Lab - allows someone to intercept and copy video from IP surveillance cameras to spy on the secured premises. But it would also allow the hacker to replace a legitimate video stream with a bogus stream, permitting a thief or corporate spy to enter an office while the security guard sees only a still-image of an empty room on his monitor.
"There are tools that can prevent this outright, but when you don't have security in place, you can run these types of attacks," said Jason Ostrom, director of Viper Lab. "Most of the enterprises we see don't have the security controls in place."
The intruder would have to gain physical access to a network over which the IP traffic is traveling, but Ostrom says this could conceivably occur through any Ethernet connection in a building, depending on the configuration.
In its simplest form, the hack - conducted with two free tools developed by researchers at Sipera Systems' Viper Lab - allows someone to intercept and copy video from IP surveillance cameras to spy on the secured premises. But it would also allow the hacker to replace a legitimate video stream with a bogus stream, permitting a thief or corporate spy to enter an office while the security guard sees only a still-image of an empty room on his monitor.
"There are tools that can prevent this outright, but when you don't have security in place, you can run these types of attacks," said Jason Ostrom, director of Viper Lab. "Most of the enterprises we see don't have the security controls in place."
The intruder would have to gain physical access to a network over which the IP traffic is traveling, but Ostrom says this could conceivably occur through any Ethernet connection in a building, depending on the configuration.
The second article, like the first, has come to us straight from the movies. Another ingenious hacker discovered a way to remotely open electronically-locked doors without even needing to create a fake access card. Again, here is your snippet:
Wired.com said:
LAS VEGAS - Security researchers have spent a lot of time the last couple of years cracking building access systems from the level of the user device - RFID and smartcards, for example.
But a researcher in Texas found that he could crack one electronic access system at the network control level and simply open a door with a spoofed command sent over the network, eliminating the need for an access card. He could do it while bypassing the audit log, so the system wouldn't see that someone opened the door.
The hack is possible because the system uses predictable TCP sequence numbering.
But a researcher in Texas found that he could crack one electronic access system at the network control level and simply open a door with a spoofed command sent over the network, eliminating the need for an access card. He could do it while bypassing the audit log, so the system wouldn't see that someone opened the door.
The hack is possible because the system uses predictable TCP sequence numbering.
Follow the links for the full articles. Both attacks are preventable if adequate security is in place, but you'd be surprised (and maybe a little horrified) to see the number of insecure institutions.
Both of these stories are brought to you by Defcon, the hacker convention that is currently taking place in Las Vegas.
Share This Entry:
2 Comments On This Entry
Page 1 of 1
Page 1 of 1
