trifinite.blog 2008-09-13T09:00:35Z The trifinite.blog is a weblog that is maintained by the trifinite.group. Every now and then you will find new entries here. You can add this weblog to your RSS-Feed reader by importing this URI. tag:trifinite.org,2008:/blog//2 Movable Type Copyright (c) 2008, Collin Mulliner A little web thing... 2008-09-13T09:00:35Z 2008-09-10T12:42:37Z tag:trifinite.org,2008:/blog//2.144 2008-09-10T12:42:37Z We at trifinite love mobile devices so we try to get our hands on every possible device. Although we are not really known for doing web stuff (besides our small site you're looking at right now) we dig it. Long story short: there is a SEO (search engine optimization) contest going on in Germany right now. The prize for the winner will be an iPhone 3G - something we really like to play with. The term that is to be optimized is Befreiphone. The contest is going on until 17th of September (10pm GMT+1). Lets see what the Bluetooth guys... Collin Mulliner http://trifinite.org/trifinite_group_collin.html collin@trifinite.org We at trifinite love mobile devices so we try to get our hands on every possible device. Although we are not really known for doing web stuff (besides our small site you're looking at right now) we dig it. Long story short: there is a SEO (search engine optimization) contest going on in Germany right now. The prize for the winner will be an iPhone 3G - something we really like to play with. The term that is to be optimized is Befreiphone. The contest is going on until 17th of September (10pm GMT+1). Lets see what the Bluetooth guys can do!

]]> The contest details are here.

If you want to support trifinite (Collin of trifinite is running this). Please set a link to Befreiphone.

]]> Attacking NFC Mobile Phones 2008-05-27T18:19:23Z 2008-05-27T18:05:37Z tag:trifinite.org,2008:/blog//2.143 2008-05-27T18:05:37Z Near Field Communication (NFC) is supposed to be the next big thing in mobile phones therefore trifinite feels obligated to take a first look at NFC. The talk was given last week at EUSecWest in London, UK. Slides and information material are now online. Slides: Attacking NFC mobile phones Material at: www.mulliner.org/nfc... Collin Mulliner http://trifinite.org/trifinite_group_collin.html collin@trifinite.org Near Field Communication (NFC) is supposed to be the next big thing in mobile phones therefore trifinite feels obligated to take a first look at NFC.

The talk was given last week at EUSecWest in London, UK.

Slides and information material are now online.

Slides: Attacking NFC mobile phones

Material at: www.mulliner.org/nfc

]]> HID Attack 2007-01-24T19:16:27Z 2007-01-24T19:02:03Z tag:trifinite.org,2007:/blog//2.142 2007-01-24T19:02:03Z I almost forgot about this... HID Attack is about attacking the Bluetooth Human Interface Device application. The software that runs on the desktop PC that communicates with a Bluetooth keyboard, mouse and joystick. The described attack hijacks the bluetooth keyboard driver on the dektop computer to inject arbitrary keypress sequences. Full details here: HID Attack Website Download the Proof-of-Concept here: HID Attack... Collin Mulliner http://trifinite.org/trifinite_group_collin.html collin@trifinite.org I almost forgot about this...

HID Attack is about attacking the Bluetooth Human Interface Device application. The software that runs on the desktop PC that communicates with a Bluetooth keyboard, mouse and joystick. The described attack hijacks the bluetooth keyboard driver on the dektop computer to inject arbitrary keypress sequences.

Full details here: HID Attack Website

Download the Proof-of-Concept here: HID Attack

]]> <![CDATA[Bluetooth® Trademark Violation]]> 2006-10-31T00:13:21Z 2006-10-30T23:15:49Z tag:trifinite.org,2006:/blog//2.141 2006-10-30T23:15:49Z Martin Herfurt http://trifinite.org/martin martin@trifinite.org Today, a good friend sent me this picture of the backside of a british parking ticket. I share this picture with you for two reasons: Entertainment and education.





According to the Bluetooth® Brand FAQ the Camden Metropolitan Police clearly infringes one of the six commandments stated there.
Obviously, the Camden Metropolitan Police didn't read the news during the last months... they wouldn't be the first ones to undergo "a Bluetooth® SIG masterminded raid" as it happened to a Shenzhen factory earlier this year.

Be responsible and click on the picture in order to report this (tremendous) violation to the Bluetooth® SIG ;)

Do they really advise to "remove" Bluetooth?

]]> Slides for PocketPC MMS Attack 2006-08-08T03:29:26Z 2006-08-08T03:20:06Z tag:trifinite.org,2006:/blog//2.140 2006-08-08T03:20:06Z Yet another non-Bluetooth topic... Here are the slides from my defcon-14 talk about MMS-based (Multimedia Messaging Service) attacks against PocketPC phones. The slides are available here and the WiFi proof-of-concept DoS tool can be downloaded here.... Collin Mulliner http://trifinite.org/trifinite_group_collin.html collin@trifinite.org Yet another non-Bluetooth topic...

Here are the slides from my defcon-14 talk about MMS-based (Multimedia Messaging Service) attacks against PocketPC phones.

The slides are available here and the WiFi proof-of-concept DoS tool can be downloaded here.

]]> TOSHIBA Security Update 2006-06-30T17:18:12Z 2006-06-30T17:14:23Z tag:trifinite.org,2006:/blog//2.139 2006-06-30T17:14:23Z I have just been informed by Toshiba that there is a new security update (PC Bluetooth Stack Service Pack 2) that also installs on non-Toshiba PCs. It is available for download at http://aps.toshiba-tro.de/bluetooth/.... Martin Herfurt http://trifinite.org/martin martin@trifinite.org I have just been informed by Toshiba that there is a new security update (PC Bluetooth Stack Service Pack 2) that also installs on non-Toshiba PCs.
It is available for download at http://aps.toshiba-tro.de/bluetooth/.

]]> Update: TOSHIBA Advisory 2006-06-21T17:55:22Z 2006-06-21T17:43:21Z tag:trifinite.org,2006:/blog//2.138 2006-06-21T17:43:21Z I have just been informed that TOSHIBA published a stable version of the stack. You find it here for download: aps.toshiba-tro.de/bluetooth Go for the latest Version (4.00.36) and your problems should be solved. Special Thanks to Toshiba for letting me know about this.... Martin Herfurt http://trifinite.org/martin martin@trifinite.org I have just been informed that TOSHIBA published a stable version of the stack. You find it here for download:
aps.toshiba-tro.de/bluetooth
Go for the latest Version (4.00.36) and your problems should be solved.
Special Thanks to Toshiba for letting me know about this.

]]> Del(l)icate Issue 2006-06-30T17:34:39Z 2006-06-21T08:15:37Z tag:trifinite.org,2006:/blog//2.137 2006-06-21T08:15:37Z Earlier this year, members of the trifinite.group discovered an issue with the Toshiba Windows Bluetooth Stack. Strangers can remotely cause a system exception on Windows hosts when they know the address of the internal Bluetooth device of this machine by sending large l2cap echo requests to it (see BlueSmack attack). Toshiba has been informed about this issue in the middle of February 2006 already but didn't manage to fix the problem. Since Toshiba has been informed once more in April 2006 and the issue still is within the product, we finally decided to publish an advisory addressing the problem so... Martin Herfurt http://trifinite.org/martin martin@trifinite.org Earlier this year, members of the trifinite.group discovered an issue with the Toshiba Windows Bluetooth Stack. Strangers can remotely cause a system exception on Windows hosts when they know the address of the internal Bluetooth device of this machine by sending large l2cap echo requests to it (see BlueSmack attack).
Toshiba has been informed about this issue in the middle of February 2006 already but didn't manage to fix the problem. Since Toshiba has been informed once more in April 2006 and the issue still is within the product, we finally decided to publish an advisory addressing the problem so that users of the product are warned and can take countermeasures.

]]> What a March 2006-04-04T02:21:08Z 2006-04-02T02:04:48Z tag:trifinite.org,2006:/blog//2.136 2006-04-02T02:04:48Z During the last month there have been quite a few events. In the beginning of March, there was the BlackHat Europe in Amsterdam. The list of speakers was quite prominent. Before BlackHat started, I also met Dragos who was on holiday together with the organizing team of the EUSecWest that just took place a week before in London. A week later, I was invited to speak at a very small, but very nice event in Coimbra, Portugal. This event was called 'Wireless Meeting 2006 (WiMe2006)' and already took place once before in 2005. I was very pleased by the student... Martin Herfurt http://trifinite.org/martin martin@trifinite.org During the last month there have been quite a few events. In the beginning of March, there was the BlackHat Europe in Amsterdam. The list of speakers was quite prominent. Before BlackHat started, I also met Dragos who was on holiday together with the organizing team of the EUSecWest that just took place a week before in London.

A week later, I was invited to speak at a very small, but very nice event in Coimbra, Portugal. This event was called 'Wireless Meeting 2006 (WiMe2006)' and already took place once before in 2005. I was very pleased by the student organizers who also got me a translator so that I could understand the other talks that were mainly held in portuguese. At this event, I also had the pleasure to meet the people of a very ambitious project with the goal to globally share broadband Internet access within a community. Even Google was investing quite
a bit of money in this project. Go to their homepage at www.fon.com and start sharing your Internet connection today. I did it already.

The week after Portugal, I have been invited to participate a meeting of Anti-Virus software manufacturers in Germany where I had the chance to talk to a bunch of interesting people and hear their opinion on Bluetooth.

Finally, Adam, Marcel and I spoke at WebSec 2006 in London.
When coming back from London, I visited Hangar-7 where the Red-Bull Owner Dieter Mateschitz keeps his private aviation and Formula 1 collection. This place is definitely worth seeing. If you ever happen to come to Salzburg, this is a must-see (and is is even for free). Co-incidentally, I met an old friend who happens to work at Hangar-7 as a mechanic. He even gave me the full tour including the garage that the average visitor does not happen to see. It is unbelievable how many expensive toys you find in this place (there are pictures (soon)).

Originally, there was the plan to also speak at MEITSEC in Dubai. This would have been right in between the Portugal and the Germany events and I am honestly glad that this got postponed to December.

The slides of the talks will sooner or later appear in the trifinite.download section and pictures of (most of) the places can be found on the trifinite.album page can be found.

At the very moment, I am on my way to Vancouver where CanSecWest will take place. After a week of partying with the CanSec crowd, I am very happy to kick back and relax in the beautiful city of Vancouver until the beginning of may.

]]> Bluetooth Security Dojo @ CanSecWest 2006-03-28T00:50:46Z 2006-03-28T00:23:17Z tag:trifinite.org,2006:/blog//2.134 2006-03-28T00:23:17Z Everyone who is interested in participating a Bluetooth Security workshop could still sign up for the upcoming Bluetooth Technology Security Dojo at CanSecWest in the beginning of April. We would be happy to meet you there :)... Martin Herfurt http://trifinite.org/martin martin@trifinite.org Everyone who is interested in participating a Bluetooth Security workshop could still sign up for the upcoming Bluetooth Technology Security Dojo at CanSecWest in the beginning of April.
We would be happy to meet you there :)

]]> InqTana Bluetooth Worm 2006-02-23T13:30:23Z 2006-02-23T13:11:56Z tag:trifinite.org,2006:/blog//2.133 2006-02-23T13:11:56Z Trifinite.group member Kevin has published a paper detailing the techniques he used in the development of the InqTana Bluetooth worm that targets vulnerable Mac OS X systems. There has been significant confusion surrounding this worm, so here are some salient points: The concurrent release of the OS X Leap.A and InqTana.A worms is coincidental There is no conspiracy, AV vendors and Apple were notified about Kevin's progress in developing this worm in advance of making details publicly available Both 10.3 and 10.4 systems are vulnerable until patched with APPLE-SA-2005-05-03 and APPLE-SA-2005-06-08 InqTana prompts before infecting *by design*, Kevin was just... Joshua Wright http://trifinite.org/trifinite_group_joshua.html joshua@trifinite.org trifinite.misc Trifinite.group member Kevin has published a paper detailing the techniques he used in the development of the InqTana Bluetooth worm that targets vulnerable Mac OS X systems. There has been significant confusion surrounding this worm, so here are some salient points:

  • The concurrent release of the OS X Leap.A and InqTana.A worms is coincidental
  • There is no conspiracy, AV vendors and Apple were notified about Kevin's progress in developing this worm in advance of making details publicly available
  • Both 10.3 and 10.4 systems are vulnerable until patched with APPLE-SA-2005-05-03 and APPLE-SA-2005-06-08
  • InqTana prompts before infecting *by design*, Kevin was just trying to be nice, but the worm could easily spread silently

Kevin's paper is available at http://www.digitalmunition.com/InqTanaThroughTheEyes.txt. Comments can be directed to the BlueTraq mailing list. Our sympathies to those organizations who were affected by the false-positive signatures published by overzealous AV companies.

]]> New trifinite.goupmember (again) 2006-02-08T22:26:32Z 2006-02-08T20:50:23Z tag:trifinite.org,2006:/blog//2.132 2006-02-08T20:50:23Z Last week, Joshua Wright joined the trifinite.group. Josh brings in a lot of experience with Wi-Fi technology and showed to have the right thinking-patterns for being part of the group :) Check out Joshua's page for details.... Martin Herfurt http://trifinite.org/martin martin@trifinite.org trifinite.group Last week, Joshua Wright joined the trifinite.group. Josh brings in a lot of experience with Wi-Fi technology and showed to have the right thinking-patterns for being part of the group :)
Check out Joshua's page for details.

]]> Bluetooth Security Workshop 2006-02-04T19:32:30Z 2006-02-04T18:57:54Z tag:trifinite.org,2006:/blog//2.131 2006-02-04T18:57:54Z Adam, Marcel and I will hold a Bluetooth Security workshop on 17th of February in London. So if you are interested in participating make sure to register.... Martin Herfurt http://trifinite.org/martin martin@trifinite.org trifinite.stuff Adam, Marcel and I will hold a Bluetooth Security workshop on 17th of February in London. So if you are interested in participating make sure to register.

]]> New trifinite.groupmember 2006-01-16T14:05:40Z 2006-01-16T13:38:16Z tag:trifinite.org,2006:/blog//2.130 2006-01-16T13:38:16Z We are happy to welcome Kevin Finisterre from digitalmunition.com to the trifinite.group. Kevin is doing a lot of interesting Bluetooth-related work. This is why Kevin fits in perfectly. Check out Kevin's new member page.... Martin Herfurt http://trifinite.org/martin martin@trifinite.org trifinite.group We are happy to welcome Kevin Finisterre from digitalmunition.com to the trifinite.group.
Kevin is doing a lot of interesting Bluetooth-related work. This is why Kevin fits in perfectly.
Check out Kevin's new member page.

]]> 22C3 - Private Investigations 2006-01-06T10:08:56Z 2006-01-06T09:48:30Z tag:trifinite.org,2006:/blog//2.129 2006-01-06T09:48:30Z Like every year, shortly after christmas, the Chaos Communication Congress took place in Berlin, Germany. As well as last year, Adam, Marcel and I were invited to give a talk on Bluetooth Security. Besides the release of toools like Blooover II and a new version of the carwhisperer, we were able to present a new Bluetooth denial of service attack that we named BlueChop (since it chops established Bluetooth connections). About 3000 cool people, interesting talks and good parties made this event again very special. There are some pictures in the trifinite.album and there are archives with videos of all... Martin Herfurt http://trifinite.org/martin martin@trifinite.org trifinite.group Like every year, shortly after christmas, the Chaos Communication Congress took place in Berlin, Germany. As well as last year, Adam, Marcel and I were invited to give a talk on Bluetooth Security.
Besides the release of toools like Blooover II and a new version of the carwhisperer, we were able to present a new Bluetooth denial of service attack that we named BlueChop (since it chops established Bluetooth connections).

About 3000 cool people, interesting talks and good parties made this event again very special. There are some pictures in the trifinite.album and there are archives with videos of all the talks.

A happy new year to all of you.

]]>