I heard a number of interesting mobile-related talks at the 28th Chaos Communications Congress (28c3) this week. Not every talk at the Congress was about newly discovered bugs or zero-day exploits; sometimes we got the building blocks necessary to better understand systems and increase security. I enjoyed key presentations on reverse-engineering USB 3G data sticks and the internals of 2G and 3G mobile data protocols.
Guillaume Delugré acknowledged researcher Ralph Phillip Weinmann’s work from last year during Delugré’s talk on reverse-engineering a popular 3G USB data stick.
Guillaume Delugré discusses how he reverse-engineered Qualcomm firmware and developed a debugger.
The USB stick runs a proprietary OS named REX. Delugré reverse-engineered a diagnostic mode used by Qualcomm engineers. Although some work has been done on documenting and using the diagnostics interface (the ModemManager project), he developed more detailed specifications.
Delugré explains the format for an undocumented diagnostics interface.
Harald Welte, a lead developer of the Openmoko project and a Linux kernel developer, gave a good breakdown of various mobile data protocols. Cellular voice communication on GSM has gotten a lot of coverage over the years, but outside of the mobile industry there has been little to no information on how the data protocols function.
Harald Welte presents details on mobile data protocols.
The talk covered the layout of a number of the mobile data protocols, including the latest 3G protocols.
Diagram of UMTS network architecture.
Perhaps in the next year we will see more development in the exploitation and security of mobile devices.
The Boston D.A. dropped a bizarre, and seemingly wide-ranging, subpoena on Twitter, seeking information on accounts ostensibly linked to threats to officers. But there’s little more to learn after a Boston judge draped a gag order over the proceedings Thursday.
On December 14, Twitter received a bizarre subpoena from the District Attorney of Suffolk County, which includes Boston.
That subpoena, as written, ostensibly asks for whatever identifying information Twitter has on anyone who used the hashtags #bostonpd and #d0xcak3 from 12/8/2011 to 12/14/2011, which could number in the thousands.
It’s unclear if that’s what the Boston police meant to do, or if they are unfamiliar with Twitter. It seems likely the latter, given that the @occupyboston account is a year-and-a-half old fallow account with four tweets. The quasi-official Twitter account for the Occupy Boston movement that was evicted in this time frame is @occupy_boston.
If so, the district attorney’s office mixed up their # and @ symbols.
The subpoena also includes a request for confidentiality from the Special Prosecutions Unit, but had no actual legal gag order. Without legal orders, the request for confidentially had no more enforceability than if Assistant District Attorney Benjamin Goldberger had also asked Twitter to send him a cupcake.
It’s Twitter’s policy to forward a subpoena to its target in order to give the user a chance to fight it, unless the company is specifically gagged. It appears that @p0isan0n received a copy from Twitter and posted it to Scribd.
ACLU attorney Peter Krupp, who is representing user @p0isan0n, filed a motion to quash the subpoena on First Amendment grounds. But Thursday, the ACLU seemed to be dealt a defeat when Suffolk Superior Court Judge Carol Ball issued an impoundment order after hearing the case in whispers at the bench.
This barred anyone in the case from talking about the arguments on either side, or about why the motion to dismiss the subpoena was likely rejected. Impoundment is an extraordinary measure that can be requested by one side of a case, and is generally granted only in cases involving sensitive security issues, investigative issues, witness intimidation, or the possibility of the suspect running.
“I think none (of these reasons) are valid in this instance,” said Krupp.
But what does it mean to subpoena a hashtag?
That would mean Twitter would be required to turn over the IP addresses and e-mail addresses of anyone who used the hashtag #BostonPD from December 12 to 14, a time period covering the widely followed eviction of Occupy Boston from Dewey park.
Krupp also sees a fishing expedition in the phrasing of “for the account or accounts associated with the following information”. That, he believes, could mean anyone that’s a follower of that account.
If the D.A. has this liberal interpretation of the subpoena, your humble Wired reporter is included for the incriminating act of following someone on Twitter.
Correction: The story was updated to reflect that the hearing was comprised mostly of attorneys conferring with the judge.
While the Occupy movement might be best known for its encampments and radical organizing strategies, it’s also inspired a new generation of protest songs. Here’s a selection.
A movement goes nowhere without creating culture as it grows.
To wit, the fast growing Occupy movement has become a locus for cultural creation by artists and musicians, as well as technologists and political activists. It started out spare, borrowing from the past.
Back in October, while I was visiting the weary crew of Occupy Long Beach, they gathered in a circle after GA to sing together to one occupier’s guitar. But at that moment there were no songs about the Occupy movement.
Instead they sang ’60s protest standards, Blowin’ in the Wind, What’s going on, and found camaraderie in the Beatles’ With a Little Help from my Friends. But 50-year-old songs could only go so far, they couldn’t really describe the now. In the months since, Occupy music has started to flow.
Here’s a sample of some of the music generated by and about the Occupys.
The beautiful and folky We Are The Many (above) by Hawaiian artist Makana is not only written specifically as a song for the Occupy movement, it has the distinction have being a surprise act for the World Leaders Dinner at APEC, when Makana pulled open his jacket and shirt to reveal an undershirt with “Occupy with Aloha” handwritten on it. He started out quiet and hesitant in front of the room of dignitaries, singing We’ll occupy the streets / we’ll occupy the courts / We’ll occupy the offices of you / ‘Til you do / The bidding of the many, not the few.
Dear Mr. President, comes straight out of the occupy, from Gabriel Quinn Andreas of Occupy Santa Barbara. He expresses a common sentiment in the occupys, many supporters of Obama that feel he’s failed them with the whole hope-y change-y thing: We gave you a fair chance and this is how it went / Signed sincerely yours / The Other Ninety-Nine Percent.
Third Eye Blind did an upbeat tribute calling for the youth to rally to the Occupy movement with If Ever There Was A Time, which they’ve made available for free. Despite being overall an optimistic song, (Things only get brighter when you light a spark / Everywhere you go right now is Zuccotti park) it’s bookended by samples from police confrontations, including Iraq vet Scott Olsen’s Occupy Oakland head wound. The group has asked downloaders to donate to the Occupy movement.
Hip-hop artist MK-ULTRA (Not to be confused with the alternative band from the Bay Area or the Chicago punk band of the same name, both from the 1990s) appears to have joined the movement around September 26th. His track Who’s The Man was shot at Zuccotti park in New York City a month before its eviction.
Miley Cyrus didn’t pen a song specifically for the Occupy, but her new video for the song Liberty Walk is made out of expertly edited footage from around marches and crackdowns on OWS around the world. It also has the distinction to be the most viewed Occupy-related music video on Youtube, clocking in at 600,000 views.
In the New Year, as people process the evictions of the fall and get through the winter, it will likely be culturally rich for Occupiers. It’s one advantage for OWS of the evictions– they’re driving the activist artists, technologists, and makers out of the parks and back into their studios, offices, and hackerspaces.
Multifunction printers (MFPs) have been common in offices for years. They let employees print, scan, and copy documents. Two separate talks at the 28th Chaos Communications Congress (28c3) show how attackers can infect these trusted office devices.
In Andrei Costin’s presentation “Hacking MFPs,” he covered the history of printer and copier hacks from the 1960s to today. The meat of the talk concerned executing remote code on an MFP using crafted PostScript. Just printing a particular document can get code to run on the machine. Previous research proof of concepts have done exactly that, once with a specially designed Word document and once with a Java applet.
Printers and copiers have been targets of attackers and spies for decades.
Attackers can grab passwords to the administration interface from an MFP's memory.
A day later researcher Ang Cui referred to Costin’s talk about PostScript attacks, though Cui’s research was limited to MFPs from HP. Similar to the earlier presentation Cui’s attack leveraged the update capabilities on multifunction devices.
Ang Cui and Jonathan Voris demonstrate printer malware that forwards printed documents to a printer outside the corporate network.
Cui’s technique for infecting printers involves the more limited Printer Job Language, rather than PostScript, and injects code into processes running on the printer. This was effectively a custom rootkit for the printer’s OS.
To get his code on a machine, he needed to reverse-engineer HP’s proprietary firmware update file format. This involved dumping memory images from the printer and using a disassembler on the extracted firmware to determine how to parse the update files. Cui has developed a tool, HPacker, that can take an infected firmware image and repackage it into the proper RFU format for updates. This tool can also analyze current memory dumps.
Researcher Ang Cui uses a memory dumper to access the boot code and reverse-engineer the update file format.