Network Attacks

1
Network Attacks

• -Blackjacking
• -Radio Frequency Identification SQLinjection
• By Alfredo Ortiz

2
BlackBerry infrastructure_________
How It Works 1. BlackBerry connects to
Wireless provider using AES encryption. 2.
Wireless provider connects to RIM using AES
encryption. 3. RIM connects to the organizations
internal LAN Where the BES server resides
through the internet using triple DES. 4.
BlackBerry device is now virtually on
internal network.
3
Blackjacking________________

• How to perform a Blackjacking
• 1. BBProxy app. Is installed on
• BB device without the users
• kowledge.
• 2. BBProxy app creates a proxy
• connection between BlackBerry
• and the attacker host.
• 3. Attacker is also virtually inside the
• private network.
• 4. Since the packets between the
• BES and the BB are encrypted
• firewall cannot inspect data coming
• in or out.

4
Radio Frequency ID tags______
This RFID can be found inside books or sometimes
glued to articles in a grocery store.
This type of RFID is used by toll way systems in
order to prevent drivers from having to stop and
deposit the toll way fee. Instead it charges
the drivers account which gets paid at a later
time.
5
RFID Attack________________
SQL injection example

• 1. Pretend the airport middleware contains a
  template for
• queries that theoretically said
• Look up the next flight to
• 2. When the bag reaches a scanning perimeter it
  builds a query
• that reads like this
• Look up the next flight to JFK shutdown
• 3. When given this query the database will
  respond
• UA254 database shutdown complete

6
References_________________

• 1 Radio Frequency Identification.
  http//en.wikipedia.org/wiki/RFID
• 2 Melanie R. Rieback, Patrick N. D. Simpson,
  Bruno Crispo, Andrew S. Tanenbaum. RFID Viruses
  and Worms (Best Paper Award for High Impact).
  http//www.rfidvirus.org
• 3. Melanie R. Rieback, Bruno Crispo, Andrew S.
  Tanenbaum. RFID Malware
• Truth vs. Myth. IEEE Security and Privacy,
  pages 70-72, July/Augus 2006. http//csdl2.comput
  er.org.ezproxy2.lib.depaul.edu/persagen/DLAbsToc
• .jsp?resourcePath/dl/mags/sp/toccomp/mags/sp/2
  006/04/j4toc.xml 4 R. Jaques. Serious
  Blackberry hack attack exposed. Australian PC
  Authority. 11 August 2006.
  http//www.pcauthority.com.au/news.aspx?CIaNID357
  37
• 5 BlackBerry. http//en.wikipedia.org/wiki/
  BlackBerry
• 6 W. Jackson. Can You Trust Your
  BlackBerry? CGN. September 18, 2006
  http//www.gcn.com/print/25_28/41977-1.html