rickostuff

The station model doesn't matter. The version of Windows is important, though. WiFi and Ethernet are not involved at all here. The victim machine has a radio and KISS TNC hooked up to their PC running WinAPRS. The attacker crafts a malicious AX.25 packet and sends it from their own station. When the victim's radio receives the packet, WinAPRS attempts to parse it and the exploit is triggered. The attacker just has to be within range of the victim station to trigger the exploit.

I'm going to have to see what I can find about this incident. Sounds like the early days of phone phreaking. Awesome!

I'm not a lawyer, but I used my real callsign when doing anything over the air. I used known protocols, no encryption, nothing commercial, etc. This was all against my own lab systems. I don't think I crossed any legal lines here. It probably would have been even better to use some kind of dummy load to further reduce the range of my transmissions but I didn't have anything like that to use at the time. I just kept my power as low as I was able.

Thanks! I actually took three OffSec courses last year. The first one I did was the OSWP (wifi) as a sort of warm up because it's the easiest course they offer and I knew I could knock that out pretty quick. Then I took the OSEP course which was a ton of content. Finally I took the OSED which was another ton of content and the most technical of those three. My work gave me 40 hours of in-office time to last year for training. I can't recall if I used that 40 hours for the OSEP or OSED, but I know I used it for one of those two. However, I still put in a ton of hours on my own time too. It's just a lot of content to go through. 40 hours isn't enough time for either of those courses in my opinion. Having no children (and an understanding spouse) made it easier for me to dedicate a lot of personal time on the training. I love OffSec's stuff though and recommend it to anyone who is into offensive security and wants practical training.

I'd like to spend some time digging into radio/tnc firmware for vulnerabilities but that's a bit over my head. I've managed to dump the firmware from my TNC but I haven't found a good way to get it disassembled yet. I've got a partial disassembly, but that's it. Unfortunately, I won't have more time to work on that for a few months.

I'm not sure if you are the same Cliff Stoll who wrote 'The Cuckoo's Egg', but if so I listened to the audio book in 2020 during the first part of the pandemic and I loved it. It was fascinating to see how a small billing discrepancy led you down such a rabbit hole. I also enjoyed the various solutions you came up with to crack the case using the technology of the time. I enjoy reading about the early days of the Internet. I have a sort of nostalgia for it, even though I didn't get on the net myself until around 1997. Your book hit a sweet spot for me with the combination of (now) retro technology and security. You might guess from this ham radio hacking post that I enjoy that kind of thing. If you are that Cliff Stoll, thanks for sharing your story!

I'm not familiar with DSD/mbelib but based on what I saw with a quick web search this sounds like a really interesting attack vector. I do want to perform some more research in this area, so thanks for the idea.

I couldn't find where anyone else had done this before with ham radio. That was another motivating factor. It was an interesting new (but, actually old) attack vector. I've always been interested in weird attack vectors like this. I've read some fun research in the past about infrared communications, magnetic strips, etc. Things that are all around us but we don't really think of as attack vectors.

I spent a lot of time last year researching packet radio software for vulnerabilities. I found a remote code execution (RCE) vulnerability in WinAPRS that let me hack into a system over the air. The result is a reverse shell obtained over ham radio where the victim machine doesn't have to be connected to Ethernet at all, as long as they are running a WinAPRS station. Is it practical? Not really. But it was fun and I learned a lot. I always wondered if I could get RCE via ham radio through memory corruption and it feels good to have proved to myself that I can do it.