Tuesday, January 08, 2013

Funtenna!

I just watched Hacking Cisco Phones: Just because you are paranoid doesn't mean your phone isn't listening to everything you say, an excellent presentation by Ang Cui and Michael Costello at 29C3. I particularly liked that they coined the term "funtenna" to describe the potential capability of malware using the off-hook switch in a VoIP phone as an antenna to transmit data over RF.

I appreciate that they credited me with the idea, but I would like to set the record straight. I met Ang and Michael at a Cyber Fast Track event a couple months ago, and they approached me with the idea of exfiltrating data from the phone by toggling a GPIO pin on the embedded CPU at radio frequencies. My only contribution was looking at the hardware and suggesting that the wire extending to the off-hook switch was probably the best candidate antenna for the hack.

Although it hasn't been implemented yet, I think the idea has merit. I don't know how fast a GPIO pin can be toggled on the platform, but the CPU operates at something like 800 MHz. That makes it very likely that the maximum GPIO toggle rate is at least in the tens of MHz, maybe even over 100 MHz. I don't know the resonant frequency of the wire extending to the off-hook switch, but it is probably a few hundred MHz. If my guesses are close, then it is likely that the funtenna could be used to transmit data a short distance, perhaps through a wall or two. It isn't a very good radio, but it should work to some extent. Even a short range wireless transmission is very interesting when it originates from unmodified hardware not intended for wireless operation.

With Ang and Michael's approval, I would like to formalize the definition of "funtenna" a bit: A funtenna is an antenna that was not intended by the designer of the system to be an antenna, particularly when used as an antenna by an attacker. In the case of the Cisco phone, the funtenna could be used to transmit data from the phone. In certain systems, it may be possible to use a funtenna to receive radio signals as well. (I even know of some people working on a way to inject data into an untouched device using nothing but a high power radio signal; it is a very limited capability but theoretically possible.) The field of emission security studies unintentional radio emissions that leak data, and I would call any radiating element (a cable with poor shielding, for example) that leaks useful or sensitive information a funtenna.

Whenever I crack open an electronic device for the first time, I now look for potential funtennas. Maybe you will too. :-)

29 comments:

Luke said...

What an awesome idea! Looks like it would be totally possible. Someone has already done this with the Raspberry Pi and turned it into an FM Transmitter simply by toggling a GPIO pin:
http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter

Lucas Daniel said...

Sorry my bad english, i'm brazilian ;)I read your post and I remembered about a distrust I have on mobile devices regardless of OS. do you think the phone can open a listening device without calling? as if the mobile network operator could hear our conversations without needing to give a ring ... do you think that would be possible in a hardware appliance any gsm?
thanks for the reply

Anonymous said...

Reminds me of an old hack, which makes dvb-t transmitter out of vga card.
http://bellard.org/dvbt/

Michael Ossmann said...

Nice links! The oldest prior art related to intentional funtenna transmission I can recall is Tempest for Eliza.

Lucas: Yes, there have been examples of mobile phones used as listening devices. If your network operator or anyone else controls the software on your phone, they can probably do that. I've never heard of an operator doing such a thing.

Jared said...

Prior art is much older than Tempest for Eliza. Try: Altair at Homebrew Computer Club, 1975
There isn't a specific funtenna here, so much as an entire computer's collective EMI.

Unknown said...

This would be a nice way to export data gathered by a device like the phones, but do you know of any juicy protocols that it could directly attack at those frequencies?

Michael Ossmann said...

Jared wins!

Hugh: It is unlikely that we could attack much over the air with this technique (at least on the Cisco phone platform). We have limited modulation capability and can only transmit at low power up to something like 100 MHz. Perhaps we could transmit control signals to a toy remote control vehicle at 27 or 49 MHz.

GB3 said...

You didn't mention that you're the one who gave them the idea for Funtenna! :)

Great talk, thanks for sharing it.

Unknown said...

One further idea, probably mentioned already somewhere, but the microphone might be used to capture keystrokes, or more interestingly the funtenna might be a nice place to sniff for TEMPEST like emissions.

AKA the A said...

Would you happen to have any materials/sources for the RF injection? I have seen some examples, but nothing very "trustworthy"...

Michael Ossmann said...

AKA the A: If you are referring to the ability to use RF to inject data into a system not intended for RF operation, I don't have any specific resources. The research that I know of is very preliminary, not public, and highly dependent on the characteristics of the target device.

jim smith said...

They can probably do that. I've never heard of an operator doing such a thing.
Transmission Fort Lauderdale

Unknown said...

we are offering latest amazon Special Offers & Deals to save your money and time. As well get the best products with best prices. Don't waste your time join us today!! : Lg smart phone

Agen Bola Terpercaya said...

all of your posting i very like thank . Agen bola terpercaya

Agen Bola said...

hello Agen Bola

John Adam said...

What is negative carbon emission?
emissions software

Used PC Exporter said...

Nice Blog Post !

Food Vlog brisbane said...

Thank you for sharing this informative post. Looking forward to read more.
Mechanics Brookevale | Car service rookvale

Unknown said...

I'm Khloé Zac, I tried to invest my savings into forex broker's trade during Pandemic and ever since last year December have been trying to withdraw my savings and each time i try to withdraw i'm asked to pay for fees and Tax fees, last Month june 26th i discovered that it was all scam and i have already lost $450,000 US dollar's. I was referred by my bestie who know so much about the internet and he referred me to Vitor programmer, i emailed him and he asked me to get in touch on WhatsApp and i did as he instructed, after 32 hours of reaching out to Vitor Programmer i received a notification on my phone screen and it was blockchain and my funds were recovered full without stories, i am writing this because a lot of people complain of being scammed online while trying to have there funds recovered, kindly Email: Vitor@programmer.net, WhatsApp contact: (+1) 519 / 398 / 1460, and tell him that you are from Khloé Zac.




Recovery Lost Funds From Online Scammer's/ Cryptocurrency/ Recovery of Stolen bitcoin 

Unknown said...

Are you financially down? Do you need a loan to get out of Debts or pay your Bills? Do you need a Personal, Home, auto, Real Estate, Business, Investment, Agricultural loan, have you been rejected by a bank, friends or partner? We offer all types of loans at a low interest rate of 2%. loan duration starting from 1 year to 30 years. We give out loans within the range of $ 10,000.00 USD to $ 1,000,000.00 USD If you are interested in getting a loan contact us, for more information and we will respond to your request once we receive your reply.

Email: brianclooney@representative.com   Email: brianclooney5@gmail.com   Direct Call Phone Number  and  WhatsApp contact: +1  (519) 398-1460 

mbuga said...

Most Powerful Love Spells Caster +27735257866 in South Africa,UK,USA,Spain,Sweden,Canada,UAE,Malta,Brunei,Japan,Ireland,Turkey,Luxembourg,Iceland,Norway,Australia,Qatar,Croatia,Austria,Denmark,Netherlands,Romania,Belgium,Greece,Belarus,New Zealand,Switzerland,Cyprus,Poland,Estonia,Egypt,Fiji,Wales,Bahamas,Taiwan,Indonesia,Singapore,Czech Republic,Serbia,Palau,Lithuania,Malaysia,France,Bulgaria,German,Jordan,Chile,Algeria,Zambia,Zimbabwe,Botswana,Lesotho,Italy,Philippines,Honduras,Finland,Hungary,Mexico,Macedonia,Argentina,Syria,China,Hong Kong,Myanmar,Kuwait,South Korea,Morocco,Tunisia,Libya,Sudan,San Marino,Israel.. Contact +27735257866 (Call/WhatsApp) OR Email:sheikhmbuga5@gmail.com https://maamarazaq.doodlekit.com http://bestlovespells.over-blog.com https://mamarazaq.blogspot.com https://maamarazaqspellscaster.podbean.com Maamarazaq a gifted spiritual healer and spells caster who may sort your issues and problems.“I Cast spells”. With the help my spiritual powers, my spell casting is done in a unique way to help in your problems. If you have been disappointed by other spell casters and healers who have failed to provide you with the results they promised you and you’re stuck with no option of happiness. It’s never too late for your problems to be solved, it’s time to have a change in life for the better and don’t just sit back and think your worst situation cannot be changed for better because GOD helps those who help themselves,could submit to me your details I may be in position to help you out. 1) DO YOU HAVE A PROBLEM IN YOUR LOVE, IS IT DETERIORATING? I think your partner is no longer interested in you. -You might think that there is no other solution. I offer solutions for all love related problems. I could strengthen bonds in all love relationships and marriage.
1) DO YOU WANT AN EVERLASTING LOVE WITH YOUR PARTNER?
2) I may restore love and happiness when relationships break up or down.
3) I may bring back your lost love.
4) I may help you look and choose for the best suitable partner when you can’t break the cycle of loneliness.
5) I may help to keep your partner faithful and be loyal to you alone.
6) I may create an everlasting love between couples.

mbuga said...

Love Spells to return lost lover in 2 days +27735257866 in South Africa,UK,USA,Spain,Sweden,Canada,UAE,Malta,Brunei,Japan,Ireland,Turkey,Luxembourg,Iceland,Norway,Australia,Qatar,Croatia,Austria,Denmark,Netherlands,Romania,Belgium,Greece,Belarus,New Zealand,Switzerland,Cyprus,Poland,Estonia,Egypt,Fiji,Wales,Bahamas,Taiwan,Indonesia,Singapore,Czech Republic,Serbia,Palau,Lithuania,Malaysia,France,Bulgaria,German,Jordan,Chile,Algeria,Zambia,Zimbabwe,Botswana,Lesotho,Italy,Philippines,Honduras,Finland,Hungary,Mexico,Macedonia,Argentina,Syria,China,Hong Kong,Myanmar,Kuwait,South Korea,Morocco,Tunisia,Libya,Sudan,San Marino,Israel... Is there anyone you wish to fall in love with but worried they might reject you? Are you failing to get your crush to be your true partner And pay Lobola for you? Have you been casting spells to make someone love you but that did not work for you? Have you lost faith in love because of the scammers that failed to cast you real spells? Well, I’m here to retain your faith. It’s not yet lost and don't lose hope. Get Married with my happy Marriage Spells, Return Your Lost Lover in just 2 DAYS even when gone for long time. These spells have built many relationships and yours WILL be the next one. Stop Barrenness (have children).Do not end up being in a relationship with someone you don’t love just because your true crush is not interested. Call for mama's Love Spells now....Call +27735257866 (Call/WhatsApp) OR Email:sheikhmbuga5@gmail.com https://maamarazaq.doodlekit.com http://bestlovespells.over-blog.com https://mamarazaq.blogspot.com https://maamarazaqspellscaster.podbean.com

mbuga said...

Guaranteed Love Spells that works +27735257866 in South Africa,UK,USA,Spain,Sweden,Canada,UAE,Malta,Brunei,Japan,Ireland,Turkey,Luxembourg,Iceland,Norway,Australia,Qatar,Croatia,Austria,Denmark,Netherlands,Romania,Belgium,Greece,Belarus,New Zealand,Switzerland,Cyprus,Poland,Estonia,Egypt,Fiji,Wales,Bahamas,Taiwan,Indonesia,Singapore,Czech Republic,Serbia,Palau,Lithuania,Malaysia,France,Bulgaria,German,Jordan,Chile,Algeria,Zambia,Zimbabwe,Botswana,Lesotho,Italy,Philippines,Honduras,Finland,Hungary,Mexico,Macedonia,Argentina,Syria,China,Hong Kong,Myanmar,Kuwait,South Korea,Morocco,Tunisia,Libya,Sudan,San Marino,Israel.. Spells are sometimes spoken on the image or sculpture of the focused person as sometimes written on a special piece of paper of on red candles depending upon the intensity of your issue and purity of your love and thoughts. Contact +27735257866 (Call/WhatsApp) OR Email:sheikhmbuga5@gmail.com https://maamarazaq.doodlekit.com http://bestlovespells.over-blog.com https://mamarazaq.blogspot.com https://maamarazaqspellscaster.podbean.com . Few people think that for love spells to really work some rhyming chants must be memorized; it is not true, because knowing only a few special words or lines told by the magician is sufficient. The most important matter is your imagination, in which you feel your lover in front of you, moreover, for more powerful perceptions your lover may be felt physically with you that you are holding him/her in your arms. Then speaking the spells does matter, because now your spell words would generate powerful positive energy to impress your lover’s soul to attract towards you.

mbuga said...

Effective Lost Love Spells Caster +27735257866 in South Africa,UK,USA,Spain,Sweden,Canada,UAE,Malta,Brunei,Japan,Ireland,Turkey,Luxembourg,Iceland,Norway,Australia,Qatar,Croatia,Austria,Denmark,Netherlands,Romania,Belgium,Greece,Belarus,New Zealand,Switzerland,Cyprus,Poland,Estonia,Egypt,Fiji,Wales,Bahamas,Taiwan,Indonesia,Singapore,Czech Republic,Serbia,Palau,Lithuania,Malaysia,France,Bulgaria,German,Jordan,Chile,Algeria,Zambia,Zimbabwe,Botswana,Lesotho,Italy,Philippines,Honduras,Finland,Hungary,Mexico,Macedonia,Argentina,Syria,China,Hong Kong,Myanmar,Kuwait,South Korea,Morocco,Tunisia,Libya,Sudan,San Marino,Israel.. Witchcraft Love Spells are among the most powerful love spells ever known on the earth. I am honest, and I genuinely care for all the clients who choose me to cast a spell for them. Enhance your life, relationships, business and abilities using traditional muthi & traditional spell casting that may help make your desires come true. This is the right place where you can acquire the most potent and authentic spiritual help, Am a powerful Spell Caster with powerful love spells, to help Fix marriage problems, financial problems, court cases, business success and reuniting lovers. Contact maamarazaq 24/7 call or Whatsapp +27735257866 or Email:sheikhmbuga5@gmail.com https://maamarazaq.doodlekit.com http://bestlovespells.over-blog.com https://mamarazaq.blogspot.com https://maamarazaqspellscaster.podbean.com

mbuga said...

Instant Spiritual Working Money Spells +27735257866 in South Africa,USA,UK,Canada,Lesotho,Zambia,Zimbabwe,UAE,Kenya,Austria,Australia,Botswana,Malta,Brunei,France,Sweden,Denmark, Belgium,Hong Kong,Russia,Brazil,New Zealand,Switzerland,Swaziland,Norway,Netherlands,Lithuania,German,Chile,Argentina,Belarus,Poland,Korea,DRC,Fiji,Italy,Spain,Wales,Bahamas,Taiwan,Indonesia,Singapore,Czech Republic,Serbia,Palau,Malaysia,Kuwait,South Korea,Algeria,Morocco,Tunisia,Libya,Sudan,China,Hong Kong,Myanmar...You need money and you need it now. There are bills to pay, things you want in life. This powerful money spell can bring them to you. Tired of having to wait because you have bills to pay and no money to do it? This no debt, more money spell is powerful enough to influence your financial freedom. Email sheikhmbuga5@gmail.com OR Contact maamarazaq +27735257866 https://maamarazaq.doodlekit.com http://bestlovespells.over-blog.com https://mamarazaq.blogspot.com https://maamarazaqspellscaster.podbean.com Want to be able to live the life you want? Not be restricted by money? Using powerful money spells has significant increase in the stimulus around you to attract more money. You want this spell so you can stop worrying about having nothing in the bank. Many have used this to gain their financial edge.

mbuga said...

Instant Money Spells Without Ingredients +27735257866 in South Africa,USA,UK,Canada,Lesotho,Zambia,Zimbabwe,UAE,Kenya,Austria,Australia,Botswana,Malta,Brunei,France,Sweden,Denmark, Belgium,Hong Kong,Russia,Brazil,New Zealand,Switzerland,Swaziland,Norway,Netherlands,Lithuania,German,Chile,Argentina,Belarus,Poland,Korea,,DRC,Fiji,Italy,Spain,Wales,Bahamas,Taiwan,Indonesia,Singapore,Czech Republic,Serbia,Palau,Malaysia,Kuwait,South Korea,Algeria,Morocco,Tunisia,Libya,Sudan,China,Hong Kong,Myanmar.. Get Money spells that will increase your wealth, money spells to help you get more money and money spells to solve all your financial problems. I have access to the supernatural world & can use my divination powers to change your money fortunes and set you to a path of bountifulness and no lack. Be financially secure happy and deliciously rich with all the material wealth that money can buy with my money spells. Email sheikhmbuga5@gmail.com OR Contact maamarazaq +27735257866 https://maamarazaq.doodlekit.com http://bestlovespells.over-blog.com https://mamarazaq.blogspot.com https://maamarazaqspellscaster.podbean.com

Unknown said...

I recommend professional expert Programmer Email: vitorzprogrammer@gmail.com, for Recovery Funds / Cryptocurrency / Binary / Forex / Recovery of Stolen Bitcoin / Report scammers and blocking of Scammers Emails, website's, phone number's / Removing Bad Records from Both Public and Private database: Whats App (+1) 519 / 398 / 1460

Unknown said...

Have you been defrauded by deceptive Bitcoin traders? Or are you seeking to recover funds you lost on telegram accounts to take over hackers/rippers?. I personally will recommend no one other than albertgonzalezwizard (@) gmail com This is the least I could do for them after they saved my life by helping me recover up to 3.966BTC in less than two weeks from an online ripper lately. I got referred to them via my colleague at work , they also helped his spouse recover tokens and coins lost to scams .I'm glad I got in contact with this specialist because I would have most likely fallen victim to another online fraudster all in the name of them trying to help me. I owe this people a lot because it is so hard to see legit help online. Are you having similar issues with your BTC Wallet,Don't get scammed by these online fraudsters, contact albertgonzalezwizard (@) gmail com they are the most efficient and most trusted recovery expert on here Whatassp +31684181827 or Telegram: +31687920980

NoveltyDMVExperts said...

I am so delighted I found your weblog, I really found you by accident,
while I was researching on Bing for something else, Regardless I am here now and would just like to say thank you for a fantastic post and a all round entertaining blog (I also love the theme/design), HOW TO GET A FAKE DRIVERS LICENSE THAT WORKS FROM THE DMV I don't have time to go through it all at the minute but I have bookmarked it and also added your RSS feeds, so when I have time I will be back to read a lot more, Please do keep up the excellent job.