The Eye-Fi: A Case Study in Next-Generation Application Security Issues
Posted: Thu Mar 06, 2008 10:53 pm
The Eye-Fi combines an SD card that hosts an embedded wireless card with a Web 2.0 web application to create a fascinating experience for photographers. In Part 2 of Seth Fogie’s two-part series, he investigates the security vulnerabilities of Eye-Fi.
We still feel this article is relevant from a vulnerability testing standpoint, as it demonstrates some of the security issues involved when dealing with technology that pushes the envelope of existing gadgetry. Even though you will no longer be able to exploit the issues we found with the Eye-Fi thanks to their rapid response, we feel you'll still be able to learn from our methodology and findings.
It is important to note, as the Eye-Fi dev team pointed out, some of the following issues are not security risks directly related to the Eye-Fi product. Ultimately it is up to the user to take responsibility for their actions and to use secure operating procedures. Again, the Eye-Fi is a superb product, and their professional and courteous response further proves this point. When it comes to security, it is a company's ability to understand, accept, and respond to software bugs that makes the difference — and we are convinced that the Eye-Fi team "gets" this important issue.
In Part 1 of this series, we took a look at the latest technology that provides a seamless and automated image transfer solution from a digital camera to a waiting PC seconds after the picture is taken. This product, known as the Eye-Fi, combines an SD card that hosts an embedded wireless card with a Web 2.0 web application to create an experience we found fascinating.
In this continuation of the Eye-Fi examination, we are going to look at this solution from the security researcher's perspective. Specifically, we are going to probe the device and its software counterparts for any bugs and/or security vulnerabilities that could be exploited by malicious hackers.
Web 2.0 and the Eye-Fi Versus CRSF
The Eye-Fi solution is—without a doubt—one of the most unique illustrations of Web 2.0 technology we have seen to date. It successfully wraps a complex application that connects to various sources of information to create a single point of administration for the Eye-Fi card, the Eye-Fi software running on the host PC, and the eye.fi web server. While the solution is eye-catching, its cutting edge programming was found to leave the user exposed to numerous attacks that could be exploited to the detriment of the Eye-Fi owner.
One of the major problems we found is that the listener on the host PC is vulnerable to cross-site request forgery attacks. As a result, it is trivial to send valid commands to the listener from a malicious website or a socially engineered URL click. In addition, thanks to the relationship between the Eye-Fi card and the Eye-Fi Manager, it is not only possible for an attacker to remotely configure the listener, but if the Eye-Fi is plugged into the USB reader, an attacker can also remotely configure the wireless card. Note that an attacker would have to know the MAC address of the card prior to most of these attacks. However, this is trivial to obtain with a sniffer.
[[url=\"http://www.informit.com/articles/article.aspx?p=1177111\"]read full article[/url]]
We still feel this article is relevant from a vulnerability testing standpoint, as it demonstrates some of the security issues involved when dealing with technology that pushes the envelope of existing gadgetry. Even though you will no longer be able to exploit the issues we found with the Eye-Fi thanks to their rapid response, we feel you'll still be able to learn from our methodology and findings.
It is important to note, as the Eye-Fi dev team pointed out, some of the following issues are not security risks directly related to the Eye-Fi product. Ultimately it is up to the user to take responsibility for their actions and to use secure operating procedures. Again, the Eye-Fi is a superb product, and their professional and courteous response further proves this point. When it comes to security, it is a company's ability to understand, accept, and respond to software bugs that makes the difference — and we are convinced that the Eye-Fi team "gets" this important issue.
In Part 1 of this series, we took a look at the latest technology that provides a seamless and automated image transfer solution from a digital camera to a waiting PC seconds after the picture is taken. This product, known as the Eye-Fi, combines an SD card that hosts an embedded wireless card with a Web 2.0 web application to create an experience we found fascinating.
In this continuation of the Eye-Fi examination, we are going to look at this solution from the security researcher's perspective. Specifically, we are going to probe the device and its software counterparts for any bugs and/or security vulnerabilities that could be exploited by malicious hackers.
Web 2.0 and the Eye-Fi Versus CRSF
The Eye-Fi solution is—without a doubt—one of the most unique illustrations of Web 2.0 technology we have seen to date. It successfully wraps a complex application that connects to various sources of information to create a single point of administration for the Eye-Fi card, the Eye-Fi software running on the host PC, and the eye.fi web server. While the solution is eye-catching, its cutting edge programming was found to leave the user exposed to numerous attacks that could be exploited to the detriment of the Eye-Fi owner.
One of the major problems we found is that the listener on the host PC is vulnerable to cross-site request forgery attacks. As a result, it is trivial to send valid commands to the listener from a malicious website or a socially engineered URL click. In addition, thanks to the relationship between the Eye-Fi card and the Eye-Fi Manager, it is not only possible for an attacker to remotely configure the listener, but if the Eye-Fi is plugged into the USB reader, an attacker can also remotely configure the wireless card. Note that an attacker would have to know the MAC address of the card prior to most of these attacks. However, this is trivial to obtain with a sniffer.
[[url=\"http://www.informit.com/articles/article.aspx?p=1177111\"]read full article[/url]]