MITRE ATT&CKtechnique
T0860 Wireless Compromise
- Domain
- ics
- Tactics
- Initial Access
- Platforms
- Embedded, Windows, Linux
- Version
- 1.2
- Created
- 2020-05-21
Description
Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance.
A Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. The remote controller device allowed the student to interface with the trams network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. The controller then enabled initial access to the network, allowing the capture and replay of tram signals.
Related
Tactic · MITRE ATT&CK (1)
- TA0108 Initial Access tactic
Referenced by MITRE ATT&CK · mitigates (4)
Referenced by MITRE ATT&CK · uses (1)
- C0020 Maroochy Water Breach campaign
References
- https://www.slideshare.net/slideshow/17-bolshev-1-13/32178888 Alexander Bolshev March 2014
- https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf Alexander Bolshev, Gleb Cherbov July 2014
- https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html Bruce Schneier January 2008
- https://www.londonreconnections.com/2017/hacked-cyber-security-railways/ John Bill May 2017
- https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/ Shelley Smith February 2008