Researchers in the United Kingdom have discovered/invented (?) what is called "Chameleon AP", a polymorphic virus that passes from Wifi AP to Wifi AP without using the Internet backbone, successfully evading Internet security features, such as deep packet inspection. It was reported today but the authors first published about their creation in July of 2013.
http://jis.eurasipjournals.com/content/2013/1/2
A polymorphic virus by the same name was first noticed in 1990.
http://virus.wikia.com/wiki/Chameleon
I don't know if the authors used this virus or just borrowed its name.
The principal steps of the Chameleon virus are as follows:
I've highlighted what seems to me is a significant and difficult step. I cannot imagine the virus downloading firmware for any and every wifi modem it encounters, infecting it and then burning it. The virus must look for specific models of Wifi modems because burning firmware on a modem is not a simple process. The virus firmware had to be infected ahead of time so that it could be easily downloaded and installed onto the target wifi. Steps 2 and 3 seem difficult as well.
http://jis.eurasipjournals.com/content/2013/1/2
A new form of compromised AP attack has been demonstrated and analysed in, called the 'Chameleon’ attack, perpetrated by the Chameleon virus. This attack replaces the firmware of an existing AP and masquerades the outward facing credentials. Thus, all visible and physical attributes are copied and there is no significant change in traffic volume or location information. Hence, this attack is considered advanced and difficult to detect, as IDS rogue AP detection methods typically rely on a change in credentials, location or traffic levels. This work provides analysis of the Chameleon virus and demonstrates a method of detecting the propagation of the virus, as it constitutes an advanced rogue AP.
http://virus.wikia.com/wiki/Chameleon
I don't know if the authors used this virus or just borrowed its name.
The principal steps of the Chameleon virus are as follows:
1. Establish a list of susceptible APs within the current location.
2. Bypass any encryption security on the AP.
3. Bypass the administrative interface on the AP.
4. Identify and store AP system settings.
5. Replace the AP firmware on vulnerable APs with the virus-loaded firmware.
6. Reload the victim AP system settings.
7. Propagate virus (return to 1).
Propagation of a virus over the wireless interface, rather than via wired backbone, presents several benefits for propagation. Firstly, the propagation of the virus would continue despite upgrades to backbone internet virus security methods, such as deep packet inspection. Without significant changes to AP operations, the attack can only be detected using WiFi frames. Secondly, the presence and volume of infected devices could not be assessed using existing forensic methods such as connection to suspicious IPs or known malicious domains. Thirdly, the virus can infect nodes which are not connected to the backbone internet. Finally, this virus is uniquely able to target APs within a specific region as propagation is based on proximity. Each of these factors presents additional challenges with detection of the virus if it is restricted to propagating over the wireless medium.
2. Bypass any encryption security on the AP.
3. Bypass the administrative interface on the AP.
4. Identify and store AP system settings.
5. Replace the AP firmware on vulnerable APs with the virus-loaded firmware.
6. Reload the victim AP system settings.
7. Propagate virus (return to 1).
Propagation of a virus over the wireless interface, rather than via wired backbone, presents several benefits for propagation. Firstly, the propagation of the virus would continue despite upgrades to backbone internet virus security methods, such as deep packet inspection. Without significant changes to AP operations, the attack can only be detected using WiFi frames. Secondly, the presence and volume of infected devices could not be assessed using existing forensic methods such as connection to suspicious IPs or known malicious domains. Thirdly, the virus can infect nodes which are not connected to the backbone internet. Finally, this virus is uniquely able to target APs within a specific region as propagation is based on proximity. Each of these factors presents additional challenges with detection of the virus if it is restricted to propagating over the wireless medium.
Comment