With the writers of Numb3rs playing it safe this season by limiting their expedient exaggerations to areas of physics and mathematics, I was relieved to see that CSI: NY stepped up to the plate to keep me occupied.As you may have guessed from the title, this episode deals with a band of James Bond like criminals who drive around in a high-tech sports car and fast-rope out of high-rise luxury condos. The CSI team discovers that the criminals are not looking for traditional valuables such as furs and jewelry--they are after personal information stored on electronic devices. The team surmises this while examining a coat that was taken off a man found face down in a gutter.
How did they come to this conclusion? The department IT folks called and informed the team that they had a firewall breach and someone was illegally accessing the network. Our quick-witted investigators power down the lab to contain the breach, but are puzzled when the examination table's florescent lights continue to flicker. They determine it has something to do with the jacket, so they pull it apart and find a mesh of wires connected to a MiniSD memory card.
What they discovered in the jacket was a device that can magically download information off of any device using wireless connections. The most amazing part of this contraption is that the whole thing is heat activated. I can only assume that they meant that it was powered by body heat, or other heat sources, because a device like this that only turns on when its hot doesn't make any sense at all.
A little research on my part found that a group of German researchers at the Fraunhofer Institute have created a similar generator that can produce 200 millivolts of power. But, According to our friends over at Engadget, you'd need about 1 watt to power just the processor of a modern hand held device. The Fraunhofer generator produces about 2 milliwatts. Sorry Charlie, even with the long underwear, you come up short in the power department.
To compound the power problems, you would need both WiFi and Bluetooth radios, plus a CPU and operating system that can perform moderately complex cryptographic functions. None of which I saw on the device.
I'm not sure why the wannabe secret agents needed a device like this in the first place. They were the party planners and staff, so rigging a laptop to do the same thing and attaching it under the buffet table would have been much easier, more effective, and would have gone completely unnoticed. Moreover, if you take the risk of breaking into someone's condo, you're better off attaching a USB or Firewire drive to the computer and downloading the information that way--when you are in the middle of a B&E, you really don't want to wait around for your system to crack the WiFi and then break into the computer, assuming that there are any vulnerabilities to be exploited in the first place.
As for how the lab was hacked, what they were trying to describe is an "evil twin" attack. By mimicking an existing WiFi access point, or AP, an attacker can trick a computer into connecting to a network they control. By exploiting weaknesses in a commonly used WiFi link encryption protocol, you can even mimic an AP that has encryption enabled. At that point, the attacker has a direct network connection to the computer, but would still need to exploit a vulnerability to gain access to anything on it. Technically speaking this bypasses any network based firewalls that may be in place, but does not render them insecure as they stated in the script.
If you like to learn a little more on the WEP attack, Infoworld as detailed (but non-technical) description here.
Watch CSI: NY for free on CBS.com:
CBS Innertube
