54
$\begingroup$

How would you design a piercing projectile (arrows, bullets, shurikens, etc) that can deliver a payload of malicious software to a computer that it is shot into?

Although it is rather silly and definitely very soft sci-fi, this is a type of weapon that shows up with surprising frequency (Avengers movies, XCOM games, etc). Essentially, this projectile weapon can hack a computer that it physically pierces through, immediately beginning the hack as soon as it becomes lodged inside the computer case proper.

Perhaps the main concern is its interaction with the physical internal components of the system. By its very nature, it needs be in very close proximity to specific internal components in order to deliver the data payload, yet it also risks physically damaging those same components. Requiring direct contact between the weapon and the components would be impractical, so one would probably need a method that can transmit wirelessly over at least an inch or two.

One must also consider which internal components would be interacted with. Different pieces of hardware speak different languages, so one might need to be prepared with multiple different types of viruses to hedge for which pieces of hardware can be reached.

What might the optimal physical design of such a weapon be? I would imagine that a long, narrow arrowhead would be ideal for piercing the outer casing of a machine while minimizing internal damage.

In order to be a proper "hacking arrow", the weapon must avoid destroying or shutting down the system with physical damage, at least immediately. There must be time for the software to be transferred and activated. The system might still break after some seconds or minutes due to mechanical issues or fire, and/or the software may destroy the system once it is finished, but the system must still temporarily survive being punctured.

What are the key aspects in designing a weapon that you can physically shoot into a computer in order to hack it?

$\endgroup$
  • 15
    $\begingroup$ Entirely ignoring the projectile/improv connection portion of it (which would be a task) the "universal hacking tool" isn't something that exists today in any capacity (I say this as somebody who works in cyber security). How much scrutiny do you want the answer to be? Are you looking for something that helps hand-wave this concept in comic-like worlds, or a detailed explanation of how it would be possible? $\endgroup$ – Nex Terren Jan 26 '17 at 18:23
  • 7
    $\begingroup$ I'm well aware that there is no "universal" hacking system. Let's assume that the software is already custom-designed specifically for the system it's being shot at. This is a premeditated shooting, not a random target. $\endgroup$ – Southpaw Hare Jan 26 '17 at 18:26
  • 70
    $\begingroup$ One of the easiest ways to hack a computer using an arrow or gun is to point it at the person who knows the password and tell them to unlock the computer... $\endgroup$ – AndyD273 Jan 26 '17 at 20:44
  • 12
    $\begingroup$ Like a USB port, on a stick? $\endgroup$ – Xavon_Wrentaile Jan 27 '17 at 0:25
  • 8
    $\begingroup$ For the record, Avengers didn't "shoot an arrow into a machine and hack it" -- they shot an arrow into a connection port; the arrow was tipped with something that fit that port. It'd be like shooting a USB drive into a USB port -- sure, still impractical, but if you're accurate enough, possible. Then it'd just be a matter of writing software that exploits some software vulerability. $\endgroup$ – Nic Hartley Jan 27 '17 at 15:23

26 Answers 26

64
$\begingroup$

Don't try to get information into the computer. Computer hardware just doesn't work that way. You're going to have to rely on so much extreme handwaving that you might as well have had a wizard cast a spell on the computer to hack it. Short of Jason Bush's nanites approach, it's just a non-starter.

Instead, try to get information from the computer. Van Eck Phreaking is a well studied approach to gleaning information off of a computer using side-band data captured electromagnetically. It can be done from across the room, or potentially even further. Few systems are designed against this, and almost all of them rely heavily on shielding which you could penetrate with your arrow.

Once you have usernames and passwords, hack the computer like usual.

$\endgroup$
  • 2
    $\begingroup$ That's the irony of this premise. With networking it's either wired or wireless. We can all basically agree that a (relatively) high velocity projectile making a wired connection to a computer is practically impossible (limited angles and impossible accuracy, like shooting a connector into USB port, or impossible/future technology like microrobotics). And if the attack vector is wireless, why shoot any projectile at all? Even if the method requires close range, with tweaking and bigger/specialized antennas & amplifiers one could eek out more range. $\endgroup$ – IT Bear Jan 26 '17 at 20:44
  • 2
    $\begingroup$ +1 for Van Eck. There's also the "Hands Off My PC" attack, which can sniff private keys but requires physical contact with the computer case. An arrow would be an unconventional approach, but would certainly get you physical contact. $\endgroup$ – Draconis Jan 26 '17 at 20:45
  • 11
    $\begingroup$ I'd actually see a narrow arrowhead with electronics contained inside, and some sort of Van Eck pickup on the pointy end of the arrowhead. The arrowhead would then have an insulating ring, and wide, flanged fingers to actually grip the edge of the case/shielding (to prevent from penetrating too far in so as to damage the electronics or end up with the antenna-shaft getting shielded too). The shaft would be the transmitting antenna, and would be covered in a thin insulating layer so incidental contact with case/shielding doesn't inadvertently ground it out. $\endgroup$ – Doktor J Jan 26 '17 at 22:02
  • $\begingroup$ How exactly is the Van Eck supposed to work with a projectile either a. moving quickly past the computer, or b. hitting the computer and potentially damaging either the computer or projectile. Also, assuming it works, how would it transmit data back to the projectile user? While this is an inventive answer, it seems to me less realistic than nanites. $\endgroup$ – kingledion Jan 27 '17 at 3:27
  • 6
    $\begingroup$ As for doing damage, the OP wanted to fire an arrow at a computer, so there's that. As for damaging the electronics on the arrow itself, we're really good at dealing with that. Consider Excalibur, a GPS guided munition literally fired out of an artillery unit. We we can shoot a computer out of a cannon, putting on on an arrow is reasonable. $\endgroup$ – Cort Ammon Jan 27 '17 at 3:43
29
$\begingroup$

As this is a very unrealistic scenario I tried to think of any realistic answer that would handle all of the variables. My best response is that the projectile would pierce the case of a computer merely as a delivery platform for specialized nanites, programmed to form virtual networks and launch various penetration attempts against the system and its components. It's possible that the projectile could serve other functions as well, such as providing a wireless power source for the ninites, or providing a wireless communications channel through a shielded computer case. How much of this could be accomplished with existing technology I do not know, and there are likely more useful methods for accomplishing such things (see social engineering).

$\endgroup$
  • $\begingroup$ Welcome to the site Jason. Nice first answer. When you have a second its worth checking out the help center to get a feeling for what makes a good question/answer. $\endgroup$ – James Jan 26 '17 at 18:57
  • $\begingroup$ That's what I was thinking. Nanites are basically future magic. $\endgroup$ – Tophandour Jan 26 '17 at 20:07
  • 3
    $\begingroup$ Or a somewhat lower tech variant: the arrow has a fat container tip containing a cable and a small robot that attaches that cable to a certain port. The rest of the arrow acts like an antenna and you can proceed to wirelessly hack a computer that would otherwise be air-gapped. This is still above current tech level, as the robot has to be really small while being able to drag and connect a cable to the correct port. $\endgroup$ – user31389 Jan 27 '17 at 14:01
  • 2
    $\begingroup$ This gets fun with phones. Shoot phone with arrow, arrow enmeshes phone with nanite blob, blob hacks phone, arrow and blob evaporate into thin air. It'd be a great way to deal with inappropriate selfie takers. $\endgroup$ – ognockocaten Jan 27 '17 at 15:09
21
$\begingroup$

This requires a bit of setup, but I think it works.

Early in the story, have engineers discuss that the new computer architecture really isn't all that fault tolerant. If anything goes wrong, it pretty much has one fail mode: brick (do nothing). Even non-critical systems trigger the fail mode. The exception is when there's a debugger attached by wireless communication, which allows tech support to diagnose the issue and do things like upload driver patches. I've seen some devices that work like this. Having a full computer work that way is improbable, but an embedded computer, like a bridge/dam monitor would be unsurprising for me.

Later, your hardware assassin (HA) creates a gun like a nail gun, with a payload. I'm thinking something like one of those toy rockets from the 1950s with the super sharp points on the tip, without the fins. The body of the rocket has wireless device in it, like a Raspberry Pi.

HA fires the nail gun at the target computer, aiming to hit an unused USB port. Puncturing the port may create a device error since those ports are polled regularly for a connection. That's the only non-critical system I can come up with that is targetable and active, particularly on the embedded targets I mentioned earlier. HA probably has a short range of a few feet.

The target goes into fault mode. The wireless in the rocket body opens communication and says, "Hi. I'm a debugger. I'm here to help you." It proceeds to patch, likely with admin access, critical code. And then it does whatever it needs to do.

This idea skirts the edge of believability, I admit, but perhaps it is a shell you can build from.

$\endgroup$
  • 1
    $\begingroup$ So, you suggest that a mission critical system listens to just any wireless system - without authorization - just because it just got bricked? That won't happen. $\endgroup$ – John Dvorak Jan 27 '17 at 13:43
  • 7
    $\begingroup$ @jandvorak I wish I did not know counterexamples, but I do. Default passwords on infrastructure monitoring is all too common. In my city, local university prof just a couple years ago demonstrated ability to log in and open the flood gates on the dam. $\endgroup$ – SRM Jan 27 '17 at 14:06
  • 3
    $\begingroup$ I like this answer because it doesn't try to attack all computers. It targets a specific computer with its weaknesses. All too often we forget to specialize our attacks to our target. The author can weave these weaknesses into the story. If this particular weakness feels far fetched, the answer still serves as a blueprint for how the author can pick a weakness which feels better to them and attack it. $\endgroup$ – Cort Ammon Jan 27 '17 at 14:48
  • $\begingroup$ I should mention here: I have a second answer in this thread that takes this answer and goes into much deeper detail. $\endgroup$ – SRM May 8 '18 at 2:32
12
$\begingroup$

I can think of a couple, admittedly far fetched, scenarios where a "hacking arrow" might be useful.

  1. PCs are protected by a faraday cage. So the arrow head pierces the case in order to breach the cage and be able to wirelessly interact with the sensitive non-hardened components inside. This would presume that PCs rely almost exclusively on the cage for protection from remote hacking, once you breech the cage it is easy to hack the PC with a Bluetooth, NFC, or Wi-Fi transmitter.

  2. The arrowhead is cutting a CABLE, essentially bridging the gap and allowing a microcomputer inside the arrow head to read all the data being transmitted by the cable and insert it's own code. So imagine a data cable that is being physically severed but the arrowhead still passes info to each severed end. Upstream and downstream PCs may not notice a difference (perhaps slight lag?). Of course this can be done in the real world and doesn't even need to physically cut the cable. Obviously extraordinary marksmanship would be required.

  3. The arrow head has a powerful transmitter that needs to be very close to the target in order to overpower electronic countermeasures/jamming. Sure, the building may be secure from intruding transmissions, but if you could deliver a transmitter RIGHT NEXT to the target, it could cut through the interference and "hack" the target.

$\endgroup$
11
$\begingroup$

It may not be as silly as you think.

Sound based attacks on encryption have been demonstrated, and other processing tasks might leak other data. Observation and potentially control of signals on wires is possible at short ranges. Some chips are now using wireless communication to avoid issues with moving low power high speed data over small wires.

Getting inside the case would make these less silly-sounding even though you don't need to with the real world attacks. The hacking part probably needs to be targeted to a device, so the projectile might be too. Either using cameras and control surfaces to aim itself at a known safe spot in the case, or maybe having a well designed shaped charge that opens a hole without throwing around much extra energy to damage things and a soft part of the projectile going in at a reasonable speed.

Redundancy and failsafe are expected to be words computer users like to hear for the foreseeable future. High end systems (specially the ones that might be expected to get hit by things) try to still work when some damage is done, quite possibly by switching to identical backup parts in the same or a nearby box.

$\endgroup$
9
$\begingroup$

Solid Snake

Why not have the shaft of the arrow contain a snake-like robot which finds and plugs itself into any unused 1394/USB headers on the mother board. The tip of the snake is therefore just the header with a wire to the base of the shaft where the controller sits with a small camera for identifying the pattern. At that point you have physical access and unless the computer admin has taken specific action to disable the unused header, you basically own most computers. The shaft also contains batteries (until it can charge from USB) and acts as an antenna for wireless transmission.

$\endgroup$
  • $\begingroup$ It could also plug itself into a debug connector (which usually allow unrestricted access to the whole hardware). Attaching itself to the RAM would also allow direct read and write access to all data in memory. $\endgroup$ – Michael Jan 27 '17 at 18:47
  • $\begingroup$ Very true, though I think simplicity trumps here, and also allows a high-level IT wizard to thwart the attempts of the ArchHacker by expertly securing the physical machines. It also requires relatively few Sci Fi conceits as-is, as robotic snakes are a field of heavy study at the moment. Miniaturizing them, allowing fine motor skills, and adding automated plug-identification are all totally reasonable. There are additional conceits for it being impact resistant enough to survive the piercing of the case and that it may need to be modified to work against blade servers as well. $\endgroup$ – Nate Diamond Jan 27 '17 at 21:59
7
+50
$\begingroup$

Earlier I posted this answer: https://worldbuilding.stackexchange.com/a/69310/26246 I claimed it was a bit unrealistic... well, here's the details...

(I thought about editing my earlier answer, but I'm going to go into way more detail here... best to start with a clean slate so the comments aren't confusing.)

I will mark certain words in boldface. Those are the points of this description that are particularly relevant to answering this question.


This is computer. It is a ruggedized cRIO-9032 from National Instruments (specs here):

cRIO-9032 from National Instruments

It is designed for outdoor use, primarily as a monitoring and control system for things like stress on bridges, gates on dams, stability of volcanoes, etc. It is wi-fi enabled, and operates in environments ranging between −20 °C and 55 °C. The chassis is aluminum A.

Now... you see those four rectangles on the right side of the image? Those are cRIO modules — think like a card on the inside of desktop machines, but these add various external connections for sensors and whatnot. Here's a closer view of one module:

one cRIO module

R&D testing confirms that you can destroy one or more of those modules — as long as the backplane isn't pierced, the computer will continue running just fine. The next time that the computer tries to access that module, it will raise a "module not found" error (error code −65622). The backplane is pretty easy to miss — an arrow vertical through a module won't hit it.

Now... I said this is a computer. A user programs it with whatever software they want, running on the real-time operating system. A brand new cRIO has "admin" and blank password as its default setting. Users are responsible for configuring a better password.

What does all this mean?

  • It means you have a computer that is frequently deployed in outdoor locations where it makes sense to shoot an arrow (unlike a server room).
  • You have a system with that will continue operating if a part gets destroyed.
  • And you have it programmable to be as secure or unsecure as the software engineers who work on the project choose to make it.

So now the scenario goes like this:

A team of software engineers creates some sort of monitoring system. They're pressed for time, and they know that they're going to have to debug the system later in the field, so they leave their debug backdoor in the software — it's off by default, but if one of the modules turns out to be buggy, the wi-fi will open an unsecure port so a laptop can log in an provide instructions. They aren't worried about security because, well, let's face it, few software engineers are, but this team figures they're out in the boonies, monitoring an oil rig or something. What they forget is that this device, in order to upload its regular monitoring data, has login certificates for databases that should probably be on an air-gapped system away from anything sensitive, but probably aren't because, again, no one worries about security. So instead, those databases are hosted on server X.

So your hacker needs to get into server X and learns about this remote monitoring project. The cRIO is high up on the oil derrick. And the hacker has one of those nifty arrows from Hawkeye of Marvel Comics. This particular arrow has a payload behind it of something like a Raspberry Pi or similar device, nicely form-factored for aerodynamic flight. (Don't complain about the handwave — I got the answer to this point... you're on your own for arrow design!)

He/she goes out to the site, fires his arrow with its electronic payload through one of the sensor modules. The cRIO raises the error code, and the silly developers' debug code turns on the wi-fi. The arrow logs in and uploads new instructions, takes advantage of security certificate for server X. He/she then goes home to his 7-monitor desktop system for some serious hacking. (Please don't do this in your movie. Stupid Swordfish.)

Important: If you ever make a movie using this idea, my co-workers are very intrigued and want to be notified!

$\endgroup$
6
$\begingroup$

Like most of the answers, this requires some handwaving:

Let's assume your target computer is connected to a standard keyboard by an unshielded wire. You fire your hacking arrow into the keyboard (or maybe at the wire itself). It outputs an electromagnetic signal powerful enough to cause interference in the unshielded wire, generating signals that get sent along the wire into the computer. If your keyboard uses a standard protocol, then the hacking device can output signals that get transmitted along the wire and emulate keystrokes.

Now your arrow can 'type' input into the target system. If the operating system is known, you come up with a standard set of keyboard commands that should perform a specific action on the target machine, such as (on Windows)

[windows key] + [R]   //opens 'run' dialog
[c][m][d] [return] //opens command prompt
[e][r][a][s][e][ ][c][:][\][w][i][n][d][o][w][s][\][*][.][*] [return]
[y] //confirm operation
$\endgroup$
  • $\begingroup$ This is my favorite idea. I wonder if you could use electromagnetic induction to target a nearby (or physically touching) USB port, creating a signal without having a device that's plugged in per se. Of course, it would be utter folly to design a secure computer with an open, functioning USB port -- but that kind of thing happens in real life all the time. Engineers assume that since it's "impossible" to penetrate security and physically access the computer, there's no need to lock down its inputs. $\endgroup$ – octern Jan 28 '17 at 18:28
5
$\begingroup$

I don't think that a piercing projectile can be of any use here, maybe something sticky that glues itself to computer device, melts a hole and sends in nanobots or something like that.

Just think for a second about shooting a metal box with an arrow. In order to pierce you need to shoot at a certain angle, with great power and there are also many other things you need to consider before getting to the data transfer problem, because in reality arrows are by far not the best projectiles.

If you really want a projectile that pierces I'd go with a bullet, but again, what if you damage some physical connections that are in the device and won't be able to transfer data? Or damage the components that store data, or short circuit will happen and instead of any hacking it will just burn the device. Too many possibilities for a bad ending. It's unpractical.

Generally speaking, if such thing was possible, it would exist in our world by now. To answer your question we need more information about the level of computer technology that exists in your world. It's like the current level of tech on Earth, then it's impossible to have hacking bullets.

You mentioned XCOM series, but I don't remember anything like that there, beside hacking with a flying robot that connects to something, maybe you mean EMP grenades? Though it's not hacking.

$\endgroup$
  • 2
    $\begingroup$ A standard recurve bow with a 35+ pound draw with steel pointed arrows would easily pierce a computer case...if not go all the way through. $\endgroup$ – James Jan 26 '17 at 18:54
  • 5
    $\begingroup$ Well, I imagine that in a world where hackers shoot bows the cases would be much thicker. $\endgroup$ – galloper Jan 26 '17 at 18:56
  • $\begingroup$ As its not mentioned in the question that is an assumption on your part though. In the fiction examples listed I can't recall a situation where the computers were specifically protected against pointy stick projectiles :D $\endgroup$ – James Jan 26 '17 at 18:58
  • 2
    $\begingroup$ XCOM 2 has "Bluescreen Bullets", which deliver computer viruses that replicate in alien systems what we know in our modern real world as "The Blue Screen of Death" (though the people of 2035 haven't experienced this embarassing phenomenon in some time). $\endgroup$ – Southpaw Hare Jan 26 '17 at 18:58
  • 1
    $\begingroup$ @JDługosz Drilling is far harder that brute force punching your way through with a sharp edge. $\endgroup$ – Trotski94 Jan 27 '17 at 10:39
5
$\begingroup$

Does it have to actually pierce the computer, instead of just sticking to the side? If it can just stick to the side (thus not damaging anything), the arrow could use powerful antennas and hyper-advanced beamforming techniques to induce currents in specific parts of the circuitry, thus changing the data as desired.

Given that almost all computers have little space between the components and the case (even a desktop tower doesn't, on its right side), I think the best approach would be to stick to the side with an instant adhesive. The metal case would be the greatest issue, as it interferes with the electromagnetic hacking, but you can probably write it off as a problem solved by the hyper-advanced beamforming.

Edit: As for the instant adhesive, it could work like how Post-Its work, by having zillions of tiny glue bubbles that are popped on contact, causing them to stick. Of course, something stronger than Post-It glue will be required.

$\endgroup$
4
$\begingroup$

Bridging the air gap

First why are you shooting projectiles to hack?

Well it must mean that you have limited / no access to the system and you are using this odd tool to open a new attack vector.
The simple version of this is an air gapped or firewalled system. It is also true that some newer operating systems offer different authentication methods for a local user rather than remote (camera authentication is now available) these might be easier to attack then the modes accessible through the internet.

How does the projectile interface with the machine?

This is the hard part computer parts and ports tend to be small enough so a miss by more than a millimeter will make the system fail. So you need to be freakishly accurate but also "hit" lightly enough to not damage the port or component you are attaching to.
The first idea that springs to mind is to have a frame the pads the landing and attaches to the outside of machine the frame then detects the location of the port (usb or whatever you desire) and connect to it. This gives you a stationary and stable platform to preform the delicate connection.
The added weight of the frame and the high accuracy requirement make this a better candidate for launch by computer sighted launcher than a human archer ... unless the archer has the super ability of ludicrous accuracy.

$\endgroup$
  • 2
    $\begingroup$ Maybe freakishly accurate, but it's not impossible, and that doesn't even have any handwavy technology to make him more accurate! $\endgroup$ – Wayne Werner Jan 26 '17 at 19:30
  • $\begingroup$ @WayneWerner I saw that, where he was shooting aspirin tablets out of the air... Yeah, that's a little nuts. $\endgroup$ – AndyD273 Jan 26 '17 at 20:43
4
$\begingroup$

Mentioning this since I don't see it already.

The projectile doesn't hack, it just locates the computer

So, imagine someone like Tony Stark.

He's already got access to any machine in the world he wants through his sophisticated mainframe. The problem is identifying that specific computer over there.

The projectile projects a carrier frequency physically into the hardware that can be detected on the global internet so the super-computer can find it and break in from the outside.

$\endgroup$
4
$\begingroup$

I saw this while I was over on the StackOverflow forum and I just had to come and write a response. I would say that no, computer hacking with an arrow is actually relatively feasible. Just consider your standard organization; they usually have security personnel who align all of the wireless antenna to function solely within the building. If you are a hacker, and a half decent bowman, it would be much simpler to fire an arrow in an open window than to try to sneak past mantraps, turnstiles, and that guy named Joe who mans the front desk with some sort of weapon (Probably an axe). Then, suddenly, you can use the arrow as basically an altered Wifi range extender allowing you to access their network from your car outside the premises. This is what is known as a rogue access point. Of course, usually it would be easier to simply use phishing or DNS hijacking to get into the network, but assuming your targets do not have email addresses or a webserver and their OS is fully patched, this arrow might offer a way in.

Secondly, I agree with those who say that you could cut a cord with extraordinary marksmanship and use it as a Man-in-the-middle tool, in which you could capture and alter packets as they flow through and use them for all sorts of things such as: Stealing passwords, credit card numbers, and other personally identifiable information.

Of course there is more than that, but that is up to you to figure out.

Lastly, please let me introduce you to a technique known as Rowhammer. This technique normally exploits the tendency of bits to flip within memory when a nearby bit is electrically discharged. Normally, it would be utilized within a web-exploit, but in your case, it is much simpler than that. Just apply direct electrical discharges to any part of the memory you want to change, and the behavior of the computer will change accordingly. However, this requires access to an extremely similar system beforehand on which to test it, as there is no way you can perform this attack without prior knowledge of the system's configuration, as you will destroy the machine.

That's it for now, but of course, there are more options than just the three I presented here.

$\endgroup$
  • $\begingroup$ Rowhammer: wow. My main desktop and my file server use ECC RAM. Isn’t ECC,registered RAM normal for servers? $\endgroup$ – JDługosz May 8 '17 at 5:53
  • $\begingroup$ That is correct. $\endgroup$ – DeepS1X May 8 '17 at 17:00
  • $\begingroup$ You should, however note that ECC RAM is only partially resistant to bit flipping. $\endgroup$ – DeepS1X May 7 '18 at 6:15
  • $\begingroup$ I think it is significantly unlikely that several bits would flip at the same time in such a way to give a passing SECDED check. That’s the point of the check code — I would expect other parts failures long before it happens. Flipping any two bits is always detected, as are any odd number of flips. Most random changes of >3 bits will not check. $\endgroup$ – JDługosz May 7 '18 at 21:21
  • $\begingroup$ You might be aware of more accurate/current information than me, but it's my understanding that ECC can correct single bit flips, detect double flips, and cannot detect any number of flips greater than 2. $\endgroup$ – DeepS1X May 9 '18 at 7:31
3
$\begingroup$

Well this answer admittedly doesn't answer the question as is because it doesn't fit many of the requirements. But I think it is a bit more realistic so could be of use for ideas.

Frozen RAM bypasses all disk encryption methods

Encrypting a hard drive can be a great way to ensure data stored on a computer is safe. To access this data you type in a password and it is stored in RAM so that the computer can continue to read/write to memory. This is considered safe because RAM is volatile so no one can come in and read that password out of memory. However, it has been shown that if you greatly reduce the temperature (freeze) RAM it drains its memory much much slower, thus giving an attacker time to plug the memory into their own machine and read the encryption key.

So, if you want to work this into a story, you can detail a room with top secret encrypted computers. The hacker has devised a way to gain access to the room but as soon as he does an alarm will trigger locking down everything and shutting down the computer. To combat this, before entering the hacker shoots an arrow into the computer which then delivers a payload of liquid nitrogen. He then enters the room, grabs the frozen RAM and encrypted hard drive, and makes off with all the tools needed to get to the secrets.

Not as flashy as remote downloading arrows like in the avengers but real life never is.

$\endgroup$
  • $\begingroup$ The hacker would have to grab the RAM, plug it into a box, then grab the hard drive. It doesn't drain that slowly. $\endgroup$ – wizzwizz4 Jan 27 '17 at 16:58
  • $\begingroup$ I think this would need "ballista" not "arrow" in order to carry enough liquid nitrogen to be effective. But I applaud the brainstroming and would happily suspend disbelief in a movie that at least tried for this level of technical accuracy with an arrow carrying only a shaft's worth of liquid nitrogen! $\endgroup$ – SRM May 8 '18 at 2:30
3
$\begingroup$

You're definitely getting into the fictional realm of science fiction here, but let's examine the variety of computer bits that you could hack, and some of the reasons that might (or probably wouldn't) work. I think I'll go from hardest/most valuable to easiest/least valuable.

Processor/Motherboard/BIOS

The most valuable target in your computer is the processor. If you could actually capture the signals that are going in and out of the CPU, you could potentially setup an emulator to replay the data. Additionally, you could inject your own signals into the stream (bonus points if you can sever the traces on the mother board and become a Man in the Middle (MitM)). Then you could alter the signals however you want.

Other points on the motherboard offer you similar kinds of benefits, like the RAM.

The problem, of course, is that you're talking about teeny tiny traces. Also, sensitive voltages. It's pretty likely that you'll crash the system when you try this. But you could do it.

If you can overwrite the BIOS with your own, however, you've also taken over the system. Though a lot of newer systems actually have certificates baked into the hardware, so monitoring would be a better thing here.

Disk drives

You can pretty much apply the same principles to disk drives - monitoring and injecting. The trickier business with the hard disk is that it's likely for a high-value target that by the time the bits make it to the disk they've been encrypted by the OS that's running in RAM.

Ports

You could probably reasonably develop a system with current technology that would allow you to fire darts into unused ports. Naturally they can't be blocked, but you could do something to that effect. Or perhaps your hacking tool has the mechanics to unplug something and then become a MitM.

Probably one of the most effective usages here would be attacking an airgapped target. Of course the unfortunate (for your attacker) thing about an airgapped target is that it's probably going to be pretty obvious that it's being attacked.

External devices

Depending on the circumstances and the device there may be an opportunity to attack external devices. Keyboards are probably the most valuable. For network cards, again by the time the information reaches the card it's probably going to be encrypted - especially in a high-value target.

$\endgroup$
3
$\begingroup$

Pierce and Play

So this is going to be a b it of a stretch, but bear with me. To start with we need to think of the projectile as two parts; the inside is going to be a high-tech computer of sorts, and the outside will be an incredibly strong and well-designed conductor.

The Shell

This is the part that is going to be hardest to swallow, but I'll give it the old college try. The outer surface of your projectile needs to be made of some kind of super conductive material. The idea is that after you physically insert it into the system that you are trying to hack, it will be able to essentially replace whatever bits of the original architecture it displaced with itself. Data is really just electricity moving around, so if your projectile can continue to move that electricity in the same way as the original hardware it shouldn't be a huge interruption to the computer.

Of course, for this to work out you are going to want your projectile to be incredibly sharp and as small as possible, to destroy the least amount of physical hardware. Something like a crazy high tech dart might be the best option for this.

The Guts

The inside of the projectile is just as fantastic and unlikely, because what you need is a computer that can figure out what kind of data is being sent through the projectile and then alter it in some way. Think of it like a man in the middle attack, only the man is actually an arrow (or dart, or whatever) and what he is in the middle of is your computer.

Handwaving at the Highest Level

So, lets pretend that you have this kind of projectile and go to use it. You throw a dart at the target computer, it pierces into it and begins acting as a conductor for the physical parts of the computer that it just destroyed. The onboard computer analyzes the data that is passing through the projectile and then alters it in whatever way it is programmed to. Eventually this leads to the targeted computer getting "hacked" for whatever definition you want to use. Once you are done you can remove the projectile, which will break that connection and kill the computer it was shot at.

$\endgroup$
  • $\begingroup$ By "super conductor", do you mean "really good conductor" or "super-conductor"? $\endgroup$ – wizzwizz4 Jan 26 '17 at 21:29
  • $\begingroup$ @wizzwizz4 I was using super conductive to mean a really good conductor. Saying that the only material that works is also a room temp super conductor is about as far fetched as everything else about my answer, but I don't think it actually adds anything to the original ask. $\endgroup$ – D.Spetz Jan 27 '17 at 14:20
3
$\begingroup$

Make up computers vulnerable to such attacks but resistant to physical damage:

Our present day computers are very likely to crash if you broke their casing and start fingering their tiny parts. But take the human brain for example: It is much more sensitive to many factors, for example pH change or temperature, but can endure quite a much localized damage without shutting down and even learn to substitute the damaged parts.

Make a computer which has many independent but connected physical parts processing information simultaneously. (Not a classic computer build around a processor and running a neural network, but real, hardware based artificial neurons.) Such a device won't be used as PC or data storage, but to control something (robot, drone swarm...) which has to intelligently react to it's environment. If you breach it's casing and wipe out some thousands neurons, it won't wreck, but will start to adapt to the situation and reroute its computing to unharmed parts. But your projectile will connect to the places of the broken neurons and send in false information. If you know enough about the system you hit, it may will be able to take control over the device.

$\endgroup$
3
$\begingroup$

I think hacker arrows make sense with one condition:

The computers have hardware backdoors, either by poor design or sabotage

Say that the computers have hardware installed that can open or shut a programmatic backdoor (an obviously bad idea, but a surprisingly common one).

Or maybe you know a rebel scientist who works in chip manufacturing and has created hidden backdoors. If you can fry that hardware the right way you'll open the backdoor.

Once the backdoor is popped via hacking arrow, the device is ready to be hacked remotely by our archer's hacker compadre.

What does "fry" mean? I don't know, ask the rebel scientist / hacker compadre. Hell, they probably designed the arrows. But maybe it means something like wireless capacitor charging...

In June 2016 it was reported that University of Michigan Department of Electrical Engineering and Computer Science built a hardware backdoor that leverages "analog circuits to create a hardware attack" so that after the capacitors store up enough electricity to be fully charged, it would be switched on, to give an attacker complete access to whatever system or device − such as a PC − that contains the backdoored chip. In the study that won the "best paper" award at at IEEE Symposium on Privacy and Security they also note that microscopic hardware backdoor wouldn't be caught by practically any modern method of hardware security analysis, and could be planted by a single employee of a chip factory.

https://en.wikipedia.org/wiki/Hardware_backdoor#Examples

$\endgroup$
3
$\begingroup$

Let's look at modern day Bluetooth. The protocol is not very secure. It's encrypt ions are not high grade. Bluetooth depends on one thing, for someone to hack you they would need to stand uncomfortably close to you for a long period of time. That's not a real scenario. So in modern day people talk about constructing large super targeted Bluetooth antennas. They can then interface with Bluetooth from a mile away and the hack becomes a real threat.

So back to the arrow. The idea of the arrow is to attack an NFC interface (near field). For instance something that works only one inch away, and is constantly observed by security may be very insecure. Plant an arrow on the other side of the wall that would give you radio access to the NFC and now you can quickly hack the weakest point in the security network.

$\endgroup$
2
$\begingroup$

So this is a way out there... but considering the examples all come from soft sci-fi sources maybe it'll be ok.

So first the head of the arrow needs to be able to pierce thin steel, but not penetrate too deep, so a sharp hard point with arms coming out the side to let just the tip in, and keep it from going right through to the sensitive stuff.

Behind the head and maybe up into the shaft of the arrow would be electronics, with a bunch of little super thin wires that would extend, seek out and tap into key areas like the ram connections, processor, hard drive, etc.

$\endgroup$
2
$\begingroup$

At the risk of stating the obvious, you could just have an arrow with an RJ45 plug on the end and a small single-board computer glued to the shaft. Shoot it into an unoccupied ethernet port on the front of a rack-mounted server and it connects via (say) an unsecured heartbeat network and uses some exploit to pwn the server in whatever way the story requires.

As to why you need the arrow, it's not unusual for servers to be in locked cages or for sections of data centers to be separated by welded mesh security fences (allowing servers to share airflow while keeping customers away from each other's equipment). Hitting an RJ45 would require impressive, but not inconceivable archery skill; I assume any character doing this is meant to be a bad-ass.

If you just want to shoot an arrow with flashing lights into a server and then say it's been hacked, "something something van Eck phreaking" would cover it, but I would say that is phenomenally difficult to sell if you are going into a lot of detail. Modern computers are filled with GHz-frequency components and spinning fans and bits of metal that would make it difficult even in a lab setting.

$\endgroup$
2
$\begingroup$

I believe that this is possible, and it can be even more discreet/fast than you think. You state that the required "software" is set up and that is needed in my idea. Say you have a RFID scanner setup. Then you shoot an arrow with an RFID chip inside that has your hacking codes or whatever into the computer/receiver. If the RFID scanner continues to be able to actaully pick up the signal you send it will activate the commadns you sent. Now probably if you want it to look like it "hit" the machine, then make the computer and arow head magnetic. That way, hopefully with no penertration, the info is delviered.

Better yet, you could just have the arrow with the information whiz above the reciver and delvier the commands.

$\endgroup$
2
$\begingroup$

After penetrating the outer shell you could use tendrils that are attracted to any electrical connection that hijack the signal and replace it with their own. This would allow you to read for eg. the cpu traffic, figure out what it's doing and then start controlling it. I would suggest the arrow has wlan that it uses to connect to a sophisticated data center somewhere that can quickly analyze the caught traffic, scans every connected device for information and then starts controlling it if it's already known. If it is unknown the programms used get transmitted to the datacenter and analysed for function names/common patterns that give information about the programm, those are used by an AI to reverse-engineer the programm and then control the device used.

The tendrils could be from a specially engineerd tin alloy. Based on the real world phenomenon of tin wiskers which grow slowly in electronics and shortcurcuit it.

https://en.wikipedia.org/wiki/Whisker_(metallurgy)

The german article names Antimon, Cadmium, Indium, Tin und Zinc as metalls which form whiskers.

$\endgroup$
2
$\begingroup$

This is C.H.I.P.:

I always wanted to post a banana here.

It has:

1.0GHz CPU
512MB of RAM
4GB of storage
Built-in Wi-Fi and Bluetooth

I am not saying this has to be done with C.H.I.P., but rather suggesting that since it has these specs, then something smaller might also have enough hardware power to connect to a wi-fi network or piconet and deliver a payload. And if 802.11p ever becomes mainstream, you could also get into vehicular networks.

Anyway. You need to get into a wireless network first. For ultra-realism, refer to:

Is hacking Wi-Fi THAT easy? (just spoof, and it's hacked?)

Otherwise, having people hack into systems as easily as walking into a bar requires a negligible amount of suspension of disbelief.

Once inside, taylor the amount of technical terms to your needs. Again, for realism, you can say that a hacker exploited a zero-day vulnerability on a port to gain system level access and set a rootkit. If your audience is not composed mostly of techies or if you wish the tech to sound alien/super advanced, you can lower the threshold and just say that the hack "bypassed the buffers and sabotaged the relay matrix".

The arrow in this case is just really the medium to get a malicious device close enough to your target. You don't even have to hit the computer proper. And if you are close enough, you can pull the hacking device out of the arrow and maybe stick it under a table with chewed bubble gum.

And of course, if you can deliver it with an arrow, you might also be able to come up with solutions involving anything from nerf guns to potato guns.

$\endgroup$
2
$\begingroup$

All the parts of the machine are wireless

Most robots are operated with wires connected to a computer, but it doesn't need to be this way.

If your robot is going to be taking damage, the wiring is a weak point, since a cut wire can disable the robot.

As an alternative, parts of the machine can communicate to each other via wireless (like bluetooth).

Your projectiles could work by:

Jamming the signals The projectile broadcasts a powerful signal on the same frequency as the wireless, preventing the parts of the machine from receiving signals.

Decrypting the packets and issuing new commands This is a little less plausible, since encryption is hard to break and very easy to upgrade, but if your projectile can read the packets and transmit them back to a server, that server could get going on cracking the encryption. Once cracked, the projectile could pretend to be a part of the machine and issue new commands.

$\endgroup$
1
$\begingroup$

With known systems and technology, I think the shooter should target the parts of a system that can be swapped while the system is running, and not attempt to break/wirelessly control components that cannot be hot-swapped if the system must keep running, because the latter would take advanced mini robots to precisely place tiny connections, at least. Wireless control of any component with the size constraint of a projectile is rather unlikely unless there are known wireless vulnerabilities, though that may be viable if you know a way to wirelessly hack the system, but the security doesn't allow anyone to set up any wireless device anywhere near it - then shooting a wireless device there might be useful, but I wonder why the security doesn't just disable the wireless receiving component beforehand in that case.

Shooting a small robot that can pierce into a network cable to decode and intercept the signals is probably easier, but if the shot must be aimed at the case, how about specific parts of a case like network/keyboard/mouse ports? Secure systems could monitor those connections, but you could imagine a determined hacker to have broken those protocols beforehand. After all, even the best computers can occasionally have a loose keyboard connection, right?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.