Advanced cyberphone. Charge your mobile phone with hacker power!

The previous article, (Cyberphone. Transforming an Android smartphone into a hacker tool), presented a simple and universal technique that can be used to create a GNU environment, the basis for hacking tools. It also explained how to build drivers directly on your device and arrange communication between Android and GNU. Finally, the article demonstrated some of the hacker capabilities in modern smartphones, including the most dangerous and common attack vectors using a radio channel. Now let’s see what your phone is capable of when you have direct physical access to the attacked device.

BadUSB

Modern Android devices can emulate USB out-of-the-box. For instance, when you connect your phone to a computer, it usually asks how it should be identified: as a network device, a removable disk, etc. Such emulation is implemented via so-called USB gadgets. You can find out what gadgets are implemented in your current kernel using the USB Gadget Tool mobile app (net.tjado.usbgadget). Chances are high that your phone supports gadgets required to deliver various BadUSB attacks.

BadUSB-hid

Using your phone, you can easily emulate a keyboard and execute arbitrary commands using automatic input (this attack was described in the article VERY bad flash drive. BadUSB attack in detail. All you need is the hid.keyboard USB function; using the script below, you can enable keyboard emulation capabilities hidden in your phone:

badusb/hid/start.sh

As a result, your phone becomes a USB keyboard. The following script activates keyboard strokes:

badusb/hid/keystrokes.sh

A BadUSB-hid attack delivered from a phone looks less suspicious compared to a flash drive. Very few people would blindly insert your malicious memory stick into their computer, but almost anyone would allow you to charge your phone from it.

This is an excellent social attack vector. Contrary to general belief, hacking a computer with a phone is much easier than hacking a phone with a computer. Isn’t this funny?

To deliver your attack covertly, you can activate it not immediately after the connection, but some time later:

Modern phones have many sensors, and you can trigger the attack using lighting, vibration, phone movement, or even a voice command:

android/listen.sh

The syntax of ducky scripts is completely identical to that described in the earlier articles about BadUSB and about its wireless analogue Mousejack. The most dangerous code that can be typed on the emulated keyboard is as follows:

badusb/hid/ducky.txt

Your phone is quietly charging from the victim’s computer, but as soon as it hears your “Run!” command, the attack is triggered, and the computer becomes compromised in a second. You can even launch this attack remotely by connecting to your phone via VPN using 4G and running the keystrokes.sh script on it.

Since your keyboard is emulated, you can use /dev/hidg0 to interactively type on the phone’s virtual keyboard:

badusb/hid/keyboard.sh

Using /dev/hidg1, you can control the mouse as well:

badusb/hid/mouse.py

Console clicks in pseudographics mode are used to transmit cursor movements to the computer.

BadUSB-ETH

The BadUSB-ETH attack that enables you to intercept network traffic (see the article Evil Ethernet. BadUSB-ETH attack in detail) can also be delivered from your phone. All you have to do is slightly reconfigure it:

badusb/eth/start.sh

In the first section of the above script, network card emulation via USB is activated. By the way, it may already be present in your phone by default or be accessible in its settings: Settings → Developer options → Default USB configuration: USB modem.

In the second section of the script, a custom DHCP server is started; it blocks the victim’s network routes and forwards all its traffic to the attacker’s phone.

Since Android OS cannot start its DHCP server when the phone is connected, interface setup might be interrupted. Therefore, you have to finish the configuration process manually, and this is exactly what the third section of the script does.

The script must be started prior to connecting the phone to a locked computer to ensure that the rndis0 interface on the phone is configured correctly. If everything is right, the computer your phone is connected to will also automatically configure its network interface. After that, the attacked computer starts forwarding all its traffic, including Wi-Fi and Ethernet (if any), to your phone. This happens because routes of existing network interfaces have been blocked by the USB network.

Next, your phone starts delivering attacks:

badusb/eth/attack.sh

In the first cycle, on_network attacks (that are universal for all clients) are delivered. In the second cycle, the IP address of the client (i.e. target device) is expected to appear; and in the third cycle, all on_client attacks are delivered against it: vulnerability checkers, brute-forcers, data collection, etc. Thanks to the phone display, the attacker can monitor the progress of these attacks.

This way, you have a good chance to capture an NetNTLM hash. If you brute-force it (which is also quite possible), you would be able to bypass the device lock. If this is a domain computer, then the captured hash can be sent to the LDAP domain controller, and, after slightly adjusting certain account properties, you can bypass its authentication as well. If you are lucky, you can immediately execute arbitrary code using some vulnerability or guessed password and then activate a backdoor. And all you need for this is just a phone!

BadUSB-HDD

In addition to input devices (hid) and network cards (eth), Android phones (more specifically, the Linux kernel) can emulate storage media: hard drives and CD drives.

BadUSB-HDD is a subtype of the BadUSB attacks: you imitate a boot device during a reboot and execute arbitrary code. However, the ability to emulate a disk can be used in other ways as well.

A regular image file is used as a disk. Its content represents a sequence of bytes. Everything that is written in this file is ‘stored’ on the ‘disk’. The following script can optionally emulate such precrafted disks:

badusb/hdd/start.sh

Importantly, you can also emulate read-only media so that the OS or antivirus cannot delete anything. The following script stops disk emulation:

badusb/hdd/stop.sh

Each disk image can use its own attack script, for example:

• empty.img. When connected, an empty disk is emulated. You can copy anything to it. The disk image file on the phone can be encrypted to conceal stolen information;
• vuln_ntfs.img. When a Windows PC is connected to a specially damaged file system, it may crash to BSOD. If you are dealing with some information terminal, then this is a simple denial of service scenario. If you are dealing with a locked computer that was forced to crash to BSOD this way, it will reboot – possibly, preserving data saved in its RAM (i.e. they won’t be erased). At this point, you can proceed to the next scenario;
• coldboot.img. The method was described in the article Cold boot attack. Dumping RAM with a USB flash drive. Using a phone, you can dump RAM to a file stored in the same image; and 
• kali.img. If you have full physical access to a computer and nothing but a phone is at your hand, you can emulate a Kali Linux boot disk (or something like this), reboot the computer from it, and start delivering further attacks. This way, you can bypass both organizational control (since you only have a phone) and technical control (all antiviruses have been left in the other OS).

The figure below shows a phone connected to a computer via USB that emulates a disk with a damaged file system that causes BSOD.

A computer forced to reboot this way may preserve data stored in its RAM (i.e. they won’t be erased during the reboot). At this point, your phone can emulate another drive via USB, coldboot.img, and deliver a Cold Boot attack.

Proxmark

The RFID (125 kHz) and NFC (13.56 MHz) technologies are commonly used for contactless identification in pass entry systems (e.g. to pass through turnstiles at factories, office and building entrances, etc.).

RFID and NFC can be easily confused since they are barely distinguishable in appearance. Still, some life hacks enable you to quickly identify the type of contactless technology you are dealing with. Modern phones are equipped with NFC and don’t use RFID; so, if your phone reacts to a tag in its vicinity, then it’s NFC. Another way is visual and involves a flashlight.

If you see a round antenna, it’s likely RFID; a rectangular antenna indicates NFC. But you can encounter special cases as well. These two technologies are equally widespread. Automated access control and management systems in business centers and enterprises normally use RFID; while most hotels use NFC. Also, payment cards, including bank cards, are based on the NFC technology, but they use a slightly different principle, which is beyond the scope of this article.

Both technologies use a contactless near-field communication technique: an RFID/NFC chip turns on and operates using electromagnetic energy over short distances (up to a few centimeters).

Most attacks on RFID and NFC involve their contactless cloning and subsequent reuse. An attack can be delivered in combination with a Proxmark device. To make it work, you have to build a driver:

Also, you have to build the tool of the same name:

RFID

RFID is a contactless identification technology; essentially, this is a radio tag that contains in most cases 5 bytes. Being absolutely unprotected from unauthorized reading, this technology can be easily cloned. RFID can be compared to a QR code that can be photographed and reused; the only difference is that it involves not an optical reading channel, but a radio channel.

To clone a tag or, let’s say, a pass, you have to read and emulate its data:

rfid/clone.sh

Since you may have to deliver this attack covertly, without looking at the phone screen, you can use Termux-API to make the phone vibrate to notify you that it has successfully read the target RFID:

rfid/read.sh

Emulation of a RFID tag read by your phone enables you to fool an access control and management system:

rfid/emulate.sh

Imagine a situation: an employee goes outside for a smoke break; you approach this person to ask the time and quietly bring your phone with Proxmark to the victim’s pocket where the pass is kept. Voila! Now you can enter the protected premises. And what if the victim is a SysAdmin? Then you get access to server rooms as a bonus.

NFC

Near Field Communication (NFC) is a wireless information transfer technology protected against unauthorized reading. Its most common variant, Mifare 1024, contains 1024 bytes of information divided into 16 sectors consisting of four blocks, 16 bytes each. Access to these sectors is protected by four-byte keys. However, this technology is plagued by a number of vulnerabilities making it possible to recover its keys. Furthermore, in many situation, keys can be recovered in a few seconds.

An attempt to completely clone a card (provided that the attacker can recover keys to its sectors) involves an attempt to read and emulate it:

nfc/clone.sh

The script below attempts to read data from card sectors using dictionary keys or deliver a nested attack against the MFOC hardware vulnerability to recover the keys:

nfc/read.sh

In case of an access card, dictionary keys can be used to access its sectors. If so, the script can automatically dump such a card.

If an attempt to read a card with dictionary keys was unsuccessful, the script tries to deliver the nested attack. To succeed, you need a key to at least one of its sectors. Using it, you can analyze the prime number generator and recover keys to all remaining sectors. If the keys were successfully recovered and all sectors have been read, then you can emulate the victim’s NFC:

nfc/emulate.sh

Sometimes sector data aren’t used for identification; instead, only a four-byte UID that is not protected from reading is used. In this case, the tag security drops to the RFID level.

What impact can be delivered in such situations? At a minimum, the same as in the case of RFID. If an NFC card contains default keys or is plagued by the popular MFOC vulnerability, then all data stored on this card can be downloaded in some 10 seconds. On some cards, this attack might take longer. Such NFC cards are well-known transit payment cards. In other words, insufficient data protection on NFC media can result in financial losses.

Proxmark is a powerful tool whose capabilities by far aren’t limited to the above-described attacks. These attacks are just the simplest and fastest operations a hacker can perform in the context of physical impact implemented in tandem with a phone. Furthermore, the Proxmark3 tool has its own set of scripts that automate certain actions.

Ethernet

If you are dealing with Ethernet, you have to connect an external network card first. Some network cards in the USB form factor are available in stores with a special tag: “For tablets”. Chances are high that your kernel identifies such a network card automatically. However, if it doesn’t, you can build the required kernel module manually, for example:

To load the required driver and configure the adapter automatically, run the following script prior to the connection:

eth/start.sh

Since Android OS uses rules-based routing, more commands are required compared to regular Linux. Ultimately, you’ll see on your phone the familiar eth0 interface used to interact with networks via wire.

Attack

If you attack a locked computer, then, instead of connecting to it via USB (as described in the article Evil Ethernet. BadUSB-ETH attack in detail), you can connect to its Ethernet port (provided that it’s active) via patch cord. In a corporate attack scenario, you most probably will have to deal with a desktop computer or laptop already connected to something via Ethernet. This indicates that the network on this interface is active. After the connection, you’ll get a network channel for interaction with the device and can scan it for vulnerabilities, brute-force SMB/RDP/SSH, and deliver MITM attacks (since you can seize the gateway’s IP address).

Since the network card adapter can be already preconfigured, you have to listen to the traffic first in order to find out what IP address you should take. In such situations, the victim device doesn’t request settings via DHCP (i.e. you cannot perform the trick that blocks network routes). Keep in mind: when you use BadUSB-ETH, a new interface is created every time and configured automatically.

eth/attack.sh

You can encounter either a configured or nonconfigured Ethernet interface; accordingly, the above script attempts to configure the device via DHCP first and then attempts to capture a packet with the IP address already assigned to the network card. The script tries to adapt to any addressing: both coerced by it or already used by the device.

The suggested DHCP configuration is as follows:

eth/dnsmasq-attack.conf

This config also uses the trick involving route blocking and forwards traffic from other network interfaces to the phone. If successful, then, similar to BadUSB-ETH, you can block other network interfaces, intercept their traffic, and also check for vulnerabilities as shown below.

Ultimately, your phone executes the entire attack arsenal on the victim device using on_network/on_client scripts described in detail in the articles about BadUSB-ETH, Pineapple, and Karma. In fact, using a smartphone and any USB network card, you can implement the functionality of a Shark Jack device.

Sniffing

If you are dealing not with an Ethernet socket, but with a wire, you can apply half-duplex traffic interception to it (i.e. listen to half of the traffic: either incoming or outgoing one). This attack was described in the article Croc-in-the-middle. Using crocodile clips do dump traffic from twisted pair cable. Crocodile clips should be connected to the orange or green pair cable; while the other end goes directly to the USB network card.

This attack requires some sleight of hand and can be delivered in less than a minute.

SDR

Software-defined radio (SDR) (e.g. HackRF One) can also be connected to your phone. This attack doesn’t require any special drivers. Furthermore, a special mobile app implementing the basic functions is available.

HackRF is the most affordable half-duplex SDR that enables you to both receive and send radio signals over a wide range of frequencies: from 1 MHz to 6 GHz. The signal format (i.e. modulation and channel width) is specified programmatically. This opens up enormous possibilities for manipulations with radio signals. For instance, you can examine any radio signal and then reproduce it in the desired form.

Of course, it’s very inconvenient to examine a radio signal, analyze its format, guess the encoding method, and then try to modulate it back from the binary code using a phone. Let’s leave this job to a computer. But some radio attacks are quite simple, well automated, and can be delivered from a phone.

Devices that can be attacked using SDR include garage doors, alarms, automation controls at an enterprise, etc. Let’s examine some of the simplest attacks.

Replay

Replay attack are very simple and can be conveniently delivered from a phone. You just record a radio signal and then play it back (like a voice recorder):

sdr/record.sh

sdr/play.sh

sdr/replay.sh

The transmission of a radio signal usually isn’t limited in any way. If a radio signal doesn’t contain cryptographic functions or changing sequences, then it can be recorded and played back by an attacker at the right time.

Opening a barrier is one of the most harmless and simple examples of this attack.

Voila! The attacker gains control over the equipment.

Of course, if you apply such a trick to industrial equipment, it won’t look like harmless fun… For more complex radio attacks (e.g. to hijack radio-controlled vehicles), a precrafted gnuradio script can be used.

GPS spoofing

A radio signal from a satellite whose power is similar to a conventional incandescent lamp, reaches Earth from an altitude of some 20 thousand kilometers. As a result, it weakens significantly, and its power becomes 100 times lower than the radio noise level. This provides a technical opportunity to interrupt and spoof such a signal without powerful equipment.

GPS satellites were launched into space almost half a century ago. In those days, people didn’t care much about computer security, and now it’s too late to return these satellites from space. Using SDR, an attacker can spoof a signal from GPS satellites and set arbitrary current coordinates:

sdr/gps/spoofing.sh

Now you can ‘teleport’ somebody’s phone to Dubai from a distance of several meters.

In fact, the georeferencing function in modern mobile phones is quite smart and relies not only on satellite systems (aside from GPS, they also include GLONASS, Galileo, and BeiDou), but also on ground-based signal sources: cell towers, Wi-Fi access points, and built-in sensors. Furthermore, modern software can detect ‘teleportation’ attempts; so, it’s better to change the location smoothly, up to several hundred meters at a time.

Autonomous GPS modules are more susceptible to this attack. In quadcopters and even more serious equipment, georeferencing doesn’t involve ground-based signal sources (that are absent in the air or sea).

GPS spoofing effects can be very diverse: from automatic drone landing and hijacking to impacts affecting more impressive vessels. For instance, an attacker onboard a ship that sails in autopilot mode and is guided by satellites can force it to turn in any direction by manipulating GPS.

In fact, it’s not location that is first synchronized over GPS, but time. And time can also be spoofed. If the time is set incorrectly, all SSL traffic on the affected device can be disrupted; under some circumstances, this can result in a denial of service.

DMR decode

SDR can be used to intercept walkie-talkie communications. Many walkie-talkies transmit voice openly, without any scrambling. Perhaps, you have already heard other people’s conversations on cheap Chinese walkie-talkies.

To intercept conversations, select the open frequency range used by most walkie-talkies (some 433 MHz) and enable FM demodulation.

Many SDR devices can transmit signals as well. Using the gnuradio scheme shown below, an attacker can send an audio message to a walkie-talkie.

Using this scheme, you can send signals not only to walkie-talkies, but also to regular FM radio receivers, thus, interfering with the radio broadcast.

Not all walkie-talkies transmit voice in the clear. However, those that use encoding can be eavesdropped as well:

In my experience, some walkie-talkies transmit voice in the clear even when scrambling is enabled in their settings.

How can an attacker exploit this? Imagine security guards who coordinate their actions over radio. A potential malefactor who needs to enter a secured perimeter and plant some spying equipment there can eavesdrop on their communications. And what if the attacker at some point sends a false message to the guards?..

TV spoofing

TV signals can also be attacked using SDR devices. Depending on the television broadcast type, an attacker can use special open-source software and generate a modulated signal that jams the original broadcast source. Such attacks are local since they cover a relatively small area. However, taking that this attack requires just two handheld devices (a HackRF and a phone), you can negate this disadvantage by approaching the target as close as possible.

Analog TV

Using SDR and the software below, you can modulate any video file into an analog TV signal:

Digital terrestrial TV (DVB-T)

Using SDR and the software below, you can modulate any video file into a digital terrestrial TV signal:

Digital satellite TV (DVB-S)

You can perform the same operation with satellite TV and broadcast any video file using publicly available software:

The ability to spoof television and radio signals can have an impressive impact. In fact, SDR is an incredibly broad topic that deserves a separate book. Here I present only a few of the simplest and most well-known attacks whose implementation doesn’t require much configuring.

QR

A mobile phone can be used to attack QR readers.

You can perform various operations with QR codes:

• brute-forcing (e.g. to bypass a check);
• fuzzing (to cause an error, denial of service, or even inject some code); or 
• injection (e.g. perform an SQL injection or inject OS system code).

You can generate a QR code for any purpose using the respective Python library and console:

To generate a QR code directly in the console, either interactively or using data received from other scripts, run the following script:

qr/encode.sh

The above script clears the screen so that the code is drawn in the same section of ​​the phone’s display. After that, it generates a QR code waiting for data in sdtin.

But if you are going to fuzz or brute-force something, then you need a reference data sample from the QR code. The easiest way is to use any mobile app specifically designed for decoding. Some phones use built-in cameras for this purpose; while console and automation fans can use the Linux QR code recognizer:

qr/decode.sh

Using the Termux-API, this script takes a photo using the phone’s camera, compresses the image, and performs recognition using the zbarimg utility. The decoded data are saved to a file for subsequent use.

Next, using a simple loop in Bash, you can start iterating over some values ​​encrypted in the QR code:

qr/brute.sh

The above code simply changes the last character from 0 to 100.

In theory, it’s quite possible that an access control system uses sequence numbers. After photographing someone’s QR code, you can try to iterate over such numbers in order to guess the code and bypass access control.

In many situations a regular URL string or its fragment is encrypted in a QR code. For example, in almost every store you can find scanners like the one shown below that are used to identify products.

Such terminals are potential penetration points: QR-encoded data can be insecurely entered into databases and be vulnerable to SQL injections or direct injections of OS commands.

Using the script below, you can run a wordlist specially compiled for a specific vulnerability:

qr/injection.sh

As for merchandise, the QR code usually contains not the entire URL, but only a value; therefore, the script just adds payload at the end. In theory, a QR code can encrypt anything: from a URL to a long hex string.

By slightly modifying the loop, you can run mutation fuzzing using radamsa:

qr/fuzz.sh

The radamsa fuzzer randomly corrupts reference data in the original QR code. It can recognize simple structures (e.g. strings and numbers), has a powerful mutation engine, and performs error testing when it works both with text or Unicode data or binary data. This enables the attacker to start a fuzzing test in just a few seconds, without going into the details of data types encrypted in the QR code.

The figure below shows a QR reader receiving corrupted data.

Similar fuzzing applied to a food vending machine made it possible to execute an arbitrary OS command on it and start a calculator after rotating the screen by 90° and causing several errors in the software.

POST

Your phone can be used not only to deliver attacks, but also to provide network access. Imagine a situation: you sit with your phone at the reception and share your mon interface via VPN with your fellow hackers pentesters to deliver attacks against Wi-Fi (since they use laptops, it’s much more convenient for them to deliver such attacks). This trick was demonstrated in the article Poisonous fruit. How to assemble your own Wi-Fi Pineapple and put it to use.

Furthermore, since the phone has built-in 4G, it can be used as a gateway for covert connection to the attacked network. In this case, using a VPN deployed on your phone via 4G, you can create a link to the attacked network from any part of the world.

First you need to configure VPN on your phone. The easiest way is to use OpenVPN. For maximum routing convenience, it’s better to use an L2 tunnel (tap). Such a tunnel enables attackers to be one hop away. Too bad, the respective Android app doesn’t allow you to use an L2 tunnel. Still, the kernel supports it, and all you have to do is add a suitable character device:

vpn.sh

Such a tunnel simplifies further routing to networks or devices your hacker phone is connected to.

Now let’s examine each scenario in more detail.

POST-wlan

How to arrange remote access to Wi-Fi via a phone?

In fact, all you have to do is slightly adjust routing on your phone so that packets from the VPN are sent to the attacked Wi-Fi. On Android, routing is not specified in the default main table (as usually happens). Instead, a special table is automatically generated for each interface (ip r show table all), and an additional set of rules is created for communication with it (ip rule show all). Such rules are often used in combination with a built-in firewall that marks packets in a flexible way, which ensures very powerful routing.

Generally speaking, this is the same Linux routing, but divided between tables, which makes the overall picture a little more complicated. But all you need to know is the number of the table assigned to the target interface. Then you have to add required routes to this table and write a respective rule for them pointing to that table:

wifi/gw.sh

Now your phone connects to the target network via Wi-Fi and becomes a gateway for your accomplices colleagues who can advance through this network while you are innocently sitting in the lobby or walking through a restricted area after passing the checkpoint. A remote attacker sitting at a computer in safety just has to specify the route to the target network via the phone’s IP address on the VPN:

POST-USB

After connecting your phone to a computer via USB, you can gain covert network access to it by activating USB gadgets described in the article about BadUSB-ETH. All you have to do is change phone’s routing so that packets from the VPN are forwarded to the target computer via USB

badusb/eth/gw.sh

The script emulates a network via USB. Next, the computer requests network settings from the phone via DHCP; at this point, you have to provide to it a hidden configuration without specifying the gateway to avoid disrupting the original routing:

badusb/eth/dnsmasq.conf

Now, you can use your phone connected via USB to get a remote network channel to the target computer over VPN, with enables you to develop further attacks or seize control over the computer.

A similar effect, albeit in a different form factor, can be achieved using a 4G modem described in the article Evil modem. Establishing a foothold in the attacked system with a USB modem.

POST-ETH

In a similar way, you can use your phone to provide remote access to a local network via wire. Attacks involving an external Ethernet adapter were discussed earlier in this article. The script below slightly reconfigures phone’s network settings so that traffic from the VPN interface can flow to the connected Ethernet adapter:

eth/gw.sh

Persistence can be implemented as shown below.

An attacker who gains access to the local network via colleague’s phone operates in much more comfortable conditions than the phone owner who doesn’t have a physical keyboard. However, nothing prevents you from connecting a keyboard to your phone, thus, transforming it into a fully-featured attack tool.

Summarizing all the above: intruder with a phone is no less dangerous than an intruder equipped with a laptop.

Conclusions

Real-life penetration with a smartphone or other device may be similar to sci-fi hacking operations shown in games or movies. The only difference is time required to deliver such an attack. Depending on the system complexity, penetration can take hours, days or even months. Nevertheless, all the above-described attacks are feasible.

This article, as well as Cyberphone. Transforming an Android smartphone into a hacker tool, clearly demonstrate that an attacker equipped with a smartphone can deliver not only general attacks, but also specific ones reproducible only from a phone or special equipment. This article is not about attacks, but about their implementation on the basis of the most innocent-looking platform: your phone. Is it possible to protect against such attacks taking that everyone has a phone nowadays?

When you have to protect a critically important facility, it can be a good idea to restrict the use of phones there. In general, protection against such attacks involves access control measures (to prevent unauthorized persons from entering the facility) and restrictions on the use of phones in the vicinity of critical information infrastructure objects.

This article concludes the series of publications about hacking techniques and physical attacks delivered using makeshift devices.

In the hands of a hacker, commonly available devices shown in the center of the graph can be transformed into hacking tools. Each of such tools implements respective technologies and enables you to develop attacks of a certain type. As a result, you can achieve a wide variety of effects: from a harmless denial of service to seizing control over the target.

Important: none of the attacks described in this series of articles require a laptop. This clearly demonstrates that computer is by far not the only effective hacking tool.