HD Moore, Jon Ellch (a.k.a. jonnycache), and another researcher known as "skape," are collaborating on adding 802.11 wireless exploits to the Metasploit 3.0 penetration testing tool. Moore, the creator of Metasploit, has written a wrapper for the tool that lets it execute raw 802.11 packet injection.

802.11 packet injection lets an attacker go after the lowest level of the operating system, such as wireless device drivers, which Ellch says are an attacker's goldmine. "This code is full of bugs because it is not written by software companies and until recently, bugs in it were not really exploitable," Ellch says. "Now that we can send packets at such a low level, we can hit the bugs in the code."

Wireless device-driver vulnerabilities are becoming a hot topic. Ellch, in a presentation at last week's Blue Hat summit, told Microsoft it needs to work with device-driver vendors to turn off some of the unnecessary wireless card features to minimize the risk of a hack. "The basic problem is end users have two choices on the driver, 'on' or 'off.'" And there's a lot of code in this software associated with features users may not need, such as "power-save," for instance, that leaves the door open for bugs.

Get the full story at Dark Reading.

— Kelly Jackson Higgins, Senior Editor, Dark Reading