Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0860_wireless-compromise
Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network.
Passed 18 of 22 test cases with the skill, and 13 of 22 without it.
and 4 more in the full report
5 fixed13 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
When mapping detection coverage for wireless compromise in our ICS SIEM, engineers want to know how many distinct detection strategies are specified for T0860 in standard guidance.
| Checked | Without skill | With skill |
|---|---|---|
| Reports that exactly 1 detection strategy is defined for T0860 | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance.
A Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. The remote controller device allowed the student to interface with the trams network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. The controller then enabled initial access to the network, allowing the capture and replay of tram signals.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Wireless Compromise by examining operational technology systems and network architecture.
Review whether mitigations for T0860 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Do not inherently rely on the authenticity provided by the network/link layer (e.g., 802.11, LTE, 802.15.4), as link layer equipment may have long lifespans and protocol vulnerabilities may not be easily patched. Provide defense-in-depth by implementing authenticity within the associated application-layer protocol, or through a network-layer VPN. Furthermore, ensure communication schemes provide strong replay protection, employing techniques such as timestamps or cryptographic nonces.
Ensure wireless networks require the authentication of all devices, and that all wireless devices also authenticate network infrastructure devices (i.e., mutual authentication). For defense-in-depth purposes, utilize VPNs or ensure that application-layer protocols also authenticate the system or device. Use protocols that provide strong authentication (e.g., IEEE 802.1X), and enforce basic protections, such as MAC filtering, when stronger cryptographic techniques are not available.
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.