This is not the same Shmoo presentation that we anticipated.
There will not be a Hookers for Hackers giveaway this time.
So, I'm sorry to disappoint you.
We have some other, you know, mostly nerdy crap to talk about.
So, maybe next year.
So, I don't know exactly why you're all here,
but, you know, we're going to give you everything
and we'll figure it out as we go.
I'm Pablos from the Shmoo group.
We do have some stickers.
If you didn't get one, you know, you're a lamer.
Right.
Go to those guys right there. Raise your hands, guys.
So, what we'd like to do at DEF CON
is just lambaste you with everything that we can think of
that we've been working on, or at least the cool stuff.
And it's ready.
And so, we have a panel of all different Shmoo guys.
There are a whole bunch of others,
but the ones that have stuff to show you today are here.
We're the troublemakers.
They're troublemakers, yeah.
And, um, but a couple things we want to talk about.
And I guess first I'd like to know,
did Mike Lynn make it here or not?
Is Mike here?
Spot the Mike.
Spot the Mike.
So, there's no Mike.
Okay, well, I'm sure you all are aware of what's going on with Mike
in the recent fiasco.
And he's not allowed to talk,
but we wanted to say a couple things about what he's up to,
which is important because everything that we do here at DEF CON
and in security research has to do with reverse engineering
and disclosure of vulnerabilities.
And, unfortunately, it's what we have to work with
as far as making systems secure.
We have to find the problems,
we have to tell people about them,
and we have to fix them.
And that's a lot of what's going on.
And it's really, really pivotal,
I think as most of you guys know,
to support that.
So, reverse engineering and Mike Lynn.
Oh, now I see why you're clapping.
Clap for Mike!
That's kind of a side project.
Yeah, this is Mike.
So...
So, as you know, Mike recently, in the last few days,
managed to get sued and settle with Cisco.
But the work that he's been doing goes on with other people.
And it goes on, and what's important about it
is that we can't let a culture of cover-ups
for security issues develop.
And if you look at the interests of vendors
and the security research community,
they're kind of opposed.
But the important, I think, message
from what Mike's just been through
is that vendors have an obligation to their customers.
And it's really the customers that are being kept in the dark
when the vendors aren't disclosing the vulnerabilities
that have been around for a while,
even once they've been fixed.
So, I think that an important thing to recognize
is that all you guys are really important, right?
The work that you're doing is really important.
Some guys, every year, put their ass on the line
and some get picked up.
And Mike's not the first, but he's the most recent.
So the important thing is keep up the good work.
And this is...
You guys rock.
This is from a project I worked on
to secure cell phones to thighs.
And I managed to patent the use of women's thighs,
which, you know, I don't know if there's anyone that leap here,
but if you are, let me know.
And then the other thing I wanted to say
before we move on is that
don't get sidetracked
by all the work that people are talking about
as far as vulnerabilities.
There's a lot more to security
than finding vulnerabilities and exploits.
There's a lot more to security
than just patch management and IDS.
There's a lot more to security than policy management.
And what there is is architecture.
What we want to do is change the world
so that 15 years from now,
we aren't coming back to DEF CON
and telling you about the latest exploit
we found in firewalls or Wi-Fi or whatever.
We need to find fundamental ways
to change the computer systems that we use
We need to find ways to take the academic research
that's been done and put it into practice.
And this is unfortunately not something
that the market has been really good at.
And so I think it's up to you guys
since you're learning to think different.
You're already on the fringe a little bit
and you've learned about how to break shit.
You know how to break shit.
You know how to build shit that can't be broken.
And what we need to do is figure out how to do that
and kind of move our entire industry forward.
And the world in general.
So that's what I wanted to say.
With that, I'm going to hand it over to Eric Johanson.
And Eric is going to take on getting on with the exploits and shit.
Good afternoon, folks. How are you?
You guys still alive?
So, let's see.
Back at the beginning of this year,
I did some work related to international domain names.
This work was apparently...
I was not the first person to do this work
specifically related to international domain names and homograph attacks.
I found some holes in, well, most of the browsers that are out there
related to how they handle Unicode characters and domain names.
And this attack has been talked about.
There were papers published in 2000.
The vendors were notified and no fixes were done.
This seems like a problem.
No?
So, it was interesting when I gave this short presentation
demoing this exploit at ShmooCon
because everyone went up in arms and said,
you should have notified the vendors first.
The vendors that I did notify several weeks in advance before ShmooCon
told me that it was not a vulnerability.
We will be making no fixes.
It's a feature.
It is a feature.
A large hardware manufacturer...
These are not the exploits you are looking for.
Okay, so an IDN exploit or a homograph attack,
what it basically is,
if you have, let's say, PayPal.com
and you have, over here, PayPal.com
only the first A in PayPal is actually a Russian A
which looks and smells and tastes identical to a Latin A
that is effectively a homograph attack
because users cannot tell the difference.
There is no difference on your browser, on most platforms,
the difference between those two domain names.
So...
Hmm...
Phishers would probably really like that, I suspect.
So...
You know, it was interesting.
The vendor response I got,
basically, most vendors told me,
this is not a bug.
Go away. We don't want to hear from you.
After it was released,
suddenly I'm getting calls from legal departments.
So, clearly, vulnerability disclosure is something that
we all face as security researchers because
just this week, we have someone that's also
going to be dealing with more issues
related to how they disclose something.
There's an RFC written out
related to vulnerability disclosure.
Everyone seems to be doing things in a slightly different way.
But ultimately, what a lot of people seem to be forgetting
is just because a vulnerability is found,
doesn't mean that they're the first people to find it.
I was not the first person to find the IDN homograph attack vulnerability.
It still hadn't been fixed.
The work that Mike has been doing,
it is very likely that other people know about those attacks.
It's very likely.
And just because it hasn't been disclosed
does not mean that it places all of our society at risk.
So, in short, I think
ultimately, for consumers to be the best informed,
they need to be aware of these vulnerabilities.
And ultimately, vendors are out to make the most money.
And I think that's in direct conflict with the Internet
and the routers of this world
and the web browsers of this world.
So, think really hard when you find that vulnerability
about how you want to handle it.
Don't be bought out.
Don't let it happen.
So...
Yeah!
All right, so...
Yeah, I know, we're going to get up here
and we're going to preach a little bit or whatever.
We got cool shit, don't worry.
Everybody's like, hey man, what is it?
So we're going to get down and dirty
and this will fry your fucking brain.
If you're not familiar with what Rainbow Tables are,
Dan will go into it a little bit.
If you haven't been to the rainbowtables.shmoo.com website,
you'll get into that.
But Dan's got something.
Dan's got a new bag.
Anybody here know math?
All right, hi all.
There's no slide for this, but since I'm up here
and I have all of your attention,
I saw Jennifer Granick just leave,
but could everybody who's from the EFF who's here,
please stand up.
We're talking about...
Hey guys.
All right, I'm just going to do introductions quick as I see you.
I used to work with these guys very briefly as a staff technologist
and now I'm elsewhere.
But these guys, we had a party last night.
You might have been to it.
We're talking about vulnerability disclosure,
full disclosure, legal ramifications.
Jennifer Granick, who is Mike's counsel, and the EFF,
these are all the guys saving all of our asses every day.
So please give a round of applause for the EFF.
Go to the dunk tank.
I'm going to be there tomorrow.
Dunk me.
All right, so Rainbow Tables.
Who's familiar with Rainbow Crack?
Put your hand up.
Word.
All right, Rainbow Crack is an implementation of a technique
made by a European researcher.
And without getting into the heavy math of that,
basically it's software.
You can download it.
Jennifer Granick, I see you walking back there.
Jennifer?
Everybody give Jennifer a hand of applause.
Kiss her ass.
Thank you.
So you download Rainbow Crack,
and basically what it lets you do is consume all of her CPU time
and generate, according to what it says,
nearly every single possible landman hash.
Anybody familiar with landman?
Raise your hand.
Word.
Okay, great.
So that's what it does, right?
And we, like Beetle over there in the Bosox cap,
had a good idea and he said,
hey, we got a bunch of people and we have a bunch of machines
and we have too much free time,
so let's just do this.
Let's just generate every single landman hash that there is.
So we started doing it.
We just downloaded the code off the guy's website.
We fired it up on about 150 machines
across different shmoo,
and we generated it.
And our goal was to use it to generate...
You can do different key spaces,
like if you want to do five characters, six characters, whatever.
We wanted to do the configuration that had
every single seven-character valid hash for landman.
Every uppercase, alphanumeric character,
a certain set of symbols and space.
So we did it.
And, you know, landman, right?
We put it up.
The link is live, right?
RainbowTables.shmoo.com
43 gigabytes over BitTorrent.
Go download it now.
If you have a laptop, saturate Defcon's bandwidth.
We're going for the BitTorrent record here.
World's largest torrent.
Can you man the slides for me?
Right there.
Right.
So...
The big thing was that we were told...
And I'll cover the political part real quick.
He'll cover the technical part.
But the political part was...
We got an email, and you'll see the email in just a second.
It said, hey, I wrote Rainbow Crack,
and I don't like you giving away the tables for free
because, you know, I charge for them.
And mind you, there's no license on the Rainbow Crack code at all.
None.
You know, the code is free.
You can download it, but there's no BSD, no GPL, whatever.
Meanwhile, I mean, there's other folks out there
that are charging $700, $800 for, like,
the Landman Symbol 32, you know, plus space tables.
$700.
You can go get those tables.
Because, obviously, it's a little difficult for everybody
to get together and just kind of generate them.
Preach, brother.
And we said, fuck it.
We'll just generate them and give them away for free.
So, there.
A 43.9 gigabyte torrent.
Join the torrent, bitches.
Right there.
That's an $800 torrent, I guess.
We're all about added value.
And Dan will go over the finer technical points
of the email that we received.
All right.
There's the email that we got from the author of Rainbow Crack.
And I would butcher his name, so I'm not going to mention it.
But, you know...
All right, you can read it.
I mean, the text is sort of small, but you can see it.
We bolded out the important points.
For those guys selling the table without permission from me,
they are not welcome.
But you are worse.
And the second paragraph basically goes into why he generated it,
why it's cool, yada, yada, yada.
And then, obviously, the third paragraph.
Are you feeling cool?
Because knowing all the passwords is cooler than trying to crack one.
That's the line from our original website,
rainbowtables.shimmy.com.
All over the world, there will be a lot of guys
can do what you do.
They aren't.
Do you know why?
To show off proof neither your ability nor knowledge.
We're just running your code, dude.
We liked you.
Why can't we all just get along?
We're not hippies.
And then, you know, if possible, please keep honored,
blah, blah, blah.
Don't be crazy anymore.
Well, I mean,
look at us.
Honestly.
Don't we all look sane?
All right, so we basically said
that we had a lot of reasons as we were doing
the rainbow table generation
to make it better.
And initially, that was all we were going to do.
We were like, oh, you know, there's some pieces of code here we could optimize.
But then we had that email,
and so that pissed us right off.
And I mean, the big key was that, like, you know,
once Dan started looking at it, he was like, fuck it.
I mean, we can do something better.
So we don't need your stinking code, dude.
And snacks, by the way,
says fuck off.
Yeah.
So we have an unnamed project.
We don't have a name for it yet.
You okay, man?
Sorry.
We're making people fall out of their chairs already.
Sweet.
All right, so we have an unnamed project.
It's me, Dan Moniz,
and Reverend Dr. Patrick Stack,
who's not here.
Some of you may know him as Optix.
He's not a schmoo, but we're working together on this
because we both love each other.
So we wanted to improve on Rainbow Crack,
and so we started out just trying to optimize
Rainbow Crack. Leave the method the same,
but just, you know, make it better.
But in the process of doing that,
we found out it is to suck.
So we changed our approach,
and we made a new tool.
It doesn't have a name yet.
Problems with Rainbow Crack.
Who here knows a little bit of math?
All right.
All right.
So I'm going to blow through this.
If you want to come to the nitty-gritty,
it's either going to be, and they're going to pimp this later,
either at SchmooCon in January in D.C.
in 2006.
Or Guantanamo. We're on the edge.
Or, if we're really good at it,
we'll get it done by TourCon,
which you should also come to this September.
A reduction function bias.
There's a reduction function in Rainbow Crack,
and it has this bias issue,
meaning that it does something a little fucked up.
If your key space is
six valid inputs,
and you have a 2 to the 4,
which is 16,
number of outputs,
the reduction that Rainbow Crack
does, slightly simplified,
I'm ignoring one little thing that doesn't matter,
is the total number of outputs,
modulo the total number of inputs,
and that equals what we're calling a bias marker.
Break it down.
So, here's some
modular arithmetic, real simple.
0 mod 6 equals 0, all the way through to
15 mod 6 equals 3.
You can sort of see the columns.
It's a lot of modular arithmetic, but one thing you'll notice
is that there are three
of every single value, i.e. the thing
to the right of the equals sign. There's three of every of them,
except four and five.
We only have two of those
in this 16 issue here.
So, say that Landman only had
six possible inputs,
and say that the algorithm, which in Landman
is DES, had
2 to the 4 outputs, or 16.
By taking an arbitrary
random output from the algorithm,
we can assume that the algorithm output is random,
and modulo it by 6,
there's a better chance of the
input values being below
that bias marker, that thing to the
right of the equals sign. So, values 0
to 3, because we have more of those,
have a better chance of being picked at random
due to this than the 4 to the 5
values. We only have two of those.
See?
I know I'm going quick.
So, the real bias problem here is
that's just a summation,
you know, that's for
i equals 0 to i equals
7 of 69
to the i. So, this Riemann sum
is not an integral factor of
2 to the 64, just like
6 is not an integral factor of 16.
This modular arithmetic has a bias.
So, if we bring this back
to what Rainbow Crack actually does,
instead of my bullshit example,
you can assume that the output of DES is statistically
random, or at least random enough
that the bias would
still be present. Why it matters.
Okay, here's some math. I'm going to
break it down. n equals the
floored result of the total number of outputs
over the total number of inputs. We're going to
add 1 if n is below
the bias marker, if it's one of those low values we
have more of. And that
1 represents the extra chance.
We have only two 4s and 5s, we have three of everything
else. 1 plus n,
so those are those more present values
over the total number of outputs,
chance of hitting that key.
n, the ones that we only have two of.
Same thing.
Values below that bias marker
are unfairly weighted
and are more likely to be inputs to the
rainbow chain generation. What that basically
means is, he screws up the
math. And he basically
does modular arithmetic
wrong, so that he ends up generating
impossible value
hashes. They can't work.
So our generation technique,
or how we get around this, we start generating
at the last possible input that's
valid for landman, and we walk towards
the first. As we
generate, we use a bit mask, so we can
determine if we have computed the key or not.
We know if the bit mask works,
if it's there or if it's not. So we have
100%, like mathematically
provable 100% verified
key space, because everything is accounted for.
At 1 bit per
input, this method requires
768 gigabytes
of disk space, if we were going to do it
on one machine.
Our badass
sorting foo.
We separate out
anything that has less than or equal to
6 characters. 7 character
key space is one
table, 5 to 6 character key space is another.
We do this so that you can detect the length of the password
really easily.
Landman primer. Here's how landman works
really quickly. Take 14 bytes of input,
split it into two chunks, each one is 7 bytes.
Hash them independently.
So say I have a password of
dog. Dog turns into
dog with nulls at the end of it.
And then we split it into dog
and then some more nulls.
You can detect that
the first half is 7 characters or less
of this particular password, because the
second half of the password is the null hash.
It's the hash of nulls.
Which is always going to be the same
for any password 7 characters or less.
Now with the password of
SpamDadRules
Word!
Where's your Spam Daddy?
There was one guy in the audience who that was
designed to be for.
That's my elite
Stego technique.
Alright, so, same thing. More than
7 characters. So it goes to that, SpamDad
and then rules, null null null.
You know that this hash is 7 characters
That's actually more than
That slide is wrong. This hash is actually
more than 7 characters. 7 characters or more.
Because the second half of the hash
is not the null password hash. We get the rules
in there. So this decreases
the time spent looking through
every hash that can't work.
RainbowCrack loses, because
RainbowCrack just generates random hashes.
He's just using your CPU time. He's just saying
I don't know. That might work.
And that reduction function has that
bias problem. So, random
hash, okay, fair enough.
That's, you know, a pretty good approach.
But plus this error
equals lame. Bad plus suck
equals lame-zor.
Now we get our
crack on.
RTcrack, that's the tool
that you use in RainbowCrack to actually crack
the passwords once you've made them all.
It reads in as much of the
hash table file that RTgen, which is
the generator, generates using
the read syscall. And then
it walks linearly to check
to see if the endpoints of the rainbow chain
match. And this has O to the N
complexity, big O notations, standard stuff.
We store the
start point and the endpoints in separate
files on corresponding offsets.
And then we take the page size
on the x86 architecture,
4096 bytes, divide it by
the entry size, 8, plus 1
for the index, and that gives us
513. So every
513th entry, after we've sorted
them all, we store it in a special index file.
And at crack time, we
mmap this
endpoint index file and use divide and conquer
or Fibonacci find to find out if
the endpoint is in the index file.
Or if it's not, to find out
what offset the endpoint is referenced
in in the master index file.
Now we get our search on.
Thus, for each offset, we read a
max, maximum
of one page of memory off of disk
rather than reading
the 12 gigabyte file you did.
So 496
bytes maximum, ever,
to read 512 possible hashes.
And this is a Bayes tree that's been
modified slightly.
Patrick, who came up with this method, has a doctorate
of divinity in searching and sorting
from the church of Donald Knuth.
Awesome.
Give it up for optics.
Optics.
Anybody have any Advil?
He sent an email to Zhu, trying to
explain this to him, and Zhu's like,
nah man, I don't know that.
So Rainbow Crack
gets an L for lame.
Disk IO in Rainbow Crack
costs as much CPU time as
encryption, if not more.
And so Rainbow Crack fails to account for this
in the way he does his statistics about how long it's
going to take you to make all the keyspace.
Don't be crazy anymore.
Say it
more whiny. Don't be crazy anymore.
So here's
our secret sauce. Our code
is implemented in C and assembly
for the IA-64 Itanium 2
and running on a classified
number of processors
in an undisclosed location.
But we have to give a shout out to SGI for
helping us out with this. Any SGI
people in the house?
Nobody? I'm sorry.
We also
implemented the generator.
We haven't done the cracker yet, but the generator's in VHDL
to run as customized
specialized hardware on a Spartan 3 FPGA.
Flip that up. There we go.
Things generating landman hashes
as we speak, basically.
Okay, I'm holding it up higher.
Jeez. And that's me.
I'm done. It has blinking lights
and shit.
Thank you.
Oh my god!
That's so fucking cool.
The brain's coming out of my ears.
That's just
hot, man. That's so hot.
Alright, so
I'm going to talk about a few wireless
things here and there.
First of all,
why oh why
do we Wi-Fi?
Who here has an open wireless
network at home?
Go ahead. You can admit it.
My name's Beetle, and I have an open
wireless network at home.
You know, crap.
My TiVo, it can't do WPA.
And my PSP, it can't either.
Does it really fucking matter?
I mean, at the end of the day, does it matter
if somebody's reading my streams of
Girls Gone Wild?
I mean, does it matter
that somebody's messing with my
Wipeout Pure ad hoc session?
Do we really care?
Some of the technology, it really doesn't matter
if it's that secure. It's dumb.
It's dumb, it's entertainment, blah blah blah.
But, when you start
looking at different environments, where in the world
should you be actually doing wireless?
Coffee shops? Eh, alright.
Airports? Mm, maybe. Hospitals?
Banks?
Nuclear power plants?
You know, this is interesting.
I got this from Matt Fisher.
He sent this to me.
Scanned it in. He was like, man, check this out.
They're doing wireless at some nuke plants.
I'm like, okay, cool.
He was like, no, no, no.
Look a little closer.
IP address, baby.
Not only do they tell you
that they're running Cisco hardware,
they tell you what the internal address space is
at Comanche Peak, Arizona, or Azima.
It's great.
Azima has installed monitoring devices
on more than 50 pieces of critical equipment.
Where did we go wrong?
I mean,
and where the hell are we going?
I mean, it's a technology of convenience, right?
But there's obviously this inconvenience
of securing it, so we just put it out there.
And then all these users,
as far as they're concerned,
they're left in the authentication cold.
And then the standards, they're half-assed to begin with.
And then how they're implemented, that's half-assed as well.
And then, of course,
everybody has this acronym
knowledge.
Everybody has a degree in acronyms now,
and they use the acronyms to secure their networks.
Right?
I have an EAP-protected network, really.
Hallelujah.
I use a VPN to secure my wireless, really.
How did you deploy that VPN?
In what configuration is that VPN?
Which EAP are you using?
Choose a mobile network with care.
Choose a mobile network at random.
How the fuck does the user know?
Really, how?
Let's look at a rogue access point attack.
Graphical, we've seen this.
Defcon, two years ago.
Unfortunately, the press just caught on this year.
Wi-Fi card comes in,
gets disassociated by an access point
that's closer or stronger.
SSID effectively becomes bad guy,
and this, before Windows XP Service Pack 2,
would occur without the user's knowledge.
Now, with Service Pack 2,
it tells you when the SSID changes.
Ooh.
Rock on.
So nobody can forge an SSID
or duplicate an SSID
or a MAC address or any of that.
So, rogue access point attacks.
When you're choosing your Wi-Fi weapon,
normal gear running at 14 dBm,
Cisco gear running at 20 dBm,
Sineo gear running at 23 dBm,
throw on a nice little directional antenna,
you get 15 dBd and 38 dBd total.
Six watts!
Versus 25 milliwatts.
You will win every time.
There's no way
that somebody's going to actually
get on to the other access point,
the legitimate access point. They're mine.
So we have things that you can display,
such as Hotmail. That's not Hotmail.
You have other things,
like PayPal. That's not PayPal.
And at airports.
That's pretty interesting.
You're seeing this across the country.
Joe's Wireless Hotspot.
I don't know who they are.
Done.
Rogue access points
are not going to go away.
Users are going to be users,
and they will fall victim to being
drawn over to impersonating access points.
If you didn't notice,
phishing, identity theft,
on the rise.
Wireless hotspot usage, on the rise.
Apparently,
some people, like Gartner,
feel that that's not a threat.
It's overblown. Gartner can blow us.
This is a problem.
Pay attention.
It gets worse.
Rogue radius.
So you secure your nice little network
with EAP, and there's a nice little acronym
bonanza with regards to EAP.
Who says that rogue access points can't be used against
wireless corporate networks that are using EAP?
Plenty of ways to screw EAP up,
and they allow for things such as
EAP peaking. That's my new term for it.
This is kind of how
EAP works.
You say, hey, I want to join the network.
Access point
replies back and says, hey, who the hell are you?
You send your identity.
Radius server validates that.
Gives you a dynamic key. Allows you onto the network.
There are variations of
EAP, such as EAP
TTLS. EAP
TTLS, very similar.
You have your 802.11 authentication association.
EAP protocol exchange.
TTLS protocol exchange. A nice little
secure tunnel is established.
And through that secure tunnel,
that's where you pass your credentials.
And everything else happens
like it's supposed to.
Ah, what's the weakness here?
If you have a previous EAP
TTLS authentication established,
and a rogue access point with
a radius server comes in, and you are
not doing remote certificate checking,
and or loose checking, disassociated,
and of course, what you do is associate,
authenticate, set up EAP
TTLS, secure
tunnel, and then you pass your credentials
over the secure tunnel to the wrong
person.
So, how do you
actually implement this? EAP TTLS
with PAP, which is a variation
that you can probably Google
for. Windows XP
Service Pack 2 using EAP TTLS with
PAP, probably using a phone client.
You have your rogue radius
server come in, rogue access point
disassociates users, learns username
and password of every user that's on the access
point at that time, disassociates them,
copies the credits to the local EAP config,
and then impersonates the victim.
Google!
You can find plenty of educational
institutions that are using EAP TTLS
with PAP.
Ah, but there's a different vulnerability
as well, because Microsoft provides
something secure and
protected EAP. And when it's used
with client certificates,
server certificates, rock on.
But PKI is
to suck.
Nobody can get it right in the wired
world. How in the world are we going to get PKI
right in the wireless world? And so,
we provide the nice little option
for people to use their username and password
over a secure tunnel
to associate to wireless networks.
If you don't validate the
server certificate and or you
don't check all of the certificate stores
in the normal store for Windows,
you are a victim to
a peep attack. In this case,
what you do is disassociate all the
users, learn
the domain and username immediately
with your rogue access point and radius server,
disassociate them again,
seed the local password file with
a bogus password. Windows XP
Service Pack 2 is kind enough to keep
re-associating to you.
Over and over and over.
And as they do, they keep providing
their username and password. It's
only part of the password, so it's difficult
for you to get it, right? Until
your dictionary stumbles upon
their correct password, they authenticate
successfully to you and bang, you
have their username and password. MS
Chat V2 does not protect against this.
Wireless
weaponry for Windows.
Rogue access point attacks.
Only in use by sophisticated hackers,
right? Because it's so
hard to set up an access point and
give people the internet.
Wireless access points?
Easy to set up.
If you want to set it up on one Windows laptop,
you can do it. Evil twin access
points for dummies. You can see it
airsnarf.shmoo.com, airsnarf4win.
html.
But why should you run only one access
point or one rogue access point when you can run
one, two, three?
Rogue Squadron.
Because it's so hard for people to run
airsnarf, which is a shell script.
Rogue access point set up for the masses.
It's a modified WRT54G
firmware based off of EWRT,
adds a username and password.
Capture and logging looks like
this.
It's the first firmware release from the
shmoo group.
We had shmoo hot
interns working on this all night.
There you go. It's basically using captive
portal or no cat.
Allows you to set up a captive portal,
people associate, and no matter
what site that they go to, just as we've demonstrated
before, you redirect them to the local captive
portal, ask for their username and password.
I'm not going to describe
how easy it would be to
modify this to display a T-Mobile
graphic.
Username and password entered.
All you do is log into the box later on,
SSH, dump your
passwords, you're gone.
Airsnarf.shmoo.com slash rogue underscore
squadron is where you can get that.
And here's
Rodney! Thanks.
So I'm lazy.
I don't actually usually try to
break things. Well, I break things once in a while, but
usually I just look at vendors' products because they're broken
enough, so why not just have fun with them?
So anyway,
never let Beetle type your slides.
Shooting your security wad, which was about
broken products.
Okay, so what am I ranting about?
You know, I have to keep up with the crowd here.
So I've been doing product reviews, I do public ones, I do
private ones, you know, take a box, set it up in a
conference room, test it for a week, it goes off in a
corner gibbering, hopefully I get some money out of
it. People put out
really lame features. I'm going to, if I
can get this thing with a fruit in the front to back up,
back up to this slide of
beetles. I'm going to steal one here.
Come on, buttons.
Back up here. So with this Microsoft
Windows, they ship
you a security product that says,
do you want to validate the server certificate?
They let you turn that off.
This is in the standard shipping
product. What were they thinking?
I mean, it's crypto, right?
We do it or don't, we yell at people.
Do you want a button in your browser that says, oh, just
turn off all the crypto, it doesn't really matter.
They weren't thinking.
Well, they were thinking about something like money
probably. But anyway,
you know, vendors do things like this.
Microsoft's certainly not the only one.
Anyway, we see incredibly
features that go by. I mean, you know,
people who build firewalls that you can get to
by clear text HTTP because no
bad guy would ever get on your management land.
Just never happens. So what we tell you
is something, I wrote this slide way before
the teal camo shock
troops with their boot knives came in
and cut pages out of the presentations.
There's a risk of
Ford Pinto gas tank syndrome, which I call FPGS.
This was something that happened a long, long
time ago where some bean counter at Ford to say
that they could save a penny per car by changing the
bolts in the gas tank, which gave them this really
interesting characteristic that if you ran into the back of a Ford
Pinto, the gas tank exploded.
Most people involved were unhappy.
And, you know, lawyers figured this out and eventually
the memos came out and Ford got sued
and they don't do that anymore. Well, we hope they don't do that
anymore. Of course, now we build plastic cars.
You just look at them and they fall apart.
Anyway, so I ask these really
hard questions of vendors and the vendors
get all freaked out when I ask them these things.
Now, remember, I'm not a hacker. I just
play one on the internet. I mean, I do my own stunts,
but I'm just playing one on the internet here.
I'm not really as scary as most of you guys are.
Anyway, so, like, does your product
produce an external log? Now, apparently, this is
hard. So, think about it. So, I have these
IDS products. I power off the box.
Go do my bad things. Power the box
back on. It doesn't generate any messages when it
gets powered back on. It just starts talking again.
And so, I would think that would be a simple
message to generate. This is apparently hard.
Do you have a security incident
reporting mechanism? Yes, I wrote this slide
a long time ago before some people did some
things that made some people's incident response
teams, um, cause us to question them.
Let's just say it that way.
Um, some people don't even have things.
I mean, there are many worse vendors out there
than, you know, Cisco, Microsoft, that type of character.
Do you store your key material
securely? So, after you've got this access
point or radius or whatever box it is with wireless,
if your private key's in the clear,
uh, so, what was the point? You know,
if you don't keep the thing secure, I mean, there's a whole bunch of crypto.
We've been doing this for 20 years. You should be able
to figure this out. Do you have a management interface?
Is it secure? I, you know,
sitting on the phone with somebody doing a firewall audit,
and I say, what do the firewall rules look like?
And the CEO orders the IT geek to let me
telnet into the box from the public internet.
I'm like, uh,
I don't need to know what your firewall rules are anymore, dude.
Um, telnet's not
too, too common. We still have SSH1,
which is breakable. There's a lot of clear
text HTTP. There were vendors at Black Hat.
We're a studly, we have a booth at Black Hat.
Let me show you our management interface.
HTTP colon slash slash.
So it's like, uh, that's not secure.
You know, building a steel door and a grass hut
doesn't actually stop very many people.
It only stops the people without the lighters
and half the hackers smoke, so like, get over it.
Alright.
Security products should not make things worse.
Uh, they should not increase
the attack surface, to use somebody's buzzwords.
People keep doing central failure,
central server, central failures, yeah.
Central servers, which is a nice single point
of failure. And then they wonder why we attack
the servers, you know. I do these reviews
where they go, you know, 10,000 clients or I'll have
policy enforcement and we have one box in the middle
that we have old copies of SSH on
and clear text access to and all these things.
Gee, the hackers figure out it's a target.
What a surprise.
Um, people should communicate securely
among the components. Again, you know,
do product reviews and people send all sorts
of information back and forth in the clear.
And that's if you don't fuzz it or replay attack it
or things like that. And they run
sloppy distros, you know. Download
Linux, put it on a box, you know,
paint the front of the box some sexy color
because you hired the marketing department to make up a logo.
You did all this four years ago
before you got venture funding. So,
you know, this thing gets
into the field and
suddenly I'm some sort of obnoxious rocket
scientist because I noticed they're running Red Hat
5.2, you know.
And it's like, it's okay because it's a policy enforcement
product from a big router vendor or a big, whatever
software vendor. So, you know,
sloppy distributions. We will notice.
People do Telnet to port 22 and read the
banners. It's actually not that hard.
Apparently the vendors don't think any of us know
this. You need to promote this fact.
Stupid vendor tricks. Logging,
logging when they start up. There's all sorts of
log analysis tools out there. That's really nice.
Can we now have some logs to analyze, please?
You know,
do a scan on a box
that does some sort of SSL web server
balancing, you know, get no logs out.
Go to the vendor and say, what's the knob I set
to the position so I can see when the attacks happen?
They go, oh, there's no logging. That's a feature.
You know, and like, how are we
supposed to know there's a problem here anymore?
People do self-signed certificates. I have a homework
assignment for all of you. Somebody please
take a copy of Ettercap and when you get
when you grab the self-signed certificate out of the
Linksys box or one of various other things,
please change the text and generate a new certificate
so you look exactly like the vendor's
cheesy self-signed certificate that they
won't replace. And because man-in-the-middle
attacks are quite possible, a self-signed
certificate is only marginally better than no certificate
at all because anybody can make these things up.
People don't put change control in.
Everybody wants to have a GUI so they can be hot
and bothered during the demo to make sure they can click
on things and it's all multi-colors and they're
teal blue and cute and red and black and blinking
and all these things, but you can't do change control.
How about a little command prompt once in a while?
Something like that? Incoherent documentation.
I have a VPN box I have to manage
for a very, very large customer with
many dozens of class B addresses.
I printed out the manual.
The manual's 1078 pages long.
I'm not sure anybody's ever read the whole manual.
And then there's a user interface
on top of that. I mean, has anybody actually figured
out how juniper zones work? There's a lot
of these things that are very strange.
It would be nice if the vendors followed the protocol
specs once in a while. You know, I do
these voice over IP security classes and
I have a domain name, tissue samples from the crater wall
dot net. That's actually a valid domain
name, yes I really own it. That character
string is too long for most products because
I mean, they didn't read the protocol spec.
And DNS has been around since, what, Lincoln was president?
Um, you know, could we please follow the protocol
specs? At least before you go cook up some
your own stupid proprietary protocol that's
on top of it that's better because your EAP
method's better than the standard EAP methods?
Not that the standard ones are that good, but at least
could we all use the same ones? We should all at least
be in the same leaking rowboat.
Alright, things you should try. Now this
sounds really cheesy and stupid, but you can make money
doing this. It's very odd. Um, run nmap
and nnessus. You know, half the time
I run nnessus, like, you know, some box in the network
will go jump off the corner and reset to factory defaults.
Now, since we all know how to download
these things and run them, and the bad guys
do, and so do the children in high school or
elementary school, or they're teaching in kindergarten
now, probably. Um, you know,
yeah, you're learning kindergarten, I'm sure. So, I mean
they should be able to survive little
things like this. This apparently is news to a lot of the
vendors. Uh, the vendors don't tend to go
there are vendors, actually, there are vendors here at Black Hat
they tend to be doing things like hiding in very loud
Hawaiian shirts, but they do walk around. They're the ones with
the good haircuts. Um, anyway,
tell net to port 22 and read the banner.
That's a really exotic way of doing a security
analysis. Unfortunately, that gets me a lot
of information. You know, I write these product reviews
and I'm the token hacker and it's all very scary.
I tell net to port 22 and read the banner.
I mean, it's really, really hard.
And I do this over and over again, in print.
And the vendors who follow them don't actually figure
it out still. It's like, you'd think they would notice this stuff.
Another one, try to look at
doing crypto. Crypto, apparently, is hard.
Thank god the hackers think it's hard because
they don't steal the private keys as much as they could.
Open SSL, turn on SSL 2.
Is there any redeeming social value in running
SSL 2 in anything on the public internet
today? I don't think there is.
But there's lots of products still supporting it.
Go after the web interface.
There's like 5 billion people up and over from the
dot-com boom who know how to write broken
HTML. And about half of them are working for
vendors building sophisticated web-based
management interfaces.
And they've got cross-site scripting and
forms you can blow up and fields you can fill in
2,000 A's and they jump into a corner and
psych vault and all these kinds of things.
Etter tap. Man in the middle of the boxes.
I mean, if they don't secure the connections,
you can man in the middle of the things.
Go look for a random exploit. This is something
they don't seem to think anybody would do.
I'm testing a product and I'm reading security
focus, various random mailing lists, and an
exploit will come out. I don't care if it's old
or new. Go try it on the thing you're trying
to use or trying to evaluate. Apparently,
nobody expects you to actually keep up with
the current news. You're supposed to buy a product,
move into a cave, and run it there for the next
20 years. Everybody runs iOS 11.4, right?
That's close to the current rev, definitely.
So, try the current stuff.
You know, the bad guys might try the current stuff.
That's sort of why they're called zero days,
the ones that are even more current than the
current ones that are known. You'd think you'd
figure this out. It's really easy to go after
a lot of products. It's pretty stupid.
It's embarrassingly stupid. And vendors just
assume nobody would actually do this.
There are no real ha- I mean, there's nobody
goes to de- there are not 500 people in a tent
in a parking lot in Las Vegas right now
talking about hacking. Doesn't happen.
You just heard it on the internet, it's a bad rumor.
It just really isn't happening.
You know, so I mean, everybody's really just
sweetness and light and just leaves the networks all alone.
And the bad guys, of course, are much more gentle
than we are, right? We all know that.
You know, they're much more gentle than we are.
Anyway. Alright. How can you make things better?
So, you know, this is actually the stock slide.
I decided to leave this one good.
How can you make things better?
Well, we're trying to be educated consumers here,
so test things, you know, try to actually do something
and figure out how to make it better.
Try to report bugs. I mean, if the vendor is so much
of a bimbo that's going to yell at you for reporting them,
that's their problem. You should still try to figure out
how to report the bugs reasonably.
If you can get one of these things to break,
if you can find something breaking, give me a paper.
I'm on the program committee for ShmooCon.
Give me a paper. All of our papers starts today,
as of right now. It's on the website,
www.shmoocon.org. We'll have paper copies
we'll put out there afterwards.
But you find something you can break,
we want it to break a track.
You're going to give me the book here?
He's going to stand up here and harass me.
Okay, I just got one more slide. You can take it.
Hey, yeah, definitely. Right, I'll get the book later.
You just, you know, you just wait.
You're the time Nazi.
Yeah, well, some of us had to be the time Nazi
when you were standing up here, you know,
going through, flashing things.
Report flaws, document the risks.
People say, you know, I say, my God,
you run HTTP on the management interface.
And the blender goes, nobody's ever said that to me.
We think it's just fine. Everybody loves this.
It's bullshit.
Anyway, disrupt future purchases
of insecure equipment.
The only way they're going to understand
is the money.
If they ship lame shit, don't buy it.
Make sure they lose sales.
If it hits their pocketbook, they'll understand.
And the other side of it is encourage
future purchases of clueful stuff.
If you find gear that's secure and works well,
make sure it gets bought again.
And make sure you show things are easy to break.
People don't believe this stuff can happen.
Nobody would crack DES.
Nobody would build a rainbow table to crack Landman.
Landman's perfect.
Nobody would actually do any of these things.
Nobody ever actually tries to break SSH1.
It's just, there's all this mythology out there
that nobody actually tries to go after any of these things.
So, there's a lot of things you can do
and there's a lot of lame products out there
and it's low-hanging fruit, I know,
but we should get rid of the low-hanging fruit.
You know, we should have to spend more time
listening to them doing exotic tables
than listening to me be a scary guy
because I can skel-telnet to port 22.
Here you go.
Man, I love listening to him rap.
That's ridiculous.
Okay.
Before we get to
kick-ass zero day,
we built some gear last year.
Actually, the year before that,
we built some gear. We had the robot.
We had 82.11 bounce.
We had the sniper Yagi.
Tissue box.
Some of us had to move the sniper Yagi
across interstate lines
in a car and, I mean,
I had to drive the speed limit at Defcon, dude.
It really sucked.
So, I told you we'd bring
some gear and we did.
Cowboy, show them
what you got.
This is the 802.11.
This is a 9 DBI flat panel
antenna back-ended by a 1 watt amp
with a 0 to 100 DBI
rotary select attenuator that allows you
to direction find.
You can see her.
You mean it doesn't go to 11?
That's messed up, man.
For those of you that can't see it real close,
we've got some actual close-up pictures.
We made sure that we got these done
once we got on site, so there's some of that
doodoo brow background.
We've got a few things that are a little bit better than that.
Yeah, it's battery powered.
She likes that.
Is the tattoo battery powered?
Thank you to all our models.
Mike will tell you, don't touch the heat sink.
We don't pay any of our models like those
NMRC guys.
Here she is. She's wearing one of the
new ShmooCon 2006 shirts. Right on, baby.
And you can dunk her for the FF too.
Great stuff.
Yeah, the 802.11
bloodhound for direction finding.
Like I said, all of it back-ends into
an iPAQ, which you're running either familiar
or Pocket PC on. Run your basic
wireless discovery utility.
But, what you can do is long-range shots
and it's hand-held.
You can go dual-handed. That's pretty cool too.
If you really want to just be
Steven Seagal or some other...
It's balanced.
Check it out, baby.
It sticks right there.
So, apparently, Mike was
hanging out with one of these
in the car, turned on, and
drove by a cop.
So, he got
pulled over, right?
No, we didn't get pulled over. Actually, I was in the car with the cop.
Oh, really?
And the guy next to us...
And we rolled down our window
and he says, yeah, man, that thing's
been sitting off my radar detector for two miles.
Apparently, he thought we were test-driving
the new radar gun.
That's hot.
And I really mean literally.
It's hot.
You don't want to touch certain parts of it.
And when you aim it
at people, I guess they get hot too.
She's hot.
Alright.
So, if you want to check out
some of the 802.11 Bloodhound
later on, just meet up with Mike.
He'll describe it in more detail.
It's sexy stuff.
I'm supposed to be participating in one of the
award-driving teams, and
we were a little short on gear, so I decided to bring some.
And there you go.
Thanks a lot, Mike, for building that. Thank you.
So,
I'm just going to introduce
Kaz.
Kaz has a zero-day for Metasploit,
Canvas, and Kismet.
Well,
last year I came and wasn't really supposed to talk,
and they convinced me to talk
five minutes before we gave a presentation.
The only person to release a zero-day last year
in WPA. So, I released a zero-day
in WPA last year.
So, I decided to go ahead and release another
zero-day.
I recently started
a new industry.
This is Pot Kettle Industries.
We're looking for the Gartner
report.
I'm still looking for VC.
If you're a VC, come talk to me afterwards.
So, what does Pot Kettle Industries do?
We exploit the exploiters.
One of the things that I'm really tired of doing
is finding all these exploits that are published
on full disclosure and full nav
that are full of holes.
Y'all talk about how everybody else's shit
sucks, but your shit's worse.
I don't know
how many of you read
the source code of shit that hits full disclosure.
Almost all of it
is vulnerable at some point in time.
So, I decided to start
writing exploits for the exploits.
I haven't quite figured out how I'm going to profit,
but it's in the business plan.
Peel all the underpants.
I'll let you
go ahead and do that for me, Paulos.
Alright, so
the first exploit that we released is in a
multi-HTML.
It's a remote exploit released by Banshee.
Supposedly, Banshee is supposed to be here today.
Are you here today?
I have a sticker for you.
I released an exploit
and it got owned.
Got owned.
I have asked for a CVE
and it has been granted. I have the first CVE
for vulnerability in an exploit.
And I have an exploit
available for that right here.
So today, or for the last couple
of weeks, they've been asking me to look at Kismet
to try and find some vulnerabilities so
we can exploit other people
during the DEF CON war driving contest
this week.
That's top secret.
Those people are listening.
Okay, we ought to return all the CDs.
We're going to burn them and make new CDs.
Please go to the Shmoo page
in your conference program
and tear it out with a razor blade
right now. Throw it away.
Do us a favor.
Among many of the other
vulnerabilities that I found in Kismet,
some of them, Beatle's team
is keeping private, and if you're running Kismet
for this
DEF CON war drive contest,
you'll be owned.
So don't.
The easiest way to evade Kismet,
like I said,
I really believe in full disclosure and all that wonderful
stuff and responsible disclosure.
Sorry, I've been told I'm supposed to hold still.
I believe in responsible disclosure
except for people that are trying to own other people.
Well, if you want to protect your network
and somebody's attacking you and trying to find your network
with Kismet, the easiest thing for you to do
is to evade Kismet detection.
What you're seeing on the screen
right now is an fscanf from
the Kismet client.
This is what it does to read the packets that are coming
from the Kismet server. I don't know
how many of you can read C,
but if you note in there,
the first thing it's scanning
is an integer
and then it looks for a string
that's enumerated
it has the hex of 0-1
then the SSID
and then the hex of 0-1
and then continues on as the scanf string.
If you add hex
of 0-1 to your SSID,
guess what? Anytime Kismet
sends your SSID across
the network, it's not going to be seen.
So if you want to keep your network
protected from anybody using Kismet,
make your SSID shmoo with a hex
of 0-1 at the end of it,
anybody using Kismet is not going to be able to see
your access points now.
Awesome.
That's
zero day number one.
There are some buffer overflows
in Kismet. The guy who wrote it
was supposed to come to Defcon. He announced
about two weeks ago that he's not coming.
He's fixed two of the vulnerabilities
that are in Kismet in the last two weeks.
There's three more that are remotely
exploitable. Don't be using Kismet
over the next week. You will be
owned. When was the last time you heard
you should download the latest rev of the software?
Download
the latest patches for your exploits, kids.
Patch management is not just for users
anymore.
How do I go back?
Arrow keys?
Shift, tab, control,
delete.
Have you used a computer?
Whatever.
We don't need no stinking slides.
If it's not written in Perl, I don't know how to use it.
Put the girls back on.
There's the Kismet evasion.
I have a really simple exploit
for Metasploit in Canvas using
H.G. Moore's exploitation technique.
About two
and a half years ago,
he announced in an advisory that he
was able to exploit
various different companies by sending
stuff into their Apache web server log.
The Apache
admins of those web servers
were using things like tail-f
and a vulnerable Xterm
to launch commands using
Xterm control
characters.
What his advisory said about two years ago
was anybody writing any applications
that take
user input needs to filter out
the user input. Well, guess what?
Canvas and Metasploit take input.
The way Metasploit works is all of their
exploits do...
If you do a check
instead of an exploit, they will do a banner
grab and then do a
lame regular expression on the banner and then print
what the banner was so you can validate it yourself.
So all you have to do is
match their lame regular expression
and then print some
control characters like H.G. Moore
provided in his vulnerability.
So what I'm going to do is I'm going to wget a
shell script and then I'm going to run it.
And now I've owned anybody
that uses Metasploit.
Every single exploit
that Canvas ships with does
print if you run it in the command line mode.
Every single exploit that comes with Metasploit
prints some piece of data from
the user or from
the server that you're trying to exploit
without filtering it. If you're running Xterm that
comes with Debian and you're running Metasploit
or Canvas from it in the command line mode,
guess what? You're ownerable.
Owner awesome.
So
using H.G. Moore's
exploits against himself. So there's
two more zero day.
I think you might be at your limit.
Hey, we're
not starting anything,
okay? I mean, we're just making a point.
And the general point is, look...
Set an example.
Seriously.
The stuff that you're throwing out there,
it's great if it busts
stuff open, right? But at the same time,
watch your back.
Because other people are going to be looking
at your code as you throw it out there for other people
to use.
Speaking of code
and application security
and that sort of thing...
and ranting...
I'd like to introduce Bruce Potter,
founder of the Shmoo Group.
Hello.
I'm a little nervous to hit the next
button because they've been slinging slides all day
and I haven't been around.
And I'm not sure if they've been screwing with me yet or not,
so I guess I'm about to figure out.
Okay, good.
Are there pictures of me on there? That's all I want to know.
Did we upload those yet?
Yeah, so for the record,
Nomad's got the most powerful lens
on a camera known to mankind.
I'm sitting up there on stage and he comes up and shows me
a picture of my shorts that he took from
sitting out there in the audience.
So...
Pwned.
My crotch was owned, okay?
Only in Vegas.
You might want to see someone about that.
Yeah.
Nomad was up my pants.
Bluetooth security...
Look,
we talked about a lot of stuff today. We've been all over the damn road.
And what we're trying to do
is raise awareness.
There's no threat here, right?
The press is sitting up here
visibly scribbling away, and they're trying to figure out
is there anything in common with all these talks
or are they just all a bunch of crazies?
All we're really trying to do is raise awareness.
One thing we really don't have anything new on this year
but I want to talk about is Bluetooth security.
Shit's gotten worse, guys.
It hasn't gotten better.
There's more Bluetooth radios out
than there ever have been. It's not dying.
Regardless of whatever the hell
the press and Gartner and people think.
Two million radios every week are integrated
into devices.
And I tell you, people are doing nasty shit
with Bluetooth right now.
Last year, we tracked people for fun at Black Hat.
That was just kind of the thing.
And then tryfinet.org. Bloover? Man,
that's an awesome tool. What's the phone it runs on?
6260 or something?
Buy some of those, man.
Buy them in bulk.
You can run Bloover on.
You can make the phones
vulnerable phones. You can make them dial.
You can grab down address books.
Things of that nature.
A lot of the new phones are patched.
But this is just an example, guys.
My car has Bluetooth in it.
One day, I'll be driving down the road
and some hacker will shut my car off.
Or he'll sequentially deploy all my airbags
and do some kind of techno thing.
And that day can't be far off.
And once they put the Bluetooth dart
in my butt, I think my life will be over.
Oh, I never should have touched that microphone.
Alright, so anyway.
That's that.
Pairing attacks. There's a paper that came out
on pairing attacks.
We have nothing to do with tryfinet.org.
I'm just pimping these guys because they have a great tool.
But there's a paper on some pairing attacks
that came out recently.
Basically discussing how to
force phones to forget
their pairing and then repair with them
and intercept the pairing process
and then basically
brute force guess the key.
Everyone's always been able to
brute force guess the key in the pairing process.
The standards bodies admitted this
when the protocol was developed.
This is not new. When you pair a Bluetooth phone,
go lock yourself in a Faraday cage
if you're really paranoid, and pair.
And that way, no one can intercept it.
But the neat new trick
is that you can trick a phone
into thinking, oh, I've lost my pairing with my earbud
or whatever, I should repair.
So, I like to liken this
to a rogue access point attack
where you've got a rogue device pretending to be another one
in your network, it just happens to be your little Bluetooth PicoNet.
If you're at DEF CON
and you're talking on your Bluetooth earbud
and your phone suddenly says,
what I really want to do...
If it says, what I really want to do right now
is repair the earbud
because I've forgotten the pairing, no.
Put the phone away, stop talking
to your girlfriend or your
Vegas hookup and just go drink
because someone's screwing with you
and they're going to try to break into your phone.
Wow, I'm not even sure
where the 802.11 seems to...
That happens on your wired earbud.
Just go home.
Yeah, that's the voices in your head at that point.
So,
defending wireless networks,
this should say defending 802.11 networks
because, you know, 802.11
does not equal wireless and vice versa.
We talked a lot about the offense.
This slide is actually taken directly from our Black Hat talk
that Beatle and I gave, so it doesn't make any sense
in its current context.
We had done something
a few years ago called Hotspot
DK. It was a hotspot defense kit
in a response to a problem where
there's a lot of money being spent to protect enterprise
wireless networks in the enterprise.
You know, like, hey, let's buy
wireless intrusion detection systems. We'll put sensors up
everywhere and we'll put things in a nock and we'll be secure.
Well, hallelujah, brother.
Your infrastructure will be secure.
Your clients are still out there in the window.
You know?
Your EVP or your nock guy or whoever
that's got a laptop leaves your enterprise
and goes to Starbucks.
Your wireless IDS is not at Starbucks
when AirSnarf is beating the shit out of it.
Alright? We need to pay more attention
to wireless client security.
So, a year and a half ago, literally,
the day that DEF CON Federal
started, we were scheduled to speak on day two,
we sat... what?
Black Hat, what the hell did I say?
DEF CON Federal 2006.
Be there.
It'll be in the Las Vegas County Jail.
Or Guantanamo.
Or Guantanamo, if we're lucky.
Jeez.
Go Gitmo.
What the hell was my train of thought?
Oh, we wrote this tool.
We wrote this tool literally
in the day before our talk
at Black Hat when we were drinking and talking to friends.
It wasn't rocket science
to write a little tool that
protected wireless clients.
Nothing out there at the time existed like it.
We released it under BSD license and said,
take it, integrate it into your own products,
we don't give a shit, just fix the problem,
secure the clients.
Now you can buy it from other people.
And it's taken a year and a half to get there.
There's really still no huge amounts of support
in the operating systems and the drivers and whatever
to try to protect the clients while they're on the road.
And really, that's a massive problem.
So things are not much better.
I'm skipping ahead in my slides.
We're working on Hotspot
DKV2.
It turns out that my third major
was computer science.
The first two were
biology and physics.
Marketing, economics...
I went through a lot of majors.
I almost got into a fist fight
with one of my professors and then I watched him
dent my car on purpose.
And I realized at that point that computer science is probably not the way
I was going to graduate college.
And I can't code for shit.
So I've been trying to write Hotspot
DKV2 for the last couple weeks
and it's been a qualified disaster.
And the guy who I normally rely on is actually moving to
Alaska right now. This is not like a line.
So I don't have code to release.
But ultimately, what we're trying to do
is build an environmental monitor.
I like to liken this to going to
downtown Baltimore. How many people, first of all,
live near Baltimore?
Okay, we all work for the government.
How many people have been to Baltimore?
Alright, when you go about
a block or two outside of downtown,
it gets really scary really quick.
That town is... it's not so pretty.
If I'm in downtown Baltimore
and I hear gunshots and then I check my body
and I'm not hit, it doesn't make
me any less nervous.
I don't think to myself, oh, thank god,
they missed me.
Let's go get a coffee, dear.
So, this is the same
kind of thing. We're trying to build an environmental monitor
that looks for nasty things happening in the air
that might not be happening directly to us.
Think of it as wireless IDS for your
mobile device, right?
This is really kind of a decent idea, I think.
There was actually a question posed yesterday to me.
Why don't you use Snort Wireless?
Well, we kind of want to do it lightweight.
We want to try something new, so we're slinging our own code to give this a shot.
If people are interested in helping out,
please contact me. I'd be more than happy to,
well, have you write the code, because I'm really shitty
at it.
Question? Okay, fire.
No, no, the question is,
if you help out, do you have to drive around Baltimore?
No, I'll do that for you.
Wait a second, Bruce.
Didn't you say that IDSs sucked?
I think that's what I heard.
So,
there we go. Where the hell did this come from?
Oh, Jesus.
Way to avoid the question.
I'm trying to get to a
geometry here.
What?
We only have one certified
open office operator.
How do I go backwards?
Oh, the back arrow.
Hey, is that my slide?
You wouldn't learn that in computer science.
Oh, I did that.
I forgot my slide.
Alright, so this is Hotspot DK.
So to get to the question Eric asked,
this microphone and I are going to have a
carnal knowledge here shortly.
So,
as security professionals,
I'll get there.
Alright? Thank you, brother. Hallelujah.
We haven't learned a lot.
People have called me kind of a killjoy
the last couple days because every time I've been on stage,
I've been pointing at the audience and being like, it's all your fault.
We've learned
the same things over and over, which is kind of
alluring a lot.
You get to learn the same thing and fill up the queue.
So, here's
the deal.
We get paid to know security stuff.
And ultimately,
we should have a better
knowledge of our environment and our equipment,
as Ronnie talked about, understanding what
vendor gear we're putting in, understand the
applications running in our environments,
that kind of thing. Ultimately, users
are the ones kind of affected by IDSs.
Is a transaction I just committed with the Bank of America
legitimate, or have I been owned?
Is my credit card down?
Bank of America can find out. It'll take six months
to discover it, but it would be nice if you
found out in real time. It would be nice if the people
in the NOC just got little pop-up windows
that were binary ones and zeros. Secure, not secure.
What's the state of the network? Bing! Zero.
Secure. What's the state of the network? Bing! Zero.
Insecure. What?
Then you know your own.
You just cast that in stone.
Yes.
Everything's secure. What we really need to be
focusing on as an industry is a better
understanding of the tools and our own enterprises
and looking at the integrity of things.
It's not good enough just to say, are there
traces of an attack, but has an attack
been successful? That's the real rub.
There's a lot of people focusing on forensics
and looking at the after-the-fact type of stuff.
But we need to have a deeper understanding
of what's going on in our environment.
Brian Watring, who couldn't be here
today, has been working for years on a
tool called OSIRIS.
You can go to hostintegritymonitoring.com
and take a look at it.
Think of it as tripwire
on steroids. It's examining configurations
and checksums
and all kinds of things about the...
Pablo, go. It's free.
Just get it. It's free. Just get it.
And he actually just has a book that was published
about how to do host integrity monitoring.
And what's unfortunate is that
there's not a lot of other tools out there that deal with that kind of thing
and I think we need to focus on that.
Further...
I made a triangle. What?
What? You made a triangle
in college? Yeah, I made a triangle
in college. It was glorious. This is my
PowerPoint food. Beetle has arrows going back
and forth and worms and all kinds of shit.
And I have a triangle.
And they're both built by bandits. Bring on the triangle.
What do you want from me, buddy?
Tell me about wireless IDS.
Wireless IDS? Why wireless IDS?
Because you said they were good.
Wireless IDS in the client, I think,
is a reasonable thing. That gets back to this kind of thing.
God!
Don't you mean
host IDS on wireless
clients? It's okay, Matt. It's almost
over. Apparently we need a keyboard
IDS. Do we have any more shit we can show instead?
Yeah. All right. I'll make this short.
Your IT security needs includes a different user interface.
Go play with this in the parking lot.
Yeah, go play with that. I'll just stick it down my
pants with a one watt amp.
Vegas was hot.
Can we get pictures before and after?
So, anyway,
sure. Look, you can see it backwards over there.
IDS and the normal user get along
fine because that's who really needs to consume
the information. What we really care about is
how bad is shit, right?
Users need to make rash tactical reactions.
We in the operations world need to make strategic reactions
like, oh god, we got broken into. Let's respond.
Incident response and things of that nature.
Does that get down your path? All right, thank you.
Further, I think you need,
when you think about security in the data center,
sorry about the rant, and if you were a
black hat, I really apologize, but
you really need to think about things in a structured
fashion, and it turns out we need to
spend as much time thinking about patch management and configuration
management as we do firewalls and software
security and IDS. Where do we buy the
honeypot hats? The honeypot hats?
I'll make you one out of this
soaking wet towel and some electronic devices later.
Dead man walking.
Anyway, I don't really want to get into
this triangle, because it'll be controversial
and more than I really want to do, and Beedle's standing behind me
threatening to beat the shit out of me.
As a moment, I'm just going to do that to piss him off.
That was awesome, dude. Awesome, whatever.
So...
Is Mike Lynn in the house?
Is he in here, man?
Motherfucker. I told him to come.
Yeah, so Mike was at ShmooCon.
If you missed his talk on signal intelligence
and how to capture really interesting things
that are in the air all day long
and how to decode them, because people are using
leaked crypto like
ASCII.
You missed a really cool talk at ShmooCon.
And it was a lot of fun. Who here was at
ShmooCon earlier this year?
Awesome. Right on, man. Thanks. That's cool.
So, ShmooCon 2006.
January 13th through 15th.
Washington, D.C. again.
Pre-registration is live now.
If you missed out on ShmooCon last year, it's sold out.
We didn't have...
He is the ticket Nazi. When we sell out, we sell out.
Yeah, we were done, man. We didn't have any space.
We had no more chairs.
We would have been people standing in the back...
Oh, or something. Okay.
So, yeah, you can go to ShmooCon.org.
What we really like about ShmooCon...
And particularly how we can kind of get it out there
for people to see.
We threw a lot of ads together last year
for people, their entertainment.
And we're interested in soliciting those again from people.
So if you have an advertisement for ShmooCon
that you'd like to get onto the web,
we'd like to get it onto the web for you.
And so just build it, make it.
We'll compare it with all the other ads that we receive.
The best ad that we get,
we're gonna pay for that dude, wherever you are,
to fly to ShmooCon, stay at ShmooCon,
hang out at ShmooCon.
Yeah, man.
Please do not hire an artist from Singapore
or somewhere.
No sweatshops, alright?
Here's an example ad, just so that,
if you want some mind view.
See if this will actually play.
Hopefully.
That's pretty hot.
Right on.
So, we're really interested
in more people submitting.
Rodney's got the CFP.
So the CFP's out.
And we're handing it out.
So if you want to see what we're interested in,
what we'd like you to present on,
feel free to do that.
We had three tracks last year.
Build it, break it, and bop it.
So we're really interested in people like building things.
And as Pablo said at DEF CON last year,
build cool shit.
And the other thing, if you have an idea for a talk,
and you haven't done a talk before,
you're not sure how you'd go about doing that,
talk to us anyway.
We're trying to encourage new people,
new blood to show up.
And we've got all sorts of folks,
PhDs, professors give courses,
all sorts of people do presentations.
We can help you out with that kind of stuff.
So if you have a good idea, talk to us.
Doesn't matter if you've given a presentation before.
Go right ahead. Please, we encourage it.
It's important to mention that when we're at ShmooCon,
we don't talk at ShmooCon.
We usually, you know, we might give a few rants here and there
and some informative things.
But those are sidebar things.
We actually provide a venue for everybody else to talk.
We come here and we just kind of throw a bunch of stuff together
and we try and jazz people up and get people excited
about doing these kind of things.
So we're interested in providing a venue for you
to give presentations.
So submit what you want and we'll make it happen.
So that's it for us.
Does anybody have any questions?
Please ask questions.
Priest is walking up.
Alright, thanks a lot guys.
We really appreciate it.
Have a good day. Have a good DEF CON.