start	end	text
6300	9100	I think that's for real this time.
15390	19290	Can everybody hear me? Okay.
19770	23190	Thank you for coming. Good afternoon.
23190	28610	I am Wes Brown, and this is Scott Dunlap, my partner.
28690	34530	And we both do security research as an interest.
34890	39490	And we have previously worked in security industry
39490	46050	as penetration testers and security assessment and application assessment and all that.
48150	51210	What is Mosquito?
52250	59930	Mosquito is a lightweight framework to deploy and run code remotely and securely
59970	63570	in the context of penetration tests.
63570	70570	It makes a best effort to ensure that the communication is secure.
71050	81170	Special care is taken to ensure that deployed code is not stored outside of process memory space.
81610	89690	It protects the confidentiality and trade secrets of code that is deployed and run on the target.
89690	93610	This could be an exploit or a methodology.
93610	100910	From past experience with working with proprietary zero days,
101230	107130	I have hesitated to puddle jump using the exploit
107570	112890	because I'm afraid of losing control of the exploit,
112890	120510	that somebody could be eavesdropping or somebody could be watching the file system for the exploit.
120870	126310	And I cannot ensure that they can do file recovery on the disk,
126310	133970	but this way we can ensure that the exploit only remains in memory, the process space.
133970	141270	At no time is the exploit written to disk unless you swap.
142070	146330	That's one case we can't really control if you force a swap.
151270	154350	I have discussed the why.
154370	163730	Often it is desirable to leverage zero day code, but doing so in an uncontrolled fashion can have repercussions.
164720	171010	Many processes have trade secrets and methodologies distilled in the form of audit and exploit code
171010	174530	that they would like to keep out of a target's hands.
175810	183950	Also very important is one problem I've had with many exploits
183950	189590	is it transmits data and control information in the clear.
189590	197770	And if I transmit the control and data in the clear, I am endangering my client.
199390	209870	I mean, using Netcat and all that is great, but you're sending your client confidential data over a clear text connection.
209870	212910	So that's one problem I'm hoping to resolve.
215190	219470	Well, here we have a technical overview.
219470	227800	We have written proof-of-concept code to prove that this idea works.
228390	231210	The interpreter is Lua.
231210	238780	Many of you may know Lua as an extension language for games like World of Warcraft.
240160	250920	We use a synchronous cipher called RSA, which all of you know is used for the initial handshaking between the client and server.
252240	256120	It's a computationally expensive operation.
256120	262320	So once handshaking is done, we move to a synchronous cipher called ISAC
263320	272540	where we trade a cipher and the clone and drone communicate by a synchronous cipher.
273260	277600	Another component is entropy generation.
277600	284640	Cryptography is worthless without good entropy, without a good pseudorandom number generator.
286200	291160	As you may have figured out, we use a console drone model.
292320	296670	One big plus is this code is extremely portable.
296840	305160	We have personally tested and built on Win32, OpenBSD for Intel 386, and Darwin.
305160	311490	By testing on Darwin, Mac OS X, we have resolved any Indian issues.
311960	319580	By ordering Indian issues between 32-bit, 64-bit, or RISC and CISC platforms.
322320	324590	Why did we pick Lua?
325140	328690	It is a lightweight and powerful procedural language.
329080	332060	It is easily extensible with bindings.
332060	336550	We have created bindings for RSA and OpenSSL.
338140	344120	It is bytecode compiled, which is a plus when you're trying to deploy code.
344580	347160	It is highly portable.
347160	350000	It is written in straight ANSI C.
350280	354540	And it has run on PalmPilot without any changes.
355380	357420	It is easy to learn.
357420	361920	It takes about one hour to learn if you already know a procedural language.
364360	368760	Moving on, we need to talk about the asynchronous cipher.
369760	378960	As I've said before, the asynchronous cipher is used for initial negotiation and handshaking of secure channels.
379420	386640	We pick RSA because it is well known in the cryptographic community.
386920	391700	While it has weaknesses, these weaknesses are known.
391860	396980	And that is more important to us than trying out some new cipher.
396980	403860	We investigated elliptic curve cryptography, and we might enable that.
403860	406220	But RSA is a known quantity.
407680	416140	We use 4096-bit keys for the handshaking, so it is very unlikely that you will crack it.
418000	424340	For the synchronous cipher, we ran into issues when we were looking for a synchronous cipher
424340	438000	because many of them had packet problems and packet implementation or copyright problems.
438000	442240	But we found one that we like, and it is ISAC.
442240	448660	It is a synchronous cipher used for console and drone communication, the actual communication itself.
448660	457080	Once the synchronous keys are changed, the stream cipher is one byte at a time.
457080	460640	It is very fast and very safe.
462940	472620	And one of the nice things is we can use a large key, 182-bit, because ISAC does not penalize you for stealing the key.
472620	478640	We could use a 16-bit key, a 32-bit key, and it would make no difference.
478660	481940	To computational performance.
484100	495800	Now, along with the good, we will be remiss as security researchers that we need to talk about the bad things about our proof of concept,
495800	498000	and that is entropy generation.
498280	502640	It is essential to good cryptographic security.
503220	507940	The problem is it uses OS facilities for entropy.
508660	514960	The pseudorandom number generator in many operating systems are not very good at all.
515880	520500	But on unit machines, we use devurandom.
520700	524540	How good it is depends on the unit's derivative.
524840	527940	OpenBSD, not surprisingly, is very good.
530080	536620	We use Windows 2000, and HP has a very good cryptographic library.
536620	542960	And because we use the OS facilities as a possible avenue of attack.
542960	547080	We will probably investigate this in more detail.
548980	557060	The cryptography library we're using, LibTomCrypt, has some entropy generation functions, but they are too slow.
557380	563100	When we tested it, it took two minutes to generate entropy.
566780	570760	Mosquito is divided into several components.
570760	577700	We got the core, which provides the basic functionality required by a drone and console.
579140	586660	A drone provides a remote process that contacts a matched console.
586940	595060	And to execute scripts and commands that the console sends to it over the secure channel.
595060	601190	A console provides a local process that controls the deployed drone.
601740	608180	One of the neat features that we put in Mosquito is transport.
608300	614500	And it's an abstracted way to connect the drone and the console.
614500	618020	I'll talk about that more in a bit.
619200	621520	Let's talk about core.
621520	629860	Core is really nothing more than an augmented neural interpreter extended with the following functionalities.
629860	640600	We have RSA encryption functions, ISAC encryption functions, networking functions, entropy gathering functions, and structured buffered functions.
642440	648320	The drone is the Mosquito component that is deployed onto the target machine.
648320	656820	It integrates the core with drone-only functionality, meaning it's a superset of the core.
657980	663480	It executes Lua code sent by secured communication.
663620	671280	And Lua code sent by the console is stored only in process memory.
671280	673500	It is not stored on a disk.
675920	683520	The console is the Mosquito component that provides a local process that controls the deployed drone.
684040	690320	It integrates the core with console-only functionality. It's a superset of the core.
691560	696340	The user uploads code to the drone by secured communication.
697040	704380	And even more neat is the user can also interact with the drone in real time.
704680	708660	We can interact with the Lua interpreter remotely.
708940	714640	So you can do debugging and you can do code on the fly on the drone.
718100	725300	Transport is an abstract functionality for the console and the drone to communicate with each other.
725300	733580	It transparently negotiates a communication channel between the drone and the console and provides a read and write method.
734260	736580	And read and write are separate.
739100	747640	And it's really neat because we can do different transport methods for different channels.
747640	752260	We have HTTP transport which is implemented by default.
752260	762580	But we have skeleton code to implement DNS transport, ICOMP transport, UDP transport, HTTP transport.
762580	773340	So if you could send HTTP in the pacifier wall but you can only go out by ICOMP, you can do that.
773340	780020	You can send a message by HTTP and go out by ICOMP.
780020	783320	You can mix and match however you want.
785520	788300	Affiliation is handshaking.
788400	796500	It's a process of identifying endpoints as valid to each other that they are who they are.
797580	800760	And it sends a passphrase to each other.
800760	808980	So unless somebody gets a hold of a drone, it's very hard to intercept.
810620	818160	And during the handshaking, they are changing synchronous keys for ISAC.
821480	827180	This is the outline of the flow of console affiliation.
827180	829180	We have...
831960	838960	When console affiliation begins, it starts and waits for the drone to contact it.
839440	848620	And if it times out, we actually have a timeout feature because we don't want it to go for too long
848620	856320	where other people may intercept the drone and modify it and then do whatever evil things they want to do with it.
857180	862060	So we would have maybe a one-minute timeout or a 30-second timeout.
863970	868430	And we have a drone in a secret mattress.
868940	873180	It generates the key to send to the drone.
873180	877500	And that's the key that the drone is going to use to send to the console.
878100	882200	And then we got the console affiliation mode.
882540	885220	The drone mode is a little more simple.
885220	887620	It generates the key.
887920	891520	It sends its handshake to the console.
891900	895420	And in that affiliation, it sends its key.
895520	898980	And then it awaits the response from the console.
899020	902120	If it times out, the poop is gone.
903940	909520	And then if the console sequence matches, then it enters operation mode
909520	913500	where the console can send Lua commands to the drone.
915900	920360	One of the neatest things about Mosquito is the build environment.
920400	925720	The virtual machine is statically linked for easy deployment in a project.
925740	930260	It's to ensure that all libraries that are needed to function are available.
932140	935000	Gloob is a deep Lua script.
935000	941220	It takes the executable file, the stub, with the binary C code functions
941220	951060	like the virtual machine, the interpreter, the socket library, the cryptography library.
951060	959740	And then it will attach the scripts in bytecode format to the end of the executable.
960360	965560	And when the executable runs, it will go through the bytecode
965560	971560	and have all the functions defined in the payload.
971720	974720	So there's two ways to get code in the drone.
974720	981640	One is to embed it in the drone, and the other is to send it over the network.
982020	985580	So if you have library functions that you're not concerned about,
985580	990600	you can put it in the drone itself and have them available for all penetration tests.
991100	994680	But then you can have exploit functions used for library code.
998280	1002800	Now, we have some ways to attack Mosquito.
1003040	1007660	We have introspective debugging.
1007660	1014140	If somebody is sitting on the machine with sharp eyes, there's not much we can do about it.
1015880	1020040	As I've discussed, they use entropy attacks.
1020040	1029440	And if you are fast enough, you can modify the drone binary itself before it's invoked.
1029440	1041740	But you have to be very, very quick, because the interval between the drone being deployed and being invoked is very short.
1041740	1044400	Two, three, four seconds at most.
1045290	1051460	And, of course, there's always cryptography attacks, known test attacks.
1053580	1056840	There are some neat uses of the framework.
1056840	1064800	As is, we can refactor exploits into Lua for security deployment on the target.
1065260	1067520	It is easily extensible.
1067520	1070700	Additional cryptographic methods are transformed.
1072020	1076260	We can write port scan code.
1076260	1080900	We can write SMB scan code and deploy it on the drone.
1081820	1089520	So if you deploy the drone, you have all your exploit code, all your functionalities there.
1091080	1101760	It will also simplify the deployment of auditing tools if you have one VM for all the platforms you attack.
1103460	1107820	All the dependencies are included with the drone.
1108100	1115200	When we deploy a drone, we have functions that will detect the target architecture.
1115200	1118880	Look in the stub library of executables.
1118880	1129560	We have a Win32 executable, we have a Darwin executable, and then we have an OpenBSD executable.
1129560	1142120	It will detect that, take the stub, latch on all the Lua library code you want, and on the fly stream it to be deployed.
1142120	1151400	That's one of the neat things we can use with Glue, because not only is Glue a script, it's also a library function in Mosquito.
1153260	1157020	We have some future ideas that we could use.
1157020	1163420	One of the neatest ideas would be an integral high-speed packet snipper and generation in the drone.
1163680	1170380	That would be great for port scanning or listening to traffic and interpreting the traffic.
1172120	1178300	One thing that we wanted to do, but weren't able to do yet, was drone-to-drone relay.
1179040	1184220	You've got the console, you've got the drone, and then you've got another drone.
1185120	1191320	And the communication is relayed through the drones as many times as you want.
1191320	1199100	But at no time does any of the drones in between know what's happening at the endpoint drone.
1199100	1202440	Because we've got nested encryption.
1202960	1214560	When you've got the endpoint drone sending a... it's got its own key that only the console knows, it's passed and encrypted again and passed and encrypted again.
1214560	1218320	Remember, ISAT has no penalty.
1219040	1222460	So you can nest it as many times as you want.
1223240	1230720	And we would like to do further refinement of the automated configuration and drone console pairs.
1231360	1238780	And consoles that can manage multiple drones. Right now we can only manage one drone.
1241300	1243900	Who are we? Got work for us?
1244860	1251280	I'm Wes Brown. I'm a security consultant and security researcher.
1251640	1257080	And Scott Dunlop is a software engineer and security researcher.
1257340	1262960	He's more of a software engineer while I'm more of a consultant type.
1263460	1272880	We are available in activity-seeking work. Wes is particularly interested in full-time employment as a security researcher.
1273880	1278440	We have a website, fmosecurity.com.
1278440	1284040	Worldwideweb.fmosecurity.com if you want more information.
1288460	1290730	Got any questions?
1292230	1299890	Tomorrow we will be putting the entire framework code on SourceForge.
1299890	1304630	It is under the BSD license. Feel free to do whatever you want with it.
1306790	1308710	And that's it.
1316690	1322710	Scott will be taking the questions because I'm deaf and I can't hear the audience.
1323230	1326350	We didn't bring any binoculars so we could lip-read.
1326830	1327910	Yes?
1331150	1339490	The 0.2 footprint was about 160k. We hadn't done any optimizations with the C compiler flags.
1339490	1342870	We were hoping to target for about 80 to 90k.
1342870	1350450	We were encountering some problems with the fact that we have to bundle most of our dependencies with the actual drone.
1350450	1353230	We're not making any assumptions about availability of things.
1353230	1361070	We're just assuming standard C live in the case of Win32, you know, the standard DLLs.
1361610	1366630	The current 0.3 is a little bit heftier because we put in live TomCrypt.
1366630	1373290	And a lot of TomCrypt is very easy to strip down. We just haven't had a chance to do it.
1375470	1376590	Sure.
1385070	1390530	We are supplying a general purpose socket library called LuaSocket.
1392330	1402870	It's not quite performing up to the standard that we'd like, but the goal was to provide the ability to do further network penetration and auditing from the drone.
1402890	1411770	Very often in audit you have a situation where you've managed to breach an edge system and you need to get deeper in now that you're past the firewall.
1412070	1414290	And to see where you can go once you've gotten into the bastion.
1415170	1417030	And that was kind of the purpose of the drone.
1418110	1419190	Yes.
1428590	1437830	We certainly kicked around the idea of abusing some of the DRM APIs in Windows XP.
1437830	1440490	Unfortunately most Unixes don't provide these.
1440730	1446470	OpenBSD does provide some functionality for preventing writing into swap space.
1446890	1449930	But that is one of our more major vulnerabilities.
1449930	1454830	This is a possibility of later analysis of the swap file.
1462920	1467800	Unfortunately I don't have a console running on Win32. I haven't linked one.
1469040	1473940	I've got the Macs, but they're not cooperating with the projector today.
1474680	1476440	It's very embarrassing.
1480790	1483550	Oh, I'm sorry. Yes.
1491020	1497180	We are relying on libtomcrypt, which is fairly simple. It's configurable and can be stripped down.
1497180	1499440	And of course Lua, as you mentioned.
1501500	1506740	And our only other major dependencies have been just Lua extensions.
1507100	1511320	The stuff that we've added in, structure buffer and everything else, are actually pretty simple.
1511940	1517180	If there are buffer overfunds in Lua, that is a problem.
1517180	1519180	However, the way the construction works...
1520320	1529320	Once the drone has been deployed, there's a fixed window which is configurable of how long the drone has to contact the console.
1530040	1538500	The first one to contact and correctly complete affiliation within that window basically gets the connection.
1538520	1546520	After that, we drop the listen socket and basically we just run with that one transport until it dies.
1546520	1550900	So buffer overrun exposure is pretty minimal.
1550900	1557520	As you mentioned, there's always a possibility of someone trying to respond before the affiliation goes through.
1557520	1564480	But unless there's some kind of very specialized IDS, I don't see that happening.
1564840	1570720	We were investigating how to deploy this by shellcode.
1570720	1577760	And if we can do this, then we would have no drone in the file system at all to intercept.
1577760	1583980	It would be in the process memory of whatever program we buffer overran.
1589860	1591540	Any other questions?
1593780	1596720	I've got to cover for a time not having a demo.
1599770	1605290	Well, you're always free to email the questions to the address over there.
1606350	1614810	And of course, the code itself will be available for your inspection tomorrow at SourceForge.
1614810	1617230	We will deploy it to SourceForge.
1622480	1630460	Well, once you put something on SourceForge, barring intervention by lawyers, it's there pretty much permanently.
1630480	1636500	Matter of fact, their policies are pretty strict about not taking something back out in the public domain once you put it there.
1637900	1640120	So once it's there, it's there.
1641240	1642280	Yes?
1646700	1653440	It really depends on public interest. I don't have an active use for Mosquito, Wes does.
1653720	1663920	It was basically my entertainment here was just getting it out in the open and just basically I wanted to see what everybody thought of the idea and the actual algorithm.
1665080	1669620	Wes, of course, considers it a more usable tool because it's more in his line.
1677120	1678240	Is that all?
1678860	1679880	I guess.
1680220	1682440	Thank you for the loan for the laptop.
1684020	1685620	Thank you for the patience.