[00:06.300 --> 00:09.100]  I think that's for real this time.
[00:15.390 --> 00:19.290]  Can everybody hear me? Okay.
[00:19.770 --> 00:23.190]  Thank you for coming. Good afternoon.
[00:23.190 --> 00:28.610]  I am Wes Brown, and this is Scott Dunlap, my partner.
[00:28.690 --> 00:34.530]  And we both do security research as an interest.
[00:34.890 --> 00:39.490]  And we have previously worked in security industry
[00:39.490 --> 00:46.050]  as penetration testers and security assessment and application assessment and all that.
[00:48.150 --> 00:51.210]  What is Mosquito?
[00:52.250 --> 00:59.930]  Mosquito is a lightweight framework to deploy and run code remotely and securely
[00:59.970 --> 01:03.570]  in the context of penetration tests.
[01:03.570 --> 01:10.570]  It makes a best effort to ensure that the communication is secure.
[01:11.050 --> 01:21.170]  Special care is taken to ensure that deployed code is not stored outside of process memory space.
[01:21.610 --> 01:29.690]  It protects the confidentiality and trade secrets of code that is deployed and run on the target.
[01:29.690 --> 01:33.610]  This could be an exploit or a methodology.
[01:33.610 --> 01:40.910]  From past experience with working with proprietary zero days,
[01:41.230 --> 01:47.130]  I have hesitated to puddle jump using the exploit
[01:47.570 --> 01:52.890]  because I'm afraid of losing control of the exploit,
[01:52.890 --> 02:00.510]  that somebody could be eavesdropping or somebody could be watching the file system for the exploit.
[02:00.870 --> 02:06.310]  And I cannot ensure that they can do file recovery on the disk,
[02:06.310 --> 02:13.970]  but this way we can ensure that the exploit only remains in memory, the process space.
[02:13.970 --> 02:21.270]  At no time is the exploit written to disk unless you swap.
[02:22.070 --> 02:26.330]  That's one case we can't really control if you force a swap.
[02:31.270 --> 02:34.350]  I have discussed the why.
[02:34.370 --> 02:43.730]  Often it is desirable to leverage zero day code, but doing so in an uncontrolled fashion can have repercussions.
[02:44.720 --> 02:51.010]  Many processes have trade secrets and methodologies distilled in the form of audit and exploit code
[02:51.010 --> 02:54.530]  that they would like to keep out of a target's hands.
[02:55.810 --> 03:03.950]  Also very important is one problem I've had with many exploits
[03:03.950 --> 03:09.590]  is it transmits data and control information in the clear.
[03:09.590 --> 03:17.770]  And if I transmit the control and data in the clear, I am endangering my client.
[03:19.390 --> 03:29.870]  I mean, using Netcat and all that is great, but you're sending your client confidential data over a clear text connection.
[03:29.870 --> 03:32.910]  So that's one problem I'm hoping to resolve.
[03:35.190 --> 03:39.470]  Well, here we have a technical overview.
[03:39.470 --> 03:47.800]  We have written proof-of-concept code to prove that this idea works.
[03:48.390 --> 03:51.210]  The interpreter is Lua.
[03:51.210 --> 03:58.780]  Many of you may know Lua as an extension language for games like World of Warcraft.
[04:00.160 --> 04:10.920]  We use a synchronous cipher called RSA, which all of you know is used for the initial handshaking between the client and server.
[04:12.240 --> 04:16.120]  It's a computationally expensive operation.
[04:16.120 --> 04:22.320]  So once handshaking is done, we move to a synchronous cipher called ISAC
[04:23.320 --> 04:32.540]  where we trade a cipher and the clone and drone communicate by a synchronous cipher.
[04:33.260 --> 04:37.600]  Another component is entropy generation.
[04:37.600 --> 04:44.640]  Cryptography is worthless without good entropy, without a good pseudorandom number generator.
[04:46.200 --> 04:51.160]  As you may have figured out, we use a console drone model.
[04:52.320 --> 04:56.670]  One big plus is this code is extremely portable.
[04:56.840 --> 05:05.160]  We have personally tested and built on Win32, OpenBSD for Intel 386, and Darwin.
[05:05.160 --> 05:11.490]  By testing on Darwin, Mac OS X, we have resolved any Indian issues.
[05:11.960 --> 05:19.580]  By ordering Indian issues between 32-bit, 64-bit, or RISC and CISC platforms.
[05:22.320 --> 05:24.590]  Why did we pick Lua?
[05:25.140 --> 05:28.690]  It is a lightweight and powerful procedural language.
[05:29.080 --> 05:32.060]  It is easily extensible with bindings.
[05:32.060 --> 05:36.550]  We have created bindings for RSA and OpenSSL.
[05:38.140 --> 05:44.120]  It is bytecode compiled, which is a plus when you're trying to deploy code.
[05:44.580 --> 05:47.160]  It is highly portable.
[05:47.160 --> 05:50.000]  It is written in straight ANSI C.
[05:50.280 --> 05:54.540]  And it has run on PalmPilot without any changes.
[05:55.380 --> 05:57.420]  It is easy to learn.
[05:57.420 --> 06:01.920]  It takes about one hour to learn if you already know a procedural language.
[06:04.360 --> 06:08.760]  Moving on, we need to talk about the asynchronous cipher.
[06:09.760 --> 06:18.960]  As I've said before, the asynchronous cipher is used for initial negotiation and handshaking of secure channels.
[06:19.420 --> 06:26.640]  We pick RSA because it is well known in the cryptographic community.
[06:26.920 --> 06:31.700]  While it has weaknesses, these weaknesses are known.
[06:31.860 --> 06:36.980]  And that is more important to us than trying out some new cipher.
[06:36.980 --> 06:43.860]  We investigated elliptic curve cryptography, and we might enable that.
[06:43.860 --> 06:46.220]  But RSA is a known quantity.
[06:47.680 --> 06:56.140]  We use 4096-bit keys for the handshaking, so it is very unlikely that you will crack it.
[06:58.000 --> 07:04.340]  For the synchronous cipher, we ran into issues when we were looking for a synchronous cipher
[07:04.340 --> 07:18.000]  because many of them had packet problems and packet implementation or copyright problems.
[07:18.000 --> 07:22.240]  But we found one that we like, and it is ISAC.
[07:22.240 --> 07:28.660]  It is a synchronous cipher used for console and drone communication, the actual communication itself.
[07:28.660 --> 07:37.080]  Once the synchronous keys are changed, the stream cipher is one byte at a time.
[07:37.080 --> 07:40.640]  It is very fast and very safe.
[07:42.940 --> 07:52.620]  And one of the nice things is we can use a large key, 182-bit, because ISAC does not penalize you for stealing the key.
[07:52.620 --> 07:58.640]  We could use a 16-bit key, a 32-bit key, and it would make no difference.
[07:58.660 --> 08:01.940]  To computational performance.
[08:04.100 --> 08:15.800]  Now, along with the good, we will be remiss as security researchers that we need to talk about the bad things about our proof of concept,
[08:15.800 --> 08:18.000]  and that is entropy generation.
[08:18.280 --> 08:22.640]  It is essential to good cryptographic security.
[08:23.220 --> 08:27.940]  The problem is it uses OS facilities for entropy.
[08:28.660 --> 08:34.960]  The pseudorandom number generator in many operating systems are not very good at all.
[08:35.880 --> 08:40.500]  But on unit machines, we use devurandom.
[08:40.700 --> 08:44.540]  How good it is depends on the unit's derivative.
[08:44.840 --> 08:47.940]  OpenBSD, not surprisingly, is very good.
[08:50.080 --> 08:56.620]  We use Windows 2000, and HP has a very good cryptographic library.
[08:56.620 --> 09:02.960]  And because we use the OS facilities as a possible avenue of attack.
[09:02.960 --> 09:07.080]  We will probably investigate this in more detail.
[09:08.980 --> 09:17.060]  The cryptography library we're using, LibTomCrypt, has some entropy generation functions, but they are too slow.
[09:17.380 --> 09:23.100]  When we tested it, it took two minutes to generate entropy.
[09:26.780 --> 09:30.760]  Mosquito is divided into several components.
[09:30.760 --> 09:37.700]  We got the core, which provides the basic functionality required by a drone and console.
[09:39.140 --> 09:46.660]  A drone provides a remote process that contacts a matched console.
[09:46.940 --> 09:55.060]  And to execute scripts and commands that the console sends to it over the secure channel.
[09:55.060 --> 10:01.190]  A console provides a local process that controls the deployed drone.
[10:01.740 --> 10:08.180]  One of the neat features that we put in Mosquito is transport.
[10:08.300 --> 10:14.500]  And it's an abstracted way to connect the drone and the console.
[10:14.500 --> 10:18.020]  I'll talk about that more in a bit.
[10:19.200 --> 10:21.520]  Let's talk about core.
[10:21.520 --> 10:29.860]  Core is really nothing more than an augmented neural interpreter extended with the following functionalities.
[10:29.860 --> 10:40.600]  We have RSA encryption functions, ISAC encryption functions, networking functions, entropy gathering functions, and structured buffered functions.
[10:42.440 --> 10:48.320]  The drone is the Mosquito component that is deployed onto the target machine.
[10:48.320 --> 10:56.820]  It integrates the core with drone-only functionality, meaning it's a superset of the core.
[10:57.980 --> 11:03.480]  It executes Lua code sent by secured communication.
[11:03.620 --> 11:11.280]  And Lua code sent by the console is stored only in process memory.
[11:11.280 --> 11:13.500]  It is not stored on a disk.
[11:15.920 --> 11:23.520]  The console is the Mosquito component that provides a local process that controls the deployed drone.
[11:24.040 --> 11:30.320]  It integrates the core with console-only functionality. It's a superset of the core.
[11:31.560 --> 11:36.340]  The user uploads code to the drone by secured communication.
[11:37.040 --> 11:44.380]  And even more neat is the user can also interact with the drone in real time.
[11:44.680 --> 11:48.660]  We can interact with the Lua interpreter remotely.
[11:48.940 --> 11:54.640]  So you can do debugging and you can do code on the fly on the drone.
[11:58.100 --> 12:05.300]  Transport is an abstract functionality for the console and the drone to communicate with each other.
[12:05.300 --> 12:13.580]  It transparently negotiates a communication channel between the drone and the console and provides a read and write method.
[12:14.260 --> 12:16.580]  And read and write are separate.
[12:19.100 --> 12:27.640]  And it's really neat because we can do different transport methods for different channels.
[12:27.640 --> 12:32.260]  We have HTTP transport which is implemented by default.
[12:32.260 --> 12:42.580]  But we have skeleton code to implement DNS transport, ICOMP transport, UDP transport, HTTP transport.
[12:42.580 --> 12:53.340]  So if you could send HTTP in the pacifier wall but you can only go out by ICOMP, you can do that.
[12:53.340 --> 13:00.020]  You can send a message by HTTP and go out by ICOMP.
[13:00.020 --> 13:03.320]  You can mix and match however you want.
[13:05.520 --> 13:08.300]  Affiliation is handshaking.
[13:08.400 --> 13:16.500]  It's a process of identifying endpoints as valid to each other that they are who they are.
[13:17.580 --> 13:20.760]  And it sends a passphrase to each other.
[13:20.760 --> 13:28.980]  So unless somebody gets a hold of a drone, it's very hard to intercept.
[13:30.620 --> 13:38.160]  And during the handshaking, they are changing synchronous keys for ISAC.
[13:41.480 --> 13:47.180]  This is the outline of the flow of console affiliation.
[13:47.180 --> 13:49.180]  We have...
[13:51.960 --> 13:58.960]  When console affiliation begins, it starts and waits for the drone to contact it.
[13:59.440 --> 14:08.620]  And if it times out, we actually have a timeout feature because we don't want it to go for too long
[14:08.620 --> 14:16.320]  where other people may intercept the drone and modify it and then do whatever evil things they want to do with it.
[14:17.180 --> 14:22.060]  So we would have maybe a one-minute timeout or a 30-second timeout.
[14:23.970 --> 14:28.430]  And we have a drone in a secret mattress.
[14:28.940 --> 14:33.180]  It generates the key to send to the drone.
[14:33.180 --> 14:37.500]  And that's the key that the drone is going to use to send to the console.
[14:38.100 --> 14:42.200]  And then we got the console affiliation mode.
[14:42.540 --> 14:45.220]  The drone mode is a little more simple.
[14:45.220 --> 14:47.620]  It generates the key.
[14:47.920 --> 14:51.520]  It sends its handshake to the console.
[14:51.900 --> 14:55.420]  And in that affiliation, it sends its key.
[14:55.520 --> 14:58.980]  And then it awaits the response from the console.
[14:59.020 --> 15:02.120]  If it times out, the poop is gone.
[15:03.940 --> 15:09.520]  And then if the console sequence matches, then it enters operation mode
[15:09.520 --> 15:13.500]  where the console can send Lua commands to the drone.
[15:15.900 --> 15:20.360]  One of the neatest things about Mosquito is the build environment.
[15:20.400 --> 15:25.720]  The virtual machine is statically linked for easy deployment in a project.
[15:25.740 --> 15:30.260]  It's to ensure that all libraries that are needed to function are available.
[15:32.140 --> 15:35.000]  Gloob is a deep Lua script.
[15:35.000 --> 15:41.220]  It takes the executable file, the stub, with the binary C code functions
[15:41.220 --> 15:51.060]  like the virtual machine, the interpreter, the socket library, the cryptography library.
[15:51.060 --> 15:59.740]  And then it will attach the scripts in bytecode format to the end of the executable.
[16:00.360 --> 16:05.560]  And when the executable runs, it will go through the bytecode
[16:05.560 --> 16:11.560]  and have all the functions defined in the payload.
[16:11.720 --> 16:14.720]  So there's two ways to get code in the drone.
[16:14.720 --> 16:21.640]  One is to embed it in the drone, and the other is to send it over the network.
[16:22.020 --> 16:25.580]  So if you have library functions that you're not concerned about,
[16:25.580 --> 16:30.600]  you can put it in the drone itself and have them available for all penetration tests.
[16:31.100 --> 16:34.680]  But then you can have exploit functions used for library code.
[16:38.280 --> 16:42.800]  Now, we have some ways to attack Mosquito.
[16:43.040 --> 16:47.660]  We have introspective debugging.
[16:47.660 --> 16:54.140]  If somebody is sitting on the machine with sharp eyes, there's not much we can do about it.
[16:55.880 --> 17:00.040]  As I've discussed, they use entropy attacks.
[17:00.040 --> 17:09.440]  And if you are fast enough, you can modify the drone binary itself before it's invoked.
[17:09.440 --> 17:21.740]  But you have to be very, very quick, because the interval between the drone being deployed and being invoked is very short.
[17:21.740 --> 17:24.400]  Two, three, four seconds at most.
[17:25.290 --> 17:31.460]  And, of course, there's always cryptography attacks, known test attacks.
[17:33.580 --> 17:36.840]  There are some neat uses of the framework.
[17:36.840 --> 17:44.800]  As is, we can refactor exploits into Lua for security deployment on the target.
[17:45.260 --> 17:47.520]  It is easily extensible.
[17:47.520 --> 17:50.700]  Additional cryptographic methods are transformed.
[17:52.020 --> 17:56.260]  We can write port scan code.
[17:56.260 --> 18:00.900]  We can write SMB scan code and deploy it on the drone.
[18:01.820 --> 18:09.520]  So if you deploy the drone, you have all your exploit code, all your functionalities there.
[18:11.080 --> 18:21.760]  It will also simplify the deployment of auditing tools if you have one VM for all the platforms you attack.
[18:23.460 --> 18:27.820]  All the dependencies are included with the drone.
[18:28.100 --> 18:35.200]  When we deploy a drone, we have functions that will detect the target architecture.
[18:35.200 --> 18:38.880]  Look in the stub library of executables.
[18:38.880 --> 18:49.560]  We have a Win32 executable, we have a Darwin executable, and then we have an OpenBSD executable.
[18:49.560 --> 19:02.120]  It will detect that, take the stub, latch on all the Lua library code you want, and on the fly stream it to be deployed.
[19:02.120 --> 19:11.400]  That's one of the neat things we can use with Glue, because not only is Glue a script, it's also a library function in Mosquito.
[19:13.260 --> 19:17.020]  We have some future ideas that we could use.
[19:17.020 --> 19:23.420]  One of the neatest ideas would be an integral high-speed packet snipper and generation in the drone.
[19:23.680 --> 19:30.380]  That would be great for port scanning or listening to traffic and interpreting the traffic.
[19:32.120 --> 19:38.300]  One thing that we wanted to do, but weren't able to do yet, was drone-to-drone relay.
[19:39.040 --> 19:44.220]  You've got the console, you've got the drone, and then you've got another drone.
[19:45.120 --> 19:51.320]  And the communication is relayed through the drones as many times as you want.
[19:51.320 --> 19:59.100]  But at no time does any of the drones in between know what's happening at the endpoint drone.
[19:59.100 --> 20:02.440]  Because we've got nested encryption.
[20:02.960 --> 20:14.560]  When you've got the endpoint drone sending a... it's got its own key that only the console knows, it's passed and encrypted again and passed and encrypted again.
[20:14.560 --> 20:18.320]  Remember, ISAT has no penalty.
[20:19.040 --> 20:22.460]  So you can nest it as many times as you want.
[20:23.240 --> 20:30.720]  And we would like to do further refinement of the automated configuration and drone console pairs.
[20:31.360 --> 20:38.780]  And consoles that can manage multiple drones. Right now we can only manage one drone.
[20:41.300 --> 20:43.900]  Who are we? Got work for us?
[20:44.860 --> 20:51.280]  I'm Wes Brown. I'm a security consultant and security researcher.
[20:51.640 --> 20:57.080]  And Scott Dunlop is a software engineer and security researcher.
[20:57.340 --> 21:02.960]  He's more of a software engineer while I'm more of a consultant type.
[21:03.460 --> 21:12.880]  We are available in activity-seeking work. Wes is particularly interested in full-time employment as a security researcher.
[21:13.880 --> 21:18.440]  We have a website, fmosecurity.com.
[21:18.440 --> 21:24.040]  Worldwideweb.fmosecurity.com if you want more information.
[21:28.460 --> 21:30.730]  Got any questions?
[21:32.230 --> 21:39.890]  Tomorrow we will be putting the entire framework code on SourceForge.
[21:39.890 --> 21:44.630]  It is under the BSD license. Feel free to do whatever you want with it.
[21:46.790 --> 21:48.710]  And that's it.
[21:56.690 --> 22:02.710]  Scott will be taking the questions because I'm deaf and I can't hear the audience.
[22:03.230 --> 22:06.350]  We didn't bring any binoculars so we could lip-read.
[22:06.830 --> 22:07.910]  Yes?
[22:11.150 --> 22:19.490]  The 0.2 footprint was about 160k. We hadn't done any optimizations with the C compiler flags.
[22:19.490 --> 22:22.870]  We were hoping to target for about 80 to 90k.
[22:22.870 --> 22:30.450]  We were encountering some problems with the fact that we have to bundle most of our dependencies with the actual drone.
[22:30.450 --> 22:33.230]  We're not making any assumptions about availability of things.
[22:33.230 --> 22:41.070]  We're just assuming standard C live in the case of Win32, you know, the standard DLLs.
[22:41.610 --> 22:46.630]  The current 0.3 is a little bit heftier because we put in live TomCrypt.
[22:46.630 --> 22:53.290]  And a lot of TomCrypt is very easy to strip down. We just haven't had a chance to do it.
[22:55.470 --> 22:56.590]  Sure.
[23:05.070 --> 23:10.530]  We are supplying a general purpose socket library called LuaSocket.
[23:12.330 --> 23:22.870]  It's not quite performing up to the standard that we'd like, but the goal was to provide the ability to do further network penetration and auditing from the drone.
[23:22.890 --> 23:31.770]  Very often in audit you have a situation where you've managed to breach an edge system and you need to get deeper in now that you're past the firewall.
[23:32.070 --> 23:34.290]  And to see where you can go once you've gotten into the bastion.
[23:35.170 --> 23:37.030]  And that was kind of the purpose of the drone.
[23:38.110 --> 23:39.190]  Yes.
[23:48.590 --> 23:57.830]  We certainly kicked around the idea of abusing some of the DRM APIs in Windows XP.
[23:57.830 --> 24:00.490]  Unfortunately most Unixes don't provide these.
[24:00.730 --> 24:06.470]  OpenBSD does provide some functionality for preventing writing into swap space.
[24:06.890 --> 24:09.930]  But that is one of our more major vulnerabilities.
[24:09.930 --> 24:14.830]  This is a possibility of later analysis of the swap file.
[24:22.920 --> 24:27.800]  Unfortunately I don't have a console running on Win32. I haven't linked one.
[24:29.040 --> 24:33.940]  I've got the Macs, but they're not cooperating with the projector today.
[24:34.680 --> 24:36.440]  It's very embarrassing.
[24:40.790 --> 24:43.550]  Oh, I'm sorry. Yes.
[24:51.020 --> 24:57.180]  We are relying on libtomcrypt, which is fairly simple. It's configurable and can be stripped down.
[24:57.180 --> 24:59.440]  And of course Lua, as you mentioned.
[25:01.500 --> 25:06.740]  And our only other major dependencies have been just Lua extensions.
[25:07.100 --> 25:11.320]  The stuff that we've added in, structure buffer and everything else, are actually pretty simple.
[25:11.940 --> 25:17.180]  If there are buffer overfunds in Lua, that is a problem.
[25:17.180 --> 25:19.180]  However, the way the construction works...
[25:20.320 --> 25:29.320]  Once the drone has been deployed, there's a fixed window which is configurable of how long the drone has to contact the console.
[25:30.040 --> 25:38.500]  The first one to contact and correctly complete affiliation within that window basically gets the connection.
[25:38.520 --> 25:46.520]  After that, we drop the listen socket and basically we just run with that one transport until it dies.
[25:46.520 --> 25:50.900]  So buffer overrun exposure is pretty minimal.
[25:50.900 --> 25:57.520]  As you mentioned, there's always a possibility of someone trying to respond before the affiliation goes through.
[25:57.520 --> 26:04.480]  But unless there's some kind of very specialized IDS, I don't see that happening.
[26:04.840 --> 26:10.720]  We were investigating how to deploy this by shellcode.
[26:10.720 --> 26:17.760]  And if we can do this, then we would have no drone in the file system at all to intercept.
[26:17.760 --> 26:23.980]  It would be in the process memory of whatever program we buffer overran.
[26:29.860 --> 26:31.540]  Any other questions?
[26:33.780 --> 26:36.720]  I've got to cover for a time not having a demo.
[26:39.770 --> 26:45.290]  Well, you're always free to email the questions to the address over there.
[26:46.350 --> 26:54.810]  And of course, the code itself will be available for your inspection tomorrow at SourceForge.
[26:54.810 --> 26:57.230]  We will deploy it to SourceForge.
[27:02.480 --> 27:10.460]  Well, once you put something on SourceForge, barring intervention by lawyers, it's there pretty much permanently.
[27:10.480 --> 27:16.500]  Matter of fact, their policies are pretty strict about not taking something back out in the public domain once you put it there.
[27:17.900 --> 27:20.120]  So once it's there, it's there.
[27:21.240 --> 27:22.280]  Yes?
[27:26.700 --> 27:33.440]  It really depends on public interest. I don't have an active use for Mosquito, Wes does.
[27:33.720 --> 27:43.920]  It was basically my entertainment here was just getting it out in the open and just basically I wanted to see what everybody thought of the idea and the actual algorithm.
[27:45.080 --> 27:49.620]  Wes, of course, considers it a more usable tool because it's more in his line.
[27:57.120 --> 27:58.240]  Is that all?
[27:58.860 --> 27:59.880]  I guess.
[28:00.220 --> 28:02.440]  Thank you for the loan for the laptop.
[28:04.020 --> 28:05.620]  Thank you for the patience.