WEBVTT 00:06.300 --> 00:09.100 I think that's for real this time. 00:15.390 --> 00:18.090 Can everybody hear me? 00:18.090 --> 00:19.290 Okay. 00:19.770 --> 00:21.950 Thank you for coming. 00:21.950 --> 00:23.190 Good afternoon. 00:23.190 --> 00:28.610 I am Wes Brown, and this is Scott Dunlap, my partner. 00:28.690 --> 00:34.530 And we both do security research as an interest. 00:34.890 --> 00:46.050 And we have previously worked in security industry as penetration testers and security assessment and application assessment and all that. 00:48.150 --> 00:51.210 What is Mosquito? 00:52.250 --> 01:03.570 Mosquito is a lightweight framework to deploy and run code remotely and securely in the context of penetration tests. 01:03.570 --> 01:10.570 It makes a best effort to ensure that the communication is secure. 01:11.050 --> 01:21.170 Special care is taken to ensure that deployed code is not stored outside of process memory space. 01:21.610 --> 01:29.690 It protects the confidentiality and trade secrets of code that is deployed and run on the target. 01:29.690 --> 01:33.610 This could be an exploit or a methodology. 01:33.610 --> 02:00.510 From past experience with working with proprietary zero days, I have hesitated to puddle jump using the exploit because I'm afraid of losing control of the exploit, that somebody could be eavesdropping or somebody could be watching the file system for the exploit. 02:00.870 --> 02:13.970 And I cannot ensure that they can do file recovery on the disk, but this way we can ensure that the exploit only remains in memory, the process space. 02:13.970 --> 02:21.270 At no time is the exploit written to disk unless you swap. 02:22.070 --> 02:26.330 That's one case we can't really control if you force a swap. 02:31.270 --> 02:34.350 I have discussed the why. 02:34.370 --> 02:43.730 Often it is desirable to leverage zero day code, but doing so in an uncontrolled fashion can have repercussions. 02:44.720 --> 02:54.530 Many processes have trade secrets and methodologies distilled in the form of audit and exploit code that they would like to keep out of a target's hands. 02:55.810 --> 03:09.590 Also very important is one problem I've had with many exploits is it transmits data and control information in the clear. 03:09.590 --> 03:17.770 And if I transmit the control and data in the clear, I am endangering my client. 03:19.390 --> 03:29.870 I mean, using Netcat and all that is great, but you're sending your client confidential data over a clear text connection. 03:29.870 --> 03:32.910 So that's one problem I'm hoping to resolve. 03:35.190 --> 03:39.470 Well, here we have a technical overview. 03:39.470 --> 03:47.800 We have written proof-of-concept code to prove that this idea works. 03:48.390 --> 03:51.210 The interpreter is Lua. 03:51.210 --> 03:58.780 Many of you may know Lua as an extension language for games like World of Warcraft. 04:00.160 --> 04:10.920 We use a synchronous cipher called RSA, which all of you know is used for the initial handshaking between the client and server. 04:12.240 --> 04:16.120 It's a computationally expensive operation. 04:16.120 --> 04:32.540 So once handshaking is done, we move to a synchronous cipher called ISAC where we trade a cipher and the clone and drone communicate by a synchronous cipher. 04:33.260 --> 04:37.600 Another component is entropy generation. 04:37.600 --> 04:44.640 Cryptography is worthless without good entropy, without a good pseudorandom number generator. 04:46.200 --> 04:51.160 As you may have figured out, we use a console drone model. 04:52.320 --> 04:56.670 One big plus is this code is extremely portable. 04:56.840 --> 05:05.160 We have personally tested and built on Win32, OpenBSD for Intel 386, and Darwin. 05:05.160 --> 05:11.490 By testing on Darwin, Mac OS X, we have resolved any Indian issues. 05:11.960 --> 05:19.580 By ordering Indian issues between 32-bit, 64-bit, or RISC and CISC platforms. 05:22.320 --> 05:24.590 Why did we pick Lua? 05:25.140 --> 05:28.690 It is a lightweight and powerful procedural language. 05:29.080 --> 05:32.060 It is easily extensible with bindings. 05:32.060 --> 05:36.550 We have created bindings for RSA and OpenSSL. 05:38.140 --> 05:44.120 It is bytecode compiled, which is a plus when you're trying to deploy code. 05:44.580 --> 05:47.160 It is highly portable. 05:47.160 --> 05:50.000 It is written in straight ANSI C. 05:50.280 --> 05:54.540 And it has run on PalmPilot without any changes. 05:55.380 --> 05:57.420 It is easy to learn. 05:57.420 --> 06:01.920 It takes about one hour to learn if you already know a procedural language. 06:04.360 --> 06:08.760 Moving on, we need to talk about the asynchronous cipher. 06:09.760 --> 06:18.960 As I've said before, the asynchronous cipher is used for initial negotiation and handshaking of secure channels. 06:19.420 --> 06:26.640 We pick RSA because it is well known in the cryptographic community. 06:26.920 --> 06:31.700 While it has weaknesses, these weaknesses are known. 06:31.860 --> 06:36.980 And that is more important to us than trying out some new cipher. 06:36.980 --> 06:43.860 We investigated elliptic curve cryptography, and we might enable that. 06:43.860 --> 06:46.220 But RSA is a known quantity. 06:47.680 --> 06:56.140 We use 4096-bit keys for the handshaking, so it is very unlikely that you will crack it. 06:58.000 --> 07:18.000 For the synchronous cipher, we ran into issues when we were looking for a synchronous cipher because many of them had packet problems and packet implementation or copyright problems. 07:18.000 --> 07:22.240 But we found one that we like, and it is ISAC. 07:22.240 --> 07:28.660 It is a synchronous cipher used for console and drone communication, the actual communication itself. 07:28.660 --> 07:37.080 Once the synchronous keys are changed, the stream cipher is one byte at a time. 07:37.080 --> 07:40.640 It is very fast and very safe. 07:42.940 --> 07:52.620 And one of the nice things is we can use a large key, 182-bit, because ISAC does not penalize you for stealing the key. 07:52.620 --> 07:58.640 We could use a 16-bit key, a 32-bit key, and it would make no difference. 07:58.660 --> 08:01.940 To computational performance. 08:04.100 --> 08:18.000 Now, along with the good, we will be remiss as security researchers that we need to talk about the bad things about our proof of concept, and that is entropy generation. 08:18.280 --> 08:22.640 It is essential to good cryptographic security. 08:23.220 --> 08:27.940 The problem is it uses OS facilities for entropy. 08:28.660 --> 08:34.960 The pseudorandom number generator in many operating systems are not very good at all. 08:35.880 --> 08:40.500 But on unit machines, we use devurandom. 08:40.700 --> 08:44.540 How good it is depends on the unit's derivative. 08:44.840 --> 08:47.940 OpenBSD, not surprisingly, is very good. 08:50.080 --> 08:56.620 We use Windows 2000, and HP has a very good cryptographic library. 08:56.620 --> 09:02.960 And because we use the OS facilities as a possible avenue of attack. 09:02.960 --> 09:07.080 We will probably investigate this in more detail. 09:08.980 --> 09:17.060 The cryptography library we're using, LibTomCrypt, has some entropy generation functions, but they are too slow. 09:17.380 --> 09:23.100 When we tested it, it took two minutes to generate entropy. 09:26.780 --> 09:30.760 Mosquito is divided into several components. 09:30.760 --> 09:37.700 We got the core, which provides the basic functionality required by a drone and console. 09:39.140 --> 09:46.660 A drone provides a remote process that contacts a matched console. 09:46.940 --> 09:55.060 And to execute scripts and commands that the console sends to it over the secure channel. 09:55.060 --> 10:01.190 A console provides a local process that controls the deployed drone. 10:01.740 --> 10:08.180 One of the neat features that we put in Mosquito is transport. 10:08.300 --> 10:14.500 And it's an abstracted way to connect the drone and the console. 10:14.500 --> 10:18.020 I'll talk about that more in a bit. 10:19.200 --> 10:21.520 Let's talk about core. 10:21.520 --> 10:29.860 Core is really nothing more than an augmented neural interpreter extended with the following functionalities. 10:29.860 --> 10:40.600 We have RSA encryption functions, ISAC encryption functions, networking functions, entropy gathering functions, and structured buffered functions. 10:42.440 --> 10:48.320 The drone is the Mosquito component that is deployed onto the target machine. 10:48.320 --> 10:56.820 It integrates the core with drone-only functionality, meaning it's a superset of the core. 10:57.980 --> 11:03.480 It executes Lua code sent by secured communication. 11:03.620 --> 11:11.280 And Lua code sent by the console is stored only in process memory. 11:11.280 --> 11:13.500 It is not stored on a disk. 11:15.920 --> 11:23.520 The console is the Mosquito component that provides a local process that controls the deployed drone. 11:24.040 --> 11:28.240 It integrates the core with console-only functionality. 11:28.240 --> 11:30.320 It's a superset of the core. 11:31.560 --> 11:36.340 The user uploads code to the drone by secured communication. 11:37.040 --> 11:44.380 And even more neat is the user can also interact with the drone in real time. 11:44.680 --> 11:48.660 We can interact with the Lua interpreter remotely. 11:48.940 --> 11:54.640 So you can do debugging and you can do code on the fly on the drone. 11:58.100 --> 12:05.300 Transport is an abstract functionality for the console and the drone to communicate with each other. 12:05.300 --> 12:13.580 It transparently negotiates a communication channel between the drone and the console and provides a read and write method. 12:14.260 --> 12:16.580 And read and write are separate. 12:19.100 --> 12:27.640 And it's really neat because we can do different transport methods for different channels. 12:27.640 --> 12:32.260 We have HTTP transport which is implemented by default. 12:32.260 --> 12:42.580 But we have skeleton code to implement DNS transport, ICOMP transport, UDP transport, HTTP transport. 12:42.580 --> 12:53.340 So if you could send HTTP in the pacifier wall but you can only go out by ICOMP, you can do that. 12:53.340 --> 13:00.020 You can send a message by HTTP and go out by ICOMP. 13:00.020 --> 13:03.320 You can mix and match however you want. 13:05.520 --> 13:08.300 Affiliation is handshaking. 13:08.400 --> 13:16.500 It's a process of identifying endpoints as valid to each other that they are who they are. 13:17.580 --> 13:20.760 And it sends a passphrase to each other. 13:20.760 --> 13:28.980 So unless somebody gets a hold of a drone, it's very hard to intercept. 13:30.620 --> 13:38.160 And during the handshaking, they are changing synchronous keys for ISAC. 13:41.480 --> 13:47.180 This is the outline of the flow of console affiliation. 13:47.180 --> 13:49.180 We have... 13:51.960 --> 13:58.960 When console affiliation begins, it starts and waits for the drone to contact it. 13:59.440 --> 14:16.320 And if it times out, we actually have a timeout feature because we don't want it to go for too long where other people may intercept the drone and modify it and then do whatever evil things they want to do with it. 14:17.180 --> 14:22.060 So we would have maybe a one-minute timeout or a 30-second timeout. 14:23.970 --> 14:28.430 And we have a drone in a secret mattress. 14:28.940 --> 14:33.180 It generates the key to send to the drone. 14:33.180 --> 14:37.500 And that's the key that the drone is going to use to send to the console. 14:38.100 --> 14:42.200 And then we got the console affiliation mode. 14:42.540 --> 14:45.220 The drone mode is a little more simple. 14:45.220 --> 14:47.620 It generates the key. 14:47.920 --> 14:51.520 It sends its handshake to the console. 14:51.900 --> 14:55.420 And in that affiliation, it sends its key. 14:55.520 --> 14:58.980 And then it awaits the response from the console. 14:59.020 --> 15:02.120 If it times out, the poop is gone. 15:03.940 --> 15:13.500 And then if the console sequence matches, then it enters operation mode where the console can send Lua commands to the drone. 15:15.900 --> 15:20.360 One of the neatest things about Mosquito is the build environment. 15:20.400 --> 15:25.720 The virtual machine is statically linked for easy deployment in a project. 15:25.740 --> 15:30.260 It's to ensure that all libraries that are needed to function are available. 15:32.140 --> 15:35.000 Gloob is a deep Lua script. 15:35.000 --> 15:51.060 It takes the executable file, the stub, with the binary C code functions like the virtual machine, the interpreter, the socket library, the cryptography library. 15:51.060 --> 15:59.740 And then it will attach the scripts in bytecode format to the end of the executable. 16:00.360 --> 16:11.560 And when the executable runs, it will go through the bytecode and have all the functions defined in the payload. 16:11.720 --> 16:14.720 So there's two ways to get code in the drone. 16:14.720 --> 16:21.640 One is to embed it in the drone, and the other is to send it over the network. 16:22.020 --> 16:30.600 So if you have library functions that you're not concerned about, you can put it in the drone itself and have them available for all penetration tests. 16:31.100 --> 16:34.680 But then you can have exploit functions used for library code. 16:38.280 --> 16:42.800 Now, we have some ways to attack Mosquito. 16:43.040 --> 16:47.660 We have introspective debugging. 16:47.660 --> 16:54.140 If somebody is sitting on the machine with sharp eyes, there's not much we can do about it. 16:55.880 --> 17:00.040 As I've discussed, they use entropy attacks. 17:00.040 --> 17:09.440 And if you are fast enough, you can modify the drone binary itself before it's invoked. 17:09.440 --> 17:21.740 But you have to be very, very quick, because the interval between the drone being deployed and being invoked is very short. 17:21.740 --> 17:24.400 Two, three, four seconds at most. 17:25.290 --> 17:31.460 And, of course, there's always cryptography attacks, known test attacks. 17:33.580 --> 17:36.840 There are some neat uses of the framework. 17:36.840 --> 17:44.800 As is, we can refactor exploits into Lua for security deployment on the target. 17:45.260 --> 17:47.520 It is easily extensible. 17:47.520 --> 17:50.700 Additional cryptographic methods are transformed. 17:52.020 --> 17:56.260 We can write port scan code. 17:56.260 --> 18:00.900 We can write SMB scan code and deploy it on the drone. 18:01.820 --> 18:09.520 So if you deploy the drone, you have all your exploit code, all your functionalities there. 18:11.080 --> 18:21.760 It will also simplify the deployment of auditing tools if you have one VM for all the platforms you attack. 18:23.460 --> 18:27.820 All the dependencies are included with the drone. 18:28.100 --> 18:35.200 When we deploy a drone, we have functions that will detect the target architecture. 18:35.200 --> 18:38.880 Look in the stub library of executables. 18:38.880 --> 18:49.560 We have a Win32 executable, we have a Darwin executable, and then we have an OpenBSD executable. 18:49.560 --> 19:02.120 It will detect that, take the stub, latch on all the Lua library code you want, and on the fly stream it to be deployed. 19:02.120 --> 19:11.400 That's one of the neat things we can use with Glue, because not only is Glue a script, it's also a library function in Mosquito. 19:13.260 --> 19:17.020 We have some future ideas that we could use. 19:17.020 --> 19:23.420 One of the neatest ideas would be an integral high-speed packet snipper and generation in the drone. 19:23.680 --> 19:30.380 That would be great for port scanning or listening to traffic and interpreting the traffic. 19:32.120 --> 19:38.300 One thing that we wanted to do, but weren't able to do yet, was drone-to-drone relay. 19:39.040 --> 19:44.220 You've got the console, you've got the drone, and then you've got another drone. 19:45.120 --> 19:51.320 And the communication is relayed through the drones as many times as you want. 19:51.320 --> 19:59.100 But at no time does any of the drones in between know what's happening at the endpoint drone. 19:59.100 --> 20:02.440 Because we've got nested encryption. 20:02.960 --> 20:14.560 When you've got the endpoint drone sending a... it's got its own key that only the console knows, it's passed and encrypted again and passed and encrypted again. 20:14.560 --> 20:18.320 Remember, ISAT has no penalty. 20:19.040 --> 20:22.460 So you can nest it as many times as you want. 20:23.240 --> 20:30.720 And we would like to do further refinement of the automated configuration and drone console pairs. 20:31.360 --> 20:35.900 And consoles that can manage multiple drones. 20:35.900 --> 20:38.780 Right now we can only manage one drone. 20:41.300 --> 20:42.180 Who are we? 20:42.180 --> 20:43.900 Got work for us? 20:44.860 --> 20:47.100 I'm Wes Brown. 20:47.260 --> 20:51.280 I'm a security consultant and security researcher. 20:51.640 --> 20:57.080 And Scott Dunlop is a software engineer and security researcher. 20:57.340 --> 21:02.960 He's more of a software engineer while I'm more of a consultant type. 21:03.460 --> 21:06.620 We are available in activity-seeking work. 21:06.620 --> 21:12.880 Wes is particularly interested in full-time employment as a security researcher. 21:13.880 --> 21:18.440 We have a website, fmosecurity.com. 21:18.440 --> 21:24.040 Worldwideweb.fmosecurity.com if you want more information. 21:28.460 --> 21:30.730 Got any questions? 21:32.230 --> 21:39.890 Tomorrow we will be putting the entire framework code on SourceForge. 21:39.890 --> 21:42.190 It is under the BSD license. 21:42.190 --> 21:44.630 Feel free to do whatever you want with it. 21:46.790 --> 21:48.710 And that's it. 21:56.690 --> 22:02.710 Scott will be taking the questions because I'm deaf and I can't hear the audience. 22:03.230 --> 22:06.350 We didn't bring any binoculars so we could lip-read. 22:06.830 --> 22:07.910 Yes? 22:11.150 --> 22:14.450 The 0.2 footprint was about 160k. 22:14.450 --> 22:19.490 We hadn't done any optimizations with the C compiler flags. 22:19.490 --> 22:22.870 We were hoping to target for about 80 to 90k. 22:22.870 --> 22:30.450 We were encountering some problems with the fact that we have to bundle most of our dependencies with the actual drone. 22:30.450 --> 22:33.230 We're not making any assumptions about availability of things. 22:33.230 --> 22:41.070 We're just assuming standard C live in the case of Win32, you know, the standard DLLs. 22:41.610 --> 22:46.630 The current 0.3 is a little bit heftier because we put in live TomCrypt. 22:46.630 --> 22:51.370 And a lot of TomCrypt is very easy to strip down. 22:51.370 --> 22:53.290 We just haven't had a chance to do it. 22:55.470 --> 22:56.590 Sure. 23:05.070 --> 23:10.530 We are supplying a general purpose socket library called LuaSocket. 23:12.330 --> 23:22.870 It's not quite performing up to the standard that we'd like, but the goal was to provide the ability to do further network penetration and auditing from the drone. 23:22.890 --> 23:31.770 Very often in audit you have a situation where you've managed to breach an edge system and you need to get deeper in now that you're past the firewall. 23:32.070 --> 23:34.290 And to see where you can go once you've gotten into the bastion. 23:35.170 --> 23:37.030 And that was kind of the purpose of the drone. 23:38.110 --> 23:39.190 Yes. 23:48.590 --> 23:57.830 We certainly kicked around the idea of abusing some of the DRM APIs in Windows XP. 23:57.830 --> 24:00.490 Unfortunately most Unixes don't provide these. 24:00.730 --> 24:06.470 OpenBSD does provide some functionality for preventing writing into swap space. 24:06.890 --> 24:09.930 But that is one of our more major vulnerabilities. 24:09.930 --> 24:14.830 This is a possibility of later analysis of the swap file. 24:22.920 --> 24:26.320 Unfortunately I don't have a console running on Win32. 24:26.320 --> 24:27.800 I haven't linked one. 24:29.040 --> 24:33.940 I've got the Macs, but they're not cooperating with the projector today. 24:34.680 --> 24:36.440 It's very embarrassing. 24:40.790 --> 24:42.670 Oh, I'm sorry. 24:42.690 --> 24:43.550 Yes. 24:51.020 --> 24:55.260 We are relying on libtomcrypt, which is fairly simple. 24:55.260 --> 24:57.180 It's configurable and can be stripped down. 24:57.180 --> 24:59.440 And of course Lua, as you mentioned. 25:01.500 --> 25:06.740 And our only other major dependencies have been just Lua extensions. 25:07.100 --> 25:11.320 The stuff that we've added in, structure buffer and everything else, are actually pretty simple. 25:11.940 --> 25:17.180 If there are buffer overfunds in Lua, that is a problem. 25:17.180 --> 25:19.180 However, the way the construction works... 25:20.320 --> 25:29.320 Once the drone has been deployed, there's a fixed window which is configurable of how long the drone has to contact the console. 25:30.040 --> 25:38.500 The first one to contact and correctly complete affiliation within that window basically gets the connection. 25:38.520 --> 25:46.520 After that, we drop the listen socket and basically we just run with that one transport until it dies. 25:46.520 --> 25:50.900 So buffer overrun exposure is pretty minimal. 25:50.900 --> 25:57.520 As you mentioned, there's always a possibility of someone trying to respond before the affiliation goes through. 25:57.520 --> 26:04.480 But unless there's some kind of very specialized IDS, I don't see that happening. 26:04.840 --> 26:10.720 We were investigating how to deploy this by shellcode. 26:10.720 --> 26:17.760 And if we can do this, then we would have no drone in the file system at all to intercept. 26:17.760 --> 26:23.980 It would be in the process memory of whatever program we buffer overran. 26:29.860 --> 26:31.540 Any other questions? 26:33.780 --> 26:36.720 I've got to cover for a time not having a demo. 26:39.770 --> 26:45.290 Well, you're always free to email the questions to the address over there. 26:46.350 --> 26:54.810 And of course, the code itself will be available for your inspection tomorrow at SourceForge. 26:54.810 --> 26:57.230 We will deploy it to SourceForge. 27:02.480 --> 27:10.460 Well, once you put something on SourceForge, barring intervention by lawyers, it's there pretty much permanently. 27:10.480 --> 27:16.500 Matter of fact, their policies are pretty strict about not taking something back out in the public domain once you put it there. 27:17.900 --> 27:20.120 So once it's there, it's there. 27:21.240 --> 27:22.280 Yes? 27:26.700 --> 27:28.960 It really depends on public interest. 27:28.960 --> 27:33.440 I don't have an active use for Mosquito, Wes does. 27:33.720 --> 27:43.920 It was basically my entertainment here was just getting it out in the open and just basically I wanted to see what everybody thought of the idea and the actual algorithm. 27:45.080 --> 27:49.620 Wes, of course, considers it a more usable tool because it's more in his line. 27:57.120 --> 27:58.240 Is that all? 27:58.860 --> 27:59.880 I guess. 28:00.220 --> 28:02.440 Thank you for the loan for the laptop. 28:04.020 --> 28:05.620 Thank you for the patience.