1 00:00:00,000 --> 00:00:00,459 WESLEY McGREW: Are you all going to throw your hands 2 00:00:00,459 --> 00:00:01,584 up at the drop? 3 00:00:01,584 --> 00:00:04,250 MODERATOR: How is everybody doing this afternoon? 4 00:00:04,250 --> 00:00:05,250 Really? 5 00:00:05,250 --> 00:00:05,250 (Cheers and yelling.) MODERATOR: This 6 00:00:05,250 --> 00:00:06,250 is Pwn the Pwn Plug. 7 00:00:06,250 --> 00:00:07,501 I hope I said that right. 8 00:00:07,501 --> 00:00:08,999 Wesley, give him a big hand! 9 00:00:08,999 --> 00:00:12,417 (Applause.) WESLEY McGREW: Thank you. 10 00:00:12,417 --> 00:00:16,834 How many of y'all out there have been basically emptying 11 00:00:16,834 --> 00:00:23,042 the vendor area out of these devices, Pwn Plugs, pineapples, I have 12 00:00:23,042 --> 00:00:25,584 to watch my Ps. 13 00:00:25,584 --> 00:00:29,834 They have this thing called a Rutabaga, Mini Pwners. 14 00:00:29,959 --> 00:00:32,334 How many of you have been buying these things? 15 00:00:32,375 --> 00:00:33,375 Make some noise. 16 00:00:33,375 --> 00:00:35,792 (Yelling.) WESLEY McGREW: How many of you 17 00:00:35,792 --> 00:00:38,834 will be using those for good? 18 00:00:38,999 --> 00:00:43,792 (Chuckles.) WESLEY McGREW: How about for evil? 19 00:00:45,792 --> 00:00:48,334 (Cheers.) WESLEY McGREW: There are people doing bad things 20 00:00:48,334 --> 00:00:50,042 with these things. 21 00:00:51,999 --> 00:00:54,959 That's why for those of you using these 22 00:00:54,959 --> 00:00:59,626 for good and evil may want to be careful when and where you turn 23 00:00:59,626 --> 00:01:01,209 these on. 24 00:01:01,999 --> 00:01:04,667 The talk is Pwn the Pwn Plug: Analyzing 25 00:01:04,667 --> 00:01:08,292 and Counter-Attacking Implanted Devices. 26 00:01:12,709 --> 00:01:14,999 My name is Wesley McGrew. 27 00:01:14,999 --> 00:01:20,959 I'm essentially the elder states man of the Mississippi State contingent 28 00:01:20,959 --> 00:01:25,083 here, effectively DC662, Mississippi state folks make 29 00:01:25,083 --> 00:01:27,334 a little noise. 30 00:01:27,876 --> 00:01:31,959 (Applause.) WESLEY McGREW: Cool. 31 00:01:32,083 --> 00:01:36,083 I'm an assistant research professor at the Mississippi State University 32 00:01:36,083 --> 00:01:40,292 and run McGrewSecurity.com and the McGrew Security Twitter account 33 00:01:40,292 --> 00:01:43,334 that you all followed last week. 34 00:01:45,083 --> 00:01:47,375 What I do, I break things. 35 00:01:47,918 --> 00:01:49,999 I love breaking things. 36 00:01:49,999 --> 00:01:52,999 And I'm occasionally good at it. 37 00:01:53,167 --> 00:01:56,999 So I'm into any kind of vulnerability analysis, any kind 38 00:01:56,999 --> 00:01:59,083 of exploit stuff. 39 00:01:59,292 --> 00:02:02,918 I don't care what it is, I want to find the problems with it. 40 00:02:03,083 --> 00:02:04,876 I'm into reverse engineering. 41 00:02:04,876 --> 00:02:07,792 I teach a reverse engineering class at Mississippi state that went really well 42 00:02:07,792 --> 00:02:09,417 in the spring. 43 00:02:09,751 --> 00:02:12,999 I also have been involved in the National Forensics Training 44 00:02:12,999 --> 00:02:16,417 Center which teaches free forensic classes to law enforcement 45 00:02:16,417 --> 00:02:18,626 and wounded veterans. 46 00:02:19,083 --> 00:02:21,918 I have my Ph.D. 47 00:02:21,999 --> 00:02:23,083 now. 48 00:02:23,459 --> 00:02:25,292 For everybody who keeps bugging me every year at DEF CON 49 00:02:25,292 --> 00:02:27,083 to finish my paper. 50 00:02:27,501 --> 00:02:31,667 That prepared me for the new role as the 12th doctor. 51 00:02:33,334 --> 00:02:37,501 In the meantime, I'm a professor at Mississippi State University, 52 00:02:37,501 --> 00:02:40,999 leading the charge on doing some cool offensive breaking 53 00:02:40,999 --> 00:02:43,375 things type research. 54 00:02:44,209 --> 00:02:47,083 What we are going to be talking about today are attacker 55 00:02:47,083 --> 00:02:49,083 implantable devices. 56 00:02:49,083 --> 00:02:54,667 This is a sort of term I sort of apply to a wide variety of things. 57 00:02:54,999 --> 00:02:59,083 There's a crisis of terminology for these things right now. 58 00:02:59,334 --> 00:03:03,083 The traditional name for these are a Dropbox. 59 00:03:03,083 --> 00:03:04,709 And unfortunately, there's a really bad name collision 60 00:03:04,709 --> 00:03:06,501 with that right now. 61 00:03:06,542 --> 00:03:08,876 (Chuckles.) WESLEY McGREW: The storage guys kind 62 00:03:08,876 --> 00:03:11,083 of took that one from us. 63 00:03:11,167 --> 00:03:13,542 What I'm talking about are all these kind 64 00:03:13,542 --> 00:03:17,959 of all in one embeddable type things that you can buy over there 65 00:03:17,959 --> 00:03:22,083 in the vendor area, things like the Pwn Plug, the power strip, 66 00:03:22,083 --> 00:03:25,876 the pwn whatever they call that one now. 67 00:03:26,459 --> 00:03:29,083 The Pwn Plug R2 that just got released. 68 00:03:29,167 --> 00:03:32,125 I haven't had a chance to get hold of it. 69 00:03:32,125 --> 00:03:33,292 The Pwn Pads. 70 00:03:33,584 --> 00:03:38,417 You have TP link router devices like you see that can run stripped 71 00:03:38,417 --> 00:03:41,667 down versions of open work. 72 00:03:41,999 --> 00:03:44,334 And finally Raspberry Pi. 73 00:03:44,417 --> 00:03:48,626 These new arm sort of credit card size computers are 74 00:03:48,626 --> 00:03:53,542 perfect platforms for this sort of activity. 75 00:03:53,542 --> 00:03:56,250 So there's a basically a pwn OS type thing 76 00:03:56,250 --> 00:03:59,083 for the Raspberry Pi. 77 00:03:59,083 --> 00:04:00,876 I presume it is probably called the Raspberry Pwn, 78 00:04:00,876 --> 00:04:03,125 but I can't remember right now. 79 00:04:04,417 --> 00:04:08,250 What they have in common, they are small and what I call attacker 80 00:04:08,250 --> 00:04:11,417 implantable, whether you're a pentester or attacker, 81 00:04:11,417 --> 00:04:16,834 you can take these and hide them pretty much anywhere in an organization. 82 00:04:16,999 --> 00:04:19,083 You can use that as sort of your in. 83 00:04:19,083 --> 00:04:23,667 You can use it to sniff packets, use it to launch attacks from. 84 00:04:24,083 --> 00:04:25,999 And it's basically a do it yourself pivot point 85 00:04:25,999 --> 00:04:29,584 in case you suck at phishing and things like that. 86 00:04:32,292 --> 00:04:35,667 These things have applications for both penetration testers 87 00:04:35,667 --> 00:04:37,999 and malicious attackers. 88 00:04:37,999 --> 00:04:40,501 I'm sure all the folks that sell you these things want you to be 89 00:04:40,501 --> 00:04:42,501 a penetration tester. 90 00:04:42,542 --> 00:04:45,751 There's something to be said for somebody maliciously using one 91 00:04:45,751 --> 00:04:47,667 of these things. 92 00:04:47,834 --> 00:04:50,375 So the question here, one question, if we are a good guy, 93 00:04:50,375 --> 00:04:52,999 how do we respond to one of these that we find 94 00:04:52,999 --> 00:04:54,999 in our organization? 95 00:04:54,999 --> 00:04:57,999 So we find a new toy in our server room that we did not 96 00:04:57,999 --> 00:05:01,083 purchase from Pwnie Express. 97 00:05:01,459 --> 00:05:02,999 How did this get here? 98 00:05:03,334 --> 00:05:04,751 Who is running it? 99 00:05:04,751 --> 00:05:06,417 What is it doing to my network? 100 00:05:06,709 --> 00:05:10,459 And also for both good and bad guys, what are the implications 101 00:05:10,459 --> 00:05:14,375 of there being vulnerabilities in these devices? 102 00:05:14,959 --> 00:05:18,999 If I'm a penetration tester what does it mean for my penetration testing tools 103 00:05:18,999 --> 00:05:21,999 to get attacked and compromised and persistent compromise 104 00:05:21,999 --> 00:05:24,334 over a long period of time. 105 00:05:24,334 --> 00:05:28,542 If I'm an organization that found these that malicious attackers installed, 106 00:05:28,542 --> 00:05:30,999 can I counter attack it? 107 00:05:30,999 --> 00:05:31,999 Why not? 108 00:05:32,167 --> 00:05:36,959 Assuming all the legal considerations are in order, we don't have 109 00:05:36,959 --> 00:05:42,667 the same sort of problems with attribution of attack at this point. 110 00:05:42,667 --> 00:05:44,999 It's not like we are counter attacking some random IP address somewhere 111 00:05:44,999 --> 00:05:49,209 else on the Internet and we don't know if that's a hot point or not. 112 00:05:49,417 --> 00:05:51,709 If three a Pwn Plug or some Raspberry Pi 113 00:05:51,709 --> 00:05:55,999 plugged into our network inside our building that we don't know 114 00:05:55,999 --> 00:06:00,292 about, that's obviously something we can attack. 115 00:06:00,292 --> 00:06:01,292 Why not? 116 00:06:01,999 --> 00:06:04,167 I say why not. 117 00:06:04,167 --> 00:06:07,999 So this slide is basically on identification. 118 00:06:07,999 --> 00:06:09,083 I'm not going to go into all the different ways 119 00:06:09,083 --> 00:06:11,999 of identifying one of these on your network. 120 00:06:12,834 --> 00:06:14,999 Honestly, if you have proper network access 121 00:06:14,999 --> 00:06:18,334 and control and monitoring in place and everything, you see one 122 00:06:18,334 --> 00:06:21,083 of these things pop up the first time it starts doing 123 00:06:21,083 --> 00:06:22,999 anything noisy. 124 00:06:23,417 --> 00:06:27,417 Physically, they are meant to be sort of inconspicuous, 125 00:06:27,417 --> 00:06:31,876 but to the trained eye it is not so much. 126 00:06:31,876 --> 00:06:33,250 So you look at these things. 127 00:06:33,250 --> 00:06:34,876 Those are the two stickers that come 128 00:06:34,876 --> 00:06:36,959 with the Pwn Plug. 129 00:06:37,209 --> 00:06:39,792 And one of them has a reference to SSH on it. 130 00:06:39,792 --> 00:06:42,083 The other one is a printer power supply. 131 00:06:42,083 --> 00:06:45,083 I think that's the best application for the Pwn Plug itself. 132 00:06:45,083 --> 00:06:46,999 It looks like a printer power supply. 133 00:06:46,999 --> 00:06:49,334 Part of its part number is 1337. 134 00:06:49,876 --> 00:06:53,125 (Laughter.) WESLEY McGREW: Actually, now that I look at the picture, 135 00:06:53,125 --> 00:06:56,083 I'm not sure what the bar code it. 136 00:06:56,083 --> 00:06:58,918 It is probably for a pack of skill else or something. 137 00:06:58,918 --> 00:06:59,918 Who knows. 138 00:07:00,999 --> 00:07:04,334 But so if you're going to be a pentester using these things or better, 139 00:07:04,334 --> 00:07:06,918 if you're a malicious attacker using these things, 140 00:07:06,918 --> 00:07:09,125 print up your own stickers. 141 00:07:09,125 --> 00:07:13,542 Get an HP printer power supply and run that off of it. 142 00:07:13,999 --> 00:07:17,167 If you found these things, that's cause for concern. 143 00:07:17,167 --> 00:07:18,167 What do we do? 144 00:07:18,417 --> 00:07:19,999 We can respond to it. 145 00:07:20,083 --> 00:07:23,709 The first thing here, I just love this picture because Ryker 146 00:07:23,709 --> 00:07:26,083 is hosting this thing. 147 00:07:26,083 --> 00:07:27,334 I forgot about that. 148 00:07:27,999 --> 00:07:31,250 First thing we want to do is pick this thing apart. 149 00:07:31,250 --> 00:07:32,501 What's going on with it? 150 00:07:32,626 --> 00:07:35,083 We want to seize this thing. 151 00:07:35,083 --> 00:07:36,999 We want to image it and forensicate it. 152 00:07:38,292 --> 00:07:41,083 What has it compromised already? 153 00:07:41,375 --> 00:07:42,999 If we can find that out. 154 00:07:43,083 --> 00:07:45,999 We want to attribute this to somebody. 155 00:07:45,999 --> 00:07:48,375 Is this somebody inside our organization who is trying 156 00:07:48,375 --> 00:07:51,083 to do their own sort of unauthorized pentest 157 00:07:51,083 --> 00:07:53,999 but they have good intentions? 158 00:07:53,999 --> 00:07:56,417 Is it somebody who managed to sneak in? 159 00:07:56,417 --> 00:07:58,918 Do we have a physical security problem now too? 160 00:07:58,959 --> 00:08:02,083 We want to get this information back. 161 00:08:02,083 --> 00:08:04,999 There's a good chance with these devices that you can find, 162 00:08:04,999 --> 00:08:07,999 where is this thing phoning home? 163 00:08:07,999 --> 00:08:09,667 Who is grabbing the data off of it? 164 00:08:09,667 --> 00:08:10,999 It may not be in the logs immediately 165 00:08:10,999 --> 00:08:15,375 because these things are small and are not meant to log a lot anyway. 166 00:08:15,584 --> 00:08:19,709 We have to wait until somebody tries to connect to it and get their data 167 00:08:19,709 --> 00:08:21,167 off of it. 168 00:08:21,751 --> 00:08:27,999 The challenge here for forensics on these devices is essentially how. 169 00:08:28,250 --> 00:08:30,792 We know procedures for pulling the plug 170 00:08:30,792 --> 00:08:35,876 on a computer or taking RAM image and imaging a hard drive and stuff 171 00:08:35,876 --> 00:08:40,167 like that on a normal PC or Mac but for an embedded device, 172 00:08:40,167 --> 00:08:44,292 do we know how we are going to acquire a forensic image 173 00:08:44,292 --> 00:08:47,834 of this thing without inadvertently destroying 174 00:08:47,834 --> 00:08:51,834 the evidence or bricking it or anything. 175 00:08:53,292 --> 00:08:55,083 That's one concern. 176 00:08:55,083 --> 00:08:57,751 How do we do incident response on this? 177 00:08:57,751 --> 00:09:03,083 Another is, if we decide to, how do we counter attack it? 178 00:09:03,083 --> 00:09:06,417 So obviously if this thing is sitting in our organization we can pull 179 00:09:06,417 --> 00:09:08,334 the plug on it. 180 00:09:08,334 --> 00:09:12,999 After we take our own forensic image out to it, we blast our own image on it, 181 00:09:12,999 --> 00:09:17,209 to hell and back and that's not terribly hard. 182 00:09:17,626 --> 00:09:19,501 What if we want to attack it in place. 183 00:09:19,876 --> 00:09:25,626 We want to compromise this thing as somebody is using it and that's 184 00:09:25,626 --> 00:09:28,999 the main meat of this talk. 185 00:09:29,709 --> 00:09:33,751 And so once we get into this thing, we can monitor the attacker. 186 00:09:33,751 --> 00:09:35,751 We have a better chance at attribution. 187 00:09:35,751 --> 00:09:38,083 We have a better chance of determining motive. 188 00:09:38,083 --> 00:09:39,501 I don't know about you, but it's okay to stop an attack, 189 00:09:39,501 --> 00:09:42,999 but I would rather know who is trying to attack me and what are they trying 190 00:09:42,999 --> 00:09:44,334 to get at? 191 00:09:44,542 --> 00:09:45,999 What are they after? 192 00:09:45,999 --> 00:09:48,626 That may help to defend against them in the future. 193 00:09:48,626 --> 00:09:50,792 We can turn this device into a honey pot. 194 00:09:51,959 --> 00:09:57,709 It is a vulnerable system that they are in and trying to attack us from. 195 00:09:57,709 --> 00:10:00,959 We can monitor their actions from it. 196 00:10:01,042 --> 00:10:03,834 So for pentesters, the typical use case for this, 197 00:10:03,834 --> 00:10:06,918 there's two different use cases. 198 00:10:06,918 --> 00:10:10,667 One is the lazy pentester who doesn't want to take a flight out and go 199 00:10:10,667 --> 00:10:15,959 in person or anything to do an internal behind the firewall pentest. 200 00:10:15,999 --> 00:10:18,292 Sends it out and says plug into the network here, plug it 201 00:10:18,292 --> 00:10:20,125 into the network here. 202 00:10:20,334 --> 00:10:22,501 Coordinates with IT staff on this. 203 00:10:23,375 --> 00:10:25,999 And so that's one use case for this. 204 00:10:25,999 --> 00:10:26,999 It's all set up. 205 00:10:26,999 --> 00:10:29,584 You know, plug in power, plug it into the network, it phones home, 206 00:10:29,584 --> 00:10:32,584 establishes SSH connection, whatever. 207 00:10:32,999 --> 00:10:37,167 You have your nerdy James Bond type pay load situation. 208 00:10:37,501 --> 00:10:42,542 This is somebody who is a more sophisticated pentester. 209 00:10:42,542 --> 00:10:46,542 Actually, it has a physical component to it, a penetration test where he'll go 210 00:10:46,542 --> 00:10:51,000 in and drop this device off surreptitiously in a network. 211 00:10:51,000 --> 00:10:53,876 This is the same thing that an attacker is going to do. 212 00:10:53,876 --> 00:10:55,959 He want to place this thing into a position 213 00:10:55,959 --> 00:11:01,250 on your network that gives him access without anybody knowing about it. 214 00:11:01,876 --> 00:11:04,334 These devices are going to be typically, are typically reused 215 00:11:04,334 --> 00:11:07,083 from test-to-test, client-to-client. 216 00:11:07,250 --> 00:11:08,999 I don't know, they probably emptied your wallet 217 00:11:08,999 --> 00:11:10,999 over there at the vendor area when you bought 218 00:11:10,999 --> 00:11:12,918 one of these things. 219 00:11:13,250 --> 00:11:17,125 You're not leaving it permanently anywhere probably unless you are very 220 00:11:17,125 --> 00:11:22,667 malicious and you're profiting enough from one of these to buy 50 more. 221 00:11:23,375 --> 00:11:27,125 And so when you are using this thing, most pentesters want to pick it back 222 00:11:27,125 --> 00:11:30,584 up and use it on the next client's engagement. 223 00:11:30,918 --> 00:11:33,626 Between the tests, are you wiping it? 224 00:11:33,626 --> 00:11:35,250 Do you know how to wipe this thing? 225 00:11:35,250 --> 00:11:36,584 It's an embedded device. 226 00:11:36,667 --> 00:11:39,250 The clean up procedure on it may not be as obvious 227 00:11:39,250 --> 00:11:42,375 as it would be if you blow out a new installation 228 00:11:42,375 --> 00:11:44,999 of Windows or something. 229 00:11:44,999 --> 00:11:46,918 It's probably more complex than that. 230 00:11:46,918 --> 00:11:50,751 Are you actually bothering to do that from Client A to Client B? 231 00:11:50,751 --> 00:11:54,584 And that, we can use that to our advantage when we attack these. 232 00:11:54,999 --> 00:11:56,834 From here on out I'm going to take the stance 233 00:11:56,834 --> 00:11:59,626 of an attacker attacking pentesters. 234 00:11:59,999 --> 00:12:01,959 Come on, they deserve it, right? 235 00:12:02,959 --> 00:12:05,250 We are going to put on our Black Hat. 236 00:12:05,334 --> 00:12:09,083 This is the only free image of a cool looking Black Hat I could find 237 00:12:09,083 --> 00:12:10,999 on image search. 238 00:12:11,083 --> 00:12:12,459 I like this guy. 239 00:12:12,459 --> 00:12:13,459 He looks cool. 240 00:12:13,751 --> 00:12:15,876 You put on your Black Hat. 241 00:12:15,876 --> 00:12:17,417 We are going to talk about hacking 242 00:12:17,417 --> 00:12:22,792 a pentesters implantable device in the field or on his bench. 243 00:12:22,918 --> 00:12:27,667 The attack I'm going to talk about in the Pwn Plug here, it's fine 244 00:12:27,667 --> 00:12:30,999 and dandy if you see this on a client network 245 00:12:30,999 --> 00:12:35,083 and you can compromise it using this attack. 246 00:12:35,083 --> 00:12:38,417 But this attack can also be used if the pentester is testing the device 247 00:12:38,417 --> 00:12:42,542 or provisioning the device for a new test on the bench, in his lab, 248 00:12:42,542 --> 00:12:45,876 getting ready for a penetration test. 249 00:12:45,876 --> 00:12:48,250 It might be even a little bit easier. 250 00:12:49,083 --> 00:12:52,125 Due to the way we do this attack. 251 00:12:52,292 --> 00:12:55,792 The benefits of an attacker doing this are great. 252 00:12:55,999 --> 00:12:58,751 The implication of breaking into one of these devices and 253 00:12:58,751 --> 00:13:02,083 before I get any further if you're running a WiFi pineapple, 254 00:13:02,083 --> 00:13:05,542 you might want to turn that off pretty soon unless you want 255 00:13:05,542 --> 00:13:07,083 it bricked. 256 00:13:07,209 --> 00:13:09,501 (Laughter.) WESLEY McGREW: Because somebody in here is going 257 00:13:09,501 --> 00:13:10,959 to do it. 258 00:13:10,999 --> 00:13:12,876 They are going to do it fast. 259 00:13:13,209 --> 00:13:16,250 The implications of owning one of these things is one, 260 00:13:16,250 --> 00:13:18,959 we can intercept things. 261 00:13:18,999 --> 00:13:21,125 If penetration tester is doing the work for you, 262 00:13:21,125 --> 00:13:23,999 he's scanning for vulnerability. 263 00:13:23,999 --> 00:13:25,459 He's breaking into systems. 264 00:13:25,751 --> 00:13:27,792 I don't have to do that now. 265 00:13:27,792 --> 00:13:32,999 So I just collect what that penetration tester is doing for me. 266 00:13:33,334 --> 00:13:36,459 And we can modify these results. 267 00:13:36,751 --> 00:13:39,918 Let's control what gets back to the penetration tester. 268 00:13:39,918 --> 00:13:41,876 He popped root on the tester? 269 00:13:42,083 --> 00:13:46,083 Cool, let's not let him know that and keep it for myself. 270 00:13:46,417 --> 00:13:48,542 We can filter the reports. 271 00:13:48,542 --> 00:13:50,876 It never shows up to the report to the client. 272 00:13:51,626 --> 00:13:53,250 Everything is cool. 273 00:13:53,250 --> 00:13:55,209 Yeah, that database is totally secure. 274 00:13:55,250 --> 00:13:57,083 We can camouflage ourself. 275 00:13:57,083 --> 00:13:58,167 Maybe the pentester sucks and he's not running 276 00:13:58,167 --> 00:14:00,667 the tests you want him to run. 277 00:14:00,834 --> 00:14:02,999 Launch your own attacks from the device. 278 00:14:03,999 --> 00:14:06,834 The thing is supposed to be launching attacks. 279 00:14:06,834 --> 00:14:07,999 Nobody is going to care. 280 00:14:08,709 --> 00:14:12,083 So your attacks are part of the test at this point. 281 00:14:12,125 --> 00:14:13,999 It's also a competitive Intel if you have 282 00:14:13,999 --> 00:14:18,125 a clever pentester that leverages some O day, you steal it. 283 00:14:18,125 --> 00:14:21,667 And essentially this is the gift that keeps on giving. 284 00:14:21,834 --> 00:14:24,542 You can do this again and again, as he reuses that device 285 00:14:24,542 --> 00:14:26,999 across multiple clients. 286 00:14:26,999 --> 00:14:30,334 You can maintain access to these organizations. 287 00:14:30,334 --> 00:14:32,083 You can get back into the pentesters' company's network 288 00:14:32,083 --> 00:14:34,167 whenever he tacit home and plugs it back 289 00:14:34,167 --> 00:14:35,751 up again. 290 00:14:35,876 --> 00:14:37,209 Cool stuff. 291 00:14:39,709 --> 00:14:43,501 So there's difficulties in preventing this sort of thing. 292 00:14:43,667 --> 00:14:48,459 And the reason why these sorts of systems have these vulnerabilities 293 00:14:48,459 --> 00:14:52,999 is because they are very small platforms and they respect running 294 00:14:52,999 --> 00:14:56,999 off the shelf penetration testing tools. 295 00:14:57,125 --> 00:15:02,083 These tools are, attack tools are great, you know. 296 00:15:02,626 --> 00:15:05,918 People write quit Python script to leverage some particular 297 00:15:05,918 --> 00:15:11,334 vulnerability or some particular network attack or something like that. 298 00:15:11,375 --> 00:15:12,459 It will work. 299 00:15:12,709 --> 00:15:14,167 So everybody starts using it. 300 00:15:14,167 --> 00:15:20,209 The problem is, as soon as it works, we are very fickle creatures. 301 00:15:20,209 --> 00:15:23,375 We get something working and we move on to the next attack. 302 00:15:23,999 --> 00:15:26,834 We don't do a whole lot of testing. 303 00:15:26,834 --> 00:15:29,792 We don't think about the attack surface of our tools. 304 00:15:30,083 --> 00:15:32,792 If you think about penetration testing tools, 305 00:15:32,792 --> 00:15:37,501 you're connecting to all sorts of services not under your control. 306 00:15:37,667 --> 00:15:41,999 These services, you know, implemented protocols probably 307 00:15:41,999 --> 00:15:47,667 to a level that even your attack tool doesn't fully implement. 308 00:15:47,751 --> 00:15:51,417 You're pulling in data from lots of sources. 309 00:15:51,417 --> 00:15:52,918 You're parsing that data. 310 00:15:52,918 --> 00:15:54,584 You're parsing file formats. 311 00:15:54,999 --> 00:15:58,292 So your attack surface is essentially the entire code. 312 00:15:58,292 --> 00:16:00,125 If it didn't have to do with processing things 313 00:16:00,125 --> 00:16:04,501 from another service, your code wouldn't be doing it. 314 00:16:04,959 --> 00:16:08,792 So essentially a vulnerability in any part of your attack tool opens 315 00:16:08,792 --> 00:16:10,417 up for you. 316 00:16:10,417 --> 00:16:13,209 Most of these tools are proof of concept tools. 317 00:16:13,209 --> 00:16:14,751 That's always a disclaimer. 318 00:16:14,751 --> 00:16:17,626 That's my disclaimer when I write a security tool. 319 00:16:17,626 --> 00:16:19,250 This is a proof of concept. 320 00:16:19,250 --> 00:16:20,999 I got it working and then I stopped. 321 00:16:21,542 --> 00:16:24,626 And I'm as guilty of this as anybody. 322 00:16:25,250 --> 00:16:29,918 So the disclaimer there is, don't use this in a production setting. 323 00:16:29,918 --> 00:16:31,501 Don't use this in your production malicious attack, 324 00:16:31,501 --> 00:16:34,918 malicious penetration test unless you understand the implications 325 00:16:34,918 --> 00:16:37,751 of what you're doing and control it. 326 00:16:38,083 --> 00:16:43,834 These are open source and folks that put together these small embedded 327 00:16:43,834 --> 00:16:47,999 attack appliances will take these open source tools, 328 00:16:47,999 --> 00:16:52,375 put them on the devices as is and wrap a user interface 329 00:16:52,375 --> 00:16:55,459 around it and send it out. 330 00:16:56,542 --> 00:16:59,417 So at no point in this process is there any kind of audit 331 00:16:59,417 --> 00:17:02,876 of what are the vulnerabilities in these tools? 332 00:17:03,292 --> 00:17:06,709 These are very small, weird platforms. 333 00:17:06,918 --> 00:17:11,083 The arm is getting less and less weird, I guess, but these things are not, 334 00:17:11,083 --> 00:17:13,999 you know, these aren't PCs. 335 00:17:14,334 --> 00:17:15,959 These are outside of the comfort zone of a lot 336 00:17:15,959 --> 00:17:18,083 of people who are using them. 337 00:17:18,375 --> 00:17:21,999 So once you get these tools running on that platform, then you just pray 338 00:17:21,999 --> 00:17:26,334 to God, that's great, let's move on and do something else now. 339 00:17:26,959 --> 00:17:30,626 When you send these things out, they are out of your physical control. 340 00:17:30,626 --> 00:17:33,250 So obviously, unless you are implements some sort 341 00:17:33,250 --> 00:17:38,334 of encrypted file system on this thing, how would you do it? 342 00:17:38,918 --> 00:17:39,999 Where is your key? 343 00:17:40,083 --> 00:17:43,542 Who is going to type in a key on this thing once it's out there? 344 00:17:43,999 --> 00:17:48,501 It's hard to protect this thing once it's out of your physical control. 345 00:17:48,501 --> 00:17:51,083 We know, we have access to a computer. 346 00:17:51,083 --> 00:17:53,999 We have access to a USB port, we're in. 347 00:17:54,083 --> 00:17:56,999 Finally, the update procedure for these things. 348 00:17:56,999 --> 00:17:58,250 Once they work, they work. 349 00:17:58,417 --> 00:18:01,375 The chances of somebody actually seeking occupant 350 00:18:01,375 --> 00:18:04,999 between tests the new firm ware for their Pwn Plug, 351 00:18:04,999 --> 00:18:08,999 the new firm ware for their Mini Pwner or Raspberry Pwn 352 00:18:08,999 --> 00:18:11,751 or whatever is very slim. 353 00:18:11,751 --> 00:18:13,083 As long as this thing is working and doing the job, 354 00:18:13,083 --> 00:18:17,584 not much chance they are going to think and go out there looking for it. 355 00:18:17,959 --> 00:18:20,501 It needs to be an automated procedure 356 00:18:20,501 --> 00:18:24,999 but you can't have automatic, that's a whole new attack surface 357 00:18:24,999 --> 00:18:28,083 for me to talk about next year. 358 00:18:30,125 --> 00:18:33,999 So these things will run old code. 359 00:18:33,999 --> 00:18:35,999 They'll run old code for a very long time. 360 00:18:36,999 --> 00:18:39,501 Security geeks are easy targets. 361 00:18:40,250 --> 00:18:41,876 It's hard. 362 00:18:41,999 --> 00:18:43,334 There's another problem. 363 00:18:43,334 --> 00:18:45,584 I talked about the problem of the naming scheme 364 00:18:45,584 --> 00:18:49,999 for these types of devices, Dropbox being taken. 365 00:18:50,334 --> 00:18:52,292 I'm going with the wordy attackable 366 00:18:52,292 --> 00:18:54,459 implantable devices. 367 00:18:54,999 --> 00:18:59,083 There's problems with doing research on this problem. 368 00:18:59,209 --> 00:19:02,876 If we talk about finding vulnerability in vulnerability software, 369 00:19:02,876 --> 00:19:05,167 that's tough to Google. 370 00:19:05,709 --> 00:19:10,751 Finding exploits in pentesting software, not the easiest research area, 371 00:19:10,751 --> 00:19:15,999 but there's a lot of it out there and there's a lot more that is yet 372 00:19:15,999 --> 00:19:17,999 to be found. 373 00:19:17,999 --> 00:19:20,375 So I'm not sure who is currently working 374 00:19:20,375 --> 00:19:26,999 on breaking things that break things, but there's a lot left out there. 375 00:19:26,999 --> 00:19:29,334 You're already familiar with the million bajillion Wireshark 376 00:19:29,334 --> 00:19:31,626 vulnerabilities out there. 377 00:19:31,626 --> 00:19:34,999 That's very typical of this genre of software. 378 00:19:34,999 --> 00:19:37,083 We are talking about things that parse things, 379 00:19:37,083 --> 00:19:39,999 have a huge attack surface. 380 00:19:40,083 --> 00:19:45,334 We have vulnerability, cross-site in meta exploit. 381 00:19:45,334 --> 00:19:50,999 We have screen shots of titles of talks that are here at DEF CON 382 00:19:50,999 --> 00:19:55,999 and back at Black Hat this past weekend. 383 00:19:55,999 --> 00:19:59,417 So the tools that security geeks use are no less vulnerable, 384 00:19:59,417 --> 00:20:03,584 perhaps even more vulnerable than the tools we are attacking 385 00:20:03,584 --> 00:20:07,584 because there hasn't been enough attention or enough audit 386 00:20:07,584 --> 00:20:09,626 on these tools. 387 00:20:11,999 --> 00:20:15,999 So the case study for this, and I'm a picking on the Pwn Plug 388 00:20:15,999 --> 00:20:18,999 for this, but honestly these same problems exist 389 00:20:18,999 --> 00:20:20,999 in other devices. 390 00:20:21,083 --> 00:20:22,918 Talk about that in a little bit. 391 00:20:23,209 --> 00:20:25,999 But today we are going to be playing with the Pwn Plug. 392 00:20:25,999 --> 00:20:28,709 I have one plugged up underneath the podium here. 393 00:20:28,999 --> 00:20:30,918 Wired up and everything. 394 00:20:30,918 --> 00:20:31,959 Hopefully it will behave itself long enough 395 00:20:31,959 --> 00:20:34,501 for a good demo at the end of this. 396 00:20:35,375 --> 00:20:38,792 What we have is a discussion of the forensics of it and demo 397 00:20:38,792 --> 00:20:43,792 of a counter attack against this thing or straight up attack against it. 398 00:20:43,792 --> 00:20:45,042 Depend on how you look at it. 399 00:20:45,959 --> 00:20:49,125 So for forensic acquisition of a Pwn Plug. 400 00:20:49,125 --> 00:20:50,542 This is what I do the first time I get hold 401 00:20:50,542 --> 00:20:52,417 of any new devices. 402 00:20:52,417 --> 00:20:53,209 I want to know how to perform 403 00:20:53,209 --> 00:20:56,125 a forensic analysis which involves imaging it, 404 00:20:56,125 --> 00:21:00,292 which gives me something that I can go back to the original state 405 00:21:00,292 --> 00:21:04,501 of the device when I screw it up when I attack it. 406 00:21:05,542 --> 00:21:09,501 Forensic acquisition is something that I'm interested in. 407 00:21:09,626 --> 00:21:12,542 There's explicit detail in the white paper for this. 408 00:21:12,542 --> 00:21:13,999 I haven't looked at the DVD. 409 00:21:13,999 --> 00:21:16,167 My, I don't have a DVD drive, but the DVD that comes 410 00:21:16,167 --> 00:21:20,999 with the conference materials has the white paper, it has the slides, 411 00:21:20,999 --> 00:21:25,626 it has the attack code and pay loads and all the crap that you need 412 00:21:25,626 --> 00:21:28,626 to do your stuff on your own. 413 00:21:28,626 --> 00:21:31,250 The white paper has the details about the forensics. 414 00:21:31,250 --> 00:21:36,751 I won't go into the U-bot commands, but the essential idea of this is that 415 00:21:36,751 --> 00:21:41,751 the Pwn Plug, which is based off of the Shiva plug platform, 416 00:21:41,751 --> 00:21:46,250 if you want to play around with the devices you can buy 417 00:21:46,250 --> 00:21:49,959 a little 99-dollar Shiva, but you're better 418 00:21:49,959 --> 00:21:55,459 off with the Raspberry Pi or something, but the Shiva hardware that 419 00:21:55,459 --> 00:22:02,959 the Pwn Plug is based on can boot off of a USB drive if you ask it to nicely. 420 00:22:03,083 --> 00:22:07,667 Essentially you can grab a DB image for Shiva plug and which 421 00:22:07,667 --> 00:22:12,250 will have everything you need to DD a drive. 422 00:22:12,584 --> 00:22:16,709 More importantly you are not relying on the file system and tools already 423 00:22:16,709 --> 00:22:19,083 on the Pwn Plug itself. 424 00:22:19,542 --> 00:22:22,125 You can, you can boot up into the serial console, 425 00:22:22,125 --> 00:22:28,459 interrupt U-bot, tell it to load a kernel off the system in the USB drive and go. 426 00:22:28,459 --> 00:22:32,918 It will boot into your USB drive instead of the Shiva, and. 427 00:22:38,501 --> 00:22:42,083 For forensics, you can DD the root file system once you get 428 00:22:42,083 --> 00:22:43,751 in there. 429 00:22:43,876 --> 00:22:47,999 Now, it's just, turns out it's just as well on this device just to copy 430 00:22:47,999 --> 00:22:49,999 from root down. 431 00:22:51,083 --> 00:22:55,501 Since, for the analysis of it, you know, the UBI file system that's 432 00:22:55,501 --> 00:22:58,959 on these devices, and other similar compressed file 433 00:22:58,959 --> 00:23:02,501 systems run a lot of these embedded devices are options 434 00:23:02,501 --> 00:23:06,959 for forensic analysis on these are kind of limited. 435 00:23:06,999 --> 00:23:09,709 There's lots of compression on these. 436 00:23:09,709 --> 00:23:12,083 At any given point you don't necessarily know how much free space 437 00:23:12,083 --> 00:23:13,584 you have. 438 00:23:13,584 --> 00:23:15,876 It depends on what you're storing really. 439 00:23:17,209 --> 00:23:20,334 The flip side of this for forensics is probably you can forget 440 00:23:20,334 --> 00:23:23,626 about recovering deleted files on this thing. 441 00:23:23,626 --> 00:23:26,542 The whole thing is part of the compressed image. 442 00:23:26,542 --> 00:23:28,876 If you lose chunks of it you are basically out of luck 443 00:23:28,876 --> 00:23:30,959 with the rest of it. 444 00:23:30,959 --> 00:23:32,501 The rest of it is just noise. 445 00:23:33,292 --> 00:23:36,125 There's really no tools for doing good forensic analysis that 446 00:23:36,125 --> 00:23:38,417 I know of right now for recovering deleted files 447 00:23:38,417 --> 00:23:40,417 and things like that. 448 00:23:40,501 --> 00:23:46,209 If you have the file image which you can blow out to another Pwn Plug, which 449 00:23:46,209 --> 00:23:51,250 is useful, you can use MTD tools on Linux to mount this image 450 00:23:51,250 --> 00:23:56,999 and start processing it at the logical file system level. 451 00:23:56,999 --> 00:23:59,542 You can go through an look at the files and things. 452 00:23:59,999 --> 00:24:02,751 These devices support attached storage. 453 00:24:02,751 --> 00:24:05,292 The storage on board most of them is fairly limited. 454 00:24:05,292 --> 00:24:07,959 So the nice thing about this is doing forensics 455 00:24:07,959 --> 00:24:12,876 on the little small USB drive that is hooked up to this thing is going 456 00:24:12,876 --> 00:24:18,417 to be a lot easier than doing the forensics on the device itself. 457 00:24:18,417 --> 00:24:21,334 And it is going to be standard procedures. 458 00:24:21,334 --> 00:24:25,083 Pop the thing out, hook it up to FTK through the right blocker, 459 00:24:25,083 --> 00:24:28,667 if you please, and start analyzing. 460 00:24:28,667 --> 00:24:31,375 Chances are it is going to be a normal-ish file system, EXT 461 00:24:31,375 --> 00:24:34,501 or Fat 32 or something like that. 462 00:24:34,501 --> 00:24:38,209 The cool thing, the stuff that is going to be on that, that's the real goods. 463 00:24:38,209 --> 00:24:42,167 That's all your packet data, things like that that aren't necessarily feasible 464 00:24:42,167 --> 00:24:45,083 to store on the internal storage. 465 00:24:45,459 --> 00:24:48,751 The cool thing about these devices is anything that is different 466 00:24:48,751 --> 00:24:52,584 from the base image, anything that is different from the base image 467 00:24:52,584 --> 00:24:55,999 on one of these Pwn Plugs is likely to be of interest to you 468 00:24:55,999 --> 00:24:59,250 because it's something that is changed. 469 00:24:59,250 --> 00:25:02,999 It's something that is as a result of the attacker using it. 470 00:25:02,999 --> 00:25:05,334 Or as a result of the tools that are running on it 471 00:25:05,334 --> 00:25:09,167 as a result of network traffic coming into it. 472 00:25:09,501 --> 00:25:12,667 What you can do is, you can take that file system that 473 00:25:12,667 --> 00:25:16,083 you've acquired and run it through FDK or whatever tools you 474 00:25:16,083 --> 00:25:21,667 have for making a known file hash set, hash all the files on the base image. 475 00:25:21,667 --> 00:25:24,584 You can download the base images off of Pwnie Express are. 476 00:25:26,834 --> 00:25:31,083 And you blow away everything that matches the hashes in there. 477 00:25:31,083 --> 00:25:32,334 I don't care about that. 478 00:25:32,334 --> 00:25:34,250 That's the same as the factory config. 479 00:25:34,250 --> 00:25:34,999 The files left are the files that are going 480 00:25:34,999 --> 00:25:36,918 to tell you something. 481 00:25:37,209 --> 00:25:38,209 Cool stuff. 482 00:25:38,876 --> 00:25:41,626 Now we are going to get into attacking these things. 483 00:25:41,626 --> 00:25:42,959 We're going to put our Black Hat firmly 484 00:25:42,959 --> 00:25:46,083 on and attack some penetration testers. 485 00:25:46,292 --> 00:25:49,667 The particular exploit that we are dealing with here 486 00:25:49,667 --> 00:25:52,834 is in the Pwn Plug user interface. 487 00:25:52,834 --> 00:25:56,209 So congratulations for those of you who bought a Shiva plug 488 00:25:56,209 --> 00:25:59,959 and put the community version, the free version 489 00:25:59,959 --> 00:26:03,250 of the Pwn Plug firm ware on it. 490 00:26:03,250 --> 00:26:04,959 You are not vulnerable to this. 491 00:26:04,999 --> 00:26:08,292 This is only in the interface, the web-based interface that 492 00:26:08,292 --> 00:26:12,667 is on the version versions that they sell to you. 493 00:26:12,667 --> 00:26:17,083 So this plug UI or pwnix, I've seen it called various things 494 00:26:17,083 --> 00:26:20,083 in the documentation. 495 00:26:20,083 --> 00:26:23,999 This is a commercial version of the Pwn Plug and it lets you do 496 00:26:23,999 --> 00:26:29,334 things like turning on passive recon, so you can sniff http requests, look 497 00:26:29,334 --> 00:26:35,584 at passive OS discovery stuff, set up reverse tunnels, things like that. 498 00:26:36,876 --> 00:26:38,999 And so there's all sorts ever fun things that this 499 00:26:38,999 --> 00:26:40,667 interface can do. 500 00:26:40,999 --> 00:26:43,417 They tell you in the documentation when you put this 501 00:26:43,417 --> 00:26:46,167 thing into stealth mode if you are going to have it 502 00:26:46,167 --> 00:26:51,083 in stealth mode in an organization, this interface has it up and going. 503 00:26:51,542 --> 00:26:54,667 The problem is, you can't do the cool graphical things. 504 00:26:54,918 --> 00:26:57,083 People aren't going to put it in stealth mode. 505 00:26:57,501 --> 00:26:58,999 Who cares if it's noisy? 506 00:26:59,292 --> 00:27:02,834 Another thing when you're setting it up, on the bench back home back 507 00:27:02,834 --> 00:27:08,167 at your lab or whatever chances are you are going to be using this interface. 508 00:27:08,167 --> 00:27:10,209 How do we break it? 509 00:27:10,250 --> 00:27:13,999 With a bunch of -- I did get a DEF CON talk accepted 510 00:27:13,999 --> 00:27:16,999 for cross-site scripting. 511 00:27:17,834 --> 00:27:22,918 These are boring vulnerabilities, easy vulnerabilities. 512 00:27:22,918 --> 00:27:28,876 So if you have not attacked much, you're going to be able to follow this. 513 00:27:28,876 --> 00:27:31,167 We have three different vulnerabilities in it. 514 00:27:31,167 --> 00:27:33,167 We have cross-site scripting, boring. 515 00:27:33,167 --> 00:27:35,876 Cross-site request forgery, that's everywhere. 516 00:27:35,999 --> 00:27:38,999 Sort of interesting, we have command injection. 517 00:27:38,999 --> 00:27:41,375 So we can run commands on this device. 518 00:27:41,375 --> 00:27:42,375 That's kind of cool. 519 00:27:42,375 --> 00:27:44,667 But you have to be logged in to do it. 520 00:27:44,667 --> 00:27:45,667 So who cares? 521 00:27:45,999 --> 00:27:47,751 If we combine these exploits. 522 00:27:47,751 --> 00:27:50,459 Say we will say our cross-site scripting is triggered 523 00:27:50,459 --> 00:27:54,709 by an injected packet that we send to this thing. 524 00:27:54,709 --> 00:27:56,459 It doesn't have to be directed to it. 525 00:27:56,459 --> 00:27:57,999 It can be anything that sniffs. 526 00:27:58,083 --> 00:27:59,999 We send a packet to this thing. 527 00:27:59,999 --> 00:28:04,334 That's a cool way of triggering XS, cool, better than united phishing e-mails 528 00:28:04,334 --> 00:28:07,584 and links on Twitter and things. 529 00:28:08,334 --> 00:28:13,125 What if the XSS pay load triggers the cross-site forgery vulnerability? 530 00:28:16,959 --> 00:28:19,542 So we have one page on president interface that 531 00:28:19,542 --> 00:28:22,876 is vulnerable, the cross-site scripting. 532 00:28:22,999 --> 00:28:27,626 That pay load hits another page that we can submit forms to on behalf 533 00:28:27,626 --> 00:28:30,584 of our penetration tester. 534 00:28:30,584 --> 00:28:31,626 Cool. 535 00:28:31,667 --> 00:28:32,999 What does that get us? 536 00:28:33,209 --> 00:28:37,667 Well, our cross-site request forgery is in the page that has 537 00:28:37,667 --> 00:28:39,999 command injection. 538 00:28:39,999 --> 00:28:43,334 So why don't we have our cross-site request forgery vulnerability, 539 00:28:43,334 --> 00:28:47,083 our pay load, go ahead and inject the command for us on behalf 540 00:28:47,083 --> 00:28:50,876 of the penetration tester that's logged in. 541 00:28:51,083 --> 00:28:55,083 We get remote cross-site scripting. 542 00:28:55,083 --> 00:28:57,999 Cross-site scripting leading to -- it requires setup. 543 00:28:58,999 --> 00:29:03,999 The stars have to be aligned but it's a realistic scenario. 544 00:29:03,999 --> 00:29:07,542 I will make you watch this slide again because the animation is cool. 545 00:29:07,542 --> 00:29:08,542 Boom! 546 00:29:08,584 --> 00:29:09,584 Okay. 547 00:29:09,584 --> 00:29:13,999 (Applause.) WESLEY McGREW: Thank you, thank you. 548 00:29:13,999 --> 00:29:16,334 It is all down on the keynote on that. 549 00:29:16,334 --> 00:29:19,459 I didn't render that fire myself. 550 00:29:19,999 --> 00:29:21,751 So here is your pay load. 551 00:29:21,751 --> 00:29:25,751 This is what you send in the exploit package to the device. 552 00:29:25,751 --> 00:29:30,083 This is what you are going to pass into HP to get this thing rolling. 553 00:29:31,542 --> 00:29:35,751 This part of it right here just passes the reg X to get it 554 00:29:35,751 --> 00:29:38,834 on to the passive recon page. 555 00:29:38,999 --> 00:29:41,918 This is what it's looking for in a packet. 556 00:29:41,999 --> 00:29:43,751 You know, you might want to make something 557 00:29:43,751 --> 00:29:46,626 a little more believable than user agent, hi! 558 00:29:47,999 --> 00:29:51,667 This is the bit that you need to get cross-site scripting going on. 559 00:29:51,667 --> 00:29:53,999 Everything inside of that is going to render in the page and we'll see that 560 00:29:53,999 --> 00:29:55,250 in a bit. 561 00:29:55,709 --> 00:29:57,876 The cross-site request forgery in here. 562 00:29:57,876 --> 00:29:59,999 We have a form in here and a bunch of crap that you have to fill 563 00:29:59,999 --> 00:30:02,751 out for this form to actually take. 564 00:30:02,876 --> 00:30:05,999 We submit this to the SSH tunnel setup page 565 00:30:05,999 --> 00:30:08,959 on the Pwn Plug interface. 566 00:30:09,459 --> 00:30:13,999 And it goes ahead and submits it on the penetration tester's behalf. 567 00:30:14,000 --> 00:30:18,918 Finally, the command injections in there, and this can be in any field. 568 00:30:18,999 --> 00:30:22,417 These same vulnerabilities, these exist throughout the interface. 569 00:30:22,667 --> 00:30:26,999 So basically you can mutate this to go to basically any page 570 00:30:26,999 --> 00:30:29,125 on the Pwn Plug. 571 00:30:29,959 --> 00:30:35,459 So basically what we have here is the SSH tunnel IP address 572 00:30:35,459 --> 00:30:41,999 is now semi-colon, CD user bin, W-git my malware, run it, remove it, 573 00:30:41,999 --> 00:30:44,292 and keep going. 574 00:30:45,667 --> 00:30:48,167 So what do we run as a result of this? 575 00:30:48,250 --> 00:30:51,459 We are not alerting XSS here. 576 00:30:51,501 --> 00:30:53,209 We want to do something with this. 577 00:30:53,209 --> 00:30:57,459 So there's some proof of concept, see my disclaimer, proof of concept. 578 00:30:57,459 --> 00:31:00,083 Don't run this in the real world or you'll get owned. 579 00:31:00,083 --> 00:31:02,999 My proof of concept malware is pwnmon. 580 00:31:04,959 --> 00:31:08,959 You can't adapt this to anything, it's a crappy discriminate. 581 00:31:12,083 --> 00:31:14,999 It cleans up a bit after itself. 582 00:31:15,209 --> 00:31:19,626 It installs itself into user bin, user S bin. 583 00:31:19,626 --> 00:31:21,834 It sets up some persistence in RC local and chron and 584 00:31:21,834 --> 00:31:25,584 all that crap to make sure that it keeps running. 585 00:31:25,626 --> 00:31:30,459 It sets up a lock file so it doesn't run more than once at a time. 586 00:31:30,542 --> 00:31:35,459 The Pwn Plug specifically disables the batch history for the root user. 587 00:31:35,459 --> 00:31:38,709 I go ahead and re-enable that so I can keep up with command logs. 588 00:31:38,959 --> 00:31:42,459 Occasionally it phones home and tries to get more code to run. 589 00:31:42,459 --> 00:31:43,792 Because that's awesome. 590 00:31:43,999 --> 00:31:49,167 So often, it gathers a process list, command history, file listing, set 591 00:31:49,167 --> 00:31:53,250 of network interfaces and connections, all the log files 592 00:31:53,250 --> 00:31:57,459 for the most interesting tools in the pwn OS and wraps it 593 00:31:57,459 --> 00:32:00,959 up and sends it to my FTP server. 594 00:32:01,083 --> 00:32:04,876 This is something that you can start from on this. 595 00:32:05,250 --> 00:32:08,292 So the demo for this, there's everything you need 596 00:32:08,292 --> 00:32:11,083 to replicate this on the DVD. 597 00:32:11,626 --> 00:32:14,209 You need a floor model or above Pwn Plug, 598 00:32:14,209 --> 00:32:18,792 actual commercial Pwn Plug to replicate this from the guys 599 00:32:18,792 --> 00:32:21,125 at the vendor area. 600 00:32:21,125 --> 00:32:22,167 Tell them I sent you. 601 00:32:22,167 --> 00:32:24,125 Tell them if there's a patch for this, to give you 602 00:32:24,125 --> 00:32:27,459 the old one so that you can play with this. 603 00:32:27,501 --> 00:32:30,292 Or just use an unsuspecting friend or enemy's. 604 00:32:31,250 --> 00:32:33,250 We are going to bounce out of here. 605 00:32:33,250 --> 00:32:34,999 I hope this demo will work. 606 00:32:34,999 --> 00:32:36,459 Otherwise I have a recording. 607 00:32:37,999 --> 00:32:41,292 So what we have here is, and we'll take you on a tour 608 00:32:41,292 --> 00:32:44,083 of the different views here. 609 00:32:44,083 --> 00:32:46,834 What we have here is the hapless penetration tester setting 610 00:32:46,834 --> 00:32:48,626 this thing up. 611 00:32:48,918 --> 00:32:51,999 Over here we have our attacker. 612 00:32:54,459 --> 00:32:57,918 Basically with where he's launching the attack from and 613 00:32:57,918 --> 00:33:00,999 the Web server that he's hosting the stuff off of, 614 00:33:00,999 --> 00:33:04,999 the FTP understand info on what is going on here. 615 00:33:04,999 --> 00:33:09,250 The players that we have here are the Pwn Plug on 10, 616 00:33:09,250 --> 00:33:15,417 the pentester/victim on 15 and the attacker here on 20. 617 00:33:15,751 --> 00:33:18,999 And here we have basically a view on the code of the pwn mon software 618 00:33:18,999 --> 00:33:22,334 in case I want to refer to anything for y'all. 619 00:33:22,709 --> 00:33:25,375 What we are going to do, we are going to start 620 00:33:25,375 --> 00:33:28,999 up the attacker Web server so we have this. 621 00:33:28,999 --> 00:33:31,751 I'm going to show you what is in here right now. 622 00:33:31,751 --> 00:33:33,125 The UBI pentest PI. 623 00:33:33,375 --> 00:33:37,626 The UBI file names, since I had to do a bunch of research to figure 624 00:33:37,626 --> 00:33:40,999 out what the hell is going on with the UBI file number, 625 00:33:40,999 --> 00:33:45,083 I figured adding more UBI named commands to the operating system 626 00:33:45,083 --> 00:33:50,083 is a good way to hide my malware and nothing makes sense anyway. 627 00:33:50,083 --> 00:33:56,209 So we have UBBI pentest PY and UBI mount here. 628 00:33:56,292 --> 00:33:59,417 UBY pentest PY is the UBI malware. 629 00:34:01,459 --> 00:34:04,501 UBI is the file on the Web server that pwnmon 630 00:34:04,501 --> 00:34:07,999 occasionally polls for new commands. 631 00:34:07,999 --> 00:34:10,709 I'll show you that in a bit. 632 00:34:11,584 --> 00:34:16,417 Classic, you know, buy and shell type crap here. 633 00:34:16,876 --> 00:34:19,375 We are going to host this Web server. 634 00:34:19,375 --> 00:34:21,959 If you learn nothing else from this talk, you can set up a Web server 635 00:34:21,959 --> 00:34:25,417 out of your current directory with just that command. 636 00:34:25,876 --> 00:34:27,918 That's just tons of fun. 637 00:34:27,918 --> 00:34:29,834 It beats setting up Apache, whatever. 638 00:34:29,834 --> 00:34:32,792 Don't run your blog off of it or anything. 639 00:34:32,792 --> 00:34:36,375 (Laughter.) WESLEY McGREW: Pay loads are great. 640 00:34:36,375 --> 00:34:39,167 That fires you up a Web server on port 8,000. 641 00:34:39,167 --> 00:34:40,167 Cool! 642 00:34:40,626 --> 00:34:41,626 Let's see. 643 00:34:41,834 --> 00:34:43,999 The Pwn Plug is still awake. 644 00:34:43,999 --> 00:34:44,999 That's good. 645 00:34:45,209 --> 00:34:48,083 We have our FTP dead drop here where it is going to go. 646 00:34:48,125 --> 00:34:49,417 It seems fine. 647 00:34:49,417 --> 00:34:52,417 We are going to be the hapless penetration tester again. 648 00:34:52,417 --> 00:34:55,999 We will turn on under plug services here, turn 649 00:34:55,999 --> 00:34:59,459 on the passive recon stuff. 650 00:34:59,709 --> 00:35:00,959 Oh, dear! 651 00:35:00,959 --> 00:35:04,999 We're already -- I may have already triggered the vulnerability, that's cool. 652 00:35:05,334 --> 00:35:08,667 He is going to enable this and we are going to see here 653 00:35:08,667 --> 00:35:13,459 in a second whether or not that is actually -- so we are enabled. 654 00:35:13,834 --> 00:35:17,083 We are going to see over here, it hadn't requested anything else. 655 00:35:17,083 --> 00:35:18,083 That's good. 656 00:35:18,083 --> 00:35:19,626 Might not. 657 00:35:19,626 --> 00:35:21,918 What we are going to do, we are going to -- we have 658 00:35:21,918 --> 00:35:26,209 the exploit pay load there, which I reviewed with you. 659 00:35:26,876 --> 00:35:29,584 A simple HP command sends this out. 660 00:35:29,751 --> 00:35:31,250 There's a trick. 661 00:35:31,250 --> 00:35:35,959 We are sending it ten times because it's kind of goofy. 662 00:35:35,999 --> 00:35:39,834 The passive recon page is pulling from a log file and unless you send -- 663 00:35:39,834 --> 00:35:43,709 unless there's a good bit of traffic on the network it takes a bit 664 00:35:43,709 --> 00:35:48,083 for the buffers to flush and for it to show up on the page. 665 00:35:48,083 --> 00:35:49,250 I've done it ten times. 666 00:35:49,250 --> 00:35:52,083 The exploit said not to run it more than two times anyway. 667 00:35:52,083 --> 00:35:54,209 Sometimes it will request it or whatever. 668 00:35:54,667 --> 00:35:57,999 So we are going to blast that out. 669 00:35:57,999 --> 00:36:02,167 And while that's going, I'm going to set up inspect element 670 00:36:02,167 --> 00:36:07,209 on this guy right here so we can see it when it shows up. 671 00:36:08,209 --> 00:36:09,959 All right. 672 00:36:09,959 --> 00:36:12,501 So let's inspect right here. 673 00:36:12,999 --> 00:36:17,250 So what we see here is our, you know, cookie high form, 674 00:36:17,250 --> 00:36:20,584 all that crap going on there. 675 00:36:20,584 --> 00:36:23,667 So pretty soon we should see a request here, and we have. 676 00:36:23,667 --> 00:36:29,417 So the cross-site scripting vulnerability has -- come on, get me 677 00:36:29,417 --> 00:36:32,999 off the blue screen here. 678 00:36:32,999 --> 00:36:33,999 Un-highlight all. 679 00:36:34,083 --> 00:36:37,083 Okay, has set up a standard reverse SSH shell 680 00:36:37,083 --> 00:36:39,417 of get all my crap. 681 00:36:39,834 --> 00:36:42,918 And that is scheduled to run every minute. 682 00:36:42,999 --> 00:36:44,626 Thankfully it's already run. 683 00:36:44,626 --> 00:36:45,999 Sometimes if you hit it wrong I would be standing 684 00:36:45,999 --> 00:36:47,999 here and have to tell you a joke or something 685 00:36:47,999 --> 00:36:50,417 before it actually does anything. 686 00:36:50,959 --> 00:36:57,334 It's gotten the UBI Mount script for code to run. 687 00:36:57,542 --> 00:37:01,584 It's already phoned in with a basically a tarred up image 688 00:37:01,584 --> 00:37:05,542 of all the cool crap on the Pwn Plug. 689 00:37:05,918 --> 00:37:08,542 So let's take a look at what we've got here. 690 00:37:08,542 --> 00:37:11,999 With the UBI mount we should have a reverse shell running. 691 00:37:11,999 --> 00:37:16,250 192168.9.10 on port, I think it was 9,000. 692 00:37:17,999 --> 00:37:19,083 Yup. 693 00:37:23,417 --> 00:37:25,501 Drum roll, please! 694 00:37:25,834 --> 00:37:26,999 Root! 695 00:37:31,334 --> 00:37:34,709 (Applause.) WESLEY McGREW: I've always wanted to do that on stage 696 00:37:34,709 --> 00:37:36,125 at DEF CON. 697 00:37:36,501 --> 00:37:38,792 (Laughter.) WESLEY McGREW: All right. 698 00:37:38,792 --> 00:37:41,083 Over here at FTP dead drop. 699 00:37:41,083 --> 00:37:42,083 This is cooler. 700 00:37:42,209 --> 00:37:44,501 We want to get stuff. 701 00:37:44,501 --> 00:37:45,501 Loot! 702 00:37:45,999 --> 00:37:47,959 So what we have here, this is funny. 703 00:37:48,999 --> 00:37:53,709 The Pwn Plug isn't so hot on its realtime clock or anything. 704 00:37:53,709 --> 00:37:55,250 So this is time stamped. 705 00:37:55,501 --> 00:37:57,501 So with Unix time stamps. 706 00:37:57,501 --> 00:37:59,292 I have underscore and dash here. 707 00:37:59,292 --> 00:38:03,626 Oh, I fucked up on my script and I have a dash in here also. 708 00:38:03,792 --> 00:38:06,209 That's a negative time stamp there. 709 00:38:06,626 --> 00:38:08,999 My Pwn Plug has lost its shit. 710 00:38:08,999 --> 00:38:11,125 We'll see what it thinks the time is. 711 00:38:13,209 --> 00:38:16,334 (Laughter.) WESLEY McGREW: Oops! 712 00:38:16,501 --> 00:38:17,626 What? 713 00:38:17,751 --> 00:38:18,999 Oh, what? 714 00:38:18,999 --> 00:38:21,999 (Chuckles.) WESLEY McGREW: What the hell is going on here? 715 00:38:21,999 --> 00:38:22,999 Oh, I see. 716 00:38:22,999 --> 00:38:25,083 It's already grabbed another one. 717 00:38:25,959 --> 00:38:27,083 Okay. 718 00:38:27,083 --> 00:38:28,083 We'll grab that one. 719 00:38:28,083 --> 00:38:31,709 Implausibly old time stamp 1946. 720 00:38:32,709 --> 00:38:37,125 We have defeated the Germans -- (Laughter.) WESLEY 721 00:38:37,125 --> 00:38:42,999 McGREW: Now we are wrecking shit at Landry Park, I guess. 722 00:38:44,125 --> 00:38:48,167 What we have in here, you couldn't see it from that. 723 00:38:48,709 --> 00:38:50,834 It's complaining about the time stamps. 724 00:38:51,209 --> 00:38:57,083 We have listing of files, interfaces, logs from met exploit, John, Bluetooth, 725 00:38:57,083 --> 00:39:02,209 we have the command history, things like that on here. 726 00:39:02,209 --> 00:39:04,292 Everything on this device runs as root. 727 00:39:05,375 --> 00:39:07,999 The Web interface is running as root. 728 00:39:07,999 --> 00:39:11,918 So there was nothing to keep us from doing any of this. 729 00:39:12,501 --> 00:39:13,709 And that's -- let's see. 730 00:39:13,709 --> 00:39:15,792 That's about it. 731 00:39:15,792 --> 00:39:17,167 The whole thing is broken now. 732 00:39:17,209 --> 00:39:18,959 It takes like ten minutes to get everything back 733 00:39:18,959 --> 00:39:20,709 into a good state. 734 00:39:20,999 --> 00:39:22,167 I'm glad that worked. 735 00:39:22,667 --> 00:39:25,918 So back to my slides, wherever those are. 736 00:39:25,918 --> 00:39:30,999 And so for conclusions for this, these attacker implanted devices can 737 00:39:30,999 --> 00:39:34,375 provide good counterintell. 738 00:39:34,375 --> 00:39:38,209 If you find one of these in your organization as a defender, 739 00:39:38,209 --> 00:39:41,083 it's a curse, I suppose. 740 00:39:41,459 --> 00:39:43,709 Depending on what they've already gotten. 741 00:39:43,709 --> 00:39:45,876 But you also have, you know that somebody was there that 742 00:39:45,876 --> 00:39:47,999 is going against you. 743 00:39:47,999 --> 00:39:51,125 And also you've got all the tools in front of you that are necessary 744 00:39:51,125 --> 00:39:55,167 to start counter attacking this thing and doing forensics on it to figure 745 00:39:55,167 --> 00:39:58,167 out who is doing this to me and why. 746 00:39:58,167 --> 00:40:00,918 What are they after and what have they already got? 747 00:40:00,999 --> 00:40:03,417 Those of you pentesters out there, that's very few 748 00:40:03,417 --> 00:40:07,918 of you who actually said you are going to use these devices for good. 749 00:40:07,918 --> 00:40:10,542 Know your tools, test your tools, use them safely. 750 00:40:10,626 --> 00:40:12,209 If you're an attacker, do that. 751 00:40:12,626 --> 00:40:15,083 Monitor carefully and clean up between engagements, 752 00:40:15,083 --> 00:40:17,125 things like that. 753 00:40:18,167 --> 00:40:21,792 You need to be a little more literate with your penetration testing tools than 754 00:40:21,792 --> 00:40:23,542 simply using them. 755 00:40:23,542 --> 00:40:25,375 You need to understand how they work. 756 00:40:25,501 --> 00:40:29,250 Maybe even try breaking them once in awhile. 757 00:40:29,250 --> 00:40:31,375 For breaking things, people who break things, 758 00:40:31,375 --> 00:40:34,918 pentesting tools make good targets. 759 00:40:34,918 --> 00:40:38,999 So with that, I appreciate y'all coming to my talk. 760 00:40:39,417 --> 00:40:41,209 There is no Q&A room. 761 00:40:41,209 --> 00:40:43,751 So you are just going to have to track me down before I go 762 00:40:43,751 --> 00:40:46,999 off and get bored and do something else. 763 00:40:46,999 --> 00:40:49,125 (Applause.) WESLEY McGREW: Thank you. 764 00:40:49,125 --> 00:40:49,125 If you can't track me down between now and the end 765 00:40:49,125 --> 00:40:49,125 of the Con, you can hit me up at Wesley@McGrew Security.com 766 00:40:49,125 --> 00:40:50,751 or Twitter @McGrewSecurity. 767 00:40:50,751 --> 00:40:51,751 Thanks!