00:00:00.000-->00:00:04.250 >>Hi everyone, um so, actually I just wanna talk about something before we start the 00:00:04.250-->00:00:10.667 presentation. Uh so I was a backup speaker, uh this is not the guy who um is here, I’m, 00:00:10.667-->00:00:15.417 well not, he’s not here obviously cause I’m here. Um because this is the content 00:00:15.417-->00:00:19.917 slide from his talk. So if you are looking for the z/OS stuff, please contact him he really did 00:00:19.917-->00:00:24.208 all the work. He got accepted, um he deserves the credit for it. Uh so you can just reach out 00:00:24.208-->00:00:29.125 to him on his Twitter handle at the bottom here or follow him on GitHub. So he wrote 3 couple, uh 00:00:29.125-->00:00:33.458 3 things that will basically help when you’re looking at the mainframe stuff. Uh so if you’re 00:00:33.458-->00:00:40.875 looking for that, you can follow this slide. Okay, so um we’re gonna actually do like a bunch 00:00:40.875-->00:00:44.833 of stuff. I know the nature is like about Maltego uh but really we’re gonna be looking at more 00:00:44.833-->00:00:51.000 interesting things, um and I’m gonna be using Maltego just to do the correlation uh and 00:00:51.000-->00:00:55.083 finding it. So I’m going to do a little bit of intro, like who I am, boring stuff. Uh and then 00:00:55.083-->00:01:00.458 how to do footprinting in like 10 seconds. Um and then we’ll start looking at uh interesting 00:01:00.458-->00:01:05.417 things. So I’m gonna try being uh the first section being uh hunting ICS devices. So if 00:01:05.417-->00:01:10.625 you’re looking to find uh power systems on the internet, how do we find them or what or, or 00:01:10.625-->00:01:14.625 whatever else. Um, and we’ll start by saying okay well first we want to look at maybe 00:01:14.625-->00:01:20.708 something that um I have context on, uh so I’m looking for like Nevada energy or something. And 00:01:20.708-->00:01:25.083 then we’ll more to saying okay well if I want to look at an entire country’s uh power system 00:01:25.083-->00:01:29.333 how do I look at that. Uh the second thing section we’ll look at interesting people. So the 00:01:29.333-->00:01:33.667 first section is kind of like interesting places. Um and that will be like looking at how do 00:01:33.667-->00:01:37.667 you use those uh all the different breaches that have happened to say okay well using 00:01:37.667-->00:01:42.875 footprinting and networking side I can track uh people from interesting organizations and 00:01:42.875-->00:01:48.000 find information about them outside of the organization. And then the last 1, uh just looking 00:01:48.000-->00:01:52.833 at interesting locations and individuals who work there. Um, and then questions if there are 00:01:52.833-->00:01:58.875 any and then beer. So that’s uh, the agenda for today. So a little bit about myself. Uh my 00:01:58.875-->00:02:04.292 name is Andrew MacPherson my alias is Andrew Mohawk. I’ve been worked at Paterva for 10 00:02:04.292-->00:02:12.375 years. Uh my employee number has all those zeros in incase we hire a million people then I’ll 00:02:12.375-->00:02:17.125 still be number 1. Uh and I have an Information Science degree from 2000 and 6. So also for Def 00:02:17.125-->00:02:23.625 Con and Black Hat I dyed my hair uh white, which has gone really well with my friends. Um so they 00:02:23.625-->00:02:28.250 just comment that I look like Draco all the time. It’s uh great. Um, and then of course 00:02:28.250-->00:02:32.375 like this a, this is an analogy, anyone who has a hammer everything looks like a nail. So 00:02:32.375-->00:02:36.667 to me I’m in a work at Paterva. I build a lot of stuff in Maltego I’ll basically try to 00:02:36.667-->00:02:42.375 automate everything with it. Um so I’m that guy just for the Maltego hammer. Okay, then I was 00:02:42.375-->00:02:47.125 meant to co-present with uh Roelof Temmingh, so he’s the co-founder of Sense Post. Uh 00:02:47.125-->00:02:52.708 he’s not here cause he couldn’t move his flights in time. Um but he started 10 person 2007 when I 00:02:52.708-->00:02:58.292 started there. Uh he’s the MD, he does stuff. And uh he’s done a lot of talks. So he’s really 00:02:58.292-->00:03:04.250 confident, not standing next to me though. Okay so the first section is uh generally I’ll 00:03:04.250-->00:03:08.375 tell you what is Maltego, what does it do, if you don’t’ know we’ve got loads of video 00:03:08.375-->00:03:12.417 tutorials and you’ll just see using it during the presentation, so you’ll have an 00:03:12.417-->00:03:17.708 idea of roughly ya know, what it can do. Um and then you can just follow those if you want to 00:03:17.708-->00:03:22.583 figure out more about the tool. So, there’s a heck of a lot of demos um, well there’s not a lot 00:03:22.583-->00:03:26.708 but it will be like a constant demo basically as we move through the pieces. Uh but all 00:03:26.708-->00:03:30.583 my demos really on a stable internet connection which they told me I can use the Def Con 00:03:30.583-->00:03:36.875 wireless um, so that’s really unstable. At this stage I had, I do have a MIFI device with me, 00:03:36.875-->00:03:43.000 but if ever I’m, he’s like bored to hack RF today could just not turn it on, uh til I finish the 00:03:43.000-->00:03:47.167 talk that would be great. Um then obviously I need all the code to work um, so Marco 00:03:47.167-->00:03:51.542 tweeted at me just now. He said it’s not hacking if it’s not spitting exceptions. So I’ve 00:03:51.542-->00:03:56.875 tried my best. Um this should be some, hopefully everything works but we’ll see how that goes. And 00:03:56.875-->00:04:01.125 then, obviously I’ll be using stuff that’s online so all the demos will be on the internet. 00:04:01.125-->00:04:06.667 Um I’ll be using some remote APIs and things uh so I need nothing to have changed so I’ve 00:04:06.667-->00:04:11.708 made all the sacrifices necessary. Uh but if everyone could ya know keep their fingers 00:04:11.708-->00:04:17.708 and toes crossed, h otherwise you, you really don’t want to see me dance. Okay, so a quick 00:04:17.708-->00:04:23.250 foot printing 101. So if we do a footprint on an organization I say, okay I start with a domain, 00:04:23.250-->00:04:28.417 I get DNS names, IP address, netblocks and AS numbers. Um so if you’re using it in the tool, 00:04:28.417-->00:04:34.625 I’m just gonna pick um, so try and make it a little more interesting. So I pick NSA dot 00:04:34.625-->00:04:40.875 gov. And let’s say I wanna find out ya know I wanna do, uh just a basic forward footprint. So we 00:04:40.875-->00:04:45.250 have a number of transforms to do DNS stuff like you can do MX transform uh we can look up 00:04:45.250-->00:04:50.625 passive DNS, things like that. Um and I can find all of those uh from here. So this is online, 00:04:50.625-->00:04:55.625 this needs to work, yay. Um there you can see, okay NSA is hosting their stuff that I can 00:04:55.625-->00:05:00.500 find. You can find some DNS names. And I get a whole bunch of others right, so these are 00:05:00.500-->00:05:06.375 like something NSA dot gov, um xcaliber, carry 7, and star fox. Things like this. And then I can 00:05:06.375-->00:05:12.375 say okay well if I look at this model I go domain, DNS, now DNS to IP addresses, so say okay I 00:05:12.375-->00:05:16.792 take all of these and I resolve them to IP addresses. So, pretty straightforward stuff, right? 00:05:16.792-->00:05:20.667 The idea of Maltego is that nothing in the tool is complicated, nothing that you 00:05:20.667-->00:05:25.750 could run is something that you couldn’t figure out by hand or be able to do. Um but the 00:05:25.750-->00:05:29.167 correlation is what gives you, ya know any sort of capabilities. So here you can 00:05:29.167-->00:05:35.708 see instead of one DNS name, multiple IPs. Uh straightforward stuff. Over here 2 different DNS 00:05:35.708-->00:05:40.333 names on the same IP address. Okay so what I can do then I follow it further down, I say 00:05:40.333-->00:05:45.833 okay I take the uh, different IP addresses and just take them to netblocks. Uh, that’s your 00:05:45.833-->00:05:52.167 boundaries. Alright and then I’ll take the netblocks to AS’s. So if you're all pen testing you 00:05:52.167-->00:05:55.875 can follow this section you see what I’m doing. I basically really quickly did the forward 00:05:55.875-->00:05:59.417 foot print on just waiting for those to come back. Alright so there’s the netblocks, a- take 00:05:59.417-->00:06:08.583 those to almost, take those to A S numbers and then I have that uh kind of footprint. And 00:06:08.583-->00:06:12.250 there’s nothing really interesting in a forward footprint almost all the time. 00:06:12.250-->00:06:16.292 Like this interesting stuff comes from passive. Uh looking at reverse, finding other things 00:06:16.292-->00:06:19.917 in the netblocks. And I’ll show you like as we move to like footprinting people like where 00:06:19.917-->00:06:24.417 it’s more exciting. Okay and then from the AS numbers since I don’t know any of them um, you 00:06:24.417-->00:06:29.708 can take them and say, who’s the company owner. I can figure up, okay this one belongs to uh 00:06:29.708-->00:06:37.042 Akamai. Okay so there’s like a more interesting one. So some DNS name at NSA dot gov resolve 00:06:37.042-->00:06:42.333 to the 10 net address, so I enter an IP address. Uh probably like a misconfigured DNS name. 00:06:42.333-->00:06:49.542 And then if I, so, kay so there you can see if I look it up uh it still has that address. So 00:06:49.542-->00:06:55.250 that’s kind of like new live, um so Maltego is really, really good at being able to do this 00:06:55.250-->00:06:59.083 quickly. Kay so that was a basic forward footprint, do that in a few minutes. And, and then what 00:06:59.083-->00:07:03.167 we did in the tool is we aid okay well actually you do this all the time um and we’re really 00:07:03.167-->00:07:07.250 lazy so we try to automate everything we can. Uh so this is a concept of machines which is 00:07:07.250-->00:07:10.667 the ability to then script uh basically the way that you run stuff so that it goes 00:07:10.667-->00:07:16.208 automatically. Kay so you can do it with a little bit of code There’s an example of one. And 00:07:16.208-->00:07:19.958 here I can just say okay well this must do everything that I’ve just done but in an 00:07:19.958-->00:07:23.333 automated way, right so then you can do foot prints with buttons. Kay because everybody wants to 00:07:23.333-->00:07:28.667 see it uh have it be shiny. So I can say well uh if I start with a domain uh, let’s just do NSA 00:07:28.667-->00:07:37.333 again. Kay, instead of running each individual transform I can just go and say run a machine, 00:07:37.333-->00:07:43.167 now I didn’t have touch it and it will then do the whole foot print for me. Alright so it’s a 00:07:43.167-->00:07:47.167 really nice way to kind of automate that stuff. Uh so I don’t have to do anything for 00:07:47.167-->00:07:52.083 it. And the reason that we have footprinting is so that it can give us information for 00:07:52.083-->00:07:56.333 targeting. Right so when we start targeting organizations I can say hey this footprint gave 00:07:56.333-->00:08:01.958 me DNS names, domain names, IP address, netblocks um so that I can use them when I’m looking 00:08:01.958-->00:08:05.917 for, say ICS devices or when you’re trying to profile individuals who work at 00:08:05.917-->00:08:10.167 organizations. Specifically, like more sensitive organizations. Um that we find. 00:08:10.167-->00:08:15.833 So, because we were doing I’m actually going to stop that one. Um, because the talk will head 00:08:15.833-->00:08:20.125 towards ICS devices in the first section I was like okay well what are ICS devices that I 00:08:20.125-->00:08:26.750 would be interested in? Okay so I say well Vegas is made up of basically LED’s and then I t- I 00:08:26.750-->00:08:32.667 look for energy companies in Las Vegas and the biggest one is uh Nevada Energy, right? So, I was 00:08:32.667-->00:08:36.583 like okay well this is a good place. We’re gonna find cool stuff on Nevada energy. So, if I 00:08:36.583-->00:08:45.083 do a footprint on Nevada Energy, uh, its NV energy dot com. Kay run this footprint it will go 00:08:45.083-->00:08:51.250 ahead and find all the things I’ll then use uh to start profiling them. Alright so this 00:08:51.250-->00:08:56.042 stuff if you’re a pen tester is, is kind of the defaults that you go through uh if you’re doing uh 00:08:56.042-->00:09:00.542 pen testing, especially from outside the organization. Alright, there all the DNS 00:09:00.542-->00:09:05.583 names, I’ll get those to IP addresses um and so on. So, it’s really quick to be able to do 00:09:05.583-->00:09:09.083 this with this stuff. Um and basically the take away is Maltego is really good for 00:09:09.083-->00:09:12.875 footprinting. Kay, you can do it really quickly, it makes nice graphs, people will think you’re 00:09:12.875-->00:09:17.792 doing complex stuff uh even if it’s really simple. Um also you can do things like so, I see 00:09:17.792-->00:09:23.333 it’s listed over there if I change, I can change the different layouts, um and I can 00:09:23.333-->00:09:26.792 change the sizing so I can see things that are more important in a network, right? So this 00:09:26.792-->00:09:31.167 netblock more heavily used than other ones so if I’m profiling stuff I could quickly go and 00:09:31.167-->00:09:37.625 head for that. Um, so once we’ve done the targeting then we could say okay well that’s our basics 00:09:37.625-->00:09:46.542 now we can start looking for exciting stuff. Uh. So start looking at industrial control 00:09:46.542-->00:09:52.458 systems. Alright, they’re pretty basic. Um devices that you have and they used to operate and 00:09:52.458-->00:09:56.500 automate your industrial processes. So, those are things like power, water, 00:09:56.500-->00:10:01.583 manufacturing, treatment. Um you know when you see the car advert being built and it’s like ‘jooot 00:10:01.583-->00:10:05.250 jooot’ [speaker makes noise] that’s ICS devices. Um, and these are systems that are d- 00:10:05.250-->00:10:09.042 designed to be really reliable, right? They’re there for like to run for 30 years without ever 00:10:09.042-->00:10:15.250 falling over. Um and of course you really don’t want them to fall over, right? So things go 00:10:15.250-->00:10:21.667 really bad if one sensor say for water up stream says, hey uh the water is flowing really quickly 00:10:21.667-->00:10:27.625 and then downstream they open uh the dam because they expect more water to arrive there. Right? So 00:10:27.625-->00:10:32.917 you don’t really want any breakage in this stuff. Um, and really it’s a worry thing. So if 00:10:32.917-->00:10:38.667 you want to hack ICS devices not what I’m going to cover here at all. Uh but they are like just 00:10:38.667-->00:10:42.667 100’s of different talks, tweets, YouTube videos. I could just google for it, there’s 00:10:42.667-->00:10:47.667 YouTube video uh hacking a PLC with metasploit. So you can just follow along, kick buttons, um 00:10:47.667-->00:10:52.917 and be able to compromise the devices. Alright, but the thing that you find in all of these 00:10:52.917-->00:10:57.625 videos is that actually they have the device with them. So, if I go there, they’re like oh 00:10:57.625-->00:11:02.042 cool they bought 25 PLCs. They’ve got them in their lab. They’re all IP’d in and they can 00:11:02.042-->00:11:07.167 own them. But really if you have to do it as an attacker and specifically an attacker saying, 00:11:07.167-->00:11:10.625 mmm, okay I’m looking for a really specialized target. Like either a specific industry, like 00:11:10.625-->00:11:15.875 I’m going for Nevada energy or a particular country. Like I want to own all the powers uh power 00:11:15.875-->00:11:21.875 plants in wherever, Germany. Um then you need to figure out okay well how can I find these 00:11:21.875-->00:11:25.333 different devices. Alright so that’s the first part of the talk uh that we’re looking at so 00:11:25.333-->00:11:30.125 we did footprinting. I can get information on the organization in, in this case Nevada energy 00:11:30.125-->00:11:34.875 and, and then I can say okay well actually these devices I need to figure out how they’re 00:11:34.875-->00:11:39.167 on the internet. And first, uh if you go so you go to one of the Sherdin pages, it tells you 00:11:39.167-->00:11:43.375 about it. They, a lot of them have implemented networking. They’re basically like hacked it 00:11:43.375-->00:11:49.917 on to the actually devices. Because these devices are really old uh for the most part. 00:11:49.917-->00:11:52.000 Haven’t been really updated uh as quickly as the rest of the security. So there’s a couple of 00:11:52.000-->00:11:55.458 major protocols that you’ll find, um and they’re like Modbus, Siemens S7, and Niagara 00:11:55.458-->00:11:59.542 Fox and, and things that you’ll be able to search for. Uh then of course if you look through 00:11:59.542-->00:12:04.625 the documentation right everyone is like, hey by default please file all these devices. Uh put 00:12:04.625-->00:12:08.542 them in a egg up network. Make sure they’re not on the internet. Um and everyone should 00:12:08.542-->00:12:13.417 follow the documentation I guess but uh it doesn’t really ever happen. So, uh then we get onto 00:12:13.417-->00:12:17.917 Shodam. So Shodam uh basically a search engine for the internet. Actually the guy that wrote 00:12:17.917-->00:12:23.292 Shodam is here somewhere. Um and it allows us to search for particular strings. So if I 00:12:23.292-->00:12:31.083 open, uh so if open Shodam I can search for I don’t know, let’s say I was looking for uh, apache 00:12:31.083-->00:12:36.333 point 2 point 2 point 2. And it will find all different things on the internet that match 00:12:36.333-->00:12:46.333 apache 2 point 2 if I click on search. Hopefully. So here it says, hey this is a particular 00:12:46.333-->00:12:51.042 machine running that, uh I can see the different countries. So what I can do is okay instead of 00:12:51.042-->00:12:55.208 looking for this sort of stuff, I’m looking for ICS devices and if I look at this I can see 00:12:55.208-->00:12:59.500 there are, so there’s a bunch of different protocols and each of these kind of has their own 00:12:59.500-->00:13:08.208 spec. So if I take something like um, so just do port 1 oh 2. So, that’s uh for the uh 7 stuff 00:13:08.208-->00:13:12.667 if I remember right. So then here I get these results, right? And look at these results and it 00:13:12.667-->00:13:17.333 says hey, uh there’s this is located in Turkey, this some basic hardware. Uh the firmware 00:13:17.333-->00:13:21.042 version. So things that are on the internet that I can find. Right but remember we’re trying 00:13:21.042-->00:13:24.917 to target something. Like, I don’t want to just go and shotgun approach every single 00:13:24.917-->00:13:28.958 ICS device in the world. I want to find specific ones. And most of the time they don’t have sort 00:13:28.958-->00:13:36.750 of the information pulled in so I think there will be one maybe. Mmm. Uh yea, so here’s one that 00:13:36.750-->00:13:41.292 says hey this one's got a plant identification, it’s at the Mauser Factory, um and it’s in 00:13:41.292-->00:13:46.167 Taiwan. Right so then I could say, okay if I was targeting that, that’s really good uh 00:13:46.167-->00:13:51.167 stuff that I can use. So, the first way that we try to do it is to say okay well I can go 00:13:51.167-->00:13:56.000 through all the ICS devices and I can start targeting them. So, the idea would be that um you 00:13:56.000-->00:14:01.208 can take these ICS devices and let’s say you had uh some vulnerabilities in a couple of 00:14:01.208-->00:14:04.875 them, you would say okay well these are the ones I’m looking at. And I can basically go and 00:14:04.875-->00:14:11.125 do what I just did but in the tool. Um, it’s not that exciting. So, I’ll just say port 00:14:11.125-->00:14:25.000 1 oh 2, find me all the um ICS IP addresses. Right so any device that matches that uh, w- 00:14:25.000-->00:14:32.583 actually, sorry that’s not the right one. So, port 1 oh 2 uh just on default Shodam. Alright 00:14:32.583-->00:14:35.333 that will then go and give you that list of however many I’ve requested. So in this case 255 00:14:35.333-->00:14:40.125 but if you were to go through each individual one, so I mean for the cement stuff there’s 00:14:40.125-->00:14:46.250 like 2-->000. But if I take uh, 5 oh 2 or one of the others, then you’ll see that there’s like, 00:14:46.250-->00:14:50.417 there could be a heck of a lot, Right so there’s 13-->000. I’ve got to go through each category, 00:14:50.417-->00:14:54.292 there’s like 20 of them. Um and it will take a really long time. So hopefully this is going to 00:14:54.292-->00:15:00.917 come back. In the event that it doesn’t come back I do actually have a graph of this. Uh so this 00:15:00.917-->00:15:08.375 isn’t really exciting so, I’ll open that graph. Kay so if I open this graph it basically 00:15:08.375-->00:15:12.333 says a search report wanted to go to these IP addresses out. I can go in there and look at 00:15:12.333-->00:15:19.792 them. I can see the results. Uh, in here you get the data segment that says, uh let me just move 00:15:19.792-->00:15:23.458 this slightly bigger. So it says all the defaults that we found right? No planted 00:15:23.458-->00:15:27.583 identification. And then I’ll say well if I’m targeting Nevada Energy I could say search for 00:15:27.583-->00:15:33.958 the word energy, right down here. I say find this one device and it’s called new underscore 00:15:33.958-->00:15:39.292 energy underscore 1. So that may be interesting but it doesn’t say Nevada Energy. So, that’s 00:15:39.292-->00:15:42.708 the main problem, it doesn’t really work actually if you’re trying to compromise these sort 00:15:42.708-->00:15:47.167 of things. Um plus it’s really tedious to do because I have to go through each individual one. 00:15:47.167-->00:15:51.375 So then the next thing you say okay well obviously that’s dumb thing to do things, right you’re 00:15:51.375-->00:15:54.958 not going to go through each individual thing. You’re gonna say well let’s make 1 way to 00:15:54.958-->00:15:59.375 search for all of them. So kind of like the google hacking of before. I can say well I’ve got 00:15:59.375-->00:16:04.333 something that I found. I can put it into Shodam and I can search for all of these 00:16:04.333-->00:16:08.208 different things. I can search for port 5 oh 2. I can search for port 1 oh 2. All of these, 00:16:08.208-->00:16:13.625 uh so some of these require other th- stuff like 19 62 and PLC. And, and then I’ll be able 00:16:13.625-->00:16:18.417 to say okay well what I can do for a particular organization I can run this footprint. Get a 00:16:18.417-->00:16:23.042 bunch of these details out and then I’ll be able to say okay from here I can go and find the 00:16:23.042-->00:16:35.875 ICS devices. Right so it’d be if I um, where’s my Nevada Energy graph? Uh, kay so this one's on 00:16:35.875-->00:16:42.917 Nevada Energy I could say, take these netblocks that I found, uh let’s put that in normal mode. 00:16:42.917-->00:16:47.000 Alright so take these individual netblocks where I found new information from the company, I 00:16:47.000-->00:16:55.333 did the footprint and uh take one of those and now run the transform that says, r- so take 00:16:55.333-->00:16:59.917 2 ICS IP address. Alright so what that does is it takes every netblock converts it to CID off 00:16:59.917-->00:17:04.292 of Shodam and then it will each for each individual port, each individual property that we have 00:17:04.292-->00:17:07.417 that will make these identifiable. Alright and here at the bottom you can see, so I 00:17:07.417-->00:17:11.667 just put the output on so you can see what’s there. So it’s searching for net colon whatever 00:17:11.667-->00:17:16.167 the CIDR every port or SLS address or whatever else. And you’ll see here you’ve got 00:17:16.167-->00:17:21.417 actually no results. Alright so I’ve got zero results. Uh from everything. Which is really lame 00:17:21.417-->00:17:25.833 cause I was like okay if I’m an organization it’s gonna be on their network. Right? They’ve 00:17:25.833-->00:17:31.167 gotta secure this stuff. It is, ya know fairly important to their uh business. So it doesn’t 00:17:31.167-->00:17:35.125 actually work either. Right. The only thing nice about it is I can start with footprinting 00:17:35.125-->00:17:40.125 information and I can say cool, while I can go from the domain or the network or the IP address 00:17:40.125-->00:17:46.250 and I can say okay, I can use that and I can apply it. It does work sometimes. So I did some 00:17:46.250-->00:17:52.417 other footprints. Uh when I was playing around with it. And if you take uh basically any 00:17:52.417-->00:17:57.000 university alright so their footprint is slightly larger if you uh look at it on scale 00:17:57.000-->00:18:03.875 alright. But I can find a bunch of different uh ICS devices from Shodam on there. And I can go 00:18:03.875-->00:18:07.625 and look at them and you’ll see that those are really nicely done. So a lot of the time 00:18:07.625-->00:18:12.833 they’ve got good DNS names. They say uh, this is for bacnet. They’ve got it in the host name. 00:18:12.833-->00:18:17.750 Um and I can read about it. So they fill in these details but actually I’m looking to target 00:18:17.750-->00:18:22.250 something more interesting. So this really doesn’t work for me either. So at this stage we’re 00:18:22.250-->00:18:25.500 like well what other stuff can we do, right? So we can’t, we can’t do, it’s not on the 00:18:25.500-->00:18:30.333 network. Um, we can’t just search all ICS devices and hope that someone put in Nevada 00:18:30.333-->00:18:36.625 Energy. Uh cause they didn’t do that either if you’re wondering. So we say okay well, what other 00:18:36.625-->00:18:42.292 kind of stuff can I give Shodam to say, I’ve got this piece of information and I wanna say okay 00:18:42.292-->00:18:48.000 from here I wanna take it to ya know, whatever my ICS devices with all these different things. 00:18:48.000-->00:18:52.208 And one of the things you can give Shodam is you can give it a GPS coordinate. Kay so this is 00:18:52.208-->00:18:57.625 really cool because I can say well I know some stuff about Nevada energy like if um, if I 00:18:57.625-->00:19:02.875 had to look at it I’ll say I know that they’re probably going to be in Las Vegas. I want to 00:19:02.875-->00:19:07.083 turn off all the LED’s I go to get them from uh Vegas. So what I can do is I can take any sort 00:19:07.083-->00:19:13.292 of point in Vegas, I’m just going to zoom out a bit. Alright so here’s all of Las Vegas and I 00:19:13.292-->00:19:20.042 can say okay I pick a point roughly central and I take the GPS coordinates. Alright so from 00:19:20.042-->00:19:26.583 around here um, I can take these GPS coordinates and I can say okay, find me IP addresses 00:19:26.583-->00:19:31.833 around these GPS coordinates that match any sort of the ICS devices. Match port 1 and 2, 00:19:31.833-->00:19:36.917 bacnet, Siemens S7, all of that stuff. And I can put it in a radius. Kay so in this case I 00:19:36.917-->00:19:41.833 mean it’s, where is it? It’s really huge, right? So I’m gonna put in like 50-kilometers. I 00:19:41.833-->00:19:47.750 mean in miles that’s 10-->000. I don’t know how to do the conversion. Um it’s something 00:19:47.750-->00:19:53.583 really big. So uh, hopefully this is gonna run so this will take a while. And, and this is 00:19:53.583-->00:19:57.792 then going to show saying okay I’ve got these points I can go within a 50-kilometer radius 00:19:57.792-->00:20:03.667 find any IP addresses. So they’ve got a really cool way that they can go from uh GPS 00:20:03.667-->00:20:08.542 coordinates to IP addresses which is really tricky and we’ll, we’ll talk about it uh 00:20:08.542-->00:20:11.750 just not when you, when you look at like look doing a sort of country scale attack on this 00:20:11.750-->00:20:33.083 sort of stuff. Now I really need the internet to work with me here. That still going. I’ve 00:20:33.083-->00:20:38.167 decided this one is taking too long as well. Um it should come back to us and I’ll probably 00:20:38.167-->00:20:45.000 just switch off to it. Bu tI have these saved as well. So, um, Las Vegas, ICS Devices. So, 00:20:45.000-->00:20:53.167 oh, here again we started from GPS coordinates but from the GPS coordinates we found all the 00:20:53.167-->00:20:58.042 different ICS devices for Vegas. Kay, so I’m just gonna work with this so we can step through it. 00:20:58.042-->00:21:04.583 Kay see here GPS coordinates, all the ICS devices. But actually, that doesn’t tell me 00:21:04.583-->00:21:08.708 exactly where it is. It just tells me that within 50 kilometers of the central point 00:21:08.708-->00:21:12.417 I picked in Las Vegas I can find these. So, what I want to do is I want to say okay well for all 00:21:12.417-->00:21:16.042 of these different devices show me exactly where they are. Alright so, I’m gonna select 00:21:16.042-->00:21:21.917 those. And now the other graph came back, see the demo does work it just takes really long. 00:21:21.917-->00:21:26.625 Um, bu there I can say okay I’ve got these ICS devices and I’m gonna pull up the exact 00:21:26.625-->00:21:32.750 coordinates. Alright so uh, I wanna see these particular coordinates now they’re coming 00:21:32.750-->00:21:37.375 back, um and that will give me information about it as well. So we’re trying to find a lot more 00:21:37.375-->00:21:40.958 than just GPS, like stuff that says, Desert Toyota, no idea what that means. But that’s fold 00:21:40.958-->00:21:45.750 in on the PLC right, so whatever they have or whatever kind of device it is, uh they’ve got. 00:21:45.750-->00:21:50.583 So, if that's running then putting out all of those. So, I could say okay, well on my map 00:21:50.583-->00:21:56.958 um, this is CCU, CCU dot I don’t know what it is I’m just going to pick a random one. Um and I 00:21:56.958-->00:22:01.250 can then just put it in make sure, hey is this still in Vegas is this the right place. So that 00:22:01.250-->00:22:07.542 you can see it’s still in Vegas and hopefully on someway near something that’s using, uh PLC 00:22:07.542-->00:22:14.833 or ICS device. Maybe it’s shell. I’m not really sure where it is. Um and we’ll look at why this is 00:22:14.833-->00:22:18.792 interesting. Now so now I’ve got all of them I’m gonna say okay well actually I want to 00:22:18.792-->00:22:21.750 visualize all of these devices right. I, cause I’m not going to go through each one like that, 00:22:21.750-->00:22:27.458 that will take me forever. Uh so I’m gonna take all the GPS coordinates, all the ICS devices 00:22:27.458-->00:22:43.375 and I’m just gonna send it to a map. Kay, hopefully this loads up. And next okay, cool. So now 00:22:43.375-->00:22:46.917 I’ve got a map of all ICS devices in Las Vegas and I can go through them and say hey, 00:22:46.917-->00:22:53.167 what’s on this one, nothing, GPS great. Uh this one say, JCI, I don’t know what that stuff is. 00:22:53.167-->00:22:57.708 And remember we’re trying to get Nevada Energy so what you do is go through all of them and since 00:22:57.708-->00:23:02.417 I’ve cheated before I actually know where it is. Um, but you could zoom into this one over 00:23:02.417-->00:23:08.125 here alright and you will see that this one is at Popeyes Louisiana kitchen, alright. 00:23:08.125-->00:23:12.292 Seems unlikely that they’ll have an ICS device. But if you look just next door that’s where 00:23:12.292-->00:23:16.542 Nevada Energy is, alright so if you were targeting them I’d say that’s likely to be the ICS 00:23:16.542-->00:23:20.875 device that’s sitting at this particular place so then I can target that and say hey there’s 00:23:20.875-->00:23:26.083 my target. I can’t match it on the other things but I can find it uh in this sort of way. So 00:23:26.083-->00:23:30.042 that’s really cool to be able to find it so I can target uh that particle thing and you can see 00:23:30.042-->00:23:34.833 it in the slides. So now I least get results, now I can at least find something that says Nevada 00:23:34.833-->00:23:38.042 Energy. That’s pretty good. That’s how I could do it. But actually it’s, it’s kind of 00:23:38.042-->00:23:41.750 manual and you know I have to get lucky on it. Um and mostly because of these coordinate 00:23:41.750-->00:23:46.583 systems. Which kind of sucks uh if I’m doing a densely populated area. But actually if I’m 00:23:46.583-->00:23:52.083 looking to be someone who targets, okay not just Nevada Energy I target like all power 00:23:52.083-->00:23:58.833 systems in Poland, right. I decided that actually I’m going to attack Poland today. Um so in 00:23:58.833-->00:24:04.833 a dense area that stuff sucks if it’s, if it’s out but in an, in an unpopulated area so if I look 00:24:04.833-->00:24:12.292 at something like, uh actually I have this written down so I don’t have to do this. Right, if 00:24:12.292-->00:24:16.917 I look at something like this, so this is a power station in Poland somewhere. Um, if it 00:24:16.917-->00:24:23.542 loads up. There we go. Kay and if I look at this power station over here you can see that 00:24:23.542-->00:24:27.583 they’ve got the chimneys with the smoke so they must make electricity that’s how I know 00:24:27.583-->00:24:31.833 that that works. Um and I can say okay well if I know that this power station is there and 00:24:31.833-->00:24:36.292 if you look around it like there’s nothing. Right it’s like countryside and you know no real 00:24:36.292-->00:24:40.417 towns so, I’m not actually worried about hitting other ICS devices. So what I can do is I 00:24:40.417-->00:24:45.750 can say well let me take a coordinate kind of right in the middle of the power station over 00:24:45.750-->00:24:55.333 here. Uh, and then say well for these GPS coordinates let me look for any IP addresses around 00:24:55.333-->00:24:59.875 it and this time I gonna take just a radius of 3 kilometers right because actually I could 00:24:59.875-->00:25:04.500 make it bigger uh because there’s nothing else around it. So here I find hopefully some 00:25:04.500-->00:25:11.458 results. So we’ll wait for that to return. So, so there I find 2 individual uh there’s a Ethernet 00:25:11.458-->00:25:16.167 IP uh both Ethernet IP devices. So I could take these and say okay show me the properties of 00:25:16.167-->00:25:20.458 them uh so I can pull out their GPS. You see they’re both at the same place. And if I go and look 00:25:20.458-->00:25:27.292 at those particular ones uh you’ll see that it says, hey these ICS devices are located in 00:25:27.292-->00:25:32.083 this cool field, alright. Uh and this field doesn’t run a lot of power systems. So it’s unlikely 00:25:32.083-->00:25:36.958 that it’s gonna be in here. But it is sus- ya know close enough to the power station that I’m 00:25:36.958-->00:25:41.083 looking at that I can argue, okay that’s probably gonna be my targets. So if I’m targeting uh 00:25:41.083-->00:25:46.125 all power stations in a particular place or in this place just this one and I know 00:25:46.125-->00:25:50.833 that they’re not going be in the city then this is okay for me, Like this will work uh because I 00:25:50.833-->00:25:56.875 can argue that most likely I’m gonna uh be able to get to that. So that way works pretty well 00:25:56.875-->00:26:01.458 within a 3 kilometer radius, that worked out fine. Um but actually if I wanted to target 00:26:01.458-->00:26:07.250 in this case all power plants in Poland then I’d have to go and like google power plants in 00:26:07.250-->00:26:11.458 Poland, I get a lot of them from like Wikipedia or something. I’d have to go find them on google, 00:26:11.458-->00:26:16.167 find all the GPS coordinates put them all into Maltego and then I can run with it. Alright. So 00:26:16.167-->00:26:20.917 that doesn’t really work for us. We’re like, well how can I find all power systems in a 00:26:20.917-->00:26:25.375 particular area? We found this thing called GEONAMES so GEONAMES is a geographical 00:26:25.375-->00:26:30.875 database and um, it’s really nice because you can look up a place and you get tit’s 00:26:30.875-->00:26:34.917 location. Like you get GPS coordinates you put in Eiffel tower, there you go, GPS 00:26:34.917-->00:26:40.000 coordinates for it. But because it’s got a really nice API we can use it in the reverse way. 00:26:40.000-->00:26:45.625 So they categorize everything by saying either it’s, uh ya know tourist spots, uh or things like 00:26:45.625-->00:26:51.708 power station, wind mill, uh hydroelectric plants, things like that. So what I can do is I 00:26:51.708-->00:26:56.625 can say well actually I’m gonna start at the categories and I’m gonna say, hey I’m looking for 00:26:56.625-->00:27:01.042 any categories that match power then I’m gonna say okay from here show me any devices you 00:27:01.042-->00:27:06.458 have or any GPS coordinates you have that match my category of power in a particular location, 00:27:06.458-->00:27:12.792 right. So I’m using the reverse of it. Uh so if I do that in tool, over here. Uh everything 00:27:12.792-->00:27:18.792 you can do with the free version as well, sorry I’m using the paid for version here. Um, so if 00:27:18.792-->00:27:23.208 I take power and I search for uh feature codes, so this is what they call it in the tool, then I 00:27:23.208-->00:27:27.958 get out uh like 3 or 4 different ones. So power station, windmill, not sure why it 00:27:27.958-->00:27:34.500 references power but clearly it does something, hydroelectric power station. Alright so then I 00:27:34.500-->00:27:39.333 can say well from a power station show me all the locations that you have. And it 00:27:39.333-->00:27:42.583 will say okay well what country do you want to look that up in? And I can say in this case 00:27:42.583-->00:27:48.667 Poland, alright so PL. And I get all the different power stations hopefully for a particular 00:27:48.667-->00:27:56.125 location. Mm, so now I’ve essentially gone and said okay well doing it just this way I 00:27:56.125-->00:28:00.375 know exactly where every power station is and now I can start doing the ICS device. So just a 00:28:00.375-->00:28:05.958 s- sanity check then I'll pick a random one and hopefully it shows it nicely. Uh so this is 00:28:05.958-->00:28:14.042 that is the Leuven Railway Substation. Kay, wherever that is. That hopefully has the 00:28:14.042-->00:28:23.125 chimney that makes the electricity. Um, kay now uh, that was too much. Uh so it’s 00:28:23.125-->00:28:29.375 over here. Maybe I can street view it. Kay so middle of Poland, not a lot of streets, 00:28:29.375-->00:28:33.167 not a lot of Google cars have been here. Um, but this is obviously gonna be one of the 00:28:33.167-->00:28:36.292 substations. Right if you go through them until I find another one uh like the one that 00:28:36.292-->00:28:41.833 we saw. So I’ve got all the coordinates and I’ve said, okay so all the power stations, all 00:28:41.833-->00:28:45.667 the ones in Poland and then I can run that transform that says, okay find all the ICS 00:28:45.667-->00:28:51.625 devices around here within a 3 kilometer radius. So essentially what I’ve done is now plotted 00:28:51.625-->00:28:59.083 all the ICS devices in a particular country based on the category um so that if you were 00:28:59.083-->00:29:02.208 targeting them um you know you could target them all at once. Alright just say, hey these are 00:29:02.208-->00:29:06.500 the vulnerabilities I’ve got, they impact C97 or 96 or whatever else. And and, then I 00:29:06.500-->00:29:10.125 can go and start looking at those. So you’ll see I didn’t get results for all of them 00:29:10.125-->00:29:14.375 obviously they might actually have not put them on the internet. Uh or something like 00:29:14.375-->00:29:18.917 that. Uh but these ones I can then find all of them. Alright so here’s one this ModBus uh 00:29:18.917-->00:29:23.917 come on, here you go, Fox, uh things like that. So now I have, okay all of the different 00:29:23.917-->00:29:28.667 locations and then this is where you’d go and uh attack that sort of information. Alright so it’s 00:29:28.667-->00:29:35.208 really nice to be able to do that, to say okay I’ve got it on a country. And so just as a side 00:29:35.208-->00:29:39.958 note on this, the only reason we have the ability to do this is that we’re arguing that, that 00:29:39.958-->00:29:43.500 the geo to IP stuff works pretty well right. We’re saying if I give you coordinates you can 00:29:43.500-->00:29:48.583 tell me IP addresses are on there, I can scan those IP addresses if they have uh you 00:29:48.583-->00:29:53.583 know the right sort of ICS stuff uh that’s there. So if people ask, hey is this actually good? 00:29:53.583-->00:29:58.875 Sometimes. Right, that’s like the best I’ve got for it. So in denser areas geo to IP is pretty 00:29:58.875-->00:30:02.250 good, kay because the way they work it out is generally they look at like the latency times 00:30:02.250-->00:30:08.167 and they can say it’s likely to be located here. Um, based on this. So, in less populated 00:30:08.167-->00:30:12.583 areas it is worse but most of the time that’s okay because the targets that you’re looking at 00:30:12.583-->00:30:18.958 are going to be surrounded by ya know nothing that will impact your search. So if you look at 00:30:18.958-->00:30:24.542 an example of this. Here’s an ICS device that says it’s in Grey Street 164. So we could say 00:30:24.542-->00:30:29.583 okay that’s exactly where it is and then we could say well where did we find it? We find it over 00:30:29.583-->00:30:36.000 here. So it’s about 300 meters out. Which for most part isn’t too bad because you remember if 00:30:36.000-->00:30:41.667 you’re doing some sort of attack that says well I’m gonna go for in this case let’s say 00:30:41.667-->00:30:46.000 everything in a harbor and I end up taking down like the manufacturer plant that’s next 00:30:46.000-->00:30:49.833 to the harbor, I’m still going to cause like a whole lot of chaos um and that might be okay 00:30:49.833-->00:30:54.792 for what I’m doing. So it really depends on the type of attacks. But here we’re looking at server 00:30:54.792-->00:31:02.333 log collateral especially in the denser areas. Um, if you are doing that. Uh [inaudible] okay. 00:31:02.333-->00:31:07.208 So that’s on ICS devices. Right so we can find interesting places I can be like, hey I can 00:31:07.208-->00:31:13.375 find all of the based on the country or I can look at uh where their physical located and 00:31:13.375-->00:31:16.208 I can find each individual one that I’m looking for and that gives us interesting 00:31:16.208-->00:31:20.125 infrastructure to target. But what about people? So if I wanna look at interesting um people 00:31:20.125-->00:31:24.958 who work at interesting places. So I don’t care about like people who don’t work at like 00:31:24.958-->00:31:29.833 places that don’t end in gov or something that I’d target. In this case because I’m an 00:31:29.833-->00:31:34.667 attacker looking for that sort of scale. Um so breaches happen all the time. Alright there’s 00:31:34.667-->00:31:38.958 like 100’s of them. Uh there’s loads and loads of different data sources you can use to get 00:31:38.958-->00:31:47.083 these. And everyone kind of does the same order of it. So they say hey are there credit cards 00:31:47.083-->00:31:50.667 in there? Who's involved in this? Um and you can get like there’s loads of work done on 00:31:50.667-->00:31:54.792 this by like blogs and white papers and things like this. And actually I’m just gonna use that 00:31:54.792-->00:32:01.000 Ashley Madison as an initial example. Um and then I’ll go from there. So, um you don’t 00:32:01.000-->00:32:06.417 actually need to know this slide. We’ll get into the talk I use like a bunch of things um 00:32:06.417-->00:32:11.417 they are free but uh that’s not really that important. Uh this one, essentially what happens 00:32:11.417-->00:32:15.125 with the database is they have got fields like email address field, or the IP 00:32:15.125-->00:32:18.333 address. But if you want to do what we’re doing and say well we’ve got a footprint of a 00:32:18.333-->00:32:24.500 netblock and I wanna take that to ya know all users that are in there. You have to convert the 00:32:24.500-->00:32:28.167 netblock to long and IP addresses um so that you can use it. Uh s- so some basic fudging 00:32:28.167-->00:32:33.000 of the data to get it to uh work. So I’m just gonna skip that. Uh but basically if you’re 00:32:33.000-->00:32:38.042 u- looking at it from a forward method I can say well I can go from a domain to a profile or a 00:32:38.042-->00:32:43.500 email address, or a alias to a profile and that’s fairly interesting, maybe. I mean it’s 00:32:43.500-->00:32:51.833 okay. Um, but users who obviously who work in places that are like more critical I’d 00:32:51.833-->00:32:55.292 say ya know, you probably shouldn’t be in there. So you say we, we generally say users 00:32:55.292-->00:32:58.292 don’t’ register work email address on places like this. Kay but if you take something like 00:32:58.292-->00:33:03.458 um, state dot gov right because they also denied the visa the previous guy. I can say well if 00:33:03.458-->00:33:10.833 I look at Ashley Madison there are um, 34 different accounts there. Alright so then I can 00:33:10.833-->00:33:13.417 take those accounts and I can take them to emails addresses and I can look at the email 00:33:13.417-->00:33:17.625 addresses. So I know that Ashley Madison the signup process is a bit weird. So someone could have 00:33:17.625-->00:33:21.208 signed them up. Uh there are 34 of them and actually you can take each one to transaction to 00:33:21.208-->00:33:25.667 start looking at how many of these people have paid money so that you can say well that’s 00:33:25.667-->00:33:29.667 probably a legitimate account. Alright but these are all state dot gov accounts so that’s one 00:33:29.667-->00:33:34.042 way that you’d do it, you just look at those profiles. I go in target those individuals. Um but 00:33:34.042-->00:33:38.667 not really that exciting. So, a way that’s way more exciting is to say well let me look at the 00:33:38.667-->00:33:44.375 foot printing stuff and say well if I know that you work at uh let’s say the CIA right. So 00:33:44.375-->00:33:48.958 that’s gonna be our example. I saw you work at the CIA then I can do a footprint of the 00:33:48.958-->00:33:53.458 organization and CIA didn’t register, well at least not at CIA dot gov. Um they didn’t 00:33:53.458-->00:33:57.917 register any accounts in that database. So now okay, I’m not going to find them. But what I 00:33:57.917-->00:34:02.250 do know is I know that I can foot print their organization really well. Kay so if I take uh 00:34:02.250-->00:34:15.292 the CIA uh, let’s do it from here. Take CIA dot gov um, I run the footprint on it. Kay that 00:34:15.292-->00:34:19.042 will then go and find all the different results for me so I can look at it. So the idea that 00:34:19.042-->00:34:23.042 I’m looking for here is I’m trying to find okay what network space do they have on the 00:34:23.042-->00:34:27.167 internet? Kay, Cause if I know what network space they have on the internet I can start looking 00:34:27.167-->00:34:31.375 at that. I realize I started this clock a little bit late. Okay, uh we’re gonna skip doing 00:34:31.375-->00:34:36.625 the actual foot print and I’m gonna open it so that we can get to the good stuff. Uh see I 00:34:36.625-->00:34:45.125 wanted to. Hey. Okay so here’s the CIA foot print you just have to trust me that it’s right. Um 00:34:45.125-->00:34:50.750 and if I look at it I’ve done like the networking side of things. I can find this. Why is 00:34:50.750-->00:34:55.542 this still running? I can find this uh particular netblock. Alright so this netblock is 00:34:55.542-->00:34:58.167 interesting to me because most of this stuff sits in it. So I’m gonna say okay, I’m gonna work 00:34:58.167-->00:35:02.500 with this netblock. Um and now I’ve got this netblock over here. The first thing I’m gonna 00:35:02.500-->00:35:07.417 do is just take it to IP addresses. Alright. Uh fairly, f- I mean there chance it 00:35:07.417-->00:35:14.917 doesn’t actually do anything. Uh where’s to IP, uh there it is. Kay so that just says, found the 00:35:14.917-->00:35:17.833 IP address in netblock pulled them out individually so I can work with it. Alright so one of 00:35:17.833-->00:35:20.625 the first things that I generally do is when we do this, is I footprinted the 00:35:20.625-->00:35:25.750 organization. I find CIA uses this netblock. Um then I run a transform that says to Wikipedia 00:35:25.750-->00:35:33.000 page edits. And the reason I wanna do that is if you look at a Wikipedia page um, you can see 00:35:33.000-->00:35:36.125 edits and edits by the history right? So if you don’t have an account if you have an account 00:35:36.125-->00:35:40.875 you will say uh here’s your username. If you don’t have an account it gives you the IP 00:35:40.875-->00:35:45.333 address. So what I can do is I can foot print an organization, figure out the network space, 00:35:45.333-->00:35:49.875 take it to all the IP addresses and then say from these IP addresses show me any places 00:35:49.875-->00:35:54.375 that they’ve been on the internet. That’s if I find out in Wikipedia which hopefully 00:35:54.375-->00:35:59.250 will happen very soon. Um, then I can say okay I know they edited those. So I actually get 00:35:59.250-->00:36:03.875 some a whole bunch of context. So I get firstly that I know they uh edited pages so I know 00:36:03.875-->00:36:08.792 info-information about the people. Right? Someone edits it like, how to stuff teddy bears? 00:36:08.792-->00:36:12.917 Then I know if I’m going to do a phishing attack ya know stuffing of teddy bears will be a good 00:36:12.917-->00:36:18.333 topic. Um, so I can see all of these if I need it validated I can just see where the pages 00:36:18.333-->00:36:24.042 are. So if I take uh, intelligence you’ll see that here these are all the a pages 00:36:24.042-->00:36:28.708 that they’ve edited that, with the word intelligence, right so if I take uh let’s look at 00:36:28.708-->00:36:34.708 central intelligence. Uh, then I can see what they edited. So here’s the difference, they um, 00:36:34.708-->00:36:44.292 they removed the text that said the agency has embassy in every state in the union and every 00:36:44.292-->00:36:49.167 nation in the world. So someone at the CIA removed that from there. Kay but more importantly 00:36:49.167-->00:36:53.417 uh instead of just these uh. While I’ve got these, IP addresses and I can see stuff 00:36:53.417-->00:36:57.042 they edit I know that these are probably their exit nodes. Alright they’ve got a huge 00:36:57.042-->00:37:00.708 network. All the network funnels through these points um and there I can say, hey these 00:37:00.708-->00:37:05.458 particular nodes are mostly likely their exit nodes. So now what I can do is I can say, well 00:37:05.458-->00:37:09.583 if I look through all the breach data I can say well I don’t care that they didn’t register from a 00:37:09.583-->00:37:15.625 so this is CIA, I don’t care that they registered, that they didn’t register from CIA. But 00:37:15.625-->00:37:18.375 show me anyone who has an account that came from one of these IP addresses. Cause I know 00:37:18.375-->00:37:22.333 if they’re browsing the internet they’re probably going uh through these, uh accounts. So 00:37:22.333-->00:37:27.292 I’m gonna take it to the Ashley Madison one. Uh and Ashley Madison is obviously just an 00:37:27.292-->00:37:31.250 example. There’s a lot more. Okay so there’s the account. So here I can see that’s the 00:37:31.250-->00:37:35.417 account number. And I can take that to email address and now I’m gonna have to zoom in very 00:37:35.417-->00:37:41.458 quickly. Kay, uh there we go. So you can see that that is at Gmail. So I don’t want to put 00:37:41.458-->00:37:46.333 the address on the, on the screen or whatever. >>Aww >>You [laughter] so you can go and 00:37:46.333-->00:37:51.458 look it up it’s in the database anyway. Um hopefully figure out how to do it. So that’s really 00:37:51.458-->00:37:56.000 interesting for us to be able to say okay I can find the exit nodes, I can find people who 00:37:56.000-->00:37:59.958 work at those organizations and their accounts. Um and this is the example that we just ran 00:37:59.958-->00:38:04.625 through right. So get the networking, find the exit nodes so I can see the wiki pages that 00:38:04.625-->00:38:09.375 they edited so I now those are likely exit nodes. Uh then I find the profile. So if this is 00:38:09.375-->00:38:13.125 also blurred out, um and actually then we’ll say okay let’s validate the profile. 00:38:13.125-->00:38:17.208 Let’s look it up elsewhere on the internet and you see something like we found the CV 00:38:17.208-->00:38:22.417 so same email address. Says he worked at the CIA. Uh, November 20 11, it’s currently. Um and 00:38:22.417-->00:38:27.417 then of course we found like some worse stuff. So like there’s a GitHub account and on 00:38:27.417-->00:38:31.292 the GitHub account he has like credentials for Gmail. Uh including his email address so 00:38:31.292-->00:38:37.000 someone could log into it. Um, and actually that’s probably too much information. Like if we’re 00:38:37.000-->00:38:40.333 looking at it, we’ll say that profile seems too easy. Like to find that much information about 00:38:40.333-->00:38:44.875 a person is really unlikely including passwords and things. So it could possible be a honey 00:38:44.875-->00:38:50.250 pot for um, them because they know that that data is in there. I mean we can’t say for sure but 00:38:50.250-->00:38:55.375 obviously there’s a lot more than just that one person um that you could use. Alright then 00:38:55.375-->00:39:00.542 uh I think I still have like a few minutes. Um then the other thing is that we have some 00:39:00.542-->00:39:04.000 friends at uh SocialLinks and we told them about this idea. And they said, hey they’ve got tons 00:39:04.000-->00:39:08.667 of breaches, well they can find it and they can get us these uh you know they can get us other 00:39:08.667-->00:39:12.542 information ‘bout this. So instead of saying we just looked at Ashley Madison, they said 00:39:12.542-->00:39:16.417 well they’ve got 100 of them, let’s go and use those. And when you do that I’m just going to 00:39:16.417-->00:39:20.542 show you the graph at the bottom here. You’ll see that here’s all the different uh account and 00:39:20.542-->00:39:25.292 obviously those are people who don’t register from their work account so then I can say well I 00:39:25.292-->00:39:28.958 can target these individuals outside of when they’re at the CIA right? Cause at the CIA they 00:39:28.958-->00:39:34.250 probably have decent security and stuff but who knows what it’s like at home um or other 00:39:34.250-->00:39:37.875 things that I can, I can find. Uh then you can also take the email addresses look at the 00:39:37.875-->00:39:42.375 header and if you apply it to the network blackout can see where the SMTP relays are. So 00:39:42.375-->00:39:46.042 then I know hey, this is the right uh, I’m just using it to validate the footprint. I can 00:39:46.042-->00:39:51.417 say all of these or this one IP address has uh leaked information so if I take um 00:39:51.417-->00:40:01.250 these IP addresses. So from the netblock that we found originally and it’s just gonna 00:40:01.250-->00:40:06.208 search all emails that were like in leaks, like HB Go here and stuff um so that you can get uh 00:40:06.208-->00:40:13.125 that sort of stuff out. Um, and one of them does have that in. So I’ll show you now. Um, so 00:40:13.125-->00:40:18.458 then how much time is left? 5, okay. So then the last section that I wanna cover while it’s 00:40:18.458-->00:40:23.167 running is that let’s say that we wanted to tie into more individuals. So here we said, 00:40:23.167-->00:40:27.500 okay we found ICS devices based on location or country, something that I was looking 00:40:27.500-->00:40:31.167 for. Then we found individuals based on their network footprint and how they access the 00:40:31.167-->00:40:36.208 internet. Um and then what we can do is we can say well, actually for ICS devices let’s 00:40:36.208-->00:40:40.125 say that I can’t get an implant in there right? Let’s say that I can’t run my exploit I need 00:40:40.125-->00:40:44.667 someone to physically go and do it. So what I can do is say well actually I can try and find 00:40:44.667-->00:40:48.417 people who work there. Okay and if I can’t find it in the organization like a lot of the 00:40:48.417-->00:40:53.500 places are very sensitive about that’s out there. Um I can try with the, the 1 method that I 00:40:53.500-->00:40:57.125 used now for the CIA or I can do something like this. Twitter has this great function that’s 00:40:57.125-->00:41:01.333 called Geo/search. Right. Which means what I can do is I can put in GPS coordinates and I can 00:41:01.333-->00:41:06.083 say, show me anyone that’s made a tweet around here. And if I can get that out I can then 00:41:06.083-->00:41:09.583 start profiling that person, right. So I can see hey, ya know what do they say around here. 00:41:09.583-->00:41:17.917 Um, so I can use the same method that I did for the ICS devices. I can say okay I find 00:41:17.917-->00:41:23.500 interesting locations. Like I find all power plants, uh actually let’s do it quickly. So 00:41:23.500-->00:41:35.125 say start with a phrase. Power, oh, I’m gonna stop this quickly. Kay start with power. I find um, 00:41:35.125-->00:41:41.375 all the feature codes. So you know what matches power? I say all power stations, uh I’ll 00:41:41.375-->00:41:49.750 pick, okay I’m just gonna pick Poland again. Alright I find GPS coordinates for every power 00:41:49.750-->00:41:55.833 station that they know about in Poland. And then I can say from here, take it to um, uh take it 00:41:55.833-->00:42:00.458 to, people who have tweeted around these. Alright. Uh so what is that? 2 tweets from the 00:42:00.458-->00:42:05.875 GPS. Kay now I can give it like a 1 kilometer radius. Um and then I’m looking for any 00:42:05.875-->00:42:09.625 individuals that have been there. They’ve tweeted from the parking lot you know going home, 00:42:09.625-->00:42:14.458 whatever excited for beer. Um, and then I can say okay well now I can profile these people. 00:42:14.458-->00:42:21.375 Alright so here, see our latest, something job. Click. Um, and I can look at, it came from this 00:42:21.375-->00:42:26.417 particular IP address and I can then say, uh where was that, where was that actually 00:42:26.417-->00:42:30.542 physically uh found. And then I can look it up and say okay this is close enough to the power 00:42:30.542-->00:42:36.917 station that I can assume that this is uh, where this person uh works. Alright. So, I’m just 00:42:36.917-->00:42:44.167 picking a random one. I don’t know how well it will work. Um, but there should be a power 00:42:44.167-->00:42:48.542 station around here. And then I can see hey, this is the individual marker where they 00:42:48.542-->00:42:52.292 tweeted from. So if I start tracking that person I’ll see okay maybe this things from 00:42:52.292-->00:42:59.542 work. Or maybe there’s stuff uh at home. Okay so just to do the conclusions. Um, if you’re 00:42:59.542-->00:43:05.167 looking for ICS devices in the internet they’re really, really difficult to attribute. Okay so 00:43:05.167-->00:43:09.583 you can’t, like no one puts in this is where it is, this is the plant, anything like that. Um, 00:43:09.583-->00:43:13.833 they’re usually not on the corporate networks unless they are not visible to the internet. 00:43:13.833-->00:43:18.583 It could all be firewalled off. Obviously then I can’t see it so I don’t know, uh but find. 00:43:18.583-->00:43:22.167 They’re a lot easier to find on GPS. Even if it’s more of a manual process for an individual 00:43:22.167-->00:43:27.167 target and if you’re looking at doing it on a large sector like, ya know targeting the harbor or 00:43:27.167-->00:43:32.375 a particular power plant. Then you need to know that you’re gonna accept collateral damage 00:43:32.375-->00:43:35.542 right. That geo to IP stuff is not as accurate as you’d want it to be. Um so you might end up 00:43:35.542-->00:43:39.125 being like okay I target all the things around it. Then if you look at the breach data it gives 00:43:39.125-->00:43:44.708 us a lot of information on the people and the organizations. So first I find exit nodes. I can 00:43:44.708-->00:43:49.083 validate those. That, that’s where they’re come from, from an organization. Um so as a pen 00:43:49.083-->00:43:53.500 tester you would maybe target those because you know that. But internal and external access. Um 00:43:53.500-->00:43:58.667 then you also find the private emails addresses. Right so I can say, hey cool I can go from 00:43:58.667-->00:44:03.875 someone who works at a particular target, find a network space, find accounts 00:44:03.875-->00:44:08.833 they’re registered with and say cool now I’ve got their Gmail or whatever. I can look it up on 00:44:08.833-->00:44:14.125 Facebook or whatever else. Um and then have the ability to uh go and target those individuals 00:44:14.125-->00:44:19.583 uh privately outside of their organization. Okay, uh so thanks for coming to the talk. Uh if 00:44:19.583-->00:44:24.625 anyone has questions I think I have to meet in the corridor, um I’m Andrew Mohawk on Twitter or 00:44:24.625-->00:00:00.000 Andrew at Paterva dot com, cool. [Applause] Thanks.