00:00:00.000-->00:00:03.904 >>For the next 45 minutes we're gonna be talking about a series of offensive uh RF exploitation 00:00:03.904-->00:00:07.674 techniques. Particularly ones aimed at the physical and mac layers of wireless communication 00:00:07.674-->00:00:12.446 systems. Reason why is because mobile and IOT means that wireless technology is more 00:00:12.446-->00:00:17.184 diverse and incumbent than it's ever been. So with that comes many more attack surfaces that 00:00:17.184-->00:00:22.222 we're excited to talk about and enumerate. So my name is Matt Knight this is Marc Newlin, 00:00:22.222-->00:00:26.593 we're both security researcher- researchers at Bastille Networks uh we're motivated by wireless 00:00:26.593-->00:00:31.331 security uh we think it's really exciting. We're happy- happy to be here. So we're gonna begin 00:00:31.331-->00:00:36.803 with a brief historical rundown of the development of wired and wireless security technology. Uh 00:00:36.803-->00:00:41.074 after that we're gonna move on to introduce some key RF concepts and this is gonna be 00:00:41.074-->00:00:45.012 pretty light, just enough to frame the rest of the discussion. And then we're gonna 00:00:45.012-->00:00:48.682 move into what is really the body of this talk, which is our methods of wireless 00:00:48.682-->00:00:51.818 exploitation. And what we've done with this is we've looked at a number of high profile 00:00:51.818-->00:00:57.391 attacks from the last couple years and for each one uh we've categorized them. We've broken 00:00:57.391-->00:01:01.495 them out in terms of the uh mechanics of how the attack is performed uh and then what we're 00:01:01.495-->00:01:05.966 really gonna try to emphasize is analogues that exist on wired networks. And the purpose of 00:01:05.966-->00:01:09.636 this is to try to demystify really what's happening in the in the wireless domain. Uh we're 00:01:09.636-->00:01:15.676 gonna have some uh some uh demos and videos and uh then we're gonna leave you with some uh 00:01:15.676-->00:01:20.447 some advice. So let's jump right in. So say you're a network security administrator in the 00:01:20.447-->00:01:24.451 1990s, and you wanna take a look at what's going on in your network, uh get some bits out, 00:01:24.451-->00:01:28.989 see what's happening. Well it- you- are really 2 protocols that you're concerned about you had 00:01:28.989-->00:01:33.994 ethernet and token ring. Uh looking into these protocols involved buying an expensive- 00:01:33.994-->00:01:38.131 expensive computer, running some proprietary software on it, totally proprietary, not that 00:01:38.131-->00:01:43.570 great. Fast forward to 1998 and Ethereal comes out. Uh it's since rebranded we know it as 00:01:43.570-->00:01:48.709 WireShark. Um what this did was it massively commoda- umm it took the proprietary solution 00:01:48.709-->00:01:53.647 and it made it a commodity. So very cheap very easy to use uh and people were able to hack on 00:01:53.647-->00:01:59.019 it and extend it. So that's great. So let's look at what's happened since the 2000s. The 00:01:59.019-->00:02:02.789 map of protocols that we're concerned with is a little more complicated, right? So 802 dot 3 00:02:02.789-->00:02:06.493 and you know you can probably still find token ring some places they're still there. But 00:02:06.493-->00:02:10.597 additionally we have tons of wireless, right? We've got this uh all these new protocols 00:02:10.597-->00:02:15.936 coming on line uh so it's a lot more complicated. If you wanted to take a look at what was 00:02:15.936-->00:02:19.973 actually going on in the air, in the 2000's you could go out you could buy an early software 00:02:19.973-->00:02:24.711 defined radio. Uh and this would, you know could easily run you 6 figures um it'd be a big 00:02:24.711-->00:02:28.582 PCIE card that you'd have to hook in- hook into a powerful computer or a you know network 00:02:28.582-->00:02:34.254 of computers. Uh so you know it was proprietary it's expensive, it's not that great. Uh fast 00:02:34.254-->00:02:39.593 forward to 2012 and a Finnish, I believe he's Finnish, uh hacker named Antti Palosaari was 00:02:39.593-->00:02:44.731 looking at his DVB-T uh over the air receiver. It's a USB stick that you can plug in in anywhere 00:02:44.731-->00:02:49.936 where's there's uh digital television with the um uh DVB-T standard, uh you can pull that 00:02:49.936-->00:02:53.740 down and watch it watch it on your computer. Well he was looking at the uh at the the 00:02:53.740-->00:02:57.611 front end for that, realized that you could put it into a debug mode that would stream raw 00:02:57.611-->00:03:02.516 IQ, that's complex samples of the radio domain, back up to your host. So with a promiscuous 00:03:02.516-->00:03:07.954 driver you can turn this into a poor man's software defined radio. It's pretty sweet. So 00:03:07.954-->00:03:13.093 fast forward to 2017 and software defined radios are totally commodity. Uh for all 00:03:13.093-->00:03:17.497 sorts of price points um ca- capability levels targeting the hacker all the way up to the 00:03:17.497-->00:03:23.236 professional so then you can put newer products.Um this this in- this has revolutionized wireless 00:03:23.236-->00:03:28.241 security and the ability to look into these proprietary protocols. So in 2017 802.11 is 00:03:30.444-->00:03:32.479 really just a piece of the puzzle when it comes to securing, securing RF. We know 00:03:32.479-->00:03:36.783 that with the growth of mobile and IoT, uh there have emerged a number of different PHYs so 00:03:36.783-->00:03:40.987 really there's a physical layer for every use case. Uh and many of these use cases target 00:03:40.987-->00:03:46.760 embedded systems. So embedded systems we know to have been designed around compromise. You 00:03:46.760-->00:03:52.099 know often times they're battery powered so they have to last for years at a time uh. Maybe they 00:03:52.099-->00:03:55.402 are they're limited in terms of the type of processing they can do on it, their ability to do 00:03:55.402-->00:03:59.806 cryptography, you know good and bad reasons for why systems might not support that. Uh 00:03:59.806-->00:04:03.043 additionally they may have limited network, um so you might not be able to push forward to 00:04:03.043-->00:04:07.380 them. Maybe they have non rewritable uh flash memory so you can't uh push a new image to 00:04:07.380-->00:04:12.252 that. And just one picture that I really love just to emphasize how complicated the deployment 00:04:12.252-->00:04:17.157 of embedded systems can be, I have up there on the slide. Uh what you can't see are 3 literal 00:04:17.157-->00:04:21.595 embedded systems. They're embedded in concrete. So you can think that pushing forward into 00:04:21.595-->00:04:26.366 that is quite a bit more complicated than patch Tuesday. So combine that with an industry 00:04:26.366-->00:04:31.571 reliance on security through obscurity means that we as attackers have loads of targets. 00:04:31.571-->00:04:35.675 So uh that was a- a whirlwind run-through of the the history I'm gonna hand it off to Marc 00:04:35.675-->00:04:41.414 and uh he's gonna get started. >>So as security practitioners you're probably familiar with 00:04:41.414-->00:04:46.419 using tools like WireShark to look at layer 2 traffic from 802.11 and 802 dot 3 networks. 00:04:50.457-->00:04:52.459 And these allow you to use commodity hardware that give out these layer 2 packets. Uh with 00:04:52.459-->00:04:54.461 this kind of sniffing you can't really look at the physical layer simply because the 00:04:54.461-->00:04:58.398 hardware you're using does not support it. So in the case of a wifi adapter this is something 00:04:58.398-->00:05:02.702 called a hardware defined radio. And we say it's hardware defined because the logic that makes it 00:05:02.702-->00:05:08.141 speak 802.11 is baked into silicon in the chip. However in order to look at wireless 00:05:08.141-->00:05:11.778 protocols, and when we say wireless we mean non 802.11, we need some different type of 00:05:11.778-->00:05:16.183 hardware. So on the left here we have an picture of a spectrogram showing a few different RF 00:05:16.183-->00:05:20.086 physical layers. And we can see that they're visually different. This is manifested in how they 00:05:20.086-->00:05:23.557 actually communicate over the air. And because we have all these different physical layers 00:05:23.557-->00:05:27.794 that you can't communicate with using a wifi adapter, we need to use something called a software 00:05:27.794-->00:05:33.600 defined radio. And a software defined radio is a flexible generic reconfigurable radio 00:05:33.600-->00:05:37.604 front end, and so you can change the center frequency, you can change the channel bandwidth 00:05:37.604-->00:05:41.675 which is how much data you're pulling down, and you stream this raw radio data either to an 00:05:41.675-->00:05:46.947 FPGA or to your host computer. And this is great because all the logic that defines how the 00:05:46.947-->00:05:51.618 protocol operates, so whether its 802.11 or Bluetooth or some proprietary protocol, this all 00:05:51.618-->00:05:55.789 exists in software. So instead of having one hardware defined radio for every different 00:05:55.789-->00:05:59.459 protocol, you can have one software defined radio and simply change the software on 00:05:59.459-->00:06:03.263 your host computers to speak these different protocols. And one of the downsides of software 00:06:03.263-->00:06:07.367 defined radio is that it can be fairly complex. And if you look at this image on the left, this 00:06:07.367-->00:06:12.572 is some RTL from a 802.15.4 software defined radio decoder that Matt implemented. And as 00:06:12.572-->00:06:15.875 you can see it's super clear what's happening there, a nice level of complexity. And you 00:06:15.875-->00:06:20.013 know w-one of the you know, concerns people have with STR is this assumption that you're 00:06:20.013-->00:06:23.516 going to need to know a lot of digital signal processing and other complex domain specific 00:06:23.516-->00:06:27.087 knowledge. And Matt and I have given a lot of time thinking about how to make software 00:06:27.087-->00:06:31.057 defined radio more accessible to people. And to this end we've given a series of talks titled 00:06:31.057-->00:06:35.128 "So You Want To Hack Radio?" And the whole point of these talks is to explain how you can use 00:06:35.128-->00:06:40.066 great open source software and hardware written by some very smart people to abstract away a 00:06:40.066-->00:06:44.404 lot of the complexity. And one of our favorite tools for this is called GnuRadio. And on the 00:06:44.404-->00:06:49.142 right here we have a picture of a GnuRadio companion float raft. And this allows you to drag and 00:06:49.142-->00:06:52.912 drop these great open source signal processing blocks and implement your transceivers, 00:06:52.912-->00:06:56.483 transmitters and receivers, without having to understand the math that goes on under the 00:06:56.483-->00:07:00.820 hood. And I want to point out that Michael Ossmann and Balint Seeber have some great videos on 00:07:00.820-->00:07:05.125 STR and GnuRadio in general on Youtube and I highly encourage you to look at those. Also a lot 00:07:05.125-->00:07:08.161 of very very smart STR people hanging out in the wireless village if you want to go talk 00:07:08.161-->00:07:11.531 to them. And now Matt is going to talk to you a little bit about some fundamental RF 00:07:11.531-->00:07:17.304 concepts. >>Alright so the purpose of this next section is not to make you experts with 00:07:17.304-->00:07:21.074 digital signal processing. It's just to provide enough context around communications in the 00:07:21.074-->00:07:25.078 wireless domain to be able to frame the rest of the discussion. So when we talk 00:07:25.078-->00:07:28.982 about wireless protocols we're invariably involving the physical layer. The physical 00:07:28.982-->00:07:34.154 layer is the lowest layer in our uh communications model. And in wired protocols it essentially 00:07:34.154-->00:07:38.158 defines how your ones and zeros get mapped into voltage hemming and wiring, kind of the physical 00:07:38.158-->00:07:42.362 properties that underline the communicate- the communication standard. In wireless however, 00:07:42.362-->00:07:46.366 it defines how your ones and zeros get mapped into patterns of energy that are being sent 00:07:46.366-->00:07:52.739 over the RF medium. So RF uh is essentially the electromagnetic spectrum. Uh you know all 00:07:52.739-->00:07:57.377 wireless signals um if you sum them all up you get a picture like this. This is a spectrogram 00:07:57.377-->00:08:01.915 uh you have signals at different frequencies carrying information. It's kind of just 00:08:01.915-->00:08:07.153 like one big shared medium. Uh so manipulating RF can be done with a radio. As Marc outlined 00:08:07.153-->00:08:10.357 they can either be soft, er hardware defined or software defined. But the key function 00:08:10.357-->00:08:15.228 that the radio performs is called the modulation. And the modulation is a function that 00:08:15.228-->00:08:18.898 exactly maps how those digital values get mapped into RF energy. It's kind of the core 00:08:18.898-->00:08:24.003 element of your wireless physical layer. So I'm briefly gonna run through what happens 00:08:24.003-->00:08:27.707 uh from the perspective of a radio when you tell it to send a message. Eh eh if you've 00:08:27.707-->00:08:32.045 developed a wireless system before, you probably get to the point where you call driver dot 00:08:32.045-->00:08:35.982 send and you pass it a buffer, right? So you make an API call. And then that writes it out over 00:08:35.982-->00:08:41.888 Spy or I2C or some interface to to radio chip set, but what does that really do to make, uh to 00:08:41.888-->00:08:45.925 make your bits magically appear in another system that could be some distance away? So the first 00:08:45.925-->00:08:49.562 thing that that radio is gonna do when it receives the buffer, is it's going to append some 00:08:49.562-->00:08:53.800 information to it. So it's going to prepend a header which includes a preamble, a state of 00:08:53.800-->00:08:58.338 frame delimiter and maybe some some header specific values. And it's gonna append the CRC so 00:08:58.338-->00:09:01.741 that it can check for errors that might occur during transmission. It's then gonna 00:09:01.741-->00:09:05.578 perform that modulation function where those ones and zeros are gonna get turned into a wav 00:09:05.578-->00:09:09.516 form. That waveform then gets run through an RF front end, which can include some 00:09:09.516-->00:09:13.453 filtering, and uh and some game stages to make it more powerful, and then it gets pushed out to 00:09:13.453-->00:09:18.224 an antenna. And it goes out into the electromagnetic spectrum, into the RF medium that carries 00:09:18.224-->00:09:24.197 it to its destination. The receiver is a little more complicated. So your waveform 00:09:24.197-->00:09:27.967 gets picked up by the antenna get gets run through a demodulator, now produces a 00:09:27.967-->00:09:34.007 stream of bits that wind up in a f in a physical layer state machine. And if you uh were to 00:09:34.007-->00:09:38.278 break this down it looks something like this um we're not gonna go through this in detail. 00:09:38.278-->00:09:42.015 If you want to learn about how these physical layer state machines work, that's all what 00:09:42.015-->00:09:46.453 that talk so you wanna hack radios is all about the one that Marc mentioned earlier. Uh so 00:09:46.453-->00:09:49.389 we're not gonna cover that here. Um there's some content out there if you wanna know how it 00:09:49.389-->00:09:53.526 works. But essentially the physical layer state machine spins on that stream of, uh 00:09:53.526-->00:09:57.831 stream of information coming from the demodulator and ultimately presents a layer 2 00:09:57.831-->00:10:03.636 frame back up to your backup to your your uh your host. So uh the key concepts to take away 00:10:03.636-->00:10:07.607 from this is that radios are state machines and they're deterministic, right? What 00:10:07.607-->00:10:12.479 happens isn't magic and the implementation of these state machines is informed by the fact 00:10:12.479-->00:10:17.550 that RF is very complicated. You have lots of contention from uh, from other interferers other 00:10:17.550-->00:10:22.655 other um actors within the medium. Whether they be uh unintentional or intentional. 00:10:22.655-->00:10:25.525 You know you could be unintentional just in terms of you know being in the 2.4 00:10:25.525-->00:10:30.029 gigahertz ISM band where wifi lives, wifi is really active, or it could be intentional, if you 00:10:30.029-->00:10:34.234 have the case of somebody trying to jam you. Anyway these radios are designed with features to 00:10:34.234-->00:10:38.404 compensate for the fact that this medium is very uh, very complicated and failure prone. 00:10:38.404-->00:10:42.942 So between all this we can find some some interesting cases that we can begin to abuse uh to 00:10:42.942-->00:10:49.382 construct some novel attacks. So that brings us to our methods of wireless exploitation. So what 00:10:49.382-->00:10:52.819 we've done here is we've categorized the major wireless attacks that uh that have 00:10:52.819-->00:10:56.222 occurred in the last couple of years uh and we're going to present them to you. For each eh 00:10:56.222-->00:11:00.660 each category we're gonna show the method of how the attack was performed, the impact that it 00:11:00.660-->00:11:05.431 enables, and number 3 is the big one. We're gonna highlight analogous attacks that exist on 00:11:05.431-->00:11:09.736 wired or IP networks if such ones exist. And again this is just to provide as much context 00:11:09.736-->00:11:13.606 around wireless domain in terms of how it's similar and how it's different than wire- eh wired 00:11:13.606-->00:11:18.311 attacks. We're gonna present some uh limited- limiting factors, whether it's incidental 00:11:18.311-->00:11:22.782 or intentional uh mitigations and limitations. We're gonna provide some examples and then 00:11:22.782-->00:11:27.353 we're gonna provide some demos as well. So uh to kick it off I'll pass it back over to Marc 00:11:27.353-->00:11:31.090 and he's going to take you through sniffing. >>So when we speak about stiffing in this 00:11:31.090-->00:11:35.295 context we're talking about sniffing the physical layer. And there's really no analogues to 00:11:35.295-->00:11:38.565 this in the wired domain. As I said with like the ethernet adapter for example. You're 00:11:38.565-->00:11:42.302 unable to see the physical layer package, you're only looking at layer 2 and higher. Sniffing 00:11:42.302-->00:11:47.140 allows you to observe the RF medium that's in use by other devices that you do not control 00:11:47.140-->00:11:50.743 and recover data that they're transmitting if they're unencrypted for example. Or you 00:11:50.743-->00:11:56.249 can have a reconnaissance goal and enumerate devices in an environment for future attacks. 00:11:56.249-->00:12:00.186 The big limitation of RF physical layer sniffing is range. And you have to be 00:12:00.186-->00:12:03.489 physically proximate to a device. And when we say physically proximate we don't 00:12:03.489-->00:12:08.094 mean in the same room we just mean within range of the budget of your antenna and your 00:12:08.094-->00:12:12.398 amplifier. There are a couple interesting sniffing attacks in the last couple years. Uh Matt 00:12:12.398-->00:12:18.204 has demonstrated that you can recover the cryptographic key from this Zigbee door lock by 00:12:18.204-->00:12:22.342 sniffing the pairing sequence that happens between the lock and the smart hub. And then you 00:12:22.342-->00:12:25.812 can operate the lock yourself and walk into somebody's home. Last year I did a bunch of 00:12:25.812-->00:12:29.515 research into wireless keyboard security. I demonstrated that a lot of the keyboards on the 00:12:29.515-->00:12:34.554 market are actually unencrypted and vulnerable to keystroke sniffing. So for a demo here I'm 00:12:34.554-->00:12:39.325 going to be looking at the HP classic wireless desktop keyboard and this is based on a 00:12:39.325-->00:12:44.464 transceiver from a company called Mozart Semiconductor. And this is a unencrypted wireless 00:12:44.464-->00:12:48.701 keyboard transceiver that I reverse engineered last year and it's actually over the air 00:12:48.701-->00:12:53.573 compatible with these common Nordic Semiconductor nRF24L transceivers. So it all uses off 00:12:53.573-->00:12:59.245 the shelf hardware defined radio to sniff unencrypted key strokes from this particular device. Now 00:12:59.245-->00:13:04.183 we're just going to switch over to a quick video demo here. So on the left we have a keyboard 00:13:11.491-->00:13:14.661 focus on this terminal on the right we're running a sniffer script with one of these Nordic 00:13:14.661-->00:13:19.165 nRF24L dongles and as we see when I'm typing with the focus on the left terminal the loads 00:13:19.165-->00:13:22.035 the actual input from the keyboard and on the right it's actually sniffing these 00:13:22.035-->00:13:26.472 unencrypted keystrokes and printing it out. And this is a uh you know pretty low 00:13:26.472-->00:13:31.477 complexity example of a sniffing attack. And now Matt is going to speak to you about wardriving. 00:13:36.883-->00:13:41.287 >>K so wardriving is really a nuance on uh on the sniffing attack. Essentially wardriving 00:13:41.287-->00:13:45.925 involves conducting sniffing but while doing so scanning for identifying features of a 00:13:45.925-->00:13:50.797 protocol or device of interest. Optionally we have the ability to actively beacon to attempt to 00:13:50.797-->00:13:55.735 induce traffic from devices that we're looking for. So the impact here is we're able to discover 00:13:55.735-->00:13:59.338 and en enumerate exploitable devices or networks that might be present within your physical 00:13:59.338-->00:14:04.043 environment. Uh and wired analogues uh to this is port scanning; you know using NMap to 00:14:04.043-->00:14:07.547 go and knock on doors to see what services uh might be might be present on a system or a 00:14:07.547-->00:14:12.852 network. Uh on the right we have a screenshot from Kismet which is a really popular umm uh 00:14:12.852-->00:14:18.691 really popular wireless um kind of reconnaissance framework that enables uh enables wardriving. 00:14:18.691-->00:14:22.962 Among other things. Uh so some limitations, uh you have the same constraints placed on you 00:14:22.962-->00:14:26.999 that you do with sniffing. Uh additionally you need to manage uh channels if you're looking 00:14:26.999-->00:14:30.536 for a system that might be on on multiple channels. You might have some uh some front ends to 00:14:30.536-->00:14:33.973 manage in terms of how you you share your time among all- all the different frequencies you 00:14:33.973-->00:14:38.377 could be looking at. Additionally active wardriving can be very easy to spot if 00:14:38.377-->00:14:41.514 you're defender knows to look for it. Cause you might be hopping from channel to channel, 00:14:41.514-->00:14:45.718 kicking off a beacon on each one uh if if you're aware of that that's going to leave a big 00:14:45.718-->00:14:49.555 footprint that you're going to be able to identify. So a classic example of wardriving is 00:14:49.555-->00:14:54.861 of course your your 802.11 AP discovery. And you know think guys like back in back in the uh 00:14:54.861-->00:14:58.931 you know early 2000s driving around with their laptops and custom made cantennas looking 00:14:58.931-->00:15:04.971 for free wifi. Uh it's kind of the the classic example. However a more uh modern and IoT focused 00:15:04.971-->00:15:10.376 focused example is uh wardriving for 802.15.4 coordinators. Uh so 802.15.4 wri- war driving I'm 00:15:10.376-->00:15:15.848 going to show you a quick video of it in a minute. Uh for this I used the Killerbee exploitation 00:15:15.848-->00:15:20.253 framework to crash broadcast beacon request messages. And then I used the ApiMote hardware 00:15:20.253-->00:15:25.024 defined radio board to send them out and listen to responses. So what this'll do is uh it'll 00:15:25.024-->00:15:30.129 channel hop through all the uh, the 802.15.4 channels in the uh 2.4gigahertz band sending out 00:15:30.129-->00:15:33.933 these requests, and if a coordinator sees- is present and sees that, it'll respond with a- 00:15:33.933-->00:15:38.938 with a response. We'll see what that looks like. Do we have the video here? >>Yeah [inaudible 00:15:52.051-->00:15:54.954 off mic] >>Ok. I'm not sure if the midi video made the transition with all the uh the 00:15:54.954-->00:15:59.725 AV stuff, so. We'll get that up online you can watch it afterward. So the next attack is 00:15:59.725-->00:16:03.763 a replay attack and a replay attack is a command injection attack that involves 00:16:03.763-->00:16:08.201 retransmitting a previously captured physical layer frame. Now this can either be a frame 00:16:08.201-->00:16:12.872 that you demodulated and have the uh have the the bits for and then you resynthesize with the 00:16:12.872-->00:16:17.677 with the modulator and send out. Or it can even be as easy as re-transmitting a roth captured 00:16:17.677-->00:16:22.849 physical layer frame, your raw radio information. The impact here uh is command injection. 00:16:22.849-->00:16:27.053 You can change the state of a network or device by getting it to recreate previously observed 00:16:27.053-->00:16:31.591 uh activity. Uh so the wired analogue is exactly the same. You can have replay attacks on 00:16:31.591-->00:16:37.897 wired networks too. So some uh limitations of this is that the replay attack is pretty easily 00:16:37.897-->00:16:43.836 defeated with uh uh using and enforcing freshness, so sequence number or authentication. Having 00:16:43.836-->00:16:49.242 a uh a cryptographic handshake uh to establish the authenticity of the message. Uh so one high 00:16:49.242-->00:16:54.547 profile example of this uh came just a couple couple months ago. Uh you may have seen in the news 00:16:54.547-->00:17:00.419 that uh at around 1:30 in the morning on a Tuesday or Wednesday all 156 uh emergency 00:17:00.419-->00:17:04.523 tornado alert sirens in the Dallas metro- metropolitan area started going off and just 00:17:04.523-->00:17:08.194 playing this really shrill loud noise. It took the authorities about 90 minutes to get it under 00:17:08.194-->00:17:12.999 control and and get those turned off. Uh obviously that inconvenienced people who in 00:17:12.999-->00:17:17.904 Dallas who were woken up by it but it also uh gave people a lot of cause for concern because uh 00:17:17.904-->00:17:21.641 this was right around when some saber rattling with North Korea was happening so it made a lot 00:17:21.641-->00:17:26.579 of people pretty uncomfortable. Uh we at Bastille have done a lot of analysis on on what we 00:17:26.579-->00:17:31.017 believe this is. We've concluded that we believe that it's it's an RF replay attack. The systems 00:17:31.017-->00:17:35.254 are tested uh I believe it's quarterly, so it would be trivial for an attacker with a 00:17:35.254-->00:17:39.392 software defined radio to capture that signal and then go back and replay it uh at a later 00:17:39.392-->00:17:45.097 date to induce that behavior. So the logistics of getting an authentic tornado siren uh into 00:17:45.097-->00:17:49.669 Caesar's Palace is a little bit, it's a little bit much um so instead I have a surrogate uh 00:17:49.669-->00:17:54.740 that I'm gonna show you. I have a Fortress Security Safeguard panic button. Uh so this is 00:17:54.740-->00:17:58.511 gonna be our surrogate. Uh essentially you've got this little siren, little remote 00:17:58.511-->00:18:03.349 control to control it. Um it's a very simple uh on/off key protocol, no freshness or 00:18:03.349-->00:18:07.920 authentication so I'm just gonna grab some raw IQ and then we're gonna replay it to uh to induce 00:18:07.920-->00:18:13.359 the attack. And um I'm gonna do it in the Faraday cage here we were gonna do our uh our 00:18:13.359-->00:18:17.630 cellular demo in here but I brought it all this way and I wanna use it so bare with me. 00:18:31.978-->00:18:35.648 [inaudible off mic] >>So now we're going to capture the output from the transmitter for 00:18:35.648-->00:18:40.653 this device. Then we're going to replay this and demonstrate that we can set off the siren just 00:18:45.358-->00:18:48.794 from this RF capture. >>I had the siren turned off I'm going to turn it on again and we're 00:18:48.794-->00:18:53.799 going to play the signal into it. [Beep] [Siren wailing] Here you go. [audience applause] You 00:19:10.816-->00:19:15.821 you really shouldn't clap for that. It's very easy. [audience laughs] Ok uh so that brings us 00:19:18.224-->00:19:23.963 to our next attack which is jamming. And I'll pass it over to Marc. >>So the concept behind 00:19:23.963-->00:19:27.099 jamming is pretty straightforward. And it's somewhat analogous to a denial 00:19:27.099-->00:19:31.871 of service attack except a little bit lower complexity. So imagine we have Alice Bob and 00:19:31.871-->00:19:36.108 Carlos trying to communicate on a wireless medium and Donald wants to come and blast a bunch 00:19:36.108-->00:19:39.478 of nonsense noise to prevent them from communicating. In this case Donald would be 00:19:39.478-->00:19:44.350 implementing the jamming attack. And jamming allows you transmit noise to prevent the RF medium 00:19:44.350-->00:19:48.521 from being used by other devices or networks. So you can block traffic or potentially disrupt 00:19:48.521-->00:19:54.627 the network's state. There are a couple uh you know limitations to jamming attacks one is that a 00:19:54.627-->00:19:58.230 lot of devices implement a jamming detection mechanism where they can see if somebody 00:19:58.230-->00:20:01.901 is trying to jam them and then alter their behavior. The other big downside is that if you're 00:20:01.901-->00:20:06.772 trying to jam a network you don't have the ability to both jam and listen to the network at 00:20:06.772-->00:20:10.743 the same time. So if you're trying to do reconnaissance you can't prevent traffic as well as 00:20:10.743-->00:20:15.047 receive it. There's a good uh example of a jamming attack our colleague Logan Lamb discovered 00:20:15.047-->00:20:19.585 2 years ago, he was looking at home security systems provided by ADT and he discovered that 00:20:19.585-->00:20:23.289 you could actually jam the wireless link between these door and window sensors and the 00:20:23.289-->00:20:27.960 control panel that sets of the alarm. And so in this case the door and window sensor when you 00:20:27.960-->00:20:32.398 open and close it, it will transmit a RF message to the control panel and tell the 00:20:32.398-->00:20:35.734 control panel that the state has changed in this case a door or window has opened or closed and 00:20:35.734-->00:20:40.940 then set off the alarm. What Logan discovered is that you can jam the 345 megahertz channel 00:20:40.940-->00:20:44.210 that these devices operate in and then simply walk into somebodies home and the alarm 00:20:44.210-->00:20:48.714 system will not off. So to demonstrate this we have a video we recorded about an hour ago 00:20:48.714-->00:20:53.719 inside the Faraday cage. >>It's this one? >>Yeah. So here we have the control panel for this 00:21:00.993-->00:21:04.830 home security system. We're opening and closing the sensor and we can see that the alarm 00:21:04.830-->00:21:09.602 state has not changed. In this case we're jamming it so now we go and we stop the jammer and 00:21:09.602-->00:21:13.038 now we'll be able to actually open and close the sensor and we see that the alarm is triggered. 00:21:13.038-->00:21:18.043 And this is a very very simple attack. So for these simple kind of jamming attacks, uh there are 00:21:26.085-->00:21:29.255 actually uh some different types of smart jamming that we can use to evade these jamming detection 00:21:29.255-->00:21:33.726 mechanisms. So there's a concept called Duty Cycle jamming. And a lot of hardware defined radios 00:21:33.726-->00:21:37.363 will only try and transmit when other devices are not transmitting on the channel. The 00:21:37.363-->00:21:40.132 reason they do this, if you have 2 devices transmitting at the same time, they will 00:21:40.132-->00:21:44.436 accidentally jam each other. And there's a feature called clear channel assessment where a 00:21:44.436-->00:21:48.174 hardware defined radio will listen to the energy level in the channel it's trying to use 00:21:48.174-->00:21:53.245 and if it detects another device it will not transmit. So for example if we have a packet 00:21:53.245-->00:21:58.817 length of 10 milliseconds, the device will say "if the channel is occupied for more than that 00:21:58.817-->00:22:02.254 10 milliseconds then it's likely somebodies jamming" and then alter the behavior. So what we 00:22:02.254-->00:22:06.158 can do is pulse our jammer on and off, and we can jam for 9 milliseconds and then turn it 00:22:06.158-->00:22:09.595 off for a millisecond and then turn it back on. And by doing this we can still effectively 00:22:09.595-->00:22:13.999 jam a channel without actually triggering these jam detection mechanisms. And Matt has 00:22:13.999-->00:22:19.672 publicly demonstrated this with an 802.15.4 anti-jam detection evasion. And we also have 00:22:19.672-->00:22:23.375 something called reflexive jamming and this allows you to target specific devices or 00:22:23.375-->00:22:28.214 packets on a wireless network. The way this works is you listen to the packet coming in you 00:22:28.214-->00:22:32.318 could decode the header, then you make a determination based on one of the addresses in the 00:22:32.318-->00:22:36.689 header or the specific packet that's being transmitted, and then you start jamming as soon 00:22:36.689-->00:22:40.492 as you make this determination. And this allows you to jam the end of the packet and for 00:22:40.492-->00:22:45.631 example cause a CRC failure. Uh a good public example of this is Samy Kamkar's RollJam device 00:22:45.631-->00:22:50.970 which he released. And now there's a bit of a virtual jamming we can do that takes 00:22:50.970-->00:22:56.909 advantage of a mac layer reservation system and 802.11 networks. So if you're a 802.11 00:22:56.909-->00:23:00.045 device and you're trying to transmit a packet, you include a duration field in the mac 00:23:00.045-->00:23:04.016 header. And this duration field specifies the amount of time you expect it to take for you to 00:23:04.016-->00:23:09.088 transmit your packet and receive it back. Other devices on the network or within range will 00:23:09.088-->00:23:12.825 listen to this duration field and assume that the channel is going to be occupied for this 00:23:12.825-->00:23:17.463 amount of time. They will then turn off their radios to save power instead of sensing the RF 00:23:17.463-->00:23:22.167 energy on the channel. So we can actually take advantage to this by sending a zero payload link 00:23:22.167-->00:23:28.240 802.11 packet with a duration field set to the maximum and trick other devices for not 00:23:28.240-->00:23:32.745 transmitting for the next 32 milliseconds. This allows us to have a very low duty cycle of 00:23:32.745-->00:23:37.950 transmission but effectively jam a channel. So for a demo here I have a single 1 line Scapy 00:23:37.950-->00:23:41.520 script which I'm going to transmit some of these packets on and we'll demonstrate that we 00:23:41.520-->00:23:47.493 can prevent another device on a separate network from communicating. So here on the 00:23:47.493-->00:23:51.597 right we have a device a client pingless access point. I run this Scapy script and on the 00:23:51.597-->00:23:56.735 right we can see that the pings have stopped, I've sent 50 packets in this case. Then after 00:23:56.735-->00:24:00.472 a few seconds we'll see that the pings start again. And this is uh pretty neat because I was 00:24:00.472-->00:24:05.477 able to send only 50 packets and effectively jam the channel for several seconds. Now we have a 00:24:11.750-->00:24:15.387 type of attack called an Evil Twin. And this is something you may have heard of. Uh as you can 00:24:15.387-->00:24:18.991 see by the beard here on the right this is an Evil Twin access point and the concept 00:24:18.991-->00:24:23.896 behind an Evil Twin is that we can convince other devices to connect to our access point or 00:24:23.896-->00:24:27.066 base station instead of the access point or base station they are intending to connect 00:24:27.066-->00:24:31.170 to. And this allows us to man in the middle of the traffic. This is very similar to an ARP 00:24:31.170-->00:24:36.308 spoofing or ARP cache poisoning attack on a wired network. The big limitation here is that 00:24:36.308-->00:24:42.014 there is often trust that exists between the client and access points or base stations. And so 00:24:42.014-->00:24:46.819 in order to effectively implement an Evil Twin attack, we need to either be able to 00:24:46.819-->00:24:50.823 turn off that trust or replicate the state of that cryptography. The Wifi Pineapple is a good off 00:24:50.823-->00:24:54.626 the shelf device that allows you to implement a wifi Evil Twin attack. Their device is called 00:24:54.626-->00:24:57.996 IMSI Catchers which allow you to do the same for cellular networks and convince devices to 00:24:57.996-->00:25:03.001 connect to your malicious base station. So for a demo here we're going to use a fake base 00:25:03.001-->00:25:07.373 station that we spun up with a software defined radio and use the openBTS software. And I want 00:25:07.373-->00:25:11.310 to point out that it's very very illegal to try and trick other people's phones to connect with 00:25:11.310-->00:25:16.315 your base stations so please do not do this. And now we'll show a quick video demo. So here we 00:25:23.689-->00:25:28.293 have a cell phone in the Faraday cage and at the time we started this video I've also turned on a 00:25:28.293-->00:25:31.597 cellular base station which is running on a software defined radio in the cage. And right now 00:25:31.597-->00:25:35.000 we can see at the top of the phone that it's not connected. And as soon as we turn on our 00:25:35.000-->00:25:38.871 fake base station, the phone is searching for the network and it's starting to register. And 00:25:38.871-->00:25:42.408 then now we have the phone, you can see the change here the phone is now registered on our 00:25:42.408-->00:25:45.477 network and this is something we've spun up with open source software on a software defined 00:25:45.477-->00:25:50.482 radio. And now Matt is going to speak to you about malicious over the air firmware updates. 00:25:54.787-->00:25:59.925 >>K we're gonna cover this one quickly. So a malicious over the air firmware update attack 00:25:59.925-->00:26:04.329 involves first modifying a firmware image to suit your liking. Right? This could be 00:26:04.329-->00:26:08.767 adding any value to it that you might want. Uh you then exploit the fact that your target device 00:26:08.767-->00:26:12.938 uh if it has one uh has an over the air firmware update mechanism, where you can use its 00:26:12.938-->00:26:17.676 wireless network to deliver new software to it. So the impact here is you can you can 00:26:17.676-->00:26:22.347 basically extend the device to to conduct behavior that the manufacturer didn't intend. So 00:26:22.347-->00:26:26.985 this can include remaining persistent on the device, uh you know denial of service is a big 00:26:26.985-->00:26:32.157 one that we saw uh last year um with BrickerBot which is a Mirai variant. You can also be uh self 00:26:32.157-->00:26:36.562 self propagating too, just like a traditional uh your traditional input malware or 00:26:36.562-->00:26:43.001 worms. So uh the limitations here is that this is pretty easily defeated by um by signing 00:26:43.001-->00:26:47.272 your code. Using secure boot or an equivalent technology uh or encrypting your network and 00:26:47.272-->00:26:51.910 doing so well. Uh if you do either of those things you're going to make it a lot harder to 00:26:51.910-->00:26:55.147 execute an attack like this. So there are 2 examples we're just going to des- describe briefly. 00:26:55.147-->00:27:00.786 Uh the first was uh uh Cesar Cerrudo from IO Active uh his hypothetical um uh traffic light 00:27:00.786-->00:27:06.625 sensor worm. Uh which was an 802.15.4 based system he's fit uh analyzed it a couple of years 00:27:06.625-->00:27:10.162 ago at BlackCat found that it was uh completely unencrypted and they weren't signing their 00:27:10.162-->00:27:14.933 images. So it was trivial for him uh to uh make his own and and push it. And he then 00:27:14.933-->00:27:19.972 theorized that you could make it self propagating and, and go from there. Uh such a- an IOT 00:27:19.972-->00:27:23.876 worm was actually demonstrated at the end of last year with a Philips Hue Zigbee Light Link 00:27:23.876-->00:27:28.413 worm. There were a number of researchers that contributed to it, uh they did such a good job 00:27:28.413-->00:27:31.250 with this, I'm just going to direct you to their website um the paper is really good and 00:27:31.250-->00:27:36.855 their video is awesome. They strap a 15.4 radio to a drone and fly it up to a office 00:27:36.855-->00:27:40.225 building and patch the lights. It's cool. Um so um check that out they do a better job of 00:27:40.225-->00:27:44.496 showing it than we could. So this is our last atte- uh type of attack that we're gonna 00:27:44.496-->00:27:47.833 highlight in this session. And that's what we're gonna call physical layer selective 00:27:47.833-->00:27:52.938 targeting. And I'm just gonna first talk about this so it's a little bit I think it's pretty 00:27:52.938-->00:27:57.442 interesting. So when it comes to developing wireless standards, you have your standards body. 00:27:57.442-->00:28:03.048 You know your I triple E um your uh 3GPP they get together and they determine what they want 00:28:03.048-->00:28:06.518 the protocol to look like, and what features they want it to have, uh what the physical layer 00:28:06.518-->00:28:10.756 looks like, how it integrates with other systems et cetera. They then take take those 00:28:10.756-->00:28:15.160 thoughts they turn them into you know a several thousand page document; it's very technical, 00:28:15.160-->00:28:19.631 lots of details. That document then gets handed off to a chip set manufacturer who has to 00:28:19.631-->00:28:25.037 interpret it. Right? So they take that and they kinda take their best best effort to 00:28:25.037-->00:28:29.107 implement that standard as well as they can. Well as you might imagine, they there are some 00:28:29.107-->00:28:34.346 nuances as to as to to how how accurate or how similar they all do that. So we can exploit that. 00:28:34.346-->00:28:39.184 We can exploit the fact that different chip sets have different radio state machines. 00:28:39.184-->00:28:42.854 So what we can do is we can fingerprint the state machine and then ste- send standards 00:28:42.854-->00:28:48.560 non-compliant transmissions to exploit corner cases within it. And the impact here is we can do 00:28:48.560-->00:28:53.432 things like uh selectively avoid certain targeted receivers. Uh which is useful in the case of 00:28:53.432-->00:28:58.704 avoiding an IDS uh for example. We can also de- do device fingerprinting. We can uh send a 00:28:58.704-->00:29:03.041 number of of frames of different characteristics see what comes back and with that we can figure 00:29:03.041-->00:29:07.446 out what kind of radio chip set is present within our environment. Uh so this has been 00:29:07.446-->00:29:12.384 uh demonstrated on 802 dot 3 ethernet networks uh in the case of avoiding Lan taps, but this 00:29:12.384-->00:29:16.755 is far more practical in the RF domain where the domain is really defined by promiscuity. 00:29:16.755-->00:29:20.592 The fact that you don't have to be physically connected to a bus in order to get at it uh makes 00:29:20.592-->00:29:25.197 this quite a bit more interesting. So some limitations here, in order for this to work 00:29:25.197-->00:29:29.234 uh your your counting on network participants being on different chip sets. If they are all on 00:29:29.234-->00:29:33.171 the same chip set, they're gonna be able to see the same type of malformed message. So I'm gonna 00:29:33.171-->00:29:38.276 show you a quick example of an 802.15.4 receiver evasion attack which is pretty interesting. Uh 00:29:38.276-->00:29:43.682 essentially I'm using uh 1 transmitter in ApiMote to craft various, uh variously deformed 00:29:43.682-->00:29:48.754 15.4 messages and then I'm gonna use 2 different receivers that have different chip sets thereby 00:29:48.754-->00:29:52.557 different state machines to receive that. So I'll just roll a quick video and talk you 00:29:52.557-->00:29:57.562 through it. So up on top we have our transmitter and then we have 2 15.4 receivers on the bottom. 00:30:01.433-->00:30:05.437 On the left we have an Atmel receiver and on the right we have a TI receiver. 5 compliant 00:30:05.437-->00:30:11.543 messages to get started now I'm gonna insert 2 extra symbols into the header of uh of the 00:30:11.543-->00:30:17.082 15.4 file. And you'll see that the RC USB stick receives that but the ApiMote does not. Now 00:30:17.082-->00:30:23.288 I'll...uh the video is cut short. Umm I'll release the full video online um by taking 2 00:30:23.288-->00:30:28.593 symbols out of the header we're able target the um, we're able to target the the uh TI radio 00:30:28.593-->00:30:34.599 and avoid the um the Atmel radio. Which brings us to the end. Uh so we've looked at a 00:30:34.599-->00:30:38.970 number of different types of attacks uh and we've drawn some analogues between them. They key 00:30:38.970-->00:30:43.241 thing that I wanna highlight with this is that some attacks are quite difficult to 00:30:43.241-->00:30:48.380 implement, but some are very hard to mitigate. So anything involving uh RF promiscuity is 00:30:48.380-->00:30:53.351 very hard to avoid just by, by nature of how the RF medium works. The fact that uh that 00:30:53.351-->00:30:58.223 you're electromagnate- magnetic energy radiates outward means that for a stood off attacker, 00:30:58.223-->00:31:01.793 there are lots they can do with it. It's very hard to conceal that. Additionally this is a 00:31:01.793-->00:31:05.564 non-exhaustive list. Uh as you start to get into wireless I'm sure you'll find many other ways 00:31:05.564-->00:31:09.801 of exploiting wireless. Uh we think we've done a fairly comprehensive job of boiling 00:31:09.801-->00:31:13.505 down kinda the essence of many of these attacks into a few different categories to kind of 00:31:13.505-->00:31:17.309 get you started. So as attackers, uh the bits of advice I'll leave you with is to always 00:31:17.309-->00:31:21.513 look for low hanging fruit first. Because the easiest attacks um are are uh you know 00:31:21.513-->00:31:24.816 you want to start with the easy attacks before you go to more complex things because the 00:31:24.816-->00:31:29.788 complexity goes up in a hurry. As we've seen there are uh analogous attacks on wired 00:31:29.788-->00:31:34.726 networks so you can lean on your existing skill set wherever possible. Additionally leverage 00:31:34.726-->00:31:38.930 open source intelligence. These are things like FCC regulatory filings and data sheets cause 00:31:38.930-->00:31:42.734 they'll make your life easy. If you want to learn more about that, Marc gave an entire talk 00:31:42.734-->00:31:47.706 on that at Hack in the Box in 2016, go look that up if you're curious. And one last note this 00:31:47.706-->00:31:51.910 is both a um, this is both a uh a challenge to everybody in the room and also a warning to 00:31:51.910-->00:31:56.114 developers. Know that we're living in the golden age of RF hacking. It's because software 00:31:56.114-->00:31:59.951 defined radio has been commodity for more than 5 years. That really means that every wireless 00:31:59.951-->00:32:05.323 PHY is in scope. Uh obscurity is not relevant any more uh you can buy the tools you can make the 00:32:05.323-->00:32:11.997 tools to expose just about any wireless PHY that you'd like. So uh go forth uh own the airwaves. 00:32:11.997-->00:32:15.567 If you're an attacker go make them your own. If you're a defender, be aware of these 00:32:15.567-->00:32:20.438 threats. Uh we have some uh radio resources if you want to learn more about this uh we just 00:32:20.438-->00:32:24.709 tweeted them out. So don't try to take pictures of the slide, you'll be able get them online. 00:32:24.709-->00:32:28.980 Uh want to acknowledge our team at Bastille and DEFCON for having us. And uh thanks very 00:32:28.980-->00:32:33.985 much. I appreciate it. [applause]