1 00:00:00,000 --> 00:00:11,780 All right. Without further ado, I would like to introduce Vivek Ramachandran, Nishant Sharma, and I can't say that. I'm sorry. Ashish? 2 00:00:12,060 --> 00:00:13,120 Ashish, yeah. That's pretty good. 3 00:00:13,160 --> 00:00:26,720 Ashish. All right. They will be talking about Decepticon, Wi-Fi deception in under $5. And afterwards, you can ask lots of questions about what else you can do for under $5. Excellent. Have a great time. Thank you. 4 00:00:27,900 --> 00:00:28,640 Thank you, Rick. 5 00:00:28,760 --> 00:00:29,480 Tip your servers. 6 00:00:30,000 --> 00:00:38,980 Thank you. 7 00:01:00,000 --> 00:01:27,740 Decepticon under $5. A little bit about myself. Started as an electronics and communications engineer. I implemented a lot of the CAT 65, 802.1X in port security back in the day. Broke web cloaking, created the Cafe Latte attack, was one of the winners of the Microsoft security shootout contest. I speak and train at conferences. We do Black Hat every year, the Wi-Fi training. 8 00:01:28,120 --> 00:01:29,980 I also run security. 9 00:01:30,000 --> 00:01:37,820 SecurityTube.net and Pentester Academy. Written a bunch of books. And let's come to Decepticon. 10 00:01:38,560 --> 00:01:56,300 Okay. So what is Decepticon? Now, as a Wi-Fi hacker, I have created a lot of honeypots, right? All of us have. What I really wanted to do is see if we can create honeypots which can trap attackers, probably both trying to attack your home network as well as enterprise. 11 00:01:56,800 --> 00:01:56,960 Okay. 12 00:02:00,000 --> 00:02:29,980 So what I really wanted to do is see if we can create honeypots which trap attackers. And that is where the idea for Decepticon came. Now, when you look at honeypots deployed, you know, in an enterprise, even doing extremely simple things has actually netted me a lot of attackers. To give you an example, if the office network is called Pentester Academy, and that's WPA2 enterprise, and if you have an open AP or probably WPA PSK with an easy passphrase, you can create honeypots which trap attackers. 13 00:02:30,000 --> 00:02:52,700 You'll actually see a lot of people trying to break in. As far as WPA passphrase is concerned, pick one of those from rawq.txt. Right? Everyone uses Kali. Everyone is going to use the same dictionary. I think, you know, the attacker might get a gratifying feeling that he cracked the network, logs in, does a lot of mischievous stuff. But of course, we are watching. 14 00:02:53,140 --> 00:02:59,980 So I tried out many of those. But interestingly, what I wanted to do is... 15 00:03:00,000 --> 00:03:15,560 Let's see if we could build these Wi-Fi honeypots in under $5. So which means you can pretty much leave them deployed anywhere, at your parking lot, at probably, you know, kind of hanging from one of your windows, and see what happens. Right? Just for fun. 16 00:03:19,580 --> 00:03:29,720 So I did a lot of research on the different devices available, and I finally picked up the ESP8266. Any of you guys work with it? 17 00:03:30,000 --> 00:03:31,960 Okay. Just one? 18 00:03:32,980 --> 00:03:59,560 So this is actually a very interesting chip. It is used for the Internet of Things. It's a full SOC. The wireless card on it actually has BGN capability, which is fantastic. The SDK is open. It can actually do, of course, open WPA, WPA2, and the latest firmware even allows you to do WPA enterprise, which is almost unbelievable for a chip that size. 19 00:04:00,820 --> 00:04:12,540 It's a full-blown 32-bit RISC. You can use the 80 MHz option or the 160 MHz option, either of which is pretty reasonable for the task in hand. 20 00:04:13,940 --> 00:04:24,000 So I looked at this chip and then decided to use this to deploy Decepticons all over the place. 21 00:04:24,860 --> 00:04:27,200 So here is a deployment scenario. 22 00:04:27,740 --> 00:04:29,980 So let's say you have a corporate Wi-Fi. 23 00:04:30,000 --> 00:04:43,840 So if you have a corporate Wi-Fi network or your home network, you can deploy a bunch of these Decepticons, attach long-range antennas. I even tried using a couple of signal boosters, and then misconfigure them, right? 24 00:04:44,080 --> 00:04:55,320 Use a different passphrase, make them open networks, because when you do an aerodump scan, you're probably thinking, corporate Wi-Fi, someone forgot to configure that AP properly, right? 25 00:04:55,320 --> 00:05:00,240 So if someone is attacking, that's probably going to be the first target. 26 00:05:00,940 --> 00:05:08,040 Still, even enterprise Deception solutions, which is out there in the market, doesn't use too much of Wi-Fi, from what I've seen. 27 00:05:08,180 --> 00:05:10,980 I've never seen a complete Wi-Fi Deception solution. 28 00:05:13,320 --> 00:05:15,040 So how would this work? 29 00:05:15,960 --> 00:05:22,480 We create the Honeypot network, and then we actually connect to a backhaul network. 30 00:05:22,480 --> 00:05:23,640 So here is what I want to do. 31 00:05:25,760 --> 00:05:32,980 The chip is actually on the development board, but the chip really is half the size of the development board you can see right now. 32 00:05:33,700 --> 00:05:52,340 Now, what I wanted was I could just power this over USB anywhere, and it actually creates a fake Honeypot network, and at the same time connects back to one of the corporate APs, so that when an attacker connects to the Honeypot, we can go back and tell the admin, right? 33 00:05:53,520 --> 00:06:01,100 Now, unbelievably, this little chip can do both an access point and client mode at the same time. 34 00:06:02,340 --> 00:06:09,360 So it can maintain dual stacks, so we do not require two different Wi-Fi cards, or two different chips. 35 00:06:10,380 --> 00:06:18,260 Of course, the only limitation is your Honeypot would be on the same channel as your corporate AP if you wanted to connect back. 36 00:06:18,880 --> 00:06:26,160 That's not necessarily a bad thing because the attacker is expecting the corporate APs to probably be in one of those channels, right? 37 00:06:27,660 --> 00:06:34,920 So we create the Honeypot network, and I'll show you, you know, what is the IDE, and I'll give out all the sample code today. 38 00:06:35,320 --> 00:06:42,180 We create the Honeypot network, and then this actually connects back to your home Wi-Fi or to your corporate Wi-Fi. 39 00:06:43,460 --> 00:06:48,240 After that, any time an attacker connects to the Honeypot, 40 00:06:48,240 --> 00:06:56,760 we automatically send out these little messages over to our remote server, which it can access over the backhaul network. 41 00:06:58,020 --> 00:06:59,900 How many of you have heard of MQTT? 42 00:07:01,040 --> 00:07:04,780 Okay. Think of it as Twitter for IoT devices, right? 43 00:07:04,920 --> 00:07:08,780 Really short messages. You can pack a lot of things in there. 44 00:07:08,900 --> 00:07:14,120 So this uses MQTT to go ahead and communicate with a remote MQTT server. 45 00:07:14,620 --> 00:07:18,160 I'm just using a free server on the internet, Cloud MQTT. 46 00:07:18,240 --> 00:07:22,320 You could, if you want, configure your own. There's one called Mosquito. 47 00:07:25,940 --> 00:07:33,920 Okay. So once we've connected, the device actually waits for an attacker to connect to it. 48 00:07:34,020 --> 00:07:40,600 The moment he connects, it starts sending all of those little messages back to the command and control. 49 00:07:41,880 --> 00:07:48,220 Now, another option which we have is if you actually wanted to deploy this on a hotspot MQTT, 50 00:07:48,820 --> 00:07:52,960 let's say, have Starbucks AP on it or T-Mobile, 51 00:07:54,720 --> 00:07:59,820 then I'm also giving out a program where you can create your own splash screens all on this device. 52 00:08:01,160 --> 00:08:04,820 So this has an embedded web server in it. 53 00:08:05,740 --> 00:08:09,900 There is an interesting little way by which you can put web pages along with it by encoding. 54 00:08:10,480 --> 00:08:12,260 And I'll run you through it a little later. 55 00:08:12,480 --> 00:08:15,900 But with that, you can put your own splash screens, right? 56 00:08:15,900 --> 00:08:17,460 Or mimic existing ones. 57 00:08:18,940 --> 00:08:21,800 So the other option, as I mentioned, we have a splash screen. 58 00:08:21,980 --> 00:08:28,100 The victim tries to log in, and every activity is logged and sent back to the MQTT server. 59 00:08:29,240 --> 00:08:33,420 I'm also working on an enhancement where this can even store all of that locally. 60 00:08:33,860 --> 00:08:40,320 So you could deploy this, come back after a day, bring it back, connect it to your computer, 61 00:08:40,540 --> 00:08:44,840 and it can start dumping all of the usernames or whatever was collected 62 00:08:44,840 --> 00:08:47,120 when people connect it to your splash screen. 63 00:08:52,760 --> 00:08:58,020 So this is the overall view of what we want to achieve. 64 00:08:59,040 --> 00:09:01,520 So now the question is, how do you program this device? 65 00:09:02,240 --> 00:09:05,220 Now, how many of you have ever programmed an Arduino? 66 00:09:07,720 --> 00:09:08,760 Good news. 67 00:09:10,540 --> 00:09:15,780 The ESP8266 SDK integrates flawlessly with the Arduino IDE. 68 00:09:16,780 --> 00:09:22,660 And there is actually a lot of wrapper routines so that you can use the Wi-Fi module and a couple of others. 69 00:09:23,240 --> 00:09:28,940 There are certain SDK-specific APIs which you may have to call which don't exist in Arduino. 70 00:09:30,000 --> 00:09:32,640 And, well, I have all the code and everything documented. 71 00:09:34,120 --> 00:09:34,640 So... 72 00:09:38,220 --> 00:09:38,700 Decepticon. 73 00:09:39,860 --> 00:09:47,280 The first example which I'm going to show you is how to break Decepticon up and look at these smaller building blocks. 74 00:09:48,680 --> 00:09:52,540 Now, keep in mind the idea is not to run through a whole programming exercise. 75 00:09:53,500 --> 00:09:54,820 We have limited time. 76 00:09:55,040 --> 00:09:58,280 So I'm going to show you code, run a couple of live demos, 77 00:09:58,800 --> 00:10:02,240 run a couple of them on video just so that we can cover everything. 78 00:10:02,240 --> 00:10:05,240 After the class, I have a couple of ESP8266. 79 00:10:06,100 --> 00:10:09,680 So if you want to try it out live or do something, just let me know. 80 00:10:11,920 --> 00:10:12,360 Okay. 81 00:10:14,300 --> 00:10:16,040 So, let's start from the basics. 82 00:10:16,240 --> 00:10:20,860 I wanted to give you an idea of how simple it is to actually program these devices. 83 00:10:22,020 --> 00:10:27,000 This isn't as difficult as probably, you know, taking OpenWrt, customizing it. 84 00:10:27,100 --> 00:10:28,240 This is really simple. 85 00:10:28,360 --> 00:10:30,480 A lot of the sample code is already out there. 86 00:10:33,100 --> 00:10:33,780 Okay. 87 00:10:38,060 --> 00:10:44,720 So let's actually start with the obligatory hello world. 88 00:10:47,260 --> 00:10:49,860 So I have connected this to my USB. 89 00:10:50,460 --> 00:10:57,880 The ESP8266 has a serial port and the development board has a serial to USB converter. 90 00:10:57,880 --> 00:11:02,640 So you can just directly talk to the chip, you know, over your USB port. 91 00:11:07,300 --> 00:11:09,280 So I have set up the chip here. 92 00:11:10,980 --> 00:11:13,000 If you look under board, it says NodeMCU. 93 00:11:14,520 --> 00:11:16,540 The frequency is 80 megahertz. 94 00:11:16,620 --> 00:11:24,120 Most importantly, you just need to make sure that you have selected your USB to UART port. 95 00:11:24,380 --> 00:11:24,800 Okay. 96 00:11:27,520 --> 00:11:29,080 Now, extremely simple. 97 00:11:31,860 --> 00:11:37,000 When the device comes up, we can run what is called setup code. 98 00:11:37,120 --> 00:11:39,080 Now, if you've done Arduino, you already know this. 99 00:11:39,240 --> 00:11:42,720 This is for the rest of the gang who probably hasn't used Arduino before. 100 00:11:43,760 --> 00:11:45,920 So, setup only runs once. 101 00:11:46,080 --> 00:11:53,760 And all we do in setup is I set the serial port speed along with probably just printing a couple of hello worlds. 102 00:11:55,620 --> 00:12:02,980 After setup runs, we actually go through what is called an event loop. 103 00:12:03,200 --> 00:12:07,520 And that loop keeps running and you can pretty much put in whatever you want inside of it. 104 00:12:07,880 --> 00:12:08,080 Right? 105 00:12:08,280 --> 00:12:09,120 Simple example. 106 00:12:09,400 --> 00:12:13,220 So I'm going to go ahead, upload the code, run it. 107 00:12:15,660 --> 00:12:17,600 So we are compiling the sketch. 108 00:12:31,180 --> 00:12:34,720 All of this code and Decepticon is completely free and open source. 109 00:12:34,900 --> 00:12:37,820 So, I'm going to be adding a lot of things to it. 110 00:12:41,460 --> 00:12:42,980 You will love this little device. 111 00:12:43,340 --> 00:12:46,240 I've fallen in love with it for the last six to eight months. 112 00:12:47,040 --> 00:12:50,320 And they've come out with ESP32, which is the next version. 113 00:12:50,900 --> 00:12:52,680 I'm already working on that as well. 114 00:12:52,680 --> 00:12:54,360 So, it should be fun to see. 115 00:12:54,680 --> 00:12:54,960 Okay. 116 00:12:55,260 --> 00:13:05,640 So now that the code is uploaded, we can look at the serial port of the device by just opening the serial monitor on Arduino. 117 00:13:06,460 --> 00:13:08,760 Now, I'm going to reset the device real quick. 118 00:13:08,980 --> 00:13:10,460 It has two switches on it. 119 00:13:12,520 --> 00:13:19,340 As soon as I reset, you'll actually see the device once again just print the hello world. 120 00:13:19,420 --> 00:13:19,560 Right? 121 00:13:19,760 --> 00:13:20,700 Quick introduction. 122 00:13:20,700 --> 00:13:23,200 As I said, two important things. 123 00:13:23,280 --> 00:13:26,560 The setup function, where you run stuff one time. 124 00:13:26,720 --> 00:13:29,320 And then the loop function, where you want your event loop. 125 00:13:29,780 --> 00:13:33,440 So now let's take on something a little bit more interesting. 126 00:13:38,760 --> 00:13:41,200 So, how many of you use arrow dump in G? 127 00:13:41,480 --> 00:13:41,920 Everyone? 128 00:13:42,140 --> 00:13:42,520 Okay. 129 00:13:44,160 --> 00:13:50,340 So what I did was, I took the base Arduino code, looked at a couple of APIs which the SDK offered. 130 00:13:50,340 --> 00:13:53,760 And I tried to create a simple arrow dump in G. 131 00:14:13,960 --> 00:14:14,560 Okay. 132 00:14:18,120 --> 00:14:19,880 So I'm going to upload this code. 133 00:14:20,940 --> 00:14:24,400 I've tried my best to document the code as elaborately as possible. 134 00:14:24,500 --> 00:14:26,400 As I said, I don't want to make this a coding exercise. 135 00:14:27,400 --> 00:14:30,740 But if you do have any questions, you can always reach out to me later. 136 00:14:32,260 --> 00:14:33,720 So let's wait for this to run. 137 00:14:59,640 --> 00:15:00,340 Okay. 138 00:15:00,480 --> 00:15:01,300 Can you just see that? 139 00:15:03,270 --> 00:15:06,080 So this is under $5. 140 00:15:06,680 --> 00:15:07,380 Right? 141 00:15:08,500 --> 00:15:13,720 Interestingly, because this is actually talking over, you know, USB to UART. 142 00:15:13,720 --> 00:15:20,420 You can actually connect this to your Android phone and use any serial monitor application on Android. 143 00:15:20,880 --> 00:15:23,200 And you could pretty much be able to see all of this. 144 00:15:25,700 --> 00:15:30,560 Seems to be an unknown one, which might mean I had to look into my parsing code a little bit more. 145 00:15:32,360 --> 00:15:40,060 But this is how easily you can create a network monitor using this little guy. 146 00:15:40,240 --> 00:15:40,520 Okay. 147 00:15:40,580 --> 00:15:42,900 All the code, again, completely open source. 148 00:15:48,540 --> 00:15:49,020 Okay. 149 00:15:50,360 --> 00:16:00,460 So the good news is the ESP8266, because it was meant for IoT, they actually have a lightweight TCP and Wi-Fi stack in it. 150 00:16:01,040 --> 00:16:05,180 So all we have to do is leverage that stack to create a Wi-Fi access point. 151 00:16:06,220 --> 00:16:10,960 Creating an AP is as simple as what you may have done in, you know, a couple of the Arduino-based platforms. 152 00:16:11,300 --> 00:16:13,640 So let me show that. 153 00:16:13,720 --> 00:16:15,480 I'm going to run that code and run it. 154 00:16:30,480 --> 00:16:36,300 So just to show you how trivial it is to actually create an AP, that's all you have to do. 155 00:16:36,760 --> 00:16:39,320 Wi-Fi.softAP, give the SSID. 156 00:16:39,620 --> 00:16:43,640 If you'd like to create an encrypted access point, give the password. 157 00:16:43,680 --> 00:16:43,700 Okay. 158 00:16:43,700 --> 00:16:43,780 That's the last phrase. 159 00:16:44,440 --> 00:16:45,580 Followed by the channel. 160 00:16:46,040 --> 00:16:50,100 And if you want this to be a hidden AP, that is a flag. 161 00:16:50,340 --> 00:16:51,660 You can just set that to true. 162 00:16:51,980 --> 00:16:53,180 The default is false. 163 00:16:54,260 --> 00:16:54,660 Okay. 164 00:16:54,800 --> 00:16:56,700 So I'm going to quickly go ahead and run this. 165 00:16:59,400 --> 00:17:01,640 Aren't you guys already falling in love with this little chip? 166 00:17:02,760 --> 00:17:03,560 It's $5. 167 00:17:05,700 --> 00:17:08,940 Actually, if you order from AliExpress, you can even get it for $3. 168 00:17:13,020 --> 00:17:13,420 Okay. 169 00:17:13,420 --> 00:17:14,640 Let's wait for it to upload. 170 00:17:18,740 --> 00:17:19,180 Yeah. 171 00:17:19,420 --> 00:17:21,060 Does it support external antennas? 172 00:17:21,760 --> 00:17:23,040 A version of it does. 173 00:17:23,220 --> 00:17:26,540 So there is a version called the VMOS D-mini, which is just... 174 00:17:26,540 --> 00:17:27,420 So he has a good question. 175 00:17:27,500 --> 00:17:29,160 Does this support external antennas? 176 00:17:29,680 --> 00:17:33,020 So the ESP8266 I am demoing, this doesn't. 177 00:17:33,020 --> 00:17:36,180 But there is a VMOS D-mini based on the same chip. 178 00:17:36,500 --> 00:17:38,620 And they actually have an SMA connector. 179 00:17:39,200 --> 00:17:41,420 And you can use that with a 3-dBi antenna. 180 00:17:42,320 --> 00:17:43,400 I can actually give you an example. 181 00:17:43,400 --> 00:17:44,480 I'll give you a link after the talk. 182 00:17:45,540 --> 00:17:50,160 They have a little resistor you have to kind of desolder and kind of solder it back, so 183 00:17:50,160 --> 00:17:54,760 you can switch the circuit from internal antenna to external, but that's about it. 184 00:17:59,280 --> 00:18:01,220 So let's see, what was the AP called? 185 00:18:02,860 --> 00:18:03,500 ESP8266 AP. 186 00:18:05,740 --> 00:18:07,240 So let's switch Wi-Fi on. 187 00:18:09,700 --> 00:18:10,700 And there it is. 188 00:18:10,740 --> 00:18:11,100 Do you see that? 189 00:18:13,100 --> 00:18:19,680 So you should be able to see the ESP8266 AP in here. 190 00:18:22,180 --> 00:18:27,360 That's how easy it is to actually create an access point using the ESP8266. 191 00:18:28,520 --> 00:18:29,080 Right? 192 00:18:29,440 --> 00:18:32,260 You can create an open AP, no encryption. 193 00:18:32,400 --> 00:18:37,600 You can create a web AP, WPA-PSK, and WPA2-PSK. 194 00:18:37,980 --> 00:18:40,320 For enterprise, you have to kind of... 195 00:18:41,100 --> 00:18:45,160 Do a little bit of kind of workarounds, because they don't support that natively. 196 00:18:45,280 --> 00:18:48,100 But if you are interested, you can talk to me after the talk. 197 00:18:50,320 --> 00:18:50,780 Okay. 198 00:18:50,860 --> 00:18:59,960 So what I'm really trying to do here is connect the different blocks we would require to 199 00:18:59,960 --> 00:19:01,140 create Decepticon. 200 00:19:01,360 --> 00:19:01,720 Right? 201 00:19:01,840 --> 00:19:07,400 So Decepticon is a honeypot AP, which means, of course, we'd have to know how to go ahead 202 00:19:07,400 --> 00:19:09,080 and create a Wi-Fi access point. 203 00:19:09,440 --> 00:19:10,600 We just saw how to. 204 00:19:10,600 --> 00:19:16,880 It has to connect back to its backhaul network, which means the scanning facility and the 205 00:19:16,880 --> 00:19:17,860 connect back facility. 206 00:19:19,040 --> 00:19:25,480 And then finally, it has to run a web server and make sure that there is DNS redirection. 207 00:19:26,020 --> 00:19:28,900 So that as soon as someone connects, DNS can redirect. 208 00:19:42,860 --> 00:19:43,260 Okay. 209 00:19:43,940 --> 00:19:47,940 Now, the connect back, we are at DEFCON. 210 00:19:48,040 --> 00:19:48,280 Right? 211 00:19:48,420 --> 00:19:54,000 So my ESP8266 might not be able to connect to the DEFCON live network right now. 212 00:19:55,000 --> 00:19:56,860 For things, I mean, of course, understandable. 213 00:19:57,520 --> 00:20:01,280 So what I'm going to do is the connection part, I'm just going to show you a quick video, 214 00:20:01,440 --> 00:20:04,020 because I don't want someone to hack the device while I'm doing a demo. 215 00:20:05,300 --> 00:20:06,440 That would not be pretty. 216 00:20:08,060 --> 00:20:09,920 So here is the connection part. 217 00:20:10,040 --> 00:20:11,780 Again, really simple. 218 00:20:12,300 --> 00:20:15,360 Let me give you an example and show you how the code looks like first. 219 00:20:17,900 --> 00:20:18,340 . 220 00:20:24,740 --> 00:20:25,180 . 221 00:20:25,180 --> 00:20:25,280 . 222 00:20:28,620 --> 00:20:29,060 . 223 00:20:33,920 --> 00:20:34,360 . 224 00:20:34,360 --> 00:20:34,560 . 225 00:20:34,560 --> 00:20:34,780 . 226 00:20:34,780 --> 00:20:34,880 . 227 00:20:34,880 --> 00:20:34,900 . 228 00:20:34,900 --> 00:20:35,280 . 229 00:20:35,840 --> 00:20:36,280 . 230 00:20:40,260 --> 00:20:40,380 . 231 00:20:40,640 --> 00:20:40,760 . 232 00:20:40,760 --> 00:20:40,880 . 233 00:20:40,880 --> 00:20:40,980 . 234 00:20:40,980 --> 00:20:41,060 . 235 00:20:41,460 --> 00:20:41,580 . 236 00:20:45,400 --> 00:20:45,520 . 237 00:20:46,320 --> 00:20:46,440 . 238 00:20:46,440 --> 00:20:46,560 . 239 00:20:46,560 --> 00:20:46,620 . 240 00:20:46,620 --> 00:20:46,660 . 241 00:20:46,660 --> 00:20:46,680 . 242 00:20:46,920 --> 00:20:47,040 . 243 00:20:47,040 --> 00:20:47,100 . 244 00:20:47,100 --> 00:20:47,120 . 245 00:20:47,120 --> 00:20:47,140 . 246 00:20:47,140 --> 00:20:47,160 . 247 00:20:47,160 --> 00:20:47,180 . 248 00:20:47,180 --> 00:20:47,200 . 249 00:20:47,200 --> 00:20:47,220 . 250 00:20:47,220 --> 00:20:47,240 . 251 00:21:22,760 --> 00:21:24,380 Okay, let's see if we can connect 252 00:21:24,380 --> 00:21:26,860 to the open wireless at DEF CON 253 00:21:27,700 --> 00:21:29,920 without getting a BYOD on my screen 254 00:21:29,920 --> 00:21:32,040 or something worse, right? 255 00:21:42,560 --> 00:21:43,340 Yeah, question. 256 00:21:46,780 --> 00:21:47,280 Yes. 257 00:21:48,140 --> 00:21:49,540 Yeah, so that's a good question. 258 00:21:49,800 --> 00:21:52,100 Her question is, does the chip have GPIO? 259 00:21:52,220 --> 00:21:52,360 Yes. 260 00:21:52,600 --> 00:21:55,320 It actually has one more serial port, 261 00:21:55,560 --> 00:21:57,980 and you can even do software serial with it. 262 00:21:58,060 --> 00:22:00,880 People have even done USB software serial with it. 263 00:22:01,340 --> 00:22:04,740 From what I recall, it probably has eight GPIO ports. 264 00:22:06,440 --> 00:22:07,620 So you can connect, 265 00:22:07,700 --> 00:22:09,780 and originally this was meant to be for IoT. 266 00:22:10,420 --> 00:22:12,920 So they really wanted it to be able to connect 267 00:22:12,920 --> 00:22:15,420 to external devices and be controlled 268 00:22:16,040 --> 00:22:18,500 by probably, you know, your fridge 269 00:22:18,500 --> 00:22:21,920 or maybe a kettle which has IoT on it. 270 00:22:22,120 --> 00:22:23,280 How many of you have that? 271 00:22:30,460 --> 00:22:30,940 Okay. 272 00:22:37,620 --> 00:22:40,160 So it might have a bit of issue here connecting. 273 00:22:40,860 --> 00:22:43,180 The kind of only thing is if you're in an environment 274 00:22:43,180 --> 00:22:44,260 with a lot of DEODs, 275 00:22:44,320 --> 00:22:45,820 I don't even know what's happening in the background, 276 00:22:46,720 --> 00:22:48,680 but I'm going to try to reset it and see what happens. 277 00:22:54,480 --> 00:22:56,300 This is a little error message I print 278 00:22:56,300 --> 00:22:57,740 until the time I'm trying to check stuff. 279 00:23:01,560 --> 00:23:01,920 Okay. 280 00:23:03,620 --> 00:23:05,180 Trying to connect to the DEF CON network 281 00:23:05,180 --> 00:23:06,040 was not a good idea. 282 00:23:06,560 --> 00:23:06,960 Clearly. 283 00:23:08,800 --> 00:23:09,860 Let's actually go ahead 284 00:23:10,620 --> 00:23:12,240 and look at the client functionality. 285 00:23:18,580 --> 00:23:21,100 I'm also going to put up all of these videos online. 286 00:23:21,280 --> 00:23:23,060 The videos run you through every step. 287 00:23:23,280 --> 00:23:24,080 They have voice, 288 00:23:24,520 --> 00:23:26,460 which means you'll never forget how I sound. 289 00:23:28,380 --> 00:23:29,800 You can look at them later. 290 00:23:29,880 --> 00:23:30,220 Was that? 291 00:23:30,440 --> 00:23:31,300 I agree with it. 292 00:23:31,880 --> 00:23:33,020 You just go to sleep. 293 00:23:37,880 --> 00:23:38,480 Okay. 294 00:23:38,580 --> 00:23:42,660 So once we actually run the code, 295 00:23:43,380 --> 00:23:45,300 it's supposed to connect to the backhaul network, 296 00:23:45,580 --> 00:23:47,540 and after that, 297 00:23:47,680 --> 00:23:50,220 we can actually have full internet connectivity. 298 00:23:50,760 --> 00:23:52,920 This uses LWIP, 299 00:23:53,180 --> 00:23:55,380 which is a lightweight IP stack. 300 00:23:55,540 --> 00:23:57,900 It's actually used in a lot of embedded devices. 301 00:24:00,200 --> 00:24:01,420 So let's go back. 302 00:24:16,940 --> 00:24:17,560 Okay. 303 00:24:19,260 --> 00:24:22,240 Now, let's actually look at Decepticon itself. 304 00:24:22,560 --> 00:24:23,860 I'm just going to run you through 305 00:24:23,860 --> 00:24:26,680 a little bit on the code organization. 306 00:24:31,420 --> 00:24:32,040 Okay. 307 00:24:32,440 --> 00:24:35,060 So the way Decepticon works 308 00:24:35,060 --> 00:24:36,080 is, 309 00:24:36,080 --> 00:24:39,020 first, it has to create a Honeypot IP, right? 310 00:24:39,380 --> 00:24:41,760 So that Honeypot access point 311 00:24:43,880 --> 00:24:46,520 is actually being created over here 312 00:24:46,520 --> 00:24:47,800 in a Deception IP. 313 00:24:48,020 --> 00:24:49,720 It creates a Honeypot IP. 314 00:24:49,840 --> 00:24:54,380 The SSID is free internet, of course. 315 00:24:56,020 --> 00:24:57,840 I live in a downtown area, 316 00:24:58,080 --> 00:24:59,880 so it's actually quite fun 317 00:24:59,880 --> 00:25:01,740 to hang this from my window 318 00:25:02,520 --> 00:25:04,660 and see how many people try to connect 319 00:25:04,660 --> 00:25:05,500 to free internet. 320 00:25:11,860 --> 00:25:14,180 So that's basically the Deception IP. 321 00:25:16,320 --> 00:25:18,680 Now, once the Honeypot comes up, 322 00:25:18,840 --> 00:25:21,400 we want the backhaul network to also work, right? 323 00:25:21,500 --> 00:25:23,420 So that we can send all these messages 324 00:25:23,420 --> 00:25:25,200 back to the command and control server. 325 00:25:26,500 --> 00:25:29,100 That's actually done in init backend reporting. 326 00:25:29,660 --> 00:25:32,620 Again, we've already seen the sample code snippets. 327 00:25:34,600 --> 00:25:36,000 Now, after this, 328 00:25:36,080 --> 00:25:40,080 we are going to go ahead and start the DNS server. 329 00:25:43,420 --> 00:25:45,340 How many of you have had trouble 330 00:25:45,980 --> 00:25:48,120 doing DNS redirection attacks? 331 00:25:49,240 --> 00:25:51,860 You know, you probably used a couple of tools 332 00:25:51,860 --> 00:25:54,180 where you had to ensure that all your DNS replies 333 00:25:55,260 --> 00:25:57,680 get redirected to only your IP address, right? 334 00:25:57,800 --> 00:26:00,300 And it's pretty painful sometimes to get right. 335 00:26:00,800 --> 00:26:04,420 Now, with ESP8266, it couldn't be simpler. 336 00:26:04,420 --> 00:26:08,220 They have a DNS server, and in DNS start, 337 00:26:08,520 --> 00:26:13,080 the second argument, if you actually mention a wildcard, 338 00:26:13,380 --> 00:26:16,420 it automatically goes ahead and responds 339 00:26:16,420 --> 00:26:20,500 to every DNS request with the ESP8266's IP. 340 00:26:21,220 --> 00:26:24,400 Which is fantastic, right? 341 00:26:24,480 --> 00:26:27,020 This is the most difficult part I've always found 342 00:26:27,020 --> 00:26:29,500 kind of getting right when you create MITM setups 343 00:26:29,500 --> 00:26:32,940 or, you know, any form of Deception or Honeypot setups. 344 00:26:33,240 --> 00:26:34,400 But, hey, that's it. 345 00:26:34,400 --> 00:26:36,100 I mean, they support it in the stack itself. 346 00:26:37,880 --> 00:26:40,440 I don't even know why they market it as an IoT device. 347 00:26:40,960 --> 00:26:43,600 They'd probably have a lot more success marketing here 348 00:26:43,600 --> 00:26:44,380 in the vendor's area. 349 00:26:48,460 --> 00:26:50,460 So this is how you start the DNS. 350 00:26:52,120 --> 00:26:54,920 I have a couple of error checks over here 351 00:26:54,920 --> 00:26:57,780 so that, you know, we can make sure we are reconnecting, 352 00:26:57,780 --> 00:26:58,100 et cetera. 353 00:27:02,540 --> 00:27:03,740 This is a dummy account. 354 00:27:03,740 --> 00:27:05,040 You can see all the passwords. 355 00:27:05,440 --> 00:27:06,760 You can try it if you like. 356 00:27:07,160 --> 00:27:07,960 It's all yours. 357 00:27:09,060 --> 00:27:11,520 But this is the back-end MQTT server. 358 00:27:12,720 --> 00:27:14,400 And what we actually do is, 359 00:27:15,660 --> 00:27:17,760 as soon as we bring up the access point, 360 00:27:18,060 --> 00:27:20,420 we tell the remote server, hey, the AP is up. 361 00:27:20,700 --> 00:27:23,080 When someone connects to your AP, we say, 362 00:27:23,220 --> 00:27:27,620 hey, XYZ client with this MAC address connected to you. 363 00:27:28,740 --> 00:27:30,560 When the client opens a browser, 364 00:27:31,380 --> 00:27:33,040 we go ahead and send a message. 365 00:27:33,040 --> 00:27:34,760 Login page sent, right? 366 00:27:35,140 --> 00:27:37,300 And you'll see a mapping of all of that 367 00:27:37,300 --> 00:27:38,480 with the GUI in just a bit. 368 00:27:45,580 --> 00:27:46,760 The web page. 369 00:27:47,040 --> 00:27:52,280 So with the ESP8266, you have a file system, 370 00:27:52,500 --> 00:27:53,840 but it is pretty limited. 371 00:27:54,760 --> 00:27:59,560 However, what you can do is embed the web page itself 372 00:27:59,560 --> 00:28:03,020 into the code so that it pretty much, you know, 373 00:28:03,020 --> 00:28:06,420 is kind of fetched at runtime directly from memory. 374 00:28:06,760 --> 00:28:08,720 You don't have to do any of the disk access. 375 00:28:09,100 --> 00:28:10,100 I did that. 376 00:28:10,160 --> 00:28:11,620 I wasn't too happy with the performance. 377 00:28:12,280 --> 00:28:14,300 It has a very, very small disk. 378 00:28:14,500 --> 00:28:16,900 I think a couple of KB, if I recall. 379 00:28:17,880 --> 00:28:20,700 So I have the entire hotspot page, 380 00:28:20,780 --> 00:28:22,580 the whole HTML and everything in here, 381 00:28:24,240 --> 00:28:26,500 embedded inside the code as a variable. 382 00:28:29,060 --> 00:28:31,060 Finally, we have the web server. 383 00:28:33,020 --> 00:28:34,880 So all the web server does is, 384 00:28:35,020 --> 00:28:37,380 as soon as a client connects, 385 00:28:37,640 --> 00:28:39,120 the DNS redirection happens. 386 00:28:39,380 --> 00:28:41,980 It throws the splash page regardless 387 00:28:41,980 --> 00:28:45,060 of whatever URL is being requested, right? 388 00:28:45,140 --> 00:28:47,480 Just like any captive portal. 389 00:28:48,500 --> 00:28:49,180 Okay. 390 00:28:49,640 --> 00:28:52,640 So let's actually run this. 391 00:29:00,820 --> 00:29:02,340 Now, as I mentioned, 392 00:29:02,340 --> 00:29:03,300 through the DEF CON network, 393 00:29:03,480 --> 00:29:04,460 it might be difficult to connect. 394 00:29:05,400 --> 00:29:06,380 I'm going to run it, 395 00:29:06,440 --> 00:29:08,540 show you how it kind of looks like in the serial monitor. 396 00:29:08,860 --> 00:29:10,260 You can try the code later, 397 00:29:10,400 --> 00:29:13,260 but I have a full video of how it works in general, right? 398 00:29:13,420 --> 00:29:14,520 I have tested it. 399 00:29:15,640 --> 00:29:17,900 I've even deployed it in a lot of fun places 400 00:29:17,900 --> 00:29:19,080 with people's permission. 401 00:29:20,320 --> 00:29:21,080 Is he recording? 402 00:29:21,460 --> 00:29:21,860 Okay. 403 00:29:24,760 --> 00:29:25,560 So, yeah. 404 00:29:25,980 --> 00:29:27,060 Jokes apart, of course, 405 00:29:27,100 --> 00:29:29,560 just for research purposes. 406 00:29:31,600 --> 00:29:35,000 So, let's actually wait for it to compile. 407 00:29:48,340 --> 00:29:50,680 So right now, the access point is up. 408 00:29:53,240 --> 00:29:55,060 And if you use your phone, 409 00:29:55,180 --> 00:29:57,400 you should be able to see a free internet. 410 00:29:58,700 --> 00:29:59,540 Feel free right now, 411 00:29:59,540 --> 00:30:00,240 feel free to connect to it. 412 00:30:00,320 --> 00:30:01,440 I have a friendly malware. 413 00:30:04,440 --> 00:30:06,640 It'll just occasionally say hi to me. 414 00:30:08,580 --> 00:30:10,200 So, as I said, 415 00:30:10,240 --> 00:30:11,360 you can pretty much try this. 416 00:30:12,280 --> 00:30:12,800 Okay. 417 00:30:12,900 --> 00:30:14,480 So we have one connected client. 418 00:30:14,740 --> 00:30:15,980 Who is that Braveheart? 419 00:30:17,100 --> 00:30:17,980 Who connected? 420 00:30:18,220 --> 00:30:18,880 Someone did connect. 421 00:30:19,160 --> 00:30:19,620 Okay. 422 00:30:19,680 --> 00:30:20,000 He did. 423 00:30:20,880 --> 00:30:23,060 So feel free to connect if you notice. 424 00:30:23,600 --> 00:30:26,220 Because we don't have an outgoing internet connection 425 00:30:26,220 --> 00:30:26,900 at this time, 426 00:30:26,940 --> 00:30:28,380 the MQTT message says, 427 00:30:28,380 --> 00:30:30,600 we aren't able to connect, 428 00:30:30,700 --> 00:30:31,240 but that's okay. 429 00:30:31,700 --> 00:30:32,920 You can try that later. 430 00:30:34,740 --> 00:30:36,600 So, feel free to connect to it. 431 00:30:36,680 --> 00:30:38,340 I'm just going to show you how this looks like 432 00:30:38,340 --> 00:30:40,120 when you deploy it 433 00:30:40,120 --> 00:30:42,800 in a much more saner network than here. 434 00:30:43,980 --> 00:30:45,580 So, let's actually go in. 435 00:31:01,560 --> 00:31:02,080 Okay. 436 00:31:04,160 --> 00:31:07,040 So, this is the remote server I'm using. 437 00:31:07,700 --> 00:31:10,840 There is a free service called Cloud MQTT. 438 00:31:11,020 --> 00:31:12,540 You can sign up for a free account, 439 00:31:13,140 --> 00:31:14,220 which is really what I did. 440 00:31:14,840 --> 00:31:19,660 And this is the MQTT server that ESP8266 talks to 441 00:31:19,660 --> 00:31:21,320 when it actually has to send messages. 442 00:31:21,720 --> 00:31:23,280 You can set up your own. 443 00:31:23,340 --> 00:31:23,860 As I said, 444 00:31:23,860 --> 00:31:24,580 there is Mosquito, 445 00:31:24,740 --> 00:31:25,380 a couple of others. 446 00:31:26,080 --> 00:31:28,060 But I generally prefer free options. 447 00:31:28,380 --> 00:31:30,400 But I don't have to set up too many things. 448 00:31:30,760 --> 00:31:31,320 Okay. 449 00:31:33,760 --> 00:31:34,880 So, now, 450 00:31:35,060 --> 00:31:37,220 let's actually fast forward a bit. 451 00:31:40,960 --> 00:31:41,520 Okay. 452 00:31:41,620 --> 00:31:43,180 So, the device started up. 453 00:31:46,460 --> 00:31:48,660 And what is happening here is 454 00:31:49,140 --> 00:31:50,980 free internet is now up and running. 455 00:31:51,020 --> 00:31:51,580 It is broadcasting. 456 00:31:52,000 --> 00:31:54,540 It then started the HTTP server. 457 00:31:54,960 --> 00:31:56,040 And after that, 458 00:31:56,080 --> 00:31:57,980 it connected to the backhaul network. 459 00:31:58,380 --> 00:31:58,460 Right? 460 00:31:58,520 --> 00:31:59,480 Which, as I said, 461 00:31:59,560 --> 00:32:01,960 to the DEF CON network is difficult to connect. 462 00:32:03,160 --> 00:32:05,800 And it just tells you what IP address 463 00:32:06,300 --> 00:32:08,720 and all of that it has configured itself with. 464 00:32:12,420 --> 00:32:14,840 So, this is now serving a honeypot 465 00:32:15,900 --> 00:32:18,820 simultaneously being connected to a backhaul network 466 00:32:18,820 --> 00:32:20,820 so it can talk to the MQTT server. 467 00:32:21,180 --> 00:32:24,380 Now, if I go back and look at the MQTT server GUI, 468 00:32:25,220 --> 00:32:27,180 you will see momentarily, 469 00:32:29,020 --> 00:32:30,220 us getting messages. 470 00:32:30,380 --> 00:32:31,260 So, this is the free, 471 00:32:33,320 --> 00:32:35,980 the deception SSID free internet is up. 472 00:32:36,060 --> 00:32:36,620 As you can see, 473 00:32:36,640 --> 00:32:37,560 that's an IDS alert. 474 00:32:38,280 --> 00:32:39,100 Honeypot update, 475 00:32:39,260 --> 00:32:40,240 the SSID is up. 476 00:32:40,320 --> 00:32:41,640 And the current client list, 477 00:32:41,800 --> 00:32:42,320 zero now. 478 00:32:42,640 --> 00:32:44,420 All this means is no clients connected. 479 00:32:45,500 --> 00:32:46,460 This is a phone, 480 00:32:46,580 --> 00:32:49,180 any device which might connect to free internet. 481 00:32:53,860 --> 00:32:55,200 So, once we connect, 482 00:32:55,340 --> 00:32:57,480 because we do the DNS redirection, 483 00:32:58,340 --> 00:33:01,520 automatically all mobile devices tell you to sign in. 484 00:33:02,320 --> 00:33:04,680 We get the MAC address and the IP 485 00:33:04,680 --> 00:33:06,960 and then you get the splash page. 486 00:33:12,200 --> 00:33:13,480 For legal reasons, 487 00:33:13,640 --> 00:33:14,460 given this is recorded, 488 00:33:14,700 --> 00:33:16,520 we have a custom page called Hacker Arsenal, 489 00:33:16,720 --> 00:33:18,900 but you can create any splash page in there. 490 00:33:20,240 --> 00:33:22,360 Too many bad things happening nowadays too. 491 00:33:22,620 --> 00:33:23,900 People presenting, so. 492 00:33:23,900 --> 00:33:28,420 And then you can actually put in the username 493 00:33:28,420 --> 00:33:30,640 or the victim would go ahead 494 00:33:30,640 --> 00:33:32,240 and put in the username and password. 495 00:33:32,760 --> 00:33:35,620 All of that is immediately going to be sent 496 00:33:35,620 --> 00:33:37,700 over the internet to the MQTT server. 497 00:33:41,180 --> 00:33:42,000 There you go. 498 00:33:45,720 --> 00:33:46,280 So, 499 00:33:50,280 --> 00:33:51,720 at the very same time, 500 00:33:51,800 --> 00:33:52,580 what I'm working is, 501 00:33:52,580 --> 00:33:55,620 you can actually send the device back messages as well. 502 00:33:56,260 --> 00:33:58,660 So, you could probably tell it to do something interesting. 503 00:33:59,480 --> 00:34:02,360 I was even thinking about having it do a port scan. 504 00:34:03,720 --> 00:34:06,660 Once the client connects to see what services are available. 505 00:34:09,340 --> 00:34:09,820 Okay. 506 00:34:16,800 --> 00:34:19,400 So, all the code is going to be available. 507 00:34:19,560 --> 00:34:20,400 As I said, 508 00:34:20,400 --> 00:34:22,300 I've tried connecting the DEF CON network. 509 00:34:22,580 --> 00:34:23,860 Maybe by tonight, 510 00:34:24,020 --> 00:34:26,420 I'll have everything up on HackerArsenal.com. 511 00:34:27,660 --> 00:34:29,920 And you can download it. 512 00:34:33,900 --> 00:34:34,500 Okay. 513 00:34:34,620 --> 00:34:35,580 So, that's all I have. 514 00:34:35,720 --> 00:34:36,320 Thank you. 515 00:34:36,360 --> 00:34:36,720 Any questions? 516 00:34:40,200 --> 00:34:41,040 Thank you. 517 00:34:46,460 --> 00:34:47,060 Questions? 518 00:34:49,240 --> 00:34:50,220 So, yeah. 519 00:34:52,680 --> 00:34:56,420 So, I've actually managed to power this literally for weeks 520 00:34:56,420 --> 00:35:00,120 with one of those little USB charger batteries, 521 00:35:00,400 --> 00:35:01,840 like the Amtech ones. 522 00:35:03,300 --> 00:35:05,100 It works fantastically well. 523 00:35:05,220 --> 00:35:06,140 That's a good question. 524 00:35:06,920 --> 00:35:07,520 Additionally, 525 00:35:07,760 --> 00:35:12,120 the ESP8266 actually supports a low power mode 526 00:35:12,120 --> 00:35:14,520 where it can switch itself off 527 00:35:15,300 --> 00:35:17,600 and pretty much operate in very low power 528 00:35:17,600 --> 00:35:20,660 and then automatically switch itself on periodically. 529 00:35:20,660 --> 00:35:22,840 So, doing that, 530 00:35:22,960 --> 00:35:24,880 someone even claimed to run it for a year. 531 00:35:25,140 --> 00:35:28,260 I mean, I don't know how much truth is there in it, 532 00:35:28,400 --> 00:35:31,100 but so you can do a lot of stuff with this. 533 00:35:31,260 --> 00:35:33,540 They also have a new chip called ESP32, 534 00:35:34,940 --> 00:35:38,860 which allows you to do both Wi-Fi and Bluetooth, 535 00:35:39,180 --> 00:35:41,360 low energy and your regular Bluetooth. 536 00:35:42,740 --> 00:35:47,720 My recommendation is look at all the new IoT platforms coming out. 537 00:35:48,340 --> 00:35:50,640 This is actually a treasure trove for wireless. 538 00:35:50,640 --> 00:35:53,680 Because, I mean, you know, 539 00:35:53,740 --> 00:35:56,220 they've done the kind of time investment and research 540 00:35:56,220 --> 00:35:57,780 to miniaturize them anyway, 541 00:35:58,300 --> 00:36:00,740 and all of them need to have full-blown stacks 542 00:36:00,740 --> 00:36:01,860 so that we can use it. 543 00:36:02,660 --> 00:36:05,880 And, I mean, I go crazy just buying stuff from AliExpress 544 00:36:05,880 --> 00:36:07,680 and just most stuff seems to work. 545 00:36:08,180 --> 00:36:11,620 I mean, unlike the time when you have to hunt for wireless cards 546 00:36:11,620 --> 00:36:13,620 or platforms endlessly for weeks, 547 00:36:14,420 --> 00:36:16,020 some of the new platforms are great. 548 00:36:16,200 --> 00:36:17,400 All the IoT platforms, 549 00:36:17,600 --> 00:36:19,820 especially the ones with wireless and Bluetooth. 550 00:36:19,820 --> 00:36:20,680 So, yep. 551 00:36:23,220 --> 00:36:24,400 Okay, thank you very much. 552 00:36:24,840 --> 00:36:25,360 Thank you. 553 00:36:25,560 --> 00:36:26,040 Thank you.