All right. Without further ado, I would like to introduce Vivek Ramachandran, Nishant Sharma, and I can't say that. I'm sorry. Ashish?
Ashish, yeah. That's pretty good.
Ashish. All right. They will be talking about Decepticon, Wi-Fi deception in under $5. And afterwards, you can ask lots of questions about what else you can do for under $5. Excellent. Have a great time. Thank you.
Thank you, Rick.
Tip your servers.
Thank you.
Decepticon under $5. A little bit about myself. Started as an electronics and communications engineer. I implemented a lot of the CAT 65, 802.1X in port security back in the day. Broke web cloaking, created the Cafe Latte attack, was one of the winners of the Microsoft security shootout contest. I speak and train at conferences. We do Black Hat every year, the Wi-Fi training.
I also run security.
SecurityTube.net and Pentester Academy. Written a bunch of books. And let's come to Decepticon.
Okay. So what is Decepticon? Now, as a Wi-Fi hacker, I have created a lot of honeypots, right? All of us have. What I really wanted to do is see if we can create honeypots which can trap attackers, probably both trying to attack your home network as well as enterprise.
Okay.
So what I really wanted to do is see if we can create honeypots which trap attackers. And that is where the idea for Decepticon came. Now, when you look at honeypots deployed, you know, in an enterprise, even doing extremely simple things has actually netted me a lot of attackers. To give you an example, if the office network is called Pentester Academy, and that's WPA2 enterprise, and if you have an open AP or probably WPA PSK with an easy passphrase, you can create honeypots which trap attackers.
You'll actually see a lot of people trying to break in. As far as WPA passphrase is concerned, pick one of those from rawq.txt. Right? Everyone uses Kali. Everyone is going to use the same dictionary. I think, you know, the attacker might get a gratifying feeling that he cracked the network, logs in, does a lot of mischievous stuff. But of course, we are watching.
So I tried out many of those. But interestingly, what I wanted to do is...
Let's see if we could build these Wi-Fi honeypots in under $5. So which means you can pretty much leave them deployed anywhere, at your parking lot, at probably, you know, kind of hanging from one of your windows, and see what happens. Right? Just for fun.
So I did a lot of research on the different devices available, and I finally picked up the ESP8266. Any of you guys work with it?
Okay. Just one?
So this is actually a very interesting chip. It is used for the Internet of Things. It's a full SOC. The wireless card on it actually has BGN capability, which is fantastic. The SDK is open. It can actually do, of course, open WPA, WPA2, and the latest firmware even allows you to do WPA enterprise, which is almost unbelievable for a chip that size.
It's a full-blown 32-bit RISC. You can use the 80 MHz option or the 160 MHz option, either of which is pretty reasonable for the task in hand.
So I looked at this chip and then decided to use this to deploy Decepticons all over the place.
So here is a deployment scenario.
So let's say you have a corporate Wi-Fi.
So if you have a corporate Wi-Fi network or your home network, you can deploy a bunch of these Decepticons, attach long-range antennas. I even tried using a couple of signal boosters, and then misconfigure them, right?
Use a different passphrase, make them open networks, because when you do an aerodump scan, you're probably thinking, corporate Wi-Fi, someone forgot to configure that AP properly, right?
So if someone is attacking, that's probably going to be the first target.
Still, even enterprise Deception solutions, which is out there in the market, doesn't use too much of Wi-Fi, from what I've seen.
I've never seen a complete Wi-Fi Deception solution.
So how would this work?
We create the Honeypot network, and then we actually connect to a backhaul network.
So here is what I want to do.
The chip is actually on the development board, but the chip really is half the size of the development board you can see right now.
Now, what I wanted was I could just power this over USB anywhere, and it actually creates a fake Honeypot network, and at the same time connects back to one of the corporate APs, so that when an attacker connects to the Honeypot, we can go back and tell the admin, right?
Now, unbelievably, this little chip can do both an access point and client mode at the same time.
So it can maintain dual stacks, so we do not require two different Wi-Fi cards, or two different chips.
Of course, the only limitation is your Honeypot would be on the same channel as your corporate AP if you wanted to connect back.
That's not necessarily a bad thing because the attacker is expecting the corporate APs to probably be in one of those channels, right?
So we create the Honeypot network, and I'll show you, you know, what is the IDE, and I'll give out all the sample code today.
We create the Honeypot network, and then this actually connects back to your home Wi-Fi or to your corporate Wi-Fi.
After that, any time an attacker connects to the Honeypot,
we automatically send out these little messages over to our remote server, which it can access over the backhaul network.
How many of you have heard of MQTT?
Okay. Think of it as Twitter for IoT devices, right?
Really short messages. You can pack a lot of things in there.
So this uses MQTT to go ahead and communicate with a remote MQTT server.
I'm just using a free server on the internet, Cloud MQTT.
You could, if you want, configure your own. There's one called Mosquito.
Okay. So once we've connected, the device actually waits for an attacker to connect to it.
The moment he connects, it starts sending all of those little messages back to the command and control.
Now, another option which we have is if you actually wanted to deploy this on a hotspot MQTT,
let's say, have Starbucks AP on it or T-Mobile,
then I'm also giving out a program where you can create your own splash screens all on this device.
So this has an embedded web server in it.
There is an interesting little way by which you can put web pages along with it by encoding.
And I'll run you through it a little later.
But with that, you can put your own splash screens, right?
Or mimic existing ones.
So the other option, as I mentioned, we have a splash screen.
The victim tries to log in, and every activity is logged and sent back to the MQTT server.
I'm also working on an enhancement where this can even store all of that locally.
So you could deploy this, come back after a day, bring it back, connect it to your computer,
and it can start dumping all of the usernames or whatever was collected
when people connect it to your splash screen.
So this is the overall view of what we want to achieve.
So now the question is, how do you program this device?
Now, how many of you have ever programmed an Arduino?
Good news.
The ESP8266 SDK integrates flawlessly with the Arduino IDE.
And there is actually a lot of wrapper routines so that you can use the Wi-Fi module and a couple of others.
There are certain SDK-specific APIs which you may have to call which don't exist in Arduino.
And, well, I have all the code and everything documented.
So...
Decepticon.
The first example which I'm going to show you is how to break Decepticon up and look at these smaller building blocks.
Now, keep in mind the idea is not to run through a whole programming exercise.
We have limited time.
So I'm going to show you code, run a couple of live demos,
run a couple of them on video just so that we can cover everything.
After the class, I have a couple of ESP8266.
So if you want to try it out live or do something, just let me know.
Okay.
So, let's start from the basics.
I wanted to give you an idea of how simple it is to actually program these devices.
This isn't as difficult as probably, you know, taking OpenWrt, customizing it.
This is really simple.
A lot of the sample code is already out there.
Okay.
So let's actually start with the obligatory hello world.
So I have connected this to my USB.
The ESP8266 has a serial port and the development board has a serial to USB converter.
So you can just directly talk to the chip, you know, over your USB port.
So I have set up the chip here.
If you look under board, it says NodeMCU.
The frequency is 80 megahertz.
Most importantly, you just need to make sure that you have selected your USB to UART port.
Okay.
Now, extremely simple.
When the device comes up, we can run what is called setup code.
Now, if you've done Arduino, you already know this.
This is for the rest of the gang who probably hasn't used Arduino before.
So, setup only runs once.
And all we do in setup is I set the serial port speed along with probably just printing a couple of hello worlds.
After setup runs, we actually go through what is called an event loop.
And that loop keeps running and you can pretty much put in whatever you want inside of it.
Right?
Simple example.
So I'm going to go ahead, upload the code, run it.
So we are compiling the sketch.
All of this code and Decepticon is completely free and open source.
So, I'm going to be adding a lot of things to it.
You will love this little device.
I've fallen in love with it for the last six to eight months.
And they've come out with ESP32, which is the next version.
I'm already working on that as well.
So, it should be fun to see.
Okay.
So now that the code is uploaded, we can look at the serial port of the device by just opening the serial monitor on Arduino.
Now, I'm going to reset the device real quick.
It has two switches on it.
As soon as I reset, you'll actually see the device once again just print the hello world.
Right?
Quick introduction.
As I said, two important things.
The setup function, where you run stuff one time.
And then the loop function, where you want your event loop.
So now let's take on something a little bit more interesting.
So, how many of you use arrow dump in G?
Everyone?
Okay.
So what I did was, I took the base Arduino code, looked at a couple of APIs which the SDK offered.
And I tried to create a simple arrow dump in G.
Okay.
So I'm going to upload this code.
I've tried my best to document the code as elaborately as possible.
As I said, I don't want to make this a coding exercise.
But if you do have any questions, you can always reach out to me later.
So let's wait for this to run.
Okay.
Can you just see that?
So this is under $5.
Right?
Interestingly, because this is actually talking over, you know, USB to UART.
You can actually connect this to your Android phone and use any serial monitor application on Android.
And you could pretty much be able to see all of this.
Seems to be an unknown one, which might mean I had to look into my parsing code a little bit more.
But this is how easily you can create a network monitor using this little guy.
Okay.
All the code, again, completely open source.
Okay.
So the good news is the ESP8266, because it was meant for IoT, they actually have a lightweight TCP and Wi-Fi stack in it.
So all we have to do is leverage that stack to create a Wi-Fi access point.
Creating an AP is as simple as what you may have done in, you know, a couple of the Arduino-based platforms.
So let me show that.
I'm going to run that code and run it.
So just to show you how trivial it is to actually create an AP, that's all you have to do.
Wi-Fi.softAP, give the SSID.
If you'd like to create an encrypted access point, give the password.
Okay.
That's the last phrase.
Followed by the channel.
And if you want this to be a hidden AP, that is a flag.
You can just set that to true.
The default is false.
Okay.
So I'm going to quickly go ahead and run this.
Aren't you guys already falling in love with this little chip?
It's $5.
Actually, if you order from AliExpress, you can even get it for $3.
Okay.
Let's wait for it to upload.
Yeah.
Does it support external antennas?
A version of it does.
So there is a version called the VMOS D-mini, which is just...
So he has a good question.
Does this support external antennas?
So the ESP8266 I am demoing, this doesn't.
But there is a VMOS D-mini based on the same chip.
And they actually have an SMA connector.
And you can use that with a 3-dBi antenna.
I can actually give you an example.
I'll give you a link after the talk.
They have a little resistor you have to kind of desolder and kind of solder it back, so
you can switch the circuit from internal antenna to external, but that's about it.
So let's see, what was the AP called?
ESP8266 AP.
So let's switch Wi-Fi on.
And there it is.
Do you see that?
So you should be able to see the ESP8266 AP in here.
That's how easy it is to actually create an access point using the ESP8266.
Right?
You can create an open AP, no encryption.
You can create a web AP, WPA-PSK, and WPA2-PSK.
For enterprise, you have to kind of...
Do a little bit of kind of workarounds, because they don't support that natively.
But if you are interested, you can talk to me after the talk.
Okay.
So what I'm really trying to do here is connect the different blocks we would require to
create Decepticon.
Right?
So Decepticon is a honeypot AP, which means, of course, we'd have to know how to go ahead
and create a Wi-Fi access point.
We just saw how to.
It has to connect back to its backhaul network, which means the scanning facility and the
connect back facility.
And then finally, it has to run a web server and make sure that there is DNS redirection.
So that as soon as someone connects, DNS can redirect.
Okay.
Now, the connect back, we are at DEFCON.
Right?
So my ESP8266 might not be able to connect to the DEFCON live network right now.
For things, I mean, of course, understandable.
So what I'm going to do is the connection part, I'm just going to show you a quick video,
because I don't want someone to hack the device while I'm doing a demo.
That would not be pretty.
So here is the connection part.
Again, really simple.
Let me give you an example and show you how the code looks like first.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Okay, let's see if we can connect
to the open wireless at DEF CON
without getting a BYOD on my screen
or something worse, right?
Yeah, question.
Yes.
Yeah, so that's a good question.
Her question is, does the chip have GPIO?
Yes.
It actually has one more serial port,
and you can even do software serial with it.
People have even done USB software serial with it.
From what I recall, it probably has eight GPIO ports.
So you can connect,
and originally this was meant to be for IoT.
So they really wanted it to be able to connect
to external devices and be controlled
by probably, you know, your fridge
or maybe a kettle which has IoT on it.
How many of you have that?
Okay.
So it might have a bit of issue here connecting.
The kind of only thing is if you're in an environment
with a lot of DEODs,
I don't even know what's happening in the background,
but I'm going to try to reset it and see what happens.
This is a little error message I print
until the time I'm trying to check stuff.
Okay.
Trying to connect to the DEF CON network
was not a good idea.
Clearly.
Let's actually go ahead
and look at the client functionality.
I'm also going to put up all of these videos online.
The videos run you through every step.
They have voice,
which means you'll never forget how I sound.
You can look at them later.
Was that?
I agree with it.
You just go to sleep.
Okay.
So once we actually run the code,
it's supposed to connect to the backhaul network,
and after that,
we can actually have full internet connectivity.
This uses LWIP,
which is a lightweight IP stack.
It's actually used in a lot of embedded devices.
So let's go back.
Okay.
Now, let's actually look at Decepticon itself.
I'm just going to run you through
a little bit on the code organization.
Okay.
So the way Decepticon works
is,
first, it has to create a Honeypot IP, right?
So that Honeypot access point
is actually being created over here
in a Deception IP.
It creates a Honeypot IP.
The SSID is free internet, of course.
I live in a downtown area,
so it's actually quite fun
to hang this from my window
and see how many people try to connect
to free internet.
So that's basically the Deception IP.
Now, once the Honeypot comes up,
we want the backhaul network to also work, right?
So that we can send all these messages
back to the command and control server.
That's actually done in init backend reporting.
Again, we've already seen the sample code snippets.
Now, after this,
we are going to go ahead and start the DNS server.
How many of you have had trouble
doing DNS redirection attacks?
You know, you probably used a couple of tools
where you had to ensure that all your DNS replies
get redirected to only your IP address, right?
And it's pretty painful sometimes to get right.
Now, with ESP8266, it couldn't be simpler.
They have a DNS server, and in DNS start,
the second argument, if you actually mention a wildcard,
it automatically goes ahead and responds
to every DNS request with the ESP8266's IP.
Which is fantastic, right?
This is the most difficult part I've always found
kind of getting right when you create MITM setups
or, you know, any form of Deception or Honeypot setups.
But, hey, that's it.
I mean, they support it in the stack itself.
I don't even know why they market it as an IoT device.
They'd probably have a lot more success marketing here
in the vendor's area.
So this is how you start the DNS.
I have a couple of error checks over here
so that, you know, we can make sure we are reconnecting,
et cetera.
This is a dummy account.
You can see all the passwords.
You can try it if you like.
It's all yours.
But this is the back-end MQTT server.
And what we actually do is,
as soon as we bring up the access point,
we tell the remote server, hey, the AP is up.
When someone connects to your AP, we say,
hey, XYZ client with this MAC address connected to you.
When the client opens a browser,
we go ahead and send a message.
Login page sent, right?
And you'll see a mapping of all of that
with the GUI in just a bit.
The web page.
So with the ESP8266, you have a file system,
but it is pretty limited.
However, what you can do is embed the web page itself
into the code so that it pretty much, you know,
is kind of fetched at runtime directly from memory.
You don't have to do any of the disk access.
I did that.
I wasn't too happy with the performance.
It has a very, very small disk.
I think a couple of KB, if I recall.
So I have the entire hotspot page,
the whole HTML and everything in here,
embedded inside the code as a variable.
Finally, we have the web server.
So all the web server does is,
as soon as a client connects,
the DNS redirection happens.
It throws the splash page regardless
of whatever URL is being requested, right?
Just like any captive portal.
Okay.
So let's actually run this.
Now, as I mentioned,
through the DEF CON network,
it might be difficult to connect.
I'm going to run it,
show you how it kind of looks like in the serial monitor.
You can try the code later,
but I have a full video of how it works in general, right?
I have tested it.
I've even deployed it in a lot of fun places
with people's permission.
Is he recording?
Okay.
So, yeah.
Jokes apart, of course,
just for research purposes.
So, let's actually wait for it to compile.
So right now, the access point is up.
And if you use your phone,
you should be able to see a free internet.
Feel free right now,
feel free to connect to it.
I have a friendly malware.
It'll just occasionally say hi to me.
So, as I said,
you can pretty much try this.
Okay.
So we have one connected client.
Who is that Braveheart?
Who connected?
Someone did connect.
Okay.
He did.
So feel free to connect if you notice.
Because we don't have an outgoing internet connection
at this time,
the MQTT message says,
we aren't able to connect,
but that's okay.
You can try that later.
So, feel free to connect to it.
I'm just going to show you how this looks like
when you deploy it
in a much more saner network than here.
So, let's actually go in.
Okay.
So, this is the remote server I'm using.
There is a free service called Cloud MQTT.
You can sign up for a free account,
which is really what I did.
And this is the MQTT server that ESP8266 talks to
when it actually has to send messages.
You can set up your own.
As I said,
there is Mosquito,
a couple of others.
But I generally prefer free options.
But I don't have to set up too many things.
Okay.
So, now,
let's actually fast forward a bit.
Okay.
So, the device started up.
And what is happening here is
free internet is now up and running.
It is broadcasting.
It then started the HTTP server.
And after that,
it connected to the backhaul network.
Right?
Which, as I said,
to the DEF CON network is difficult to connect.
And it just tells you what IP address
and all of that it has configured itself with.
So, this is now serving a honeypot
simultaneously being connected to a backhaul network
so it can talk to the MQTT server.
Now, if I go back and look at the MQTT server GUI,
you will see momentarily,
us getting messages.
So, this is the free,
the deception SSID free internet is up.
As you can see,
that's an IDS alert.
Honeypot update,
the SSID is up.
And the current client list,
zero now.
All this means is no clients connected.
This is a phone,
any device which might connect to free internet.
So, once we connect,
because we do the DNS redirection,
automatically all mobile devices tell you to sign in.
We get the MAC address and the IP
and then you get the splash page.
For legal reasons,
given this is recorded,
we have a custom page called Hacker Arsenal,
but you can create any splash page in there.
Too many bad things happening nowadays too.
People presenting, so.
And then you can actually put in the username
or the victim would go ahead
and put in the username and password.
All of that is immediately going to be sent
over the internet to the MQTT server.
There you go.
So,
at the very same time,
what I'm working is,
you can actually send the device back messages as well.
So, you could probably tell it to do something interesting.
I was even thinking about having it do a port scan.
Once the client connects to see what services are available.
Okay.
So, all the code is going to be available.
As I said,
I've tried connecting the DEF CON network.
Maybe by tonight,
I'll have everything up on HackerArsenal.com.
And you can download it.
Okay.
So, that's all I have.
Thank you.
Any questions?
Thank you.
Questions?
So, yeah.
So, I've actually managed to power this literally for weeks
with one of those little USB charger batteries,
like the Amtech ones.
It works fantastically well.
That's a good question.
Additionally,
the ESP8266 actually supports a low power mode
where it can switch itself off
and pretty much operate in very low power
and then automatically switch itself on periodically.
So, doing that,
someone even claimed to run it for a year.
I mean, I don't know how much truth is there in it,
but so you can do a lot of stuff with this.
They also have a new chip called ESP32,
which allows you to do both Wi-Fi and Bluetooth,
low energy and your regular Bluetooth.
My recommendation is look at all the new IoT platforms coming out.
This is actually a treasure trove for wireless.
Because, I mean, you know,
they've done the kind of time investment and research
to miniaturize them anyway,
and all of them need to have full-blown stacks
so that we can use it.
And, I mean, I go crazy just buying stuff from AliExpress
and just most stuff seems to work.
I mean, unlike the time when you have to hunt for wireless cards
or platforms endlessly for weeks,
some of the new platforms are great.
All the IoT platforms,
especially the ones with wireless and Bluetooth.
So, yep.
Okay, thank you very much.
Thank you.
Thank you.