start	end	text
0	5580	Welcome to the presentation about Cotopaxi toolkit for testing IoT devices.
5580	10640	At the beginning, a short introduction about myself. My name is Jakub Botwicz. Currently,
10640	16240	I work in Samsung R&D Center in Poland, where I lead a small team of security pen testers.
16340	23620	In recent three years, I have reported more than 30 CVEs to different open source components,
23620	28700	mostly IoT libraries. In my free time, I climb and trek in the mountains,
28700	33160	especially Isle of Active Volcanoes, which inspired the name of the toolkit.
33540	37580	I would like to acknowledge also other contributors who added new features or
37580	41680	performed quality reviews of the tool. They are listed on the slide.
42780	48140	What was the idea for Cotopaxi? One thing is that the overall security level of IoT devices
48140	53680	is still very low, so there is a lot of testing to do. Another topic is that there are new
53680	61340	protocols used mainly in IoT devices like Coop, DTLS, or MQTT, and most of these new protocols
61340	68180	are not supported by security testing tools. If you look at the slide, you will see the
68180	74660	landscape of security tools for IoT devices when we started preparing Cotopaxi back in 2017.
74880	81760	There were lots of gaps, and the major tool Shodan search engine could be used only for
81760	89440	public devices. Currently, the situation changed a little bit for better with the new tools that
89440	97240	appeared during last years. But still, when you have a look at specific protocols, there are still
97240	104340	multiple gaps to fill. For example, when you run nmap scan on a device using Coop protocol on
104340	111340	non-standard port, you will receive a lot of unknown protocols or wild guesses based only on
111340	122440	port numbers. Similarly, in Wireshark, it supports most of new protocols but only on standard ports.
122440	133180	On the slide, you can see example of Coop traffic that was shown as unknown UDP protocol.
134140	140240	Only after manual change using decodeS function, you will receive decoded Coop packets.
141340	148560	So when in 2017 our team performed large-scale assessment of multiple IoT components, we got
148560	154960	ideas for new tools, large corpus with malformed packets, and a pack of new vulnerabilities.
156500	160940	All of that was used as a foundation for Cotopaxi.
163320	169000	The most important information about Cotopaxi, it was released to public as an open source
169000	177360	project under GPL2 license. It is available in the public GitHub repository in the Samsung
177360	183400	organization. Currently, this is the fourth release of the tool with new features and vulnerabilities.
184240	189040	When it comes to this strange name, Cotopaxi is an active volcano in Ecuador
189040	196720	and it's quite interesting target for climbing. Cotopaxi can be used by different security
196720	202140	personnel. If you're a pentester, you can use it when you're performing black box assessment
202880	211500	of large environments like smart home, smart factory, or smart city. If you're a security
211500	218300	researcher, you can analyze network traffic of tested device, identify known vulnerabilities,
218300	225820	or check for OEM devices. And finally, if you're a developer or vendor, you can
225820	231940	fuzz your devices and check whether they can be used in distributed denial of service attacks.
232540	237900	Currently, there are 10 tools in the toolkit and they support different phases of penetration
237900	244720	testing. Starting from the reconnaissance phase, there is a service ping that checks
244720	255800	availability of endpoints for specific protocols. The next one is security scanner that allows to
255800	264700	detect and so on. Deer buster for resource listing in various protocols. Software finger
264700	271560	painter that classifies software components used by the server. And the new tool for device
271560	278160	identification that passively analyzes traffic and classifies devices using machine learning.
278960	284640	In the pre-exploitation phase, there are amplification sniffer for detecting traffic
284640	293540	amplifiers. Protocol fuzzer in two versions for testing clients and servers.
294020	298720	And known vulnerability tester also in two versions.
300060	306200	Cotopaxi currently supports 10 protocols, three of them were added in this version.
307000	316180	These are advanced message queuing protocol, AMQP, MQTT for sensor networks, and the QUIC
316180	324180	protocol. I will shortly tell about the two of them. QUIC is the new protocol designed by Google
324180	334000	and widely used in their applications and IoT devices. It is mainly like TCP and TLS in one
334000	343820	with support for multiple streams and low latency and connection setup. And it's also UDP based.
344240	351400	The second of new protocols is MQTT-SN. This is an UDP clone of the most popular
351400	362720	IoT protocol MQTT. It was designed for sensor networks, what is quite popular in IoT world.
363620	372960	Okay, first and basic tool in the Cotopaxi toolkit is ServicePink. It's used by all other tools
374340	380440	to check whether there's an active server of protocol at a specific address and port.
380640	384700	It uses a set of payloads for each protocol to test
385340	391780	endpoints. And this is an extension of usual port scan using NMAP.
392680	399220	The next tool is ServiceFingerprinter. This is an equivalent to NMAP, service and application
399220	407060	version detection. However, NMAP works only using server responses comparison for a list of inputs,
407060	413860	while Cotopaxi uses machine learning classifier based on the number of requests and responses.
415140	420440	And the next tool is used for device identification. This is a new feature in
420440	426900	this version. It is based on two large corpuses of IoT traffic provided by authors of papers
426900	434640	listed on the slide. After recording sample of traffic, we can classify all devices that were
437720	443880	communicating, but you need to make sure that you have captured all of packets
443880	450820	going in and out of device, so that the classification results were accurate.
451580	458080	The next tool performs resource listing, and it's similar to popular dirbuster, but works
458080	466740	for a wider range of protocols like co-op, multicast DNS, ssdp, rtsp. You need to provide
466920	472960	a list of resource names and Cotopaxi will check each of them on the server. There are some
472960	479480	predefined lists for each protocol available in the list's subdirectory.
481100	487900	Next feature is a protocol fuzzer. It is using a corpus of malformed packets prepared
488300	495320	using American Fuzzalab fuzzer, and it checks whether device crashed after receiving packet,
495320	501580	or what was the time of packet processing. Usually, packets processed longer
501580	508940	are more interesting for further analysis and mutations, and can be used for next steps of
508940	516840	fuzzing. The next tool is vulnerability tester. We have five classes of vulnerabilities,
516840	522480	information disclosures, crashes, traffic amplifications, memory leaks, and remote
522480	530640	code execution. In this version, we have 10 new vulnerabilities that were added to the database,
530640	541500	and in total 34 issues. Here we can see a sample of vulnerabilities found by us, and
542640	550060	that can be identified by Cotopaxi. For example, we have here a malformed DNS packet that causes
550720	559000	infinite loops in a tiny SVC MDNS server, or a single packet that induces six packets
559000	565220	in response from the server, which can be used for distributed denial of service attacks.
566020	573340	And the last, but not least, tool in our toolkit is the amplification sniffer that dumps all
573340	579320	packets, and analyze input and output of the server, calculate the amplification
580120	586600	factor for tested device. Short information how IoT devices can be used to perform
587240	593720	distributed denials of service attacks. It is possible, after identifying a large number of
593720	602460	vulnerabilities devices, that attackers send packets with spoofed source addresses,
602460	610180	and device sends responses to victim, causing traffic overload. It's possible easily in UDP
610180	614860	based protocols, where there is no handshake at the beginning of communications,
615580	621080	so UDP based protocols like co-op or DTLS can be used for such attacks.
622000	629800	So finally, before we start the demo, short information what you can do to start with
629800	638120	Cotopaxi. First, download the tool from the repository, read the manual and install it.
638120	646760	Of course, use it and hack different devices, but only when you have a consent of the owner,
646760	652760	or you are the owner. If you find any errors in the toolkit, pre-support it
653320	661200	using GitHub issues. Using the same way, you can contribute new vulnerabilities or new code.
665540	674100	So we can now start using Cotopaxi with the first tool named ServicePink. As for
674100	683260	all the tools in the toolkit, you can use "-h", to receive help. And you can see that for this
683260	691740	tool, you need to provide destination address in the form of hostname, single IP address or
691740	704440	multiple addresses by a list separated by a comma or by a mask. Similarly for port,
704440	713220	you can use single port, multiple ports with a range or with a list with a comma.
718720	737730	We have a test environment here with multiple devices to test. For example,
740210	752190	port 2000 with one of the available servers. If you see on the right side,
752190	758330	when you try to use nmap, you will receive information that there is some unknown
759050	765210	service on the port. However, when you use Cotopaxi, you will receive information that
765210	775250	the server here is empty. Similarly for UDP-based
778710	792110	ports, you can also check them in the pink and we receive information that the server here is
792110	803520	co-op. And the next tool I would like to show you is the ServerPink.enter.
805120	810560	Again, we need to provide the IP address on the port and the protocol.
811520	821880	And after executing this, we can see that the server was alive before and after the test
821880	835080	and it was identified as using io-coop. If we get the verbose, we will see all the packets that were
835080	845960	sent and the vector of attributes that was used for classification and finally the result.
847510	865280	Okay, we can also check the resource listener. Again, we need to provide the IP address port
865920	871140	and for this tool we need to provide also a list of the
873200	880860	resources that we will be looking at the server. And for Cotopaxi, there are
881680	889790	multiple lists for each of the protocol and they are provided in the folder Cotopaxi lists.
896990	903610	You can see here the results for the following
905350	912370	endpoints. So we're out, advanced, advanced, graded, basic, big, and so on. And during
915130	925450	the testing, the tool also provided calculated amplification factor for each
926300	933690	of the URLs. And you can see that for some of the URLs that the amplification factors are
934260	944750	quite big, so this tool, this endpoint can be used for traffic amplification attacks.
951080	959980	In the next test, we will use the setup with IoT light bulb connected with the smartphone hub.
959980	968940	As you can see, the light bulb is continuously steered to change the
968940	981330	color and the hub is still available using the standard pin. Okay, so we will now
983190	998000	ping it using Cotopaxi. You see that it responds to the DTLS protocol.
998000	1005700	So we can now start fuzzing using the protocol fuzzer.
1008600	1019040	So we are using the same IP port and the switch for DTLS protocol.
1026650	1038070	And what happened here is the Cotopaxi started fuzzing, sent the first packet,
1038070	1050290	the packet was responded. But with the next packet, the hub crashed. So Cotopaxi
1050290	1061830	is waiting for the hub to reload. And after this, it will continue fuzzing with the next payloads.
1062790	1072170	You can see the lights on the hub. They are showing the current status of the hub.
1072170	1091060	When the light gets dark, the hub is going down. So after each crash, Cotopaxi waits
1091940	1099700	60 seconds. And you can see that again the next packet caused again a crash.
1103860	1110730	And during the crash, the light bulb does not change the color.
1114520	1126460	The corpus is quite big for DTLS protocol, so that the whole test could take a really
1127640	1137120	long time. But we can stop it and we will receive information that Cotopaxi found two payloads
1137120	1143890	that caused crash. And these are the files that are crashing.
1145850	1148080	We can also use
1150740	1160110	Vulnerability Tester, because we already have the payloads in the database.
1160860	1165320	Okay, so now we see that the hub is running.
1167120	1190460	We can check it with ping. Again, we will see that it responds to DTLS. And we can now crash it.
1192280	1201800	You can see that the lights went dark and the server and the Cotopaxi checked that
1201800	1222660	this device is vulnerable to this attack. And the hub is back again.
1225850	1231850	And now I will show you how to use AmplifierDetector to check which services can be used
1231850	1239370	to perform distributed denial-of-service attacks. We have here a wire shark that will
1239370	1245420	show us the whole traffic. In this window, we will run the AmplifierDetector.
1246230	1251210	You can see the syntax is as follows, that you need to provide
1251910	1255730	IP address of the host that will be monitored.
1258950	1268530	And now we will first perform service ping to identify whether the server is really responding.
1270550	1274670	Okay, you can now see the first traffic going in and out.
1277410	1283010	Currently, the amplification factor is very low.
1284650	1294650	But when we start to perform resource listing to the same IP address on the port,
1294650	1304330	we will see some larger responses where the co-op server will provide some larger
1305670	1329250	data. Okay, and now you will see the highest amplification factor was
1329930	1342010	2048 and it was provided using the following request and response.
1344430	1353350	And when we stop the amplification detector, we will receive again the same
1354470	1359410	packet that was the highest amplification factor.
1360670	1372150	Also, the resource locator provides us also with information about amplification factor for each
1373870	1378710	of the provided requests and responses.
1381190	1384910	I have already shown you how to use the standard versions of
1384910	1390370	Protocol Fuzzer and Vulnerability Tester. Now we used client versions.
1391690	1399730	Okay, so here we have an implementation of co-op client and here is the Cotopaxi client
1399730	1405210	Protocol Fuzzer. We will start it.
1406930	1415110	It will be listening as a server on port 10000. And now we can
1416770	1422670	start the client. And as you can see,
1423630	1431890	client initiated traffic, sent request to the server and server responded
1432850	1441610	with the payload as you can see here in Wireshark.
1442350	1451910	When we start initiate next transmission, we will receive next payloads.
1452310	1459110	We can stop it at any time and see how many payloads were sent.
1460250	1471350	Similarly works the Vulnerability Tester. It also listens at a particular port.
1472510	1479370	And when we start a client, we will receive information which payloads were sent and we
1479370	1489230	can see what happened on the client side. And finally, after sending all payloads
1489230	1493790	for this protocol, we receive information summary.
1495390	1505350	Similarly to the server version, we can always see a list of all issues that can be
1506730	1511910	that can be tested using this tool.
1514830	1518550	The next tool I would like to show you is device identification,
1518550	1525150	which is a new feature in this version. To use it, you need to provide a pickup file
1526670	1531950	with recorded traffic for the host you would like to test.
1532490	1542630	You can see here we have an example dump open in Wireshark.
1546010	1559150	We can load just the whole file without showing the IP address and then the tool will try to classify
1560510	1572630	every IP address that is included in this dump. And here you see the results for every IP.
1573850	1587410	If there is no one distinct class, you will see the whole similar classes with the
1588130	1603050	percentage probability. For larger dumps, it is possible to stop loading at any moment,
1603050	1614690	and the whole packets that were already loaded will be processed afterwards.
1614690	1626570	Okay, now we can click ctrl-c to break loading and you can see the classification results.
1631810	1647790	And finally, we can just select one IP address, one device to be classified using option minus i.
1656550	1665030	And in this case, after loading packets, we can see only results of classification for this
1666110	1676180	one selected device. Currently, the device identification tool supports
1676880	1687280	around 55 devices. If you have any other device that is not supported yet,
1687280	1695780	please send us a pickup file with the dump of the traffic network and we will
1696460	1704780	add it to the next version of Cotopaxi. And of course, if you see that any device was incorrectly
1705520	1714580	classified, also please send us your dump and we will fix it.
1717670	1722770	Thank you for watching the presentation and demo. If you have any questions,
1722770	1729110	please ask them using the DEF CON chat. Thank you!