1 00:00:00,000 --> 00:00:05,300 Welcome to the presentation about Cotopaxi toolkit for testing IoT devices. 2 00:00:05,720 --> 00:00:08,640 At the beginning, a short introduction about myself. 3 00:00:08,700 --> 00:00:10,120 My name is Jakub Botwicz. 4 00:00:10,120 --> 00:00:16,220 Currently, I work in Samsung R&D Center in Poland, where I lead a small team of security pen testers. 5 00:00:16,320 --> 00:00:25,480 In recent three years, I have reported more than 30 CVEs to different open source components, mostly IoT libraries. 6 00:00:25,580 --> 00:00:33,120 In my free time, I climb and trek in the mountains, especially I love active volcanoes, which inspired the name of the toolkit. 7 00:00:33,520 --> 00:00:39,780 I would like to acknowledge also other contributors who added new features or performed quality reviews of the tool. 8 00:00:39,780 --> 00:00:41,640 They are listed on the slide. 9 00:00:42,760 --> 00:00:44,820 What was the idea for Cotopaxi? 10 00:00:44,820 --> 00:00:51,740 One thing is that the overall security level of IoT devices is still very low, so there is a lot of testing to do. 11 00:00:51,740 --> 00:01:04,460 Another topic is that there are new protocols used mainly in IoT devices like Coop, DTLS, or MQTT, and most of these new protocols are not supported by security testing tools. 12 00:01:05,360 --> 00:01:14,680 If you look at the slide, you will see the landscape of security tools for IoT devices when we started preparing Cotopaxi back in 2017. 13 00:01:14,740 --> 00:01:23,400 There were lots of gaps and the major tool Shodan search engine could be used only for public devices. 14 00:01:24,020 --> 00:01:32,140 Currently, the situation changed a little bit for better with the new tools that appeared during last years. 15 00:01:32,780 --> 00:01:39,240 But still, when you have a look at specific protocols, there are still multiple gaps to fill. 16 00:01:39,920 --> 00:01:52,920 For example, when you run nmap scan on a device using Coop protocol on non-standard port, you will receive a lot of unknown protocols or wild guesses based only on port numbers. 17 00:01:53,780 --> 00:02:02,420 Similarly, in Wireshark, it supports most of new protocols but only on standard ports. 18 00:02:02,420 --> 00:02:13,160 On the slide, you can see example of Coop traffic that was shown as unknown UDP protocol. 19 00:02:14,100 --> 00:02:20,020 Only after manual change using decodeS function, you will receive decoded Coop packets. 20 00:02:21,320 --> 00:02:34,940 So, when in 2017 our team performed large-scale assessment of multiple IoT components, we got ideas for new tools, large corpus with malformed packets and a pack of new vulnerabilities. 21 00:02:36,500 --> 00:02:40,880 All of that was used as a foundation for Cotopaxi. 22 00:02:43,340 --> 00:02:52,840 The most important information about Cotopaxi, it was released to public as an open source project under GPL2 license. 23 00:02:52,840 --> 00:02:58,760 It is available in the public github repository in the Samsung organization. 24 00:02:58,760 --> 00:03:03,370 Currently, this is the fourth release of the tool with new features and vulnerabilities. 25 00:03:04,180 --> 00:03:12,920 When it comes to this strange name, Cotopaxi is an active volcano in Ecuador and it's quite interesting target for climbing. 26 00:03:14,080 --> 00:03:17,940 Cotopaxi can be used by different security personnel. 27 00:03:17,940 --> 00:03:30,120 If you're a pentester, you can use it when you're performing black box assessment of large environments like smart home, smart factory or smart city. 28 00:03:30,260 --> 00:03:42,720 If you're a security researcher, you can analyze network traffic of tested device identifying known vulnerabilities or check for OEM devices. 29 00:03:42,960 --> 00:03:51,540 And finally, if you're a developer or vendor, you can fuzz your devices and check whether they can be used in distributed denial of service attacks. 30 00:03:52,520 --> 00:03:58,980 Currently, there are 10 tools in the toolkit and they support different phases of penetration testing. 31 00:03:58,980 --> 00:04:08,120 Starting from the reconnaissance phase, there is a service ping that checks availability of endpoints for specific protocols. 32 00:04:08,520 --> 00:04:17,280 The next one is security scanner that allows to verify security properties like cryptography, certificates and so on. 33 00:04:17,640 --> 00:04:23,760 Deer buster for resource listing in various protocols. 34 00:04:23,760 --> 00:04:29,540 Software finger painter that classifies software components used by the server. 35 00:04:29,540 --> 00:04:38,100 And the new tool for device identification that passively analyze traffic and classify devices using machine learning. 36 00:04:39,050 --> 00:04:58,720 In the pre-exploitation phase, there are amplification sniffer for detecting traffic amplifiers, protocol fuzzer in two versions for testing clients and servers and known vulnerability tester also in two versions. 37 00:05:00,040 --> 00:05:03,520 Cotopaxi currently support 10 protocols. 38 00:05:03,520 --> 00:05:06,600 Three of them were added in this version. 39 00:05:06,880 --> 00:05:17,240 These are advanced message queuing protocol AMQP, MQTT for sensor networks and the QUIC protocol. 40 00:05:17,240 --> 00:05:20,980 I will shortly tell about two of them. 41 00:05:21,440 --> 00:05:29,660 QUIC is the new protocol designed by Google and widely used in their applications and IoT devices. 42 00:05:30,140 --> 00:05:40,500 It is mainly like TCP and TLS in one with support for multiple streams and low latency and connection setup. 43 00:05:40,500 --> 00:05:43,820 And it's also UDP based. 44 00:05:44,280 --> 00:05:47,800 The second of new protocols is MQTT-SN. 45 00:05:47,800 --> 00:05:54,300 This is an UDP clone of the most popular IoT protocol MQTT. 46 00:05:54,380 --> 00:06:02,680 It was designed for sensor networks, what is quite popular in IoT world. 47 00:06:04,360 --> 00:06:10,680 First and basic tool in the Cotopaxi toolkit is ServicePink. 48 00:06:10,680 --> 00:06:20,400 It's used by all other tools to check whether there's an active server of protocol at a specific address and port. 49 00:06:20,980 --> 00:06:26,820 It uses a set of payloads for each protocol to test endpoints. 50 00:06:26,900 --> 00:06:31,760 And this is an extension of usual port scan using NMAP. 51 00:06:32,640 --> 00:06:35,580 The next tool is ServiceFingerprinter. 52 00:06:35,580 --> 00:06:40,840 This is an equivalent to NMAP, service and application version detection. 53 00:06:40,860 --> 00:06:53,900 However, NMAP works only using server responses comparison for a list of inputs, while Cotopaxi uses machine learning classifier based on the number of requests and responses. 54 00:06:55,600 --> 00:06:59,240 The next tool is used for device identification. 55 00:06:59,240 --> 00:07:01,540 This is a new feature in this version. 56 00:07:01,660 --> 00:07:08,760 It is based on two large corpuses of IoT traffic provided by authors of papers listed on the slide. 57 00:07:09,320 --> 00:07:17,840 After recording sample of traffic, we can classify all devices that were communicating. 58 00:07:19,340 --> 00:07:30,880 But you need to make sure that you have captured all of packets going in and out of device, so that the classification results were accurate. 59 00:07:31,680 --> 00:07:44,980 The next tool performs resource listing and it's similar to popular dirbuster, but works for a wider range of protocols like co-op, multicast DNS, SSDP, RTSP. 60 00:07:45,440 --> 00:07:51,980 You need to provide a list of resource names and Cotopaxi will check each of them on the server. 61 00:07:52,200 --> 00:07:59,660 There are some predefined lists for each protocol available in the list's subdirectory. 62 00:08:00,660 --> 00:08:03,320 The next feature is a protocol fuzzer. 63 00:08:03,320 --> 00:08:19,240 It is using corpus of malformed packets prepared using American Fuzzalab fuzzer and it checks whether device crashed after receiving packet or what was the time of packet processing. 64 00:08:19,240 --> 00:08:30,040 Usually packets processed longer are more interesting for further analysis and mutations and can be used for next steps of fuzzing. 65 00:08:31,180 --> 00:08:33,840 The next tool is vulnerability tester. 66 00:08:33,840 --> 00:08:43,980 We have five classes of vulnerabilities information disclosures, crashes, traffic amplifications, memory leaks, and remote code execution. 67 00:08:44,100 --> 00:08:55,800 In this version we have 10 new vulnerabilities that were added to the database and in total 34 issues. 68 00:08:56,840 --> 00:09:05,100 Here we can see a sample of vulnerabilities found by us and that can be identified by Cotopaxi. 69 00:09:05,100 --> 00:09:24,860 For example we have here a malformed DNS packet that that cause infinite loop in tiny svc mdns server or a single packet that induce six packets in response from the server which can be used for distributed denial of service attacks. 70 00:09:26,360 --> 00:09:42,400 And the last but not least tool in our toolkit is the amplification sniffer that dumps all packets and analyze input and output of the server, calculate the amplification factor for tested device. 71 00:09:43,100 --> 00:09:49,880 Short information how IoT devices can be used to perform distributed denials of service attacks. 72 00:09:49,880 --> 00:10:07,680 It is possible after identifying a large number of vulnerabilities devices that attacker sends packets with spoofed source addresses and device send responses to victim causing traffic overload. 73 00:10:07,680 --> 00:10:15,120 It's possible easily in UDP-based protocols where there is no handshake at the beginning of communications. 74 00:10:15,360 --> 00:10:21,020 So UDP-based protocols like co-op or DTLS can be used for such attacks. 75 00:10:22,340 --> 00:10:31,040 So finally before we start the demo, short information what you can do to start with Cotopaxi. 76 00:10:31,220 --> 00:10:38,220 First download the tool from the repository, read the manual and install it. 77 00:10:38,220 --> 00:10:48,620 Of course use it and hack different devices but only when you have a consent of the owner or you are the owner. 78 00:10:48,740 --> 00:10:55,720 If you find any errors in the toolkit please report it using GitHub issues. 79 00:10:56,080 --> 00:11:00,860 Using the same way you can contribute new vulnerabilities or new code.