Welcome to the presentation about Cotopaxi toolkit for testing IoT devices.
At the beginning, a short introduction about myself. My name is Jakub Botwicz. Currently,
I work in Samsung R&D Center in Poland, where I lead a small team of security pen testers.
In recent three years, I have reported more than 30 CVEs to different open source components,
mostly IoT libraries. In my free time, I climb and trek in the mountains,
especially I love active volcanoes, which inspired the name of the toolkit.
I would like to acknowledge also other contributors who added new features or
performed quality reviews of the tool. They are listed on the slide.
What was the idea for Cotopaxi? One thing is that the overall security level of IoT devices
is still very low, so there is a lot of testing to do. Another topic is that there are new
protocols used mainly in IoT devices like Coop, DTLS, or MQTT, and most of these new protocols
are not supported by security testing tools. If you look at the slide, you will see the
landscape of security tools for IoT devices when we started preparing Cotopaxi back in 2017.
There were lots of gaps and the major tool Shodan search engine could be used only for
public devices. Currently, the situation changed a little bit for better with the new tools that
appeared during last years. But still, when you have a look at specific protocols, there are still
multiple gaps to fill. For example, when you run nmap scan on a device using Coop protocol on
non-standard port, you will receive a lot of unknown protocols or wild guesses based only on
port numbers. Similarly, in Wireshark, it supports most of new protocols but only on standard ports.
On the slide, you can see example of Coop traffic that was shown as unknown UDP protocol.
Only after manual change using decodeS function, you will receive decoded Coop packets.
So, when in 2017 our team performed large-scale assessment of multiple IoT components, we got
ideas for new tools, large corpus with malformed packets and a pack of new vulnerabilities.
All of that was used as a foundation for Cotopaxi.
The most important information about Cotopaxi, it was released to public as an open source
project under GPL2 license. It is available in the public github repository in the Samsung
organization. Currently, this is the fourth release of the tool with new features and vulnerabilities.
When it comes to this strange name, Cotopaxi is an active volcano in Ecuador
and it's quite interesting target for climbing. Cotopaxi can be used by different security
personnel. If you're a pentester, you can use it when you're performing black box assessment
of large environments like smart home, smart factory or smart city. If you're a security
researcher, you can analyze network traffic of tested device identifying known vulnerabilities
or check for OEM devices. And finally, if you're a developer or vendor, you can
fuzz your devices and check whether they can be used in distributed denial of service attacks.
Currently, there are 10 tools in the toolkit and they support different phases of penetration
testing. Starting from the reconnaissance phase, there is a service ping that checks availability
of endpoints for specific protocols. The next one is security scanner that allows to verify
security properties like cryptography, certificates and so on. Deer buster for
resource listing in various protocols. Software finger painter that classifies
software components used by the server. And the new tool for device identification
that passively analyze traffic and classify devices using machine learning.
In the pre-exploitation phase, there are amplification sniffer for detecting traffic
amplifiers, protocol fuzzer in two versions for testing clients and servers and known
vulnerability tester also in two versions. Cotopaxi currently support 10 protocols.
Three of them were added in this version. These are advanced message queuing protocol AMQP,
MQTT for sensor networks and the QUIC protocol. I will shortly tell about two of them.
QUIC is the new protocol designed by Google and widely used in their applications and IoT devices.
It is mainly like TCP and TLS in one with support for multiple streams and low latency
and connection setup. And it's also UDP based. The second of new protocols is MQTT-SN.
This is an UDP clone of the most popular IoT protocol MQTT. It was designed for
sensor networks, what is quite popular in IoT world.
First and basic tool in the Cotopaxi toolkit is ServicePink. It's used by all other tools
to check whether there's an active server of protocol at a specific address and port.
It uses a set of payloads for each protocol to test
endpoints. And this is an extension of usual port scan using NMAP.
The next tool is ServiceFingerprinter. This is an equivalent to NMAP, service and application
version detection. However, NMAP works only using server responses comparison for a list of inputs,
while Cotopaxi uses machine learning classifier based on the number of requests and responses.
The next tool is used for device identification. This is a new feature in this version.
It is based on two large corpuses of IoT traffic provided by authors of papers listed on the slide.
After recording sample of traffic, we can classify all devices that were
communicating. But you need to make sure that you have captured all of packets going in and out
of device, so that the classification results were accurate. The next tool performs resource listing
and it's similar to popular dirbuster, but works for a wider range of protocols like
co-op, multicast DNS, SSDP, RTSP. You need to provide a list of resource names and Cotopaxi
will check each of them on the server. There are some predefined lists for each protocol available
in the list's subdirectory. The next feature is a protocol fuzzer. It is using
corpus of malformed packets prepared using American Fuzzalab fuzzer and it checks whether
device crashed after receiving packet or what was the time of packet processing. Usually packets
processed longer are more interesting for further analysis and mutations and can be used for next
steps of fuzzing. The next tool is vulnerability tester. We have five classes of vulnerabilities
information disclosures, crashes, traffic amplifications, memory leaks, and remote code
execution. In this version we have 10 new vulnerabilities that were added to the database
and in total 34 issues. Here we can see a sample of vulnerabilities found by us and
that can be identified by Cotopaxi. For example we have here a malformed DNS packet that
that cause infinite loop in tiny svc mdns server or a single packet that induce six packets
in response from the server which can be used for distributed denial of service attacks.
And the last but not least tool in our toolkit is the amplification sniffer that dumps all packets
and analyze input and output of the server, calculate the amplification factor for tested
device. Short information how IoT devices can be used to perform distributed denials of service
attacks. It is possible after identifying a large number of vulnerabilities devices
that attacker sends packets with spoofed source addresses and device send responses to victim
causing traffic overload. It's possible easily in UDP-based protocols where there is no handshake
at the beginning of communications. So UDP-based protocols like co-op or DTLS can be used for such
attacks. So finally before we start the demo, short information what you can do to start with
Cotopaxi. First download the tool from the repository, read the manual and install it.
Of course use it and hack different devices but only when you have a consent of the owner or you
are the owner. If you find any errors in the toolkit please report it using GitHub issues.
Using the same way you can contribute new vulnerabilities or new code.