start	end	text
0	5300	Welcome to the presentation about Cotopaxi toolkit for testing IoT devices.
5720	10620	At the beginning, a short introduction about myself. My name is Jakub Botwicz. Currently,
10620	16220	I work in Samsung R&D Center in Poland, where I lead a small team of security pen testers.
16320	23580	In recent three years, I have reported more than 30 CVEs to different open source components,
23580	28660	mostly IoT libraries. In my free time, I climb and trek in the mountains,
28660	33120	especially I love active volcanoes, which inspired the name of the toolkit.
33520	37540	I would like to acknowledge also other contributors who added new features or
37540	41640	performed quality reviews of the tool. They are listed on the slide.
42760	48120	What was the idea for Cotopaxi? One thing is that the overall security level of IoT devices
48120	53660	is still very low, so there is a lot of testing to do. Another topic is that there are new
53660	61320	protocols used mainly in IoT devices like Coop, DTLS, or MQTT, and most of these new protocols
61320	68160	are not supported by security testing tools. If you look at the slide, you will see the
68160	74680	landscape of security tools for IoT devices when we started preparing Cotopaxi back in 2017.
74740	81740	There were lots of gaps and the major tool Shodan search engine could be used only for
81740	89420	public devices. Currently, the situation changed a little bit for better with the new tools that
89420	97220	appeared during last years. But still, when you have a look at specific protocols, there are still
97220	104320	multiple gaps to fill. For example, when you run nmap scan on a device using Coop protocol on
104320	111320	non-standard port, you will receive a lot of unknown protocols or wild guesses based only on
111320	122420	port numbers. Similarly, in Wireshark, it supports most of new protocols but only on standard ports.
122420	133160	On the slide, you can see example of Coop traffic that was shown as unknown UDP protocol.
134100	140020	Only after manual change using decodeS function, you will receive decoded Coop packets.
141320	148540	So, when in 2017 our team performed large-scale assessment of multiple IoT components, we got
148540	154940	ideas for new tools, large corpus with malformed packets and a pack of new vulnerabilities.
156500	160880	All of that was used as a foundation for Cotopaxi.
163340	168980	The most important information about Cotopaxi, it was released to public as an open source
168980	177340	project under GPL2 license. It is available in the public github repository in the Samsung
177340	183370	organization. Currently, this is the fourth release of the tool with new features and vulnerabilities.
184180	189000	When it comes to this strange name, Cotopaxi is an active volcano in Ecuador
189000	196700	and it's quite interesting target for climbing. Cotopaxi can be used by different security
196700	202120	personnel. If you're a pentester, you can use it when you're performing black box assessment
202860	211460	of large environments like smart home, smart factory or smart city. If you're a security
211460	217760	researcher, you can analyze network traffic of tested device identifying known vulnerabilities
217760	225780	or check for OEM devices. And finally, if you're a developer or vendor, you can
225780	231540	fuzz your devices and check whether they can be used in distributed denial of service attacks.
232520	237880	Currently, there are 10 tools in the toolkit and they support different phases of penetration
237880	245180	testing. Starting from the reconnaissance phase, there is a service ping that checks availability
245180	251860	of endpoints for specific protocols. The next one is security scanner that allows to verify
251860	259120	security properties like cryptography, certificates and so on. Deer buster for
259780	266020	resource listing in various protocols. Software finger painter that classifies
266020	272220	software components used by the server. And the new tool for device identification
272220	278100	that passively analyze traffic and classify devices using machine learning.
279050	284600	In the pre-exploitation phase, there are amplification sniffer for detecting traffic
284600	294580	amplifiers, protocol fuzzer in two versions for testing clients and servers and known
294580	303520	vulnerability tester also in two versions. Cotopaxi currently support 10 protocols.
303520	312040	Three of them were added in this version. These are advanced message queuing protocol AMQP,
312040	320980	MQTT for sensor networks and the QUIC protocol. I will shortly tell about two of them.
321440	329660	QUIC is the new protocol designed by Google and widely used in their applications and IoT devices.
330140	337900	It is mainly like TCP and TLS in one with support for multiple streams and low latency
337900	347800	and connection setup. And it's also UDP based. The second of new protocols is MQTT-SN.
347800	356520	This is an UDP clone of the most popular IoT protocol MQTT. It was designed for
357160	362680	sensor networks, what is quite popular in IoT world.
364360	372920	First and basic tool in the Cotopaxi toolkit is ServicePink. It's used by all other tools
374320	380400	to check whether there's an active server of protocol at a specific address and port.
380980	384680	It uses a set of payloads for each protocol to test
385280	391760	endpoints. And this is an extension of usual port scan using NMAP.
392640	399220	The next tool is ServiceFingerprinter. This is an equivalent to NMAP, service and application
399220	407060	version detection. However, NMAP works only using server responses comparison for a list of inputs,
407060	413900	while Cotopaxi uses machine learning classifier based on the number of requests and responses.
415600	421540	The next tool is used for device identification. This is a new feature in this version.
421660	428760	It is based on two large corpuses of IoT traffic provided by authors of papers listed on the slide.
429320	434560	After recording sample of traffic, we can classify all devices that were
436320	445080	communicating. But you need to make sure that you have captured all of packets going in and out
445080	454280	of device, so that the classification results were accurate. The next tool performs resource listing
454280	460380	and it's similar to popular dirbuster, but works for a wider range of protocols like
460940	469160	co-op, multicast DNS, SSDP, RTSP. You need to provide a list of resource names and Cotopaxi
469160	475720	will check each of them on the server. There are some predefined lists for each protocol available
475720	484840	in the list's subdirectory. The next feature is a protocol fuzzer. It is using
485720	492660	corpus of malformed packets prepared using American Fuzzalab fuzzer and it checks whether
492660	500540	device crashed after receiving packet or what was the time of packet processing. Usually packets
500540	507820	processed longer are more interesting for further analysis and mutations and can be used for next
507820	516200	steps of fuzzing. The next tool is vulnerability tester. We have five classes of vulnerabilities
516200	522740	information disclosures, crashes, traffic amplifications, memory leaks, and remote code
522740	530380	execution. In this version we have 10 new vulnerabilities that were added to the database
530950	541480	and in total 34 issues. Here we can see a sample of vulnerabilities found by us and
542590	549240	that can be identified by Cotopaxi. For example we have here a malformed DNS packet that
549240	558940	that cause infinite loop in tiny svc mdns server or a single packet that induce six packets
558940	564860	in response from the server which can be used for distributed denial of service attacks.
566360	573680	And the last but not least tool in our toolkit is the amplification sniffer that dumps all packets
573680	581020	and analyze input and output of the server, calculate the amplification factor for tested
581020	588860	device. Short information how IoT devices can be used to perform distributed denials of service
588860	595380	attacks. It is possible after identifying a large number of vulnerabilities devices
596040	604540	that attacker sends packets with spoofed source addresses and device send responses to victim
605480	612880	causing traffic overload. It's possible easily in UDP-based protocols where there is no handshake
612880	619980	at the beginning of communications. So UDP-based protocols like co-op or DTLS can be used for such
619980	629780	attacks. So finally before we start the demo, short information what you can do to start with
629780	638220	Cotopaxi. First download the tool from the repository, read the manual and install it.
638220	647260	Of course use it and hack different devices but only when you have a consent of the owner or you
647260	655720	are the owner. If you find any errors in the toolkit please report it using GitHub issues.
656080	660860	Using the same way you can contribute new vulnerabilities or new code.