1
00:00:01,260 --> 00:00:02,060
Hey, everyone.

2
00:00:02,060 --> 00:00:10,380
My name is Eric Escobar, and today my talk is going to be on detecting the unseen adversary, which is really just wireless blue teaming with a snappy sounding name to it.

3
00:00:11,020 --> 00:00:13,220
So, this talk is going to be a one-cut take.

4
00:00:13,220 --> 00:00:18,420
There's going to be a lot of ums, a lot of uhs, a lot of me fumbling with my mouse trying to transition a slide.

5
00:00:18,420 --> 00:00:23,640
So, this is going to be just as if I were up on stage and the demo gods are just going to be as much of a problem.

6
00:00:24,020 --> 00:00:26,980
So, without further ado, let's talk about me.

7
00:00:27,560 --> 00:00:31,720
So, I like to kind of pose the point that I'm forever noob.

8
00:00:31,720 --> 00:00:39,500
The best thing about computers and computer security is that no one is ever going to know everything, and the person that says that they do is just completely lying.

9
00:00:39,880 --> 00:00:43,520
I started off my professional career as a civil engineer.

10
00:00:43,520 --> 00:00:49,400
You know, I got my degrees in civil engineering to build bridges, dams, and all these big things that you see out on the highway.

11
00:00:49,560 --> 00:00:53,520
I got the opportunity to basically be an analyst at a company.

12
00:00:53,520 --> 00:00:58,980
I got a great opportunity there, and we started coming to DEF CON for, I believe, DEF CON 22.

13
00:00:59,740 --> 00:01:02,600
And from there, I was competing in the wireless capture the flags.

14
00:01:02,620 --> 00:01:06,180
We won a couple of times, and now I'm one of the village members.

15
00:01:06,360 --> 00:01:08,980
And yeah, I get to help make the challenges.

16
00:01:09,240 --> 00:01:15,240
And my full-time job now is as a pen tester for SecureWorks, where I basically just pen test wireless all day.

17
00:01:15,500 --> 00:01:24,460
And this talk is really one of these talks of, you know, stuff that isn't crazy super hackery, stuff that isn't completely unobtainable.

18
00:01:24,460 --> 00:01:28,980
It's a lot of simple tactics that I used to get into a lot of really large companies.

19
00:01:29,380 --> 00:01:36,020
And really, this talk kind of stems from the fact that these are conversations that I have with my clients day in and day out.

20
00:01:36,020 --> 00:01:41,080
And it'd be really nice to point people in the direction of kind of, like, my overall summary of this stuff.

21
00:01:42,320 --> 00:01:44,500
Okay, so detecting the unseen adversary.

22
00:01:44,500 --> 00:01:49,120
It's like a super markety title that I'm not in love with, obviously.

23
00:01:49,120 --> 00:01:51,200
But whatever, I needed a tagline.

24
00:01:51,960 --> 00:02:01,720
So one of the things that I've discovered just doing wireless pen tests is that a lot of my clients have robust logging and alerts for all of their internal network security and all their external network security.

25
00:02:01,760 --> 00:02:04,400
When I say external, I'm talking about, like, the public internet.

26
00:02:04,400 --> 00:02:07,660
So they have firewalls that detect when scans get run.

27
00:02:07,660 --> 00:02:11,400
You know, they can detect somebody doing some nefarious stuff on their internal environment.

28
00:02:11,460 --> 00:02:17,360
But they almost all fall down when it comes to detecting anything on their enterprise wireless.

29
00:02:17,460 --> 00:02:26,520
So any, you know, WIDs or WIPs, which is wireless intrusion prevention or intrusion detection, it's basically, you know, back into the 90s.

30
00:02:26,520 --> 00:02:28,620
You know, there are not a lot of companies that do it.

31
00:02:28,620 --> 00:02:35,000
And if they do anything regarding it, it's not really that robust and can get knocked over pretty easily.

32
00:02:36,660 --> 00:02:38,980
So some of the benefits of wireless attacks.

33
00:02:39,000 --> 00:02:43,000
I don't have to have any internal access to any network, to any environment.

34
00:02:43,000 --> 00:02:44,400
You don't have to sneak in anywhere.

35
00:02:44,400 --> 00:02:46,800
I don't have to clone keys, badges, or do any of this.

36
00:02:46,800 --> 00:02:55,580
I can typically just post up in a park with a, you know, with a long range antenna or, you know, sit in some kind of lobby or common area.

37
00:02:55,580 --> 00:03:00,540
And, you know, I don't need any special access like I would if I were going to try and plug in a device.

38
00:03:00,820 --> 00:03:03,600
It's way easier for me to stay anonymous and I can stay out of sight.

39
00:03:03,600 --> 00:03:14,040
And then especially if I'm attacking somebody's external infrastructure, there's really not any IP addresses that are going to be logged or anything along those lines that are going to get me caught or at least create a footprint.

40
00:03:14,660 --> 00:03:18,960
So that's a lot of the reasons why I like, you know, doing wireless from that kind of standpoint.

41
00:03:19,640 --> 00:03:27,160
This is kind of an old image, but this kind of goes back to my old kit of what I, you know, what was founded out of competing the wireless ETF.

42
00:03:27,520 --> 00:03:31,200
Basically, it's just comprised of a little lithium or a little LiPo battery.

43
00:03:31,200 --> 00:03:31,840
Is that LiPo?

44
00:03:31,840 --> 00:03:40,320
No, it's a whatever , just a little anchor battery connected to Raspberry Pi and the Raspberry Pi has a USB, you know, wireless adapter that I can put into monitor mode.

45
00:03:41,260 --> 00:03:43,940
That's an old TP-Link network adapter.

46
00:03:44,000 --> 00:03:46,540
It's, you know, old compared to today's standards.

47
00:03:46,540 --> 00:03:50,840
You know, now I use something like a Panda that can do 2.4 and 5 gigahertz frequencies.

48
00:03:51,100 --> 00:04:08,820
But at the end of the day, that can easily just fit in my pocket, fit in a backpack, and I can then use my phone to connect into that Raspberry Pi and simply have, you know, an AirMon screen or any of my normal tools that run off of, you know, whatever flavor of operating system that you want on that Raspberry Pi.

49
00:04:08,820 --> 00:04:19,480
And I can sit there with this device in my pocket, pen testing your network, you know, just sitting like, you know, any other college student just, you know, leaned up against a wall, you know, that wouldn't attract a ton of attention.

50
00:04:19,520 --> 00:04:29,160
I'm not going to be like, you know, some of the wireless CTF, you know, members or competitors that walk around with, like, a laptop in the face, you know, with all these antennas and porcupine, you know, stuff all over.

51
00:04:29,160 --> 00:04:31,540
I'm not going to be the Wi-Fi cactus or anything like that.

52
00:04:31,540 --> 00:04:33,280
I want to come and try and pen test your site.

53
00:04:33,280 --> 00:04:36,220
And this is just a screenshot of my iPhone.

54
00:04:36,620 --> 00:04:38,980
And, you know, just some things that I can see out of a glance.

55
00:04:38,980 --> 00:04:43,680
And again, if you just see somebody walking with their cell phone, you're not going to think anything of it, right?

56
00:04:44,080 --> 00:04:51,660
And then this is something that we've taken on engagements where we've, you know, gone on to a large, large site that we have to walk around.

57
00:04:51,700 --> 00:04:54,080
And really, this is just the black backpack.

58
00:04:54,080 --> 00:05:04,900
You know, you'd have to look a little bit harder to see that there are actually a bunch of omnidirectional antennas, along with, you know, a bunch of just different network adapters all put into this backpack.

59
00:05:05,420 --> 00:05:10,200
And it's one of those things that if you're not looking for it, you know, these antennas could easily be placed inside of the backpack.

60
00:05:10,200 --> 00:05:18,820
But at the end of the day, we've been able to do engagements that cover thousands of acres worth of, you know, worth of a client site.

61
00:05:19,000 --> 00:05:22,780
And, you know, there was full-on, you know, public people there.

62
00:05:22,780 --> 00:05:24,480
There were, you know, staff there.

63
00:05:24,480 --> 00:05:26,480
There were security people there.

64
00:05:26,620 --> 00:05:27,720
And no one saw us.

65
00:05:27,720 --> 00:05:31,400
We didn't stick out at all, just because we're normal people with normal backpacks.

66
00:05:31,680 --> 00:05:36,040
And again, it's one of those things that it's easy to remain unseen and still do nefarious things.

67
00:05:36,640 --> 00:05:38,720
Here's another clip of the backpack.

68
00:05:38,720 --> 00:05:43,080
Basically, it's just some larger anchor batteries hooked into multiple Raspberry Pis.

69
00:05:43,080 --> 00:05:57,900
And again, you can see on the right-hand side, a bunch of omnidirectional antennas that are kind of just placed, you know, in a not necessarily covert, but in a way that you'd have to really look at that to know what's going on.

70
00:05:59,580 --> 00:06:04,020
So I think one of the biggest things, the biggest fly on the wall here is rogue access points.

71
00:06:04,020 --> 00:06:06,680
At least I shouldn't say everybody.

72
00:06:06,780 --> 00:06:17,100
A large amount of my clients are all very concerned of the rogue access points, but they really don't have any idea what they say or what they mean when they talk about rogue access points.

73
00:06:17,100 --> 00:06:29,280
And really, by definition, a rogue access point is just any wireless access point that's not within your control that, you know, that's in your airspace, you know, your physical airspace that you do control where your access points might be.

74
00:06:29,500 --> 00:06:35,820
So I mean, really, at the end of the day, technically any phone or any hotspot could be a rogue access point or could be considered a rogue access point.

75
00:06:35,820 --> 00:06:37,400
But that's not really what clients most care about.

76
00:06:37,400 --> 00:06:50,300
They most care about access points that are designed to mimic their own access points that then their users will connect to and get tricked into, you know, potentially providing credentials or some other type of data that they shouldn't, right?

77
00:06:51,160 --> 00:06:54,620
So I'll just give you a couple access points of what a rogue access point can do.

78
00:06:54,820 --> 00:06:59,440
There's this tool that I use from time to time called Wi-Fi Fisher.

79
00:06:59,540 --> 00:07:04,760
And essentially, all that it does is it just stands up, you know, a hotspot with whatever name I want to give it.

80
00:07:04,820 --> 00:07:11,880
And it will kick off users by de-authenticating them from their current network with the goal of having them connect to my rogue access point.

81
00:07:12,280 --> 00:07:16,240
And when they connect to my rogue access point, I send them to a captive portal.

82
00:07:16,340 --> 00:07:21,020
And the captive portal looks like a, you know, just a simple... it takes their user agent.

83
00:07:21,020 --> 00:07:24,320
So if they're coming from an iPhone, this would be like the iPhone Wi-Fi screen.

84
00:07:24,560 --> 00:07:28,140
This example is coming from a, you know, Windows 10 laptop.

85
00:07:28,140 --> 00:07:33,200
So when they open up their browser, it looks like, oh man, I need to type in my wireless network key.

86
00:07:33,280 --> 00:07:39,840
What most users don't realize, and most users, you know, aren't security people or tech wizards that are really going to, you know, analyze this.

87
00:07:39,840 --> 00:07:46,220
But if you have a full screen browser window open, you'll notice that that's all just rendered in the browser.

88
00:07:46,220 --> 00:07:49,160
That, you know, what's asking for your key.

89
00:07:49,160 --> 00:07:55,300
Now, if a user types in their key and hits next, that will then submit it to me in clear text because I run that web server.

90
00:07:55,300 --> 00:07:56,940
That's my rogue access point.

91
00:07:57,220 --> 00:08:02,200
And then it's configured in such a way that the second that they give me a valid credential, it will then shut down my rogue access point.

92
00:08:02,200 --> 00:08:06,720
So that means an attacker can just automatically just say, hey, okay, like I'm going to be quiet now.

93
00:08:06,720 --> 00:08:09,380
I'm not going to try and draw any more attention to myself.

94
00:08:09,480 --> 00:08:13,360
And it's one of those things that like, is this a crazy, super sophisticated hacker technique?

95
00:08:13,400 --> 00:08:14,020
Absolutely not.

96
00:08:14,020 --> 00:08:17,240
Are people in the wireless village going to make fun of me for even probably talking about this?

97
00:08:17,440 --> 00:08:17,920
Sure.

98
00:08:18,220 --> 00:08:22,440
But at the end of the day, this has gotten me so many credentials that it's kind of sad.

99
00:08:22,440 --> 00:08:33,420
And this has, you know, been the downfall of so many corporate networks that it's definitely worth mentioning because people use it and it works as an attack vector and people are tricked by it.

100
00:08:33,420 --> 00:08:39,300
Because at the end of the day, if you're watching this, you're probably a security minded person and you would probably say, oh, man, there's no way that I would fall for it.

101
00:08:39,340 --> 00:08:51,460
But, you know, take a step back and think of everybody in your organization that, you know, that deals with Wi-Fi, that deals with, you know, just any device that's connected to the internet, would they fall for it?

102
00:08:51,460 --> 00:08:55,480
Well, at the end of the day, I just need a single person to fall for it and that's it.

103
00:08:55,480 --> 00:08:57,900
I just need one person to fall for it.

104
00:08:58,320 --> 00:09:02,040
And then I have your, you know, in this case, it's a, you know, pre-shared key.

105
00:09:02,040 --> 00:09:04,680
So WPA2 PSK network.

106
00:09:05,040 --> 00:09:19,400
But there are other attacks such as ePammer that, you know, they can mimic a corporate internet, you know, that's WPA2 Enterprise where a user would type in their credentials and then I could get hash credentials, clear text credentials if there's, you know,

107
00:09:19,400 --> 00:09:20,520
GTC downgrade.

108
00:09:20,520 --> 00:09:31,000
But really at the end of the day, this all surrounds, you know, rogue access points and somebody standing up an access point that mimics your own and being able to detect that it's happening.

109
00:09:31,000 --> 00:09:38,240
Because at the end of the day, I'd say that that fewer than 10% of our clients even know when we stand up a rogue access point that they're even looking for it.

110
00:09:38,240 --> 00:09:40,480
And even if they're looking for it, they may not even get the alerts.

111
00:09:40,660 --> 00:09:44,220
I've had plenty of clients that have said like, oh yeah, we have rogue access point detection.

112
00:09:44,340 --> 00:09:50,840
And, you know, after the pen test, we went back and looked at our logs and we got all these alerts, but, you know, they were never configured to go anywhere.

113
00:09:50,940 --> 00:09:56,600
They were never, you know, configured to get acted upon really is the best case for that.

114
00:09:56,640 --> 00:10:03,300
I mean, again, it seems super silly that this is all that my attack vector is a standard rogue access point and hoping to fish some credentials.

115
00:10:03,340 --> 00:10:05,460
But at the end of the day, it works.

116
00:10:05,860 --> 00:10:12,020
And just the fact that it works is scary enough because it's a really old style kind of attack really.

117
00:10:13,560 --> 00:10:25,340
So rogue access points, like I was talking about, they can lead to stolen credentials if you're using say E-Pammer to get WPA2 enterprise credentials, or in the case of Wi-Fi Fisher, you can use that for PSK.

118
00:10:25,340 --> 00:10:32,040
So just, you know, shared network key like you probably have at home, you know, and that can lead then to a full internal network compromise.

119
00:10:32,040 --> 00:10:34,580
So it can lead to compromised workstations.

120
00:10:34,980 --> 00:10:40,640
They can also basically lead to data being exfiltrated, right?

121
00:10:40,640 --> 00:10:49,820
So if an end user connects to my access point, I can exfiltrate data off that system without it going through any of the normal controls or processes that it normally would.

122
00:10:50,300 --> 00:10:53,720
And then it can also allow users to circumvent corporate policies.

123
00:10:53,720 --> 00:11:09,880
So a lot of time that, say your corporation blocks Netflix or Facebook or something, end users might connect their laptop or their mobile device that's work provided, they might connect it to another rogue access point in hopes that they can circumvent that and that they can watch Netflix,

124
00:11:09,880 --> 00:11:16,480
that they can do any other basically types of activities that would probably be blocked on any other network.

125
00:11:16,520 --> 00:11:20,200
So it's one of those things that end users, you know, may not always get tricked.

126
00:11:20,200 --> 00:11:27,400
They might willingly connect to other access points to get to, you know, whatever stuff that they want to that's being blocked by corporate policies.

127
00:11:29,020 --> 00:11:34,100
And so this is one of these matrices that I kind of like to reference and use.

128
00:11:34,100 --> 00:11:39,680
It might seem a little bit dense, but really at the end of the day, rogue access points are kind of summed up in this way.

129
00:11:39,680 --> 00:11:47,000
So the easiest rogue access point for a corporation to detect is an exact match of whatever the SSID is.

130
00:11:47,000 --> 00:11:49,000
And SSID is just their wireless name.

131
00:11:49,000 --> 00:11:52,440
So say that's like, you know, Home Network 123.

132
00:11:52,440 --> 00:11:59,060
So you would see then a second Home Network 123 with a MAC address of 0012, you know, all the way through 55.

133
00:11:59,160 --> 00:12:06,480
That would be the easiest to detect because that is completely different, you know, than your normal, whatever your normal MAC address would be.

134
00:12:06,480 --> 00:12:11,640
And that's just a hardware address that is associated with that wireless radio.

135
00:12:11,820 --> 00:12:21,860
The next hardest would be then basically that exact same SSID with just some random characters that, you know, just randomly generated MAC address hardware address.

136
00:12:21,960 --> 00:12:33,980
Then as you kind of like go down that difficulty scale or up the difficulty scale, you're going to see it's going to be an exact match of that, you know, SSID with then a MAC address that's similar to the MAC addresses of the access points that you run.

137
00:12:33,980 --> 00:12:41,960
That might be harder for some, you know, for some intrusion prevention detection software to detect is something that's similar to what would be expected.

138
00:12:43,180 --> 00:12:50,020
And then if you're talking about a larger client, say I go to, you know, say it's a bank, right?

139
00:12:50,020 --> 00:12:51,720
A bank will have multiple branches.

140
00:12:51,720 --> 00:13:04,580
Say I went to one bank and copied a MAC address from that site and took it to another branch, you know, in the same town or, you know, same vicinity where wirelessly they won't touch, but that MAC address is at least valid on the network, right?

141
00:13:04,620 --> 00:13:06,660
And I stand that up as an access point.

142
00:13:06,660 --> 00:13:12,540
Well, now the intrusion prevention detection system is not going to detect me because it is technically somewhere in the system.

143
00:13:12,540 --> 00:13:16,300
The controller will just not have any idea of the geography behind that.

144
00:13:16,300 --> 00:13:20,160
And so that's makes it harder to detect, you know, and then you keep going.

145
00:13:20,160 --> 00:13:33,760
And then now you can make, say your SSID is just similar, but not an exact match to what that Wi-Fi would be with, again, random MAC addresses and then, you know, similar and then going down that same spectrum.

146
00:13:33,800 --> 00:13:45,820
At the end of the day, this is just something that an attacker can use and kind of see like, okay, well, you know, what level of sophistication does your monitoring hardware, you know, and detection system, what does that look like?

147
00:13:46,160 --> 00:13:56,080
Because for example here, say you were looking for an SSID that matched exactly and it was cloned from a MAC address of the same site.

148
00:13:56,080 --> 00:14:02,500
Well, what happens if there's some weird reflection or attenuation there that makes your wireless signals bounce from place to place?

149
00:14:02,500 --> 00:14:11,720
Well, if you're doing detection on a MAC address seen by different access point, now all of a sudden that gets a lot harder and a lot more complicated of a thing to program.

150
00:14:11,720 --> 00:14:13,860
And it's probably going to generate a lot of false positives.

151
00:14:13,860 --> 00:14:25,300
So it's one of these things that at the end of the day, it's easy to say, oh man, we need, you know, rogue access point detection or rogue access point detection really is an entire, you know, suite of what is an attacker doing.

152
00:14:25,520 --> 00:14:40,560
And so it's really important just to kind of break down that nuance and see that, you know, some clients might see an exact match of 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, or maybe even random, but similar to known access points or clone from a different site or the same site.

153
00:14:40,860 --> 00:14:42,420
That's typically not going to get picked up.

154
00:14:42,420 --> 00:14:47,180
And it allows an attacker like myself, who's already, you know, attacking wirelessly and is not going to be seen.

155
00:14:47,180 --> 00:14:55,620
It allows me to basically not trigger any logs or trigger any detection, which again, you know, is there some software that can detect that?

156
00:14:55,620 --> 00:14:56,240
Absolutely.

157
00:14:56,240 --> 00:14:57,860
How many clients actually run it?

158
00:14:57,860 --> 00:14:58,960
Not a lot.

159
00:14:59,280 --> 00:15:04,600
Again, I probably been detected less than 5, 10% of the time, which is kind of surprising.

160
00:15:04,960 --> 00:15:08,600
And this kind of brings me into simple is not the same thing as easy, right?

161
00:15:08,600 --> 00:15:15,600
Like all of these things that I've talked about, they're simple to understand, but they may not be that easy to configure, right?

162
00:15:15,600 --> 00:15:28,260
And that's an important distinction because just looking for excessive password spraying, you know, watching for devices that continually try credentials over and over and over and over again.

163
00:15:28,260 --> 00:15:39,780
There's been a number of sites where I basically just sprayed an access point with user credentials that I got off LinkedIn with the attempt of trying to authenticate to their access point.

164
00:15:39,780 --> 00:15:41,060
And eventually it worked.

165
00:15:41,060 --> 00:15:42,000
It took a long time.

166
00:15:42,000 --> 00:15:47,740
I spent all night trying to, you know, associate with credentials until a pair of them worked.

167
00:15:47,740 --> 00:15:50,360
But at the end of the day, that's all that it took.

168
00:15:50,440 --> 00:15:54,440
And if somebody was watching their logs, they would have seen, wow, 10,000 attempts.

169
00:15:54,440 --> 00:15:55,860
That seems a bit strange.

170
00:15:56,100 --> 00:15:58,080
But again, a lot of people don't look at their logs.

171
00:15:58,080 --> 00:16:00,440
And is that a simple thing for me to say?

172
00:16:00,440 --> 00:16:01,380
Yeah, absolutely.

173
00:16:01,380 --> 00:16:02,340
Is it easy?

174
00:16:02,340 --> 00:16:03,520
Definitely not.

175
00:16:04,500 --> 00:16:07,160
And then same thing, get alerts from rogue access points.

176
00:16:07,160 --> 00:16:15,760
A bunch of my clients will have, you know, software or some type of controller available to them that will actually look for rogue access points.

177
00:16:15,760 --> 00:16:18,120
I mean, at home, I run Ubiquity.

178
00:16:18,160 --> 00:16:23,740
And it will, you know, if I check that box, it will determine, you know, hey, there's a rogue access point detected.

179
00:16:23,740 --> 00:16:25,860
I'm going to send you a push notification to your phone.

180
00:16:26,340 --> 00:16:32,500
There's a lot of end users, a lot of clients, a lot of corporations out there that don't even have that box checked.

181
00:16:32,500 --> 00:16:38,580
And even though their controller, even though whatever software they is capable of seeing it, they don't even check the box.

182
00:16:38,580 --> 00:16:47,640
So, they'll never even get that notification, even though their software, their controller, whatever it may be, has that, you know, out of the box as an option.

183
00:16:47,940 --> 00:16:52,920
And then have a plan to what to do when you do detect a rogue access point.

184
00:16:53,320 --> 00:16:56,420
That's one of those things that's like, cool, you detect a rogue access point.

185
00:16:56,520 --> 00:16:57,300
Now what?

186
00:16:57,300 --> 00:17:12,940
You know, depending on the size of your site, that might be just, you know, taking a walk around the office, or it might be trying to take a walk around a multi-acre, you know, area or an entire campus or an entire outdoor place or an entire sporting arena.

187
00:17:13,300 --> 00:17:21,480
And so, it's one of those things that, you know, you have to plan to the scale of your corporation, your company, your organization, whatever it may be, is to, you know, how are you going to locate these?

188
00:17:21,480 --> 00:17:27,640
Is your controller software, is it capable of saying, you know, this was seen from this access point or from this location?

189
00:17:27,680 --> 00:17:29,500
Or is that something you're going to have to deploy?

190
00:17:29,500 --> 00:17:31,300
Is there going to have to be somebody trained in that?

191
00:17:31,300 --> 00:17:34,740
A lot of times, it's not enough just to detect them.

192
00:17:34,740 --> 00:17:38,680
You have to locate them to see, you know, is this somebody that was doing this nefariously?

193
00:17:38,680 --> 00:17:41,460
Or is it, you know, some error in the system?

194
00:17:41,640 --> 00:17:48,360
Being able to distinguish that and being able to have a game plan for when that happens will make it less of a panic situation, right?

195
00:17:49,080 --> 00:17:51,380
And a lot of that is having a wireless pen test, right?

196
00:17:51,380 --> 00:18:00,960
Like, knowing where your weaknesses lie before you actually have to, you know, rely on your logs and rely on your locating, relying on pretty much everything, right?

197
00:18:02,220 --> 00:18:03,700
Really, log your data.

198
00:18:03,700 --> 00:18:05,660
It's one of those things, it's simple.

199
00:18:05,660 --> 00:18:08,680
It's not easy, like, to log your data and look at your logs.

200
00:18:08,680 --> 00:18:20,720
Because a lot of the times when I'm doing something, when I'm pen testing, all that data is probably logged somewhere or at least can be enabled or there's some logging software or, you know, something available to you.

201
00:18:20,720 --> 00:18:22,520
But people don't look at their logs.

202
00:18:22,520 --> 00:18:29,440
You know, sysadmins have a busy job and typically don't look at their logs or really investigate that stuff.

203
00:18:29,440 --> 00:18:32,480
Or there may not even be a person dedicated to just wireless.

204
00:18:32,480 --> 00:18:39,000
It might just be the network security team and they don't even bother to ingest, you know, their wireless logs that are being generated.

205
00:18:39,260 --> 00:18:41,820
So, again, all these things, they're really simple.

206
00:18:41,820 --> 00:18:46,140
I feel a little bit sheepish giving a talk about how simple these things are.

207
00:18:46,280 --> 00:19:00,780
But each and every one of these things, you know, I haven't been done when I've been on a pen test at times and it's allowed me to compromise a full entire organization, you know, because any number of these, you know, or combination of these weren't done.

208
00:19:00,780 --> 00:19:04,160
And again, they're simple, but they're not easy to enact.

209
00:19:04,540 --> 00:19:05,800
It's just one of those things.

210
00:19:05,800 --> 00:19:11,600
Again, these are simple ways that somebody can get in that typically aren't covered.

211
00:19:12,440 --> 00:19:13,340
Now, okay.

212
00:19:13,340 --> 00:19:15,600
So, like, kind of switching gears.

213
00:19:15,640 --> 00:19:18,540
There's a bunch of other information that wireless devices emit.

214
00:19:18,540 --> 00:19:21,980
And there's far more than this, but I just kind of want to give out the basics of it.

215
00:19:22,340 --> 00:19:26,460
But really, devices, you know, they can allow users to be tracked.

216
00:19:26,460 --> 00:19:28,140
You can identify the type of device.

217
00:19:28,200 --> 00:19:30,760
You can see what devices are connected to what networks.

218
00:19:30,880 --> 00:19:34,920
Just using a tool like AeroDump, which, again, is a super old tool, but still works great.

219
00:19:35,140 --> 00:19:36,740
You can, you know, take a look at this screen.

220
00:19:36,740 --> 00:19:41,120
And if you're not familiar with the screen, then, oh, well, I'll kind of explain it right now.

221
00:19:41,120 --> 00:19:47,880
So, if you look at the top left corner, there's BSSID, and that is basically, you know, the access point hardware address.

222
00:19:48,320 --> 00:19:53,800
And then, down below, you see the access point and then devices connected to that access point.

223
00:19:53,860 --> 00:19:59,720
And if you just take a quick look, you can see power levels will kind of associate roughly with, you know, distance away from that access point.

224
00:19:59,720 --> 00:20:01,660
The power level is what you'd be looking at.

225
00:20:01,700 --> 00:20:14,560
And then, if you can see devices that are connected to that access point, well, MAC addresses are basically handed out, or at least ranges of them are handed out to hardware manufacturers, and they can be identified by just a couple of octets.

226
00:20:14,720 --> 00:20:17,560
And so, if you were to plug in... so, if you... I'll switch back.

227
00:20:17,840 --> 00:20:29,160
If you look at this, you'll see that, basically, you know, that 18B430, if you were to plug that into Google, what that gets you is that it says, oh, that's Nest.

228
00:20:29,160 --> 00:20:32,620
And so, from that, I can say, okay, well, maybe they have a Nest camera on this network.

229
00:20:32,620 --> 00:20:34,040
You know, should I look for Nest cameras?

230
00:20:34,500 --> 00:20:42,260
You know, maybe there is a Nest thermostat, and you can basically, as an attacker, I don't need to know what your username, your password is.

231
00:20:42,260 --> 00:20:49,720
I don't need to know, you know, really anything else about your company, organization, or wireless networks, because I can see all of that in the clear.

232
00:20:49,720 --> 00:20:52,680
I can see, you know, what at least types of devices are connected.

233
00:20:53,680 --> 00:20:55,420
And so, really, it's one of these things.

234
00:20:55,420 --> 00:21:04,720
I know I'm going to keep saying it over and over and over and over, but it's simple to detect somebody like me on your network, but it's typically not easy.

235
00:21:05,160 --> 00:21:19,580
And really, I just kind of want this to be one of those wake-up calls that, you know, if you are a sysadmin, if you do control wireless networks, to kind of take a look at the security policies, the monitoring capability that you have, because at the end of the day,

236
00:21:19,580 --> 00:21:25,420
you don't want to be scrambling if you do detect something, or if you do detect a breach or some weirdness.

237
00:21:25,660 --> 00:21:40,180
And again, I think just going back to this last slide and showing, you know, check for password spraying, you know, check for any rogue access points that are in your area, have a plan on how to locate them, you know, understand what data somebody like me can see,

238
00:21:40,180 --> 00:21:56,960
you know, know how far your access points, you know, broadcast, you know, log the data that you do collect, that you have the capability of collecting, and then look at them from time to time and notice if there's anything strange or weird, and then maybe build some policies out to alert you if anything funky does look like it's happening.

239
00:21:57,960 --> 00:22:00,340
Again, I think this is all simple.

240
00:22:00,560 --> 00:22:03,060
It's not easy always to configure.

241
00:22:03,140 --> 00:22:05,480
So, hopefully that was helpful.

242
00:22:05,700 --> 00:22:13,800
I will be around in the Wireless Village if anybody wants to send me questions, and maybe I'll add some contact information to this on the page after it gets posted.

243
00:22:14,000 --> 00:22:15,320
But again, I hope it's helpful.

244
00:22:15,320 --> 00:22:27,880
I know this may seem like a super one-on-one, easy mode talk, but each and every one of these aspects is something that, you know, one of my clients has potentially not done that has led me to compromise their organization.

245
00:22:27,980 --> 00:22:39,300
And if everybody looked at this and kind of had this in the back of their mind, if you're a sysadmin that controls networks, or maybe you're not even a sysadmin that controls your wireless networks, but you could bring this to them, it would go pretty darn far.

246
00:22:39,300 --> 00:22:46,860
Because at the end of the day, everybody has logging in place for their external network infrastructure and for their internal network infrastructure.

247
00:22:47,100 --> 00:22:55,260
But wireless, for some reason, is the extension of your, you know, of your internal network beyond your walls, potentially.

248
00:22:55,480 --> 00:23:03,240
And it can let somebody like me, or somebody worse than me, somebody who actually is trying to do some harm to your network, in, and you won't even see them.

249
00:23:03,240 --> 00:23:04,360
You won't even know that they're there.

250
00:23:04,360 --> 00:23:07,240
They will be, you know, for your eyes unseen.

251
00:23:07,460 --> 00:23:09,160
Again, hopefully it's helpful.

252
00:23:09,160 --> 00:23:14,840
I know this may seem like kind of like a one-on-one-ish talk, but it might be something that you need to hear.

253
00:23:14,840 --> 00:23:16,000
So, take it for what it's worth.

254
00:23:16,000 --> 00:23:19,460
And if you have any questions, feel free to contact me and I'll be in Discord.

255
00:23:19,480 --> 00:23:20,520
All right, talk to you guys later.

256
00:23:20,860 --> 00:23:21,220
Transcribed by https://otter.ai