Hey, everyone. My name is Eric Escobar, and today my talk is going to be on detecting the unseen
adversary, which is really just wireless blue teaming with a snappy sounding name to it.
So, this talk is going to be a one-cut take. There's going to be a lot of ums, a lot of uhs,
a lot of me fumbling with my mouse trying to transition a slide. So, this is going to be
just as if I were up on stage and the demo gods are just going to be as much of a problem.
So, without further ado, let's talk about me. So, I like to kind of pose the point that I'm
forever noob. The best thing about computers and computer security is that no one is ever going to
know everything, and the person that says that they do is just completely lying. I started off
my professional career as a civil engineer. You know, I got my degrees in civil engineering to
build bridges, dams, and all these big things that you see out on the highway. I got the opportunity
to basically be an analyst at a company. I got a great opportunity there, and we started coming
to DEF CON for, I believe, DEF CON 22. And from there, I was competing in the wireless capture
the flags. We won a couple of times, and now I'm one of the village members. And yeah, I get to
help make the challenges. And my full-time job now is as a pen tester for SecureWorks, where I
basically just pen test wireless all day. And this talk is really one of these talks of, you know,
stuff that isn't crazy super hackery, stuff that isn't completely unobtainable. It's a lot of
simple tactics that I used to get into a lot of really large companies. And really, this talk
kind of stems from the fact that these are conversations that I have with my clients
day in and day out. And it'd be really nice to point people in the direction of kind of, like,
my overall summary of this stuff. Okay, so detecting the unseen adversary. It's like a
super markety title that I'm not in love with, obviously. But whatever, I needed a tagline.
So one of the things that I've discovered just doing wireless pen tests is that a lot of my
clients have robust logging and alerts for all of their internal network security and all their
external network security. When I say external, I'm talking about, like, the public internet. So
they have firewalls that detect when scans get run. You know, they can detect somebody doing
some nefarious stuff on their internal environment. But they almost all fall down when it comes to
detecting anything on their enterprise wireless. So any, you know, WIDs or WIPs, which is wireless
intrusion prevention or intrusion detection, it's basically, you know, back into the 90s. You
know, there are not a lot of companies that do it. And if they do anything regarding it, it's not
really that robust and can get knocked over pretty easily. So some of the benefits of wireless
attacks. I don't have to have any internal access to any network, to any environment. You don't have
to sneak in anywhere. I don't have to clone keys, badges, or do any of this. I can typically just
post up in a park with a, you know, with a long range antenna or, you know, sit in some kind of
lobby or common area. And, you know, I don't need any special access like I would if I were going to
try and plug in a device. It's way easier for me to stay anonymous and I can stay out of sight.
And then especially if I'm attacking somebody's external infrastructure, there's really not any
IP addresses that are going to be logged or anything along those lines that are going to
get me caught or at least create a footprint. So that's a lot of the reasons why I like, you know,
doing wireless from that kind of standpoint. This is kind of an old image, but this kind of
goes back to my old kit of what I, you know, what was founded out of competing the wireless ETF.
Basically, it's just comprised of a little lithium or a little LiPo battery. Is that LiPo? No, it's a
whatever, just a little anchor battery connected to Raspberry Pi and the Raspberry Pi has a USB,
you know, wireless adapter that I can put into monitor mode. That's an old TP-Link
network adapter. It's, you know, old compared to today's standards. You know, now I use something
like a Panda that can do 2.4 and 5 gigahertz frequencies. But at the end of the day, that can
easily just fit in my pocket, fit in a backpack, and I can then use my phone to connect into that
Raspberry Pi and simply have, you know, an AirMon screen or any of my normal tools that run off of,
you know, whatever flavor of operating system that you want on that Raspberry Pi.
And I can sit there with this device in my pocket, pen testing your network, you know,
just sitting like, you know, any other college student just, you know, leaned up against a wall,
you know, that wouldn't attract a ton of attention. I'm not going to be like,
you know, some of the wireless CTF, you know, members or competitors that walk around with,
like, a laptop in the face, you know, with all these antennas and porcupine, you know,
stuff all over. I'm not going to be the Wi-Fi cactus or anything like that. I want to come
and try and pen test your site. And this is just a screenshot of my iPhone. And, you know, just some
things that I can see out of a glance. And again, if you just see somebody walking with their cell
phone, you're not going to think anything of it, right? And then this is something that we've taken
on engagements where we've, you know, gone on to a large, large site that we have to walk around.
And really, this is just the black backpack. You know, you'd have to look a little bit harder to
see that there are actually a bunch of omnidirectional antennas, along with, you know,
a bunch of just different network adapters all put into this backpack. And it's one of those
things that if you're not looking for it, you know, these antennas could easily be placed inside
of the backpack. But at the end of the day, we've been able to do engagements that cover thousands
of acres worth of, you know, worth of a client site. And, you know, there was full-on, you know,
public people there. There were, you know, staff there. There were security people there. And no
one saw us. We didn't stick out at all, just because we're normal people with normal backpacks.
And again, it's one of those things that it's easy to remain unseen and still do nefarious things.
Here's another clip of the backpack. Basically, it's just some larger anchor batteries
hooked into multiple Raspberry Pis. And again, you can see on the right-hand side,
a bunch of omnidirectional antennas that are kind of just placed, you know, in a not necessarily
covert, but in a way that you'd have to really look at that to know what's going on.
So I think one of the biggest things, the biggest fly on the wall here is rogue access points.
At least I shouldn't say everybody. A large amount of my clients are all very concerned
of the rogue access points, but they really don't have any idea what they say or what they mean when
they talk about rogue access points. And really, by definition, a rogue access point is just any
wireless access point that's not within your control that, you know, that's in your airspace,
you know, your physical airspace that you do control where your access points might be.
So I mean, really, at the end of the day, technically any phone or any hotspot could
be a rogue access point or could be considered a rogue access point. But that's not really what
clients most care about. They most care about access points that are designed to mimic their
own access points that then their users will connect to and get tricked into, you know,
potentially providing credentials or some other type of data that they shouldn't, right?
So I'll just give you a couple access points of what a rogue access point can do.
There's this tool that I use from time to time called
Wi-Fi Fisher. And essentially, all that it does is it just stands up, you know, a hotspot with
whatever name I want to give it. And it will kick off users by de-authenticating them from
their current network with the goal of having them connect to my rogue access point. And when
they connect to my rogue access point, I send them to a captive portal. And the captive portal looks
like a, you know, just a simple... it takes their user agent. So if they're coming from an iPhone,
this would be like the iPhone Wi-Fi screen. This example is coming from a, you know,
Windows 10 laptop. So when they open up their browser, it looks like, oh man, I need to type
in my wireless network key. What most users don't realize, and most users, you know, aren't security
people or tech wizards that are really going to, you know, analyze this. But if you have a full
screen browser window open, you'll notice that that's all just rendered in the browser. That,
you know, what's asking for your key. Now, if a user types in their key and hits next,
that will then submit it to me in clear text because I run that web server. That's my rogue
access point. And then it's configured in such a way that the second that they give me a valid
credential, it will then shut down my rogue access point. So that means an attacker can just
automatically just say, hey, okay, like I'm going to be quiet now. I'm not going to try and draw any
more attention to myself. And it's one of those things that like, is this a crazy, super sophisticated
hacker technique? Absolutely not. Are people in the wireless village going to make fun of me for
even probably talking about this? Sure. But at the end of the day, this has gotten me so many
credentials that it's kind of sad. And this has, you know, been the downfall of so many corporate
networks that it's definitely worth mentioning because people use it and it works as an attack
vector and people are tricked by it. Because at the end of the day, if you're watching this,
you're probably a security minded person and you would probably say, oh, man, there's no way that
I would fall for it. But, you know, take a step back and think of everybody in your organization
that, you know, that deals with Wi-Fi, that deals with, you know, just any device that's connected
to the internet, would they fall for it? Well, at the end of the day, I just need a single person
to fall for it and that's it. I just need one person to fall for it. And then I have your, you
know, in this case, it's a, you know, pre-shared key. So WPA2 PSK network. But there are other
attacks such as ePammer that, you know, they can mimic a corporate internet, you know, that's
WPA2 Enterprise where a user would type in their credentials and then I could get hash credentials,
clear text credentials if there's, you know, GTC downgrade. But really at the end of the day,
this all surrounds, you know, rogue access points and somebody standing up an access point that
mimics your own and being able to detect that it's happening. Because at the end of the day,
I'd say that that fewer than 10% of our clients even know when we stand up a rogue access point
that they're even looking for it. And even if they're looking for it, they may not even get
the alerts. I've had plenty of clients that have said like, oh yeah, we have rogue access point
detection. And, you know, after the pen test, we went back and looked at our logs and we got all
these alerts, but, you know, they were never configured to go anywhere. They were never,
you know, configured to get acted upon really is the best case for that. I mean, again,
it seems super silly that this is all that my attack vector is a standard rogue access point
and hoping to fish some credentials. But at the end of the day, it works. And just the fact that
it works is scary enough because it's a really old style kind of attack really.
So rogue access points, like I was talking about, they can lead to stolen credentials if you're
using say E-Pammer to get WPA2 enterprise credentials, or in the case of Wi-Fi Fisher,
you can use that for PSK. So just, you know, shared network key like you probably have at home,
you know, and that can lead then to a full internal network compromise. So it can lead
to compromised workstations. They can also basically lead to data being exfiltrated,
right? So if an end user connects to my access point, I can exfiltrate data off that system
without it going through any of the normal controls or processes that it normally would.
And then it can also allow users to circumvent corporate policies. So a lot of time that,
say your corporation blocks Netflix or Facebook or something, end users might connect their laptop
or their mobile device that's work provided, they might connect it to another rogue access point
in hopes that they can circumvent that and that they can watch Netflix, that they can do
any other basically types of activities that would probably be blocked on any other network.
So it's one of those things that end users, you know, may not always get tricked. They might
willingly connect to other access points to get to, you know, whatever stuff that they want to
that's being blocked by corporate policies. And so this is one of these matrices that
I kind of like to reference and use. It might seem a little bit dense,
but really at the end of the day, rogue access points are kind of summed up in this way. So
the easiest rogue access point for a corporation to detect is an exact match of whatever the SSID
is. And SSID is just their wireless name. So say that's like, you know, Home Network 123.
So you would see then a second Home Network 123 with a MAC address of 0012, you know,
all the way through 55. That would be the easiest to detect because that is completely different,
you know, than your normal, whatever your normal MAC address would be. And that's just a hardware
address that is associated with that wireless radio. The next hardest would be then basically
that exact same SSID with just some random characters that, you know, just randomly
generated MAC address hardware address. Then as you kind of like go down that difficulty scale
or up the difficulty scale, you're going to see it's going to be an exact match of that, you know,
SSID with then a MAC address that's similar to the MAC addresses of the access points that you run.
That might be harder for some, you know, for some intrusion prevention detection software
to detect is something that's similar to what would be expected. And then if you're talking
about a larger client, say I go to, you know, say it's a bank, right? A bank will have multiple
branches. Say I went to one bank and copied a MAC address from that site and took it to another
branch, you know, in the same town or, you know, same vicinity where wirelessly they won't touch,
but that MAC address is at least valid on the network, right?
And I stand that up as an access point. Well, now the intrusion prevention detection system
is not going to detect me because it is technically somewhere in the system.
The controller will just not have any idea of the geography behind that. And so that's
makes it harder to detect, you know, and then you keep going. And then now you can make,
say your SSID is just similar, but not an exact match to what that Wi-Fi would be with, again,
random MAC addresses and then, you know, similar and then going down that same spectrum.
At the end of the day, this is just something that an attacker can use and kind of see like,
okay, well, you know, what level of sophistication does your monitoring hardware,
you know, and detection system, what does that look like? Because for example here, say you were
looking for an SSID that matched exactly and it was cloned from a MAC address of the same site.
Well, what happens if there's some weird reflection or attenuation there that makes
your wireless signals bounce from place to place? Well, if you're doing detection on a
MAC address seen by different access point, now all of a sudden that gets a lot harder and a lot
more complicated of a thing to program. And it's probably going to generate a lot of false positives.
So it's one of these things that at the end of the day, it's easy to say, oh man, we need,
you know, rogue access point detection or rogue access point detection really is an entire,
you know, suite of what is an attacker doing. And so it's really important just to kind of
break down that nuance and see that, you know, some clients might see an exact match of 0, 1,
1, 2, 2, 3, 3, 4, 4, 5, or maybe even random, but similar to known access points or clone from
a different site or the same site. That's typically not going to get picked up. And it
allows an attacker like myself, who's already, you know, attacking wirelessly and is not going
to be seen. It allows me to basically not trigger any logs or trigger any detection, which again,
you know, is there some software that can detect that? Absolutely. How many clients
actually run it? Not a lot. Again, I probably been detected less than 5, 10% of the time,
which is kind of surprising. And this kind of brings me into simple is not the same thing as
easy, right? Like all of these things that I've talked about, they're simple to understand,
but they may not be that easy to configure, right? And that's an important distinction
because just looking for excessive password spraying, you know, watching for devices that
continually try credentials over and over and over and over again. There's been a number of
sites where I basically just sprayed an access point with user credentials that I got off LinkedIn
with the attempt of trying to authenticate to their access point. And eventually it worked.
It took a long time. I spent all night trying to, you know, associate with credentials until
a pair of them worked. But at the end of the day, that's all that it took. And if somebody
was watching their logs, they would have seen, wow, 10,000 attempts. That seems a bit strange.
But again, a lot of people don't look at their logs. And is that a simple thing for me to say?
Yeah, absolutely. Is it easy? Definitely not. And then same thing, get alerts from
rogue access points. A bunch of my clients will have, you know, software or some type of
controller available to them that will actually look for rogue access points. I mean, at home,
I run Ubiquity. And it will, you know, if I check that box, it will determine, you know, hey,
there's a rogue access point detected. I'm going to send you a push notification to your phone.
There's a lot of end users, a lot of clients, a lot of corporations out there that don't even
have that box checked. And even though their controller, even though whatever software they
is capable of seeing it, they don't even check the box. So, they'll never even get that
notification, even though their software, their controller, whatever it may be, has that, you know,
out of the box as an option. And then have a plan to what to do when you do detect a rogue access
point. That's one of those things that's like, cool, you detect a rogue access point. Now what?
You know, depending on the size of your site, that might be just, you know, taking a walk around the
office, or it might be trying to take a walk around a multi-acre, you know, area or an entire
campus or an entire outdoor place or an entire sporting arena. And so, it's one of those things
that, you know, you have to plan to the scale of your corporation, your company, your organization,
whatever it may be, is to, you know, how are you going to locate these? Is your controller software,
is it capable of saying, you know, this was seen from this access point or from this location?
Or is that something you're going to have to deploy? Is there going to have to be somebody
trained in that? A lot of times, it's not enough just to detect them. You have to locate them to
see, you know, is this somebody that was doing this nefariously? Or is it, you know, some error
in the system? Being able to distinguish that and being able to have a game plan for when that
happens will make it less of a panic situation, right? And a lot of that is having a wireless
pen test, right? Like, knowing where your weaknesses lie before you actually have to,
you know, rely on your logs and rely on your locating, relying on pretty much everything,
right? Really, log your data. It's one of those things, it's simple. It's not easy,
like, to log your data and look at your logs. Because a lot of the times when I'm doing
something, when I'm pen testing, all that data is probably logged somewhere or at least can be
enabled or there's some logging software or, you know, something available to you. But people don't
look at their logs. You know, sysadmins have a busy job and typically don't look at their logs
or really investigate that stuff. Or there may not even be a person dedicated to just wireless.
It might just be the network security team and they don't even bother to ingest, you know,
their wireless logs that are being generated. So, again, all these things, they're really simple.
I feel a little bit sheepish giving a talk about how simple these things are. But each and every
one of these things, you know, I haven't been done when I've been on a pen test at times and
it's allowed me to compromise a full entire organization, you know, because any number of
these, you know, or combination of these weren't done. And again, they're simple, but they're not
easy to enact. It's just one of those things. Again, these are simple ways that somebody can
get in that typically aren't covered. Now, okay. So, like, kind of switching gears. There's a bunch
of other information that wireless devices emit. And there's far more than this, but I just kind of
want to give out the basics of it. But really, devices, you know, they can allow users to be
tracked. You can identify the type of device. You can see what devices are connected to what
networks. Just using a tool like AeroDump, which, again, is a super old tool, but still works great.
You can, you know, take a look at this screen. And if you're not familiar with the screen,
then, oh, well, I'll kind of explain it right now. So, if you look at the top left corner,
there's BSSID, and that is basically, you know, the access point hardware address.
And then, down below, you see the access point and then devices connected to that access point.
And if you just take a quick look, you can see power levels will kind of associate roughly with,
you know, distance away from that access point. The power level is what you'd be looking at.
And then, if you can see devices that are connected to that access point, well,
MAC addresses are basically handed out, or at least ranges of them are handed out to hardware
manufacturers, and they can be identified by just a couple of octets. And so, if you were to plug
in... so, if you... I'll switch back. If you look at this, you'll see that, basically, you know,
that 18B430, if you were to plug that into Google, what that gets you is that it says,
oh, that's Nest. And so, from that, I can say, okay, well, maybe they have a Nest camera on
this network. You know, should I look for Nest cameras? You know, maybe there is a Nest thermostat,
and you can basically, as an attacker, I don't need to know what your username, your password is.
I don't need to know, you know, really anything else about your company, organization, or wireless
networks, because I can see all of that in the clear. I can see, you know, what at least types
of devices are connected. And so, really, it's one of these things. I know I'm going to keep saying
it over and over and over and over, but it's simple to detect somebody like me on your network,
but it's typically not easy. And really, I just kind of want this to be one of those
wake-up calls that, you know, if you are a sysadmin, if you do control wireless networks,
to kind of take a look at the security policies, the monitoring capability that you have,
because at the end of the day, you don't want to be scrambling if you do detect something,
or if you do detect a breach or some weirdness. And again, I think just going back to this last
slide and showing, you know, check for password spraying, you know, check for any rogue access
points that are in your area, have a plan on how to locate them, you know, understand what data
somebody like me can see, you know, know how far your access points, you know, broadcast,
you know, log the data that you do collect, that you have the capability of collecting,
and then look at them from time to time and notice if there's anything strange or weird,
and then maybe build some policies out to alert you if anything funky does look like it's happening.
Again, I think this is all simple. It's not easy always to configure. So, hopefully that was
helpful. I will be around in the Wireless Village if anybody wants to send me questions, and maybe
I'll add some contact information to this on the page after it gets posted. But again, I hope it's
helpful. I know this may seem like a super one-on-one, easy mode talk, but each and every
one of these aspects is something that, you know, one of my clients has potentially not done
that has led me to compromise their organization. And if everybody looked at this and kind of had
this in the back of their mind, if you're a sysadmin that controls networks, or maybe you're
not even a sysadmin that controls your wireless networks, but you could bring this to them,
it would go pretty darn far. Because at the end of the day, everybody has logging in place for
their external network infrastructure and for their internal network infrastructure.
But wireless, for some reason, is the extension of your, you know, of your internal network
beyond your walls, potentially. And it can let somebody like me, or somebody worse than me,
somebody who actually is trying to do some harm to your network, in, and you won't even see them.
You won't even know that they're there. They will be, you know, for your eyes unseen. Again,
hopefully it's helpful. I know this may seem like kind of like a one-on-one-ish talk, but
it might be something that you need to hear. So, take it for what it's worth. And if you
have any questions, feel free to contact me and I'll be in Discord. All right, talk to you guys
later.
Transcribed by https://otter.ai