start	end	text
1260	5340	Hey, everyone. My name is Eric Escobar, and today my talk is going to be on detecting the unseen
5340	10380	adversary, which is really just wireless blue teaming with a snappy sounding name to it.
11020	15180	So, this talk is going to be a one-cut take. There's going to be a lot of ums, a lot of uhs,
15300	19480	a lot of me fumbling with my mouse trying to transition a slide. So, this is going to be
19480	23640	just as if I were up on stage and the demo gods are just going to be as much of a problem.
24020	30540	So, without further ado, let's talk about me. So, I like to kind of pose the point that I'm
30540	35360	forever noob. The best thing about computers and computer security is that no one is ever going to
35360	40640	know everything, and the person that says that they do is just completely lying. I started off
40640	45720	my professional career as a civil engineer. You know, I got my degrees in civil engineering to
45720	50560	build bridges, dams, and all these big things that you see out on the highway. I got the opportunity
50560	56400	to basically be an analyst at a company. I got a great opportunity there, and we started coming
56400	61680	to DEF CON for, I believe, DEF CON 22. And from there, I was competing in the wireless capture
61680	67820	the flags. We won a couple of times, and now I'm one of the village members. And yeah, I get to
67820	73260	help make the challenges. And my full-time job now is as a pen tester for SecureWorks, where I
73260	79780	basically just pen test wireless all day. And this talk is really one of these talks of, you know,
79780	85040	stuff that isn't crazy super hackery, stuff that isn't completely unobtainable. It's a lot of
85040	90520	simple tactics that I used to get into a lot of really large companies. And really, this talk
90520	94420	kind of stems from the fact that these are conversations that I have with my clients
94420	99020	day in and day out. And it'd be really nice to point people in the direction of kind of, like,
99020	105660	my overall summary of this stuff. Okay, so detecting the unseen adversary. It's like a
105660	111200	super markety title that I'm not in love with, obviously. But whatever, I needed a tagline.
111960	115900	So one of the things that I've discovered just doing wireless pen tests is that a lot of my
115900	120040	clients have robust logging and alerts for all of their internal network security and all their
120040	124520	external network security. When I say external, I'm talking about, like, the public internet. So
124520	128960	they have firewalls that detect when scans get run. You know, they can detect somebody doing
128960	133960	some nefarious stuff on their internal environment. But they almost all fall down when it comes to
133960	139700	detecting anything on their enterprise wireless. So any, you know, WIDs or WIPs, which is wireless
139700	146520	intrusion prevention or intrusion detection, it's basically, you know, back into the 90s. You
146520	151340	know, there are not a lot of companies that do it. And if they do anything regarding it, it's not
152060	158220	really that robust and can get knocked over pretty easily. So some of the benefits of wireless
158220	163540	attacks. I don't have to have any internal access to any network, to any environment. You don't have
163540	167640	to sneak in anywhere. I don't have to clone keys, badges, or do any of this. I can typically just
167640	174200	post up in a park with a, you know, with a long range antenna or, you know, sit in some kind of
174200	179080	lobby or common area. And, you know, I don't need any special access like I would if I were going to
179080	183600	try and plug in a device. It's way easier for me to stay anonymous and I can stay out of sight.
183600	187920	And then especially if I'm attacking somebody's external infrastructure, there's really not any
187920	192160	IP addresses that are going to be logged or anything along those lines that are going to
192160	196880	get me caught or at least create a footprint. So that's a lot of the reasons why I like, you know,
196880	201340	doing wireless from that kind of standpoint. This is kind of an old image, but this kind of
201340	207160	goes back to my old kit of what I, you know, what was founded out of competing the wireless ETF.
207520	213100	Basically, it's just comprised of a little lithium or a little LiPo battery. Is that LiPo? No, it's a
213100	218040	whatever, just a little anchor battery connected to Raspberry Pi and the Raspberry Pi has a USB,
218040	222660	you know, wireless adapter that I can put into monitor mode. That's an old TP-Link
222660	227240	network adapter. It's, you know, old compared to today's standards. You know, now I use something
227240	232720	like a Panda that can do 2.4 and 5 gigahertz frequencies. But at the end of the day, that can
232720	237460	easily just fit in my pocket, fit in a backpack, and I can then use my phone to connect into that
237460	245180	Raspberry Pi and simply have, you know, an AirMon screen or any of my normal tools that run off of,
245180	248820	you know, whatever flavor of operating system that you want on that Raspberry Pi.
248820	252900	And I can sit there with this device in my pocket, pen testing your network, you know,
252900	257500	just sitting like, you know, any other college student just, you know, leaned up against a wall,
257500	260780	you know, that wouldn't attract a ton of attention. I'm not going to be like,
260780	265400	you know, some of the wireless CTF, you know, members or competitors that walk around with,
265400	268420	like, a laptop in the face, you know, with all these antennas and porcupine, you know,
268420	271940	stuff all over. I'm not going to be the Wi-Fi cactus or anything like that. I want to come
271940	277600	and try and pen test your site. And this is just a screenshot of my iPhone. And, you know, just some
277600	281180	things that I can see out of a glance. And again, if you just see somebody walking with their cell
281180	286580	phone, you're not going to think anything of it, right? And then this is something that we've taken
286580	291660	on engagements where we've, you know, gone on to a large, large site that we have to walk around.
291700	295540	And really, this is just the black backpack. You know, you'd have to look a little bit harder to
295540	300520	see that there are actually a bunch of omnidirectional antennas, along with, you know,
300680	306280	a bunch of just different network adapters all put into this backpack. And it's one of those
306280	309380	things that if you're not looking for it, you know, these antennas could easily be placed inside
309380	314200	of the backpack. But at the end of the day, we've been able to do engagements that cover thousands
314200	321460	of acres worth of, you know, worth of a client site. And, you know, there was full-on, you know,
321460	327340	public people there. There were, you know, staff there. There were security people there. And no
327340	331400	one saw us. We didn't stick out at all, just because we're normal people with normal backpacks.
331680	336040	And again, it's one of those things that it's easy to remain unseen and still do nefarious things.
336640	340640	Here's another clip of the backpack. Basically, it's just some larger anchor batteries
340640	346520	hooked into multiple Raspberry Pis. And again, you can see on the right-hand side,
346920	351760	a bunch of omnidirectional antennas that are kind of just placed, you know, in a not necessarily
351760	357900	covert, but in a way that you'd have to really look at that to know what's going on.
359580	364020	So I think one of the biggest things, the biggest fly on the wall here is rogue access points.
364020	369200	At least I shouldn't say everybody. A large amount of my clients are all very concerned
369200	375440	of the rogue access points, but they really don't have any idea what they say or what they mean when
375440	380360	they talk about rogue access points. And really, by definition, a rogue access point is just any
380360	385440	wireless access point that's not within your control that, you know, that's in your airspace,
385440	389280	you know, your physical airspace that you do control where your access points might be.
389500	393040	So I mean, really, at the end of the day, technically any phone or any hotspot could
393040	396560	be a rogue access point or could be considered a rogue access point. But that's not really what
396560	401240	clients most care about. They most care about access points that are designed to mimic their
401240	406340	own access points that then their users will connect to and get tricked into, you know,
406340	410300	potentially providing credentials or some other type of data that they shouldn't, right?
411160	414620	So I'll just give you a couple access points of what a rogue access point can do.
414820	417180	There's this tool that I use from time to time called
418160	423200	Wi-Fi Fisher. And essentially, all that it does is it just stands up, you know, a hotspot with
423200	427800	whatever name I want to give it. And it will kick off users by de-authenticating them from
427800	432780	their current network with the goal of having them connect to my rogue access point. And when
432780	437560	they connect to my rogue access point, I send them to a captive portal. And the captive portal looks
437560	442200	like a, you know, just a simple... it takes their user agent. So if they're coming from an iPhone,
442200	447160	this would be like the iPhone Wi-Fi screen. This example is coming from a, you know,
447160	451700	Windows 10 laptop. So when they open up their browser, it looks like, oh man, I need to type
451700	456740	in my wireless network key. What most users don't realize, and most users, you know, aren't security
456740	460700	people or tech wizards that are really going to, you know, analyze this. But if you have a full
460700	467460	screen browser window open, you'll notice that that's all just rendered in the browser. That,
467460	471700	you know, what's asking for your key. Now, if a user types in their key and hits next,
471700	475980	that will then submit it to me in clear text because I run that web server. That's my rogue
475980	480040	access point. And then it's configured in such a way that the second that they give me a valid
480040	483780	credential, it will then shut down my rogue access point. So that means an attacker can just
483780	488080	automatically just say, hey, okay, like I'm going to be quiet now. I'm not going to try and draw any
488080	492260	more attention to myself. And it's one of those things that like, is this a crazy, super sophisticated
492260	495860	hacker technique? Absolutely not. Are people in the wireless village going to make fun of me for
495860	500880	even probably talking about this? Sure. But at the end of the day, this has gotten me so many
500880	504720	credentials that it's kind of sad. And this has, you know, been the downfall of so many corporate
504720	511480	networks that it's definitely worth mentioning because people use it and it works as an attack
511480	514960	vector and people are tricked by it. Because at the end of the day, if you're watching this,
514960	518040	you're probably a security minded person and you would probably say, oh, man, there's no way that
518040	524420	I would fall for it. But, you know, take a step back and think of everybody in your organization
524420	529340	that, you know, that deals with Wi-Fi, that deals with, you know, just any device that's connected
529340	534080	to the internet, would they fall for it? Well, at the end of the day, I just need a single person
534080	539480	to fall for it and that's it. I just need one person to fall for it. And then I have your, you
539480	545560	know, in this case, it's a, you know, pre-shared key. So WPA2 PSK network. But there are other
545560	552800	attacks such as ePammer that, you know, they can mimic a corporate internet, you know, that's
552800	557280	WPA2 Enterprise where a user would type in their credentials and then I could get hash credentials,
557280	561940	clear text credentials if there's, you know, GTC downgrade. But really at the end of the day,
561940	567160	this all surrounds, you know, rogue access points and somebody standing up an access point that
567160	571940	mimics your own and being able to detect that it's happening. Because at the end of the day,
571940	576740	I'd say that that fewer than 10% of our clients even know when we stand up a rogue access point
576740	579740	that they're even looking for it. And even if they're looking for it, they may not even get
579740	583560	the alerts. I've had plenty of clients that have said like, oh yeah, we have rogue access point
583560	587480	detection. And, you know, after the pen test, we went back and looked at our logs and we got all
587480	592080	these alerts, but, you know, they were never configured to go anywhere. They were never,
592080	597080	you know, configured to get acted upon really is the best case for that. I mean, again,
597080	601440	it seems super silly that this is all that my attack vector is a standard rogue access point
601440	607140	and hoping to fish some credentials. But at the end of the day, it works. And just the fact that
607140	612020	it works is scary enough because it's a really old style kind of attack really.
613560	616760	So rogue access points, like I was talking about, they can lead to stolen credentials if you're
616760	623220	using say E-Pammer to get WPA2 enterprise credentials, or in the case of Wi-Fi Fisher,
623220	628000	you can use that for PSK. So just, you know, shared network key like you probably have at home,
628500	632560	you know, and that can lead then to a full internal network compromise. So it can lead
632560	640380	to compromised workstations. They can also basically lead to data being exfiltrated,
640380	645640	right? So if an end user connects to my access point, I can exfiltrate data off that system
645640	649820	without it going through any of the normal controls or processes that it normally would.
650300	654780	And then it can also allow users to circumvent corporate policies. So a lot of time that,
654780	661520	say your corporation blocks Netflix or Facebook or something, end users might connect their laptop
661520	665860	or their mobile device that's work provided, they might connect it to another rogue access point
665860	670600	in hopes that they can circumvent that and that they can watch Netflix, that they can do
670600	676480	any other basically types of activities that would probably be blocked on any other network.
676520	680660	So it's one of those things that end users, you know, may not always get tricked. They might
680660	685240	willingly connect to other access points to get to, you know, whatever stuff that they want to
685240	691800	that's being blocked by corporate policies. And so this is one of these matrices that
692240	695900	I kind of like to reference and use. It might seem a little bit dense,
695900	699940	but really at the end of the day, rogue access points are kind of summed up in this way. So
699940	706680	the easiest rogue access point for a corporation to detect is an exact match of whatever the SSID
706680	712440	is. And SSID is just their wireless name. So say that's like, you know, Home Network 123.
712440	717700	So you would see then a second Home Network 123 with a MAC address of 0012, you know,
717700	722380	all the way through 55. That would be the easiest to detect because that is completely different,
722380	727240	you know, than your normal, whatever your normal MAC address would be. And that's just a hardware
727240	734200	address that is associated with that wireless radio. The next hardest would be then basically
734200	738900	that exact same SSID with just some random characters that, you know, just randomly
738900	744140	generated MAC address hardware address. Then as you kind of like go down that difficulty scale
744140	747820	or up the difficulty scale, you're going to see it's going to be an exact match of that, you know,
747820	753980	SSID with then a MAC address that's similar to the MAC addresses of the access points that you run.
753980	758280	That might be harder for some, you know, for some intrusion prevention detection software
758280	764740	to detect is something that's similar to what would be expected. And then if you're talking
764740	771120	about a larger client, say I go to, you know, say it's a bank, right? A bank will have multiple
771120	775900	branches. Say I went to one bank and copied a MAC address from that site and took it to another
775900	780920	branch, you know, in the same town or, you know, same vicinity where wirelessly they won't touch,
780920	784580	but that MAC address is at least valid on the network, right?
784620	788680	And I stand that up as an access point. Well, now the intrusion prevention detection system
788680	792540	is not going to detect me because it is technically somewhere in the system.
792540	796620	The controller will just not have any idea of the geography behind that. And so that's
796620	801340	makes it harder to detect, you know, and then you keep going. And then now you can make,
801340	809000	say your SSID is just similar, but not an exact match to what that Wi-Fi would be with, again,
809000	813760	random MAC addresses and then, you know, similar and then going down that same spectrum.
813800	817300	At the end of the day, this is just something that an attacker can use and kind of see like,
817300	821880	okay, well, you know, what level of sophistication does your monitoring hardware,
822520	829220	you know, and detection system, what does that look like? Because for example here, say you were
829220	836080	looking for an SSID that matched exactly and it was cloned from a MAC address of the same site.
836080	840260	Well, what happens if there's some weird reflection or attenuation there that makes
840260	844920	your wireless signals bounce from place to place? Well, if you're doing detection on a
844920	849640	MAC address seen by different access point, now all of a sudden that gets a lot harder and a lot
849640	853980	more complicated of a thing to program. And it's probably going to generate a lot of false positives.
853980	858000	So it's one of these things that at the end of the day, it's easy to say, oh man, we need,
858000	862480	you know, rogue access point detection or rogue access point detection really is an entire,
862480	866960	you know, suite of what is an attacker doing. And so it's really important just to kind of
866960	872980	break down that nuance and see that, you know, some clients might see an exact match of 0, 1,
872980	878820	1, 2, 2, 3, 3, 4, 4, 5, or maybe even random, but similar to known access points or clone from
879180	882600	a different site or the same site. That's typically not going to get picked up. And it
882600	886560	allows an attacker like myself, who's already, you know, attacking wirelessly and is not going
886560	893600	to be seen. It allows me to basically not trigger any logs or trigger any detection, which again,
893600	896780	you know, is there some software that can detect that? Absolutely. How many clients
896780	902960	actually run it? Not a lot. Again, I probably been detected less than 5, 10% of the time,
902960	907640	which is kind of surprising. And this kind of brings me into simple is not the same thing as
907640	912940	easy, right? Like all of these things that I've talked about, they're simple to understand,
912940	917520	but they may not be that easy to configure, right? And that's an important distinction
918000	924400	because just looking for excessive password spraying, you know, watching for devices that
924400	929660	continually try credentials over and over and over and over again. There's been a number of
929660	936060	sites where I basically just sprayed an access point with user credentials that I got off LinkedIn
936620	941060	with the attempt of trying to authenticate to their access point. And eventually it worked.
941060	946380	It took a long time. I spent all night trying to, you know, associate with credentials until
946580	950820	a pair of them worked. But at the end of the day, that's all that it took. And if somebody
950820	955860	was watching their logs, they would have seen, wow, 10,000 attempts. That seems a bit strange.
956100	960440	But again, a lot of people don't look at their logs. And is that a simple thing for me to say?
960440	966260	Yeah, absolutely. Is it easy? Definitely not. And then same thing, get alerts from
966260	971140	rogue access points. A bunch of my clients will have, you know, software or some type of
971140	976960	controller available to them that will actually look for rogue access points. I mean, at home,
976960	982060	I run Ubiquity. And it will, you know, if I check that box, it will determine, you know, hey,
982060	985860	there's a rogue access point detected. I'm going to send you a push notification to your phone.
986340	991260	There's a lot of end users, a lot of clients, a lot of corporations out there that don't even
991260	995280	have that box checked. And even though their controller, even though whatever software they
995860	999900	is capable of seeing it, they don't even check the box. So, they'll never even get that
999900	1005540	notification, even though their software, their controller, whatever it may be, has that, you know,
1005540	1012120	out of the box as an option. And then have a plan to what to do when you do detect a rogue access
1012120	1017300	point. That's one of those things that's like, cool, you detect a rogue access point. Now what?
1017300	1021880	You know, depending on the size of your site, that might be just, you know, taking a walk around the
1021880	1028080	office, or it might be trying to take a walk around a multi-acre, you know, area or an entire
1028080	1034600	campus or an entire outdoor place or an entire sporting arena. And so, it's one of those things
1034600	1037940	that, you know, you have to plan to the scale of your corporation, your company, your organization,
1037940	1042540	whatever it may be, is to, you know, how are you going to locate these? Is your controller software,
1042540	1047640	is it capable of saying, you know, this was seen from this access point or from this location?
1047680	1050180	Or is that something you're going to have to deploy? Is there going to have to be somebody
1050180	1055740	trained in that? A lot of times, it's not enough just to detect them. You have to locate them to
1055740	1060500	see, you know, is this somebody that was doing this nefariously? Or is it, you know, some error
1060500	1064640	in the system? Being able to distinguish that and being able to have a game plan for when that
1064640	1070580	happens will make it less of a panic situation, right? And a lot of that is having a wireless
1070580	1074880	pen test, right? Like, knowing where your weaknesses lie before you actually have to,
1074880	1080340	you know, rely on your logs and rely on your locating, relying on pretty much everything,
1080340	1086480	right? Really, log your data. It's one of those things, it's simple. It's not easy,
1086480	1090380	like, to log your data and look at your logs. Because a lot of the times when I'm doing
1090380	1096020	something, when I'm pen testing, all that data is probably logged somewhere or at least can be
1096020	1101560	enabled or there's some logging software or, you know, something available to you. But people don't
1101560	1107300	look at their logs. You know, sysadmins have a busy job and typically don't look at their logs
1107300	1112480	or really investigate that stuff. Or there may not even be a person dedicated to just wireless.
1112480	1116320	It might just be the network security team and they don't even bother to ingest, you know,
1116320	1121820	their wireless logs that are being generated. So, again, all these things, they're really simple.
1121820	1127140	I feel a little bit sheepish giving a talk about how simple these things are. But each and every
1127140	1132400	one of these things, you know, I haven't been done when I've been on a pen test at times and
1132400	1138080	it's allowed me to compromise a full entire organization, you know, because any number of
1138080	1142820	these, you know, or combination of these weren't done. And again, they're simple, but they're not
1142820	1149180	easy to enact. It's just one of those things. Again, these are simple ways that somebody can
1149180	1156160	get in that typically aren't covered. Now, okay. So, like, kind of switching gears. There's a bunch
1156160	1160400	of other information that wireless devices emit. And there's far more than this, but I just kind of
1160400	1165880	want to give out the basics of it. But really, devices, you know, they can allow users to be
1165880	1169920	tracked. You can identify the type of device. You can see what devices are connected to what
1169920	1174920	networks. Just using a tool like AeroDump, which, again, is a super old tool, but still works great.
1175140	1178300	You can, you know, take a look at this screen. And if you're not familiar with the screen,
1178300	1182920	then, oh, well, I'll kind of explain it right now. So, if you look at the top left corner,
1182920	1187880	there's BSSID, and that is basically, you know, the access point hardware address.
1188320	1193800	And then, down below, you see the access point and then devices connected to that access point.
1193860	1197980	And if you just take a quick look, you can see power levels will kind of associate roughly with,
1197980	1201660	you know, distance away from that access point. The power level is what you'd be looking at.
1201700	1205040	And then, if you can see devices that are connected to that access point, well,
1205040	1210600	MAC addresses are basically handed out, or at least ranges of them are handed out to hardware
1210600	1215360	manufacturers, and they can be identified by just a couple of octets. And so, if you were to plug
1215360	1222140	in... so, if you... I'll switch back. If you look at this, you'll see that, basically, you know,
1222140	1228340	that 18B430, if you were to plug that into Google, what that gets you is that it says,
1228340	1232040	oh, that's Nest. And so, from that, I can say, okay, well, maybe they have a Nest camera on
1232040	1236900	this network. You know, should I look for Nest cameras? You know, maybe there is a Nest thermostat,
1236900	1242260	and you can basically, as an attacker, I don't need to know what your username, your password is.
1242260	1247900	I don't need to know, you know, really anything else about your company, organization, or wireless
1247900	1251420	networks, because I can see all of that in the clear. I can see, you know, what at least types
1251420	1256240	of devices are connected. And so, really, it's one of these things. I know I'm going to keep saying
1256240	1263120	it over and over and over and over, but it's simple to detect somebody like me on your network,
1263120	1267280	but it's typically not easy. And really, I just kind of want this to be one of those
1267280	1272340	wake-up calls that, you know, if you are a sysadmin, if you do control wireless networks,
1272340	1278080	to kind of take a look at the security policies, the monitoring capability that you have,
1278460	1282680	because at the end of the day, you don't want to be scrambling if you do detect something,
1282680	1287920	or if you do detect a breach or some weirdness. And again, I think just going back to this last
1287920	1294180	slide and showing, you know, check for password spraying, you know, check for any rogue access
1294180	1298180	points that are in your area, have a plan on how to locate them, you know, understand what data
1298180	1304240	somebody like me can see, you know, know how far your access points, you know, broadcast,
1304240	1307740	you know, log the data that you do collect, that you have the capability of collecting,
1307740	1311320	and then look at them from time to time and notice if there's anything strange or weird,
1311320	1316960	and then maybe build some policies out to alert you if anything funky does look like it's happening.
1317960	1324720	Again, I think this is all simple. It's not easy always to configure. So, hopefully that was
1324720	1329740	helpful. I will be around in the Wireless Village if anybody wants to send me questions, and maybe
1329740	1334880	I'll add some contact information to this on the page after it gets posted. But again, I hope it's
1334880	1340900	helpful. I know this may seem like a super one-on-one, easy mode talk, but each and every
1340900	1345360	one of these aspects is something that, you know, one of my clients has potentially not done
1345360	1349880	that has led me to compromise their organization. And if everybody looked at this and kind of had
1349880	1353780	this in the back of their mind, if you're a sysadmin that controls networks, or maybe you're
1353780	1357420	not even a sysadmin that controls your wireless networks, but you could bring this to them,
1357420	1362260	it would go pretty darn far. Because at the end of the day, everybody has logging in place for
1362260	1366860	their external network infrastructure and for their internal network infrastructure.
1367100	1372900	But wireless, for some reason, is the extension of your, you know, of your internal network
1372900	1378020	beyond your walls, potentially. And it can let somebody like me, or somebody worse than me,
1378020	1383240	somebody who actually is trying to do some harm to your network, in, and you won't even see them.
1383240	1388100	You won't even know that they're there. They will be, you know, for your eyes unseen. Again,
1388100	1392180	hopefully it's helpful. I know this may seem like kind of like a one-on-one-ish talk, but
1393160	1396180	it might be something that you need to hear. So, take it for what it's worth. And if you
1396180	1400160	have any questions, feel free to contact me and I'll be in Discord. All right, talk to you guys
1400160	1400520	later.
1400860	1401220	Transcribed by https://otter.ai