1
00:00:00,240 --> 00:00:02,130
- Well, we have a fun talk this afternoon.

2
00:00:02,130 --> 00:00:04,260
I don't know about you all
but I love a good rickroll.

3
00:00:04,260 --> 00:00:07,020
And our next speaker rickrolled
his entire high school,

4
00:00:07,020 --> 00:00:08,220
which is pretty awesome.

5
00:00:08,220 --> 00:00:09,270
So please welcome Minh Duong

6
00:00:09,270 --> 00:00:11,670
for his first time up
here at DEF CON Speaking,

7
00:00:11,670 --> 00:00:14,548
telling us about how he
rickrolled his whole high school.

8
00:00:14,548 --> 00:00:18,798
(audience applauding and cheering)

9
00:00:21,712 --> 00:00:22,620
- Hi everyone.

10
00:00:22,620 --> 00:00:24,070
Thanks for coming to my talk.

11
00:00:24,960 --> 00:00:27,180
My name is Minh, I'm 19 years old

12
00:00:27,180 --> 00:00:29,490
and I'm starting my second
year as an undergraduate

13
00:00:29,490 --> 00:00:32,613
at the University of Illinois
at Urbana-Champaign next week.

14
00:00:33,540 --> 00:00:35,250
This is my first time at DEF CON

15
00:00:35,250 --> 00:00:37,980
and my second time ever
attending a security conference.

16
00:00:37,980 --> 00:00:40,020
So it's extremely humbling
to be up here on stage

17
00:00:40,020 --> 00:00:40,853
as a newbie.

18
00:00:44,430 --> 00:00:46,743
Before we proceed, first on disclaimers.

19
00:00:48,090 --> 00:00:49,890
If you came to this
talk expecting anything

20
00:00:49,890 --> 00:00:51,150
other than a script kiddie story

21
00:00:51,150 --> 00:00:53,730
then you didn't read
the abstract carefully.

22
00:00:53,730 --> 00:00:56,700
This presentation is for
educational purposes only.

23
00:00:56,700 --> 00:00:58,170
I do not condone hijacking

24
00:00:58,170 --> 00:00:59,920
and rickrolling other high schools.

25
00:01:01,410 --> 00:01:04,200
Also, please don't hack my
own high school district,

26
00:01:04,200 --> 00:01:06,850
they're very cool people
and they don't deserve that.

27
00:01:08,760 --> 00:01:10,800
So let's start from the beginning.

28
00:01:10,800 --> 00:01:12,330
Here's a picture of my high school

29
00:01:12,330 --> 00:01:14,100
which has about 2000 students

30
00:01:14,100 --> 00:01:18,060
and is part of a larger school
district in suburban Chicago

31
00:01:18,060 --> 00:01:20,253
which has six high schools in total.

32
00:01:21,180 --> 00:01:23,460
My school offered some IT classes.

33
00:01:23,460 --> 00:01:25,050
They essentially had a career pathway

34
00:01:25,050 --> 00:01:28,290
that you can follow from
freshman to senior year.

35
00:01:28,290 --> 00:01:30,090
Obviously I was running to computers,

36
00:01:30,090 --> 00:01:32,373
so of course I signed
up in my freshman year.

37
00:01:33,240 --> 00:01:35,553
Those classes were held in this room.

38
00:01:36,690 --> 00:01:37,740
It's pretty amazing.

39
00:01:37,740 --> 00:01:39,660
It's where I developed
my cyber security skills,

40
00:01:39,660 --> 00:01:41,733
thanks to my awesome teacher, Mr. Drenth.

41
00:01:42,810 --> 00:01:43,920
It's got computer lab

42
00:01:43,920 --> 00:01:47,250
and has shelves full of computer
parts, cables, monitors,

43
00:01:47,250 --> 00:01:49,860
switches, everything a high school hacker

44
00:01:49,860 --> 00:01:50,860
could ever dream of.

45
00:01:51,990 --> 00:01:55,110
Now, one of the coolest
things about this room

46
00:01:55,110 --> 00:01:56,163
was this closet.

47
00:01:57,090 --> 00:01:59,730
Inside this closet were two desktop PCs

48
00:01:59,730 --> 00:02:01,890
that were each running Windows 7.

49
00:02:01,890 --> 00:02:04,320
I inherited this space
from the upperclassman

50
00:02:04,320 --> 00:02:06,330
and it was here that I
really started developing

51
00:02:06,330 --> 00:02:07,473
my script kiddie case.

52
00:02:08,460 --> 00:02:10,320
I never owned my own computer before,

53
00:02:10,320 --> 00:02:11,550
so this was the next best thing

54
00:02:11,550 --> 00:02:14,150
since I basically had both
these computers to myself

55
00:02:15,180 --> 00:02:16,860
and like any hacker wannabe,

56
00:02:16,860 --> 00:02:19,360
I started running scans
against my school network.

57
00:02:20,310 --> 00:02:21,600
I was quite ambitious

58
00:02:21,600 --> 00:02:24,033
and decided to scan the
entire 10 dot subnet.

59
00:02:26,624 --> 00:02:28,440
I had some help from my
upperclassmen friends

60
00:02:28,440 --> 00:02:31,110
and we took turns running every IP scanner

61
00:02:31,110 --> 00:02:33,300
and we had to split the scans into parts

62
00:02:33,300 --> 00:02:35,490
because if we tried to open one big scan

63
00:02:35,490 --> 00:02:36,753
it would crash Notepad.

64
00:02:38,790 --> 00:02:40,200
We learned quite a bit from the scans.

65
00:02:40,200 --> 00:02:41,670
The first being that our school district

66
00:02:41,670 --> 00:02:44,250
has its own metropolitan area network,

67
00:02:44,250 --> 00:02:47,670
so all the high schools are
connected to the same network

68
00:02:47,670 --> 00:02:49,270
and each have their own subnets.

69
00:02:50,310 --> 00:02:52,410
We also found a ton of different things,

70
00:02:52,410 --> 00:02:56,220
printers, voiceover IP phones, switches.

71
00:02:56,220 --> 00:02:59,873
One of the coolest things we
found was the security cameras.

72
00:02:59,873 --> 00:03:02,010
(audience chuckling)

73
00:03:02,010 --> 00:03:04,140
- The top left is me
when I first found them

74
00:03:04,140 --> 00:03:05,400
and the bottom right is my friend

75
00:03:05,400 --> 00:03:07,673
giving me the middle
finger after I showed him.

76
00:03:10,410 --> 00:03:12,300
Now, one of the most important things

77
00:03:12,300 --> 00:03:13,290
we found in the network

78
00:03:13,290 --> 00:03:15,420
that forms the basis for this entire talk

79
00:03:15,420 --> 00:03:16,773
is the IPTV system.

80
00:03:17,610 --> 00:03:20,130
The system is manufactured by Exterity

81
00:03:20,130 --> 00:03:22,143
and consists of three main products.

82
00:03:23,370 --> 00:03:25,350
The first is the AvediaPlayer

83
00:03:25,350 --> 00:03:28,200
which are receivers
attached to projectors.

84
00:03:28,200 --> 00:03:30,360
They send serial commands to the projector

85
00:03:30,360 --> 00:03:32,010
to control its current state,

86
00:03:32,010 --> 00:03:33,760
and also what content is displayed.

87
00:03:35,520 --> 00:03:38,070
Here's the web interface
for the AvediaPlayer.

88
00:03:38,070 --> 00:03:40,380
You can change the input source and volume

89
00:03:40,380 --> 00:03:41,940
and you can also change
the current channel

90
00:03:41,940 --> 00:03:44,283
to a specific RTP or UDP stream.

91
00:03:46,410 --> 00:03:48,000
Next up is the AvediaStream

92
00:03:48,000 --> 00:03:51,510
which is attached to a device
that displays video output.

93
00:03:51,510 --> 00:03:53,490
The encoder then takes that video output

94
00:03:53,490 --> 00:03:56,130
and broadcast it as a network stream

95
00:03:56,130 --> 00:03:58,563
which receivers can
connect to and display.

96
00:04:00,300 --> 00:04:03,160
Here is an example of
the carousel live stream

97
00:04:03,160 --> 00:04:04,410
at my former high school

98
00:04:04,410 --> 00:04:07,350
which is displayed on all the hallway TVs.

99
00:04:07,350 --> 00:04:09,300
The stream is broadcasted by the encoder

100
00:04:09,300 --> 00:04:11,130
to the AvediaPlayers.

101
00:04:11,130 --> 00:04:13,830
It's just a slideshow showing
special events at the time

102
00:04:13,830 --> 00:04:14,970
weather, et cetera

103
00:04:14,970 --> 00:04:17,583
but it was also used to
show morning announcements.

104
00:04:19,650 --> 00:04:21,660
And finally, we have the AvediaServer,

105
00:04:21,660 --> 00:04:23,490
which provides an easy to use interface

106
00:04:23,490 --> 00:04:25,653
to manage all the devices at once.

107
00:04:27,540 --> 00:04:29,730
Here is the projector
control from the AvediaServer

108
00:04:29,730 --> 00:04:31,500
where we can drag and drop receivers

109
00:04:31,500 --> 00:04:34,923
onto the control buttons at the
top, like power on and HDMI.

110
00:04:35,970 --> 00:04:39,090
Now each of the six schools
has its own AvediaServer

111
00:04:39,090 --> 00:04:42,180
which controls Exterity devices
in their respective subnet.

112
00:04:42,180 --> 00:04:43,013
And in this case,

113
00:04:43,013 --> 00:04:45,730
I'm viewing the projectors
from my specific high school.

114
00:04:46,830 --> 00:04:49,710
So that was pretty much the
bulk of my freshman year.

115
00:04:49,710 --> 00:04:51,750
I was just getting the district network,

116
00:04:51,750 --> 00:04:53,550
finding random devices
to screw around with

117
00:04:53,550 --> 00:04:55,300
and figuring out how things worked.

118
00:04:56,790 --> 00:04:59,250
All right, we're going to skip
a few years to my senior year

119
00:04:59,250 --> 00:05:02,070
and the time skip is because
nothing notable happened

120
00:05:02,070 --> 00:05:03,780
in my sophomore year,

121
00:05:03,780 --> 00:05:06,453
and my junior year is when
the COVID-19 pandemic hit.

122
00:05:07,440 --> 00:05:08,910
And the first semester of my senior year

123
00:05:08,910 --> 00:05:11,373
was hybrid learning, so
not much happened either.

124
00:05:13,290 --> 00:05:16,440
Then the district decided
in March of my senior year

125
00:05:16,440 --> 00:05:18,750
that everyone would be
required to come back in person

126
00:05:18,750 --> 00:05:20,130
in April.

127
00:05:20,130 --> 00:05:21,883
It's at this point that I remember,

128
00:05:21,883 --> 00:05:24,990
oh, Hey I still have
access to all those devices

129
00:05:24,990 --> 00:05:26,220
from freshman year,

130
00:05:26,220 --> 00:05:29,040
and I should probably tell
the district about it.

131
00:05:29,040 --> 00:05:32,793
And then I think, oh, Hey,
I need to do a senior prank.

132
00:05:34,410 --> 00:05:36,630
And finally I conclude,

133
00:05:36,630 --> 00:05:39,183
oh, Hey I should rickroll
my high school district.

134
00:05:40,770 --> 00:05:42,733
So I asked a few friends for help.

135
00:05:42,733 --> 00:05:45,900
(audience applauding)

136
00:05:48,930 --> 00:05:50,460
- So I asked a few friends for help

137
00:05:50,460 --> 00:05:54,060
and we officially began
working on operation Big Rick.

138
00:05:54,060 --> 00:05:56,940
(audience laughing)

139
00:05:56,940 --> 00:05:58,260
- One of the first things we needed to do

140
00:05:58,260 --> 00:06:01,320
was establish access to the
district network from home.

141
00:06:01,320 --> 00:06:03,480
Now I already had a
working solution for this

142
00:06:03,480 --> 00:06:06,930
because I installed Chrome RDP on every PC

143
00:06:06,930 --> 00:06:09,690
in the classroom that I mentioned earlier.

144
00:06:09,690 --> 00:06:13,020
On the screen right now is
a list of all those PCs.

145
00:06:13,020 --> 00:06:14,910
They're grayed out because
they reformat the machines

146
00:06:14,910 --> 00:06:17,010
every year so I can't access them anymore.

147
00:06:17,880 --> 00:06:21,570
Now, while we did have network
access through those PCs

148
00:06:21,570 --> 00:06:23,520
it's not going to be very
hard for district tech

149
00:06:23,520 --> 00:06:26,880
to pinpoint me if any scan
or exploitation traffic

150
00:06:26,880 --> 00:06:28,800
is coming from those machines.

151
00:06:28,800 --> 00:06:31,710
So we need a way to pivot
to different machines

152
00:06:31,710 --> 00:06:35,370
that are not associated with
us so we don't get found out.

153
00:06:35,370 --> 00:06:38,067
So now I introduce LanSchool.

154
00:06:39,360 --> 00:06:43,150
Who here knows what LanSchool is?

155
00:06:43,150 --> 00:06:45,300
Okay, not a lot.

156
00:06:45,300 --> 00:06:46,350
For those who don't know,

157
00:06:46,350 --> 00:06:48,450
LanSchool is a program
that gives teacher control

158
00:06:48,450 --> 00:06:50,640
over devices in their classroom.

159
00:06:50,640 --> 00:06:52,290
There are two applications,

160
00:06:52,290 --> 00:06:53,430
one is LanSchool Student,

161
00:06:53,430 --> 00:06:55,200
which is installed as a background process

162
00:06:55,200 --> 00:06:57,120
on all student devices.

163
00:06:57,120 --> 00:06:59,700
And the other application
is LanSchool Teacher,

164
00:06:59,700 --> 00:07:01,290
which a teacher uses on their computer

165
00:07:01,290 --> 00:07:03,123
to control all the student devices.

166
00:07:04,587 --> 00:07:07,830
So what can you do with LanSchool Teacher?

167
00:07:07,830 --> 00:07:11,670
You can freeze a student
computer to make it unusable.

168
00:07:11,670 --> 00:07:13,470
This is the one every student hates.

169
00:07:14,520 --> 00:07:16,720
You can remotely view
and control a student.

170
00:07:18,300 --> 00:07:20,133
You can upload arbitrary files.

171
00:07:21,540 --> 00:07:23,673
You can execute arbitrary files,

172
00:07:25,680 --> 00:07:28,470
and you can view keystroke history,

173
00:07:28,470 --> 00:07:29,820
which I think is absolutely insane

174
00:07:29,820 --> 00:07:32,640
because it opens up a
massive door for abuse.

175
00:07:32,640 --> 00:07:35,490
Imagine what would
happen if a threat actor

176
00:07:35,490 --> 00:07:37,053
got access to all this control?

177
00:07:40,860 --> 00:07:42,810
It turns out it's pretty
easy to obtain a copy

178
00:07:42,810 --> 00:07:45,210
of LanSchool Teacher if
you know where to look.

179
00:07:45,210 --> 00:07:46,200
And if you're an IT guy

180
00:07:46,200 --> 00:07:48,270
provisioning hundreds
of student computers,

181
00:07:48,270 --> 00:07:50,310
well, you're not exactly
going to prioritize

182
00:07:50,310 --> 00:07:52,060
adding passwords to the classrooms.

183
00:07:54,120 --> 00:07:57,030
And here I'm doing a
student's keystroke history.

184
00:07:57,030 --> 00:07:58,500
It looks like they're
doing some 3D modeling

185
00:07:58,500 --> 00:08:00,000
based on their search history.

186
00:08:01,740 --> 00:08:04,110
Now, it also turns out LanSchool Student

187
00:08:04,110 --> 00:08:06,450
was not only installed
on the student computers

188
00:08:06,450 --> 00:08:08,455
but also on some staff computers as well.

189
00:08:08,455 --> 00:08:11,250
(audience laughing softly)

190
00:08:11,250 --> 00:08:13,700
- Here's a desktop of one
of the security guards.

191
00:08:17,160 --> 00:08:21,000
So using our district network
access and LanSchool Teacher

192
00:08:21,000 --> 00:08:24,210
we were able to pivot to
a different high school.

193
00:08:24,210 --> 00:08:26,820
So that way, when we'd
run our scans from there

194
00:08:26,820 --> 00:08:29,280
the district wouldn't be able to track us.

195
00:08:29,280 --> 00:08:32,010
I now had a better knowledge
of what to scan for,

196
00:08:32,010 --> 00:08:33,543
so we found a few new things.

197
00:08:35,370 --> 00:08:39,213
It turns out all Exterity devices run SSH,

198
00:08:40,830 --> 00:08:43,263
and they let you open a shell,

199
00:08:44,100 --> 00:08:46,113
like direct user access to the system.

200
00:08:47,218 --> 00:08:48,840
This makes things way easier though,

201
00:08:48,840 --> 00:08:51,960
because instead of sending
a bunch of web requests

202
00:08:51,960 --> 00:08:53,700
to control each of the receivers,

203
00:08:53,700 --> 00:08:54,810
we can create a payload

204
00:08:54,810 --> 00:08:57,213
that runs its serial
commands locally on device.

205
00:08:59,220 --> 00:09:02,670
Now this payload is really
just a batch script that I made

206
00:09:02,670 --> 00:09:05,190
that makes request to
a web interface locally

207
00:09:05,190 --> 00:09:07,940
but it's pretty simple and
it boils down to this logic.

208
00:09:09,210 --> 00:09:10,860
The first thing we do is set the receiver

209
00:09:10,860 --> 00:09:12,360
to play the rickroll stream.

210
00:09:12,360 --> 00:09:17,360
So it's at address 225.25.25.25.5000.

211
00:09:18,150 --> 00:09:20,370
The next thing we do is
set the input to HDMI,

212
00:09:20,370 --> 00:09:23,270
since this is the input where
the AvediaStream is playing.

213
00:09:25,320 --> 00:09:27,917
Then we disable infrared capabilities.

214
00:09:27,917 --> 00:09:31,084
(audience applauding)

215
00:09:35,700 --> 00:09:37,380
- This way the teacher
cannot use their remote

216
00:09:37,380 --> 00:09:39,390
to turn off the receiver.

217
00:09:39,390 --> 00:09:41,790
Although they still can
technically power off the projector

218
00:09:41,790 --> 00:09:43,800
off manually by pressing the power button

219
00:09:43,800 --> 00:09:46,159
but we'll get onto how to fix that later.

220
00:09:46,159 --> 00:09:48,630
(audience laughing)

221
00:09:48,630 --> 00:09:50,340
- And a final step in our initial process

222
00:09:50,340 --> 00:09:51,813
is to actually turn it on.

223
00:09:54,000 --> 00:09:56,820
Then we enter a first
loop for three minutes.

224
00:09:56,820 --> 00:09:59,190
It's during this loop that
the countdown is displayed

225
00:09:59,190 --> 00:10:01,170
not the actual rickroll yet.

226
00:10:01,170 --> 00:10:03,840
The loop basically sets
the volume to the max,

227
00:10:03,840 --> 00:10:07,170
and then it sends a power
on command every 10 seconds.

228
00:10:07,170 --> 00:10:09,810
And this fixes the issue
I mentioned earlier,

229
00:10:09,810 --> 00:10:12,120
where the teacher could just
manually turn out the projector

230
00:10:12,120 --> 00:10:14,603
but that doesn't work because
it just turns on again.

231
00:10:17,880 --> 00:10:19,080
Close to the end of the countdown,

232
00:10:19,080 --> 00:10:20,880
we switch the input back to HDMI

233
00:10:20,880 --> 00:10:21,960
to make sure that the projector

234
00:10:21,960 --> 00:10:23,460
is still showing the rickroll.

235
00:10:24,930 --> 00:10:26,820
Then we run the main loop a second time

236
00:10:26,820 --> 00:10:28,230
but this time for nine minutes

237
00:10:28,230 --> 00:10:30,330
and this covers the entire rickroll stream

238
00:10:30,330 --> 00:10:32,280
and also allows people
to read the final message

239
00:10:32,280 --> 00:10:34,080
that's displayed after the rickroll.

240
00:10:36,330 --> 00:10:37,920
Finally, we restored a channel

241
00:10:37,920 --> 00:10:39,900
that the receiver was
broadcasting previously

242
00:10:39,900 --> 00:10:41,310
using a backup we made,

243
00:10:41,310 --> 00:10:42,930
and then re-enabled the infrared remote.

244
00:10:42,930 --> 00:10:44,630
So everything goes back to normal.

245
00:10:47,430 --> 00:10:49,290
At all times, we maintained a pivot

246
00:10:49,290 --> 00:10:50,850
of at least three AvediaPlayers

247
00:10:50,850 --> 00:10:53,190
before connecting to the AvediaServer.

248
00:10:53,190 --> 00:10:55,620
This way, the district would
not be able to trace us back

249
00:10:55,620 --> 00:10:57,420
even through the LanSchool computers

250
00:10:58,980 --> 00:11:01,200
without significant effort.

251
00:11:01,200 --> 00:11:03,810
And then our plan was to
slowly distribute the script

252
00:11:03,810 --> 00:11:06,150
from the AvediaServer to
all of the AvediaPlayers

253
00:11:06,150 --> 00:11:07,113
that we identified.

254
00:11:13,230 --> 00:11:15,870
In my research, I also
found a privilege escalation

255
00:11:15,870 --> 00:11:18,030
in AvediaPlayer and AvediaStream.

256
00:11:18,030 --> 00:11:20,030
Here's a show where I'm logging as root.

257
00:11:21,960 --> 00:11:22,793
The way that the exploit works

258
00:11:22,793 --> 00:11:25,389
is that you can export a backup
of the device configuration

259
00:11:25,389 --> 00:11:29,100
to an FTP server, which will
be the attacker machine.

260
00:11:29,100 --> 00:11:31,140
The backup also includes the shadow file,

261
00:11:31,140 --> 00:11:33,810
so you can just change the root
hash to something you know,

262
00:11:33,810 --> 00:11:35,910
import that backup back onto the device

263
00:11:35,910 --> 00:11:37,320
and then log as root VSSH.

264
00:11:38,844 --> 00:11:41,670
The AvediaServer had an even
easier privilege escalation,

265
00:11:41,670 --> 00:11:44,160
pseudo access was just given
to the system control binary,

266
00:11:44,160 --> 00:11:46,710
which is a classic get
the fuck out binary.

267
00:11:46,710 --> 00:11:48,300
So you can just create a service file

268
00:11:48,300 --> 00:11:50,430
that executes a command and says root

269
00:11:50,430 --> 00:11:51,930
and call system control on it.

270
00:11:54,046 --> 00:11:55,140
Those are the root hashes by the way

271
00:11:55,140 --> 00:11:57,293
in case anyone's interested
in cracking them.

272
00:11:58,590 --> 00:12:00,870
I haven't tried anything beyond
rocking that text at all,

273
00:12:00,870 --> 00:12:03,023
so don't shame me if
you do manage to get it.

274
00:12:05,280 --> 00:12:07,410
All right, it's go time now.

275
00:12:07,410 --> 00:12:08,550
We picked a date April 30th,

276
00:12:08,550 --> 00:12:11,000
because that was a Friday
before AP exam started.

277
00:12:12,000 --> 00:12:15,540
We've had plenty of times to
test and get things working,

278
00:12:15,540 --> 00:12:16,373
we're ready.

279
00:12:17,790 --> 00:12:20,090
But at the last minute
we found something new.

280
00:12:21,510 --> 00:12:24,390
First, let me introduce
to you the EPIC system.

281
00:12:24,390 --> 00:12:26,250
EPIC stands for Education Paging

282
00:12:26,250 --> 00:12:27,993
and Intercoms Communications.

283
00:12:28,835 --> 00:12:30,390
(audience laughing)

284
00:12:30,390 --> 00:12:32,063
- It's exactly what it sounds like.

285
00:12:33,570 --> 00:12:34,980
It consists of speakers,

286
00:12:34,980 --> 00:12:36,870
which can be installed on
the ceilings of hallways

287
00:12:36,870 --> 00:12:37,773
and classrooms.

288
00:12:38,738 --> 00:12:42,240
(audience applauding)

289
00:12:42,240 --> 00:12:44,820
- Similar to the IPDV system,

290
00:12:44,820 --> 00:12:46,560
these speakers also have a central server

291
00:12:46,560 --> 00:12:48,183
called the EPIC server.

292
00:12:49,200 --> 00:12:50,250
Here's an example of one of the projectors

293
00:12:50,250 --> 00:12:51,250
I mentioned earlier.

294
00:12:52,590 --> 00:12:55,040
You use the EPIC server
to control various alarms

295
00:12:56,430 --> 00:12:58,020
and you can create and
manage bell schedules

296
00:12:58,020 --> 00:13:00,520
for when class starts and
when class is dismissed.

297
00:13:01,770 --> 00:13:06,477
And more importantly, you can
upload custom audio for bells.

298
00:13:06,477 --> 00:13:10,727
(audience laughing and applauding)

299
00:13:14,100 --> 00:13:17,040
- So April 27th,

300
00:13:17,040 --> 00:13:19,620
it's exactly three days
before the big rick

301
00:13:19,620 --> 00:13:23,460
when we discovered the IP
ranges for the network speakers.

302
00:13:23,460 --> 00:13:25,230
The reason we didn't find
them in my freshman year

303
00:13:25,230 --> 00:13:28,530
is because the EPIC system was
installed in my junior year.

304
00:13:28,530 --> 00:13:29,970
This looks exciting for us.

305
00:13:29,970 --> 00:13:30,803
If we can get access

306
00:13:30,803 --> 00:13:33,810
then we can change the
bells use at rickroll.

307
00:13:33,810 --> 00:13:36,993
Unfortunately, the default
passwords don't work.

308
00:13:39,450 --> 00:13:43,050
Two days pass, it's 1:00 past
midnight on the April 29th.

309
00:13:43,050 --> 00:13:44,970
One of my partners, Shapes, is sad

310
00:13:44,970 --> 00:13:46,680
because he was the one trying to push us

311
00:13:46,680 --> 00:13:48,130
into getting the EPIC system.

312
00:13:49,650 --> 00:13:52,058
Five minutes later, he finds the password.

313
00:13:52,058 --> 00:13:55,380
(audience laughing)

314
00:13:55,380 --> 00:13:56,880
- So it turns out the district

315
00:13:56,880 --> 00:13:59,040
did change the default password

316
00:13:59,040 --> 00:14:02,194
but they used the example
password from the manual.

317
00:14:02,194 --> 00:14:06,444
(audience laughing and applauding)

318
00:14:12,457 --> 00:14:13,290
- When we checked the settings,

319
00:14:13,290 --> 00:14:15,930
we found the IP address of the
server that it was bound to

320
00:14:15,930 --> 00:14:18,930
which brought us to this
login page where we connected.

321
00:14:18,930 --> 00:14:21,720
We found out that this was a
login page for the EPIC server.

322
00:14:21,720 --> 00:14:23,790
So we quickly found a default
credential list in the manual,

323
00:14:23,790 --> 00:14:25,320
which weren't changed,

324
00:14:25,320 --> 00:14:27,750
and boom, we now have
control of the bell system

325
00:14:27,750 --> 00:14:29,133
for one of the schools.

326
00:14:30,180 --> 00:14:32,163
However, there's a slight problem.

327
00:14:33,060 --> 00:14:35,460
The EPIC system at the other schools

328
00:14:35,460 --> 00:14:37,260
had their default passwords changed.

329
00:14:38,370 --> 00:14:39,273
We can't log in,

330
00:14:41,820 --> 00:14:44,070
but all hope is not lost.

331
00:14:44,070 --> 00:14:46,080
In the settings, I found an SMB server

332
00:14:46,080 --> 00:14:47,820
that was configured for backups

333
00:14:47,820 --> 00:14:49,980
with the same default credentials.

334
00:14:49,980 --> 00:14:52,140
And then I thought one
of the backup servers

335
00:14:52,140 --> 00:14:55,023
for the other school still
have default credentials.

336
00:14:56,100 --> 00:14:57,574
I was right.

337
00:14:57,574 --> 00:14:58,620
(audience laughing)

338
00:14:58,620 --> 00:14:59,790
- Here are the extracted contents

339
00:14:59,790 --> 00:15:02,040
of one of the backup archives
for another EPIC server

340
00:15:02,040 --> 00:15:04,633
which we did not have initial access to.

341
00:15:04,633 --> 00:15:07,740
And in each archive is a SQL dump

342
00:15:07,740 --> 00:15:11,523
of the entire configuration,
including user entries.

343
00:15:13,380 --> 00:15:14,820
Now, most of these entries

344
00:15:14,820 --> 00:15:16,680
were just teacher accounts
connected to LDAP.

345
00:15:16,680 --> 00:15:18,540
So no password hashes there,

346
00:15:18,540 --> 00:15:22,170
but there are a few local
manufacturer created accounts

347
00:15:22,170 --> 00:15:24,720
which you can see in this top left corner.

348
00:15:24,720 --> 00:15:27,510
So it makes sense that we
would try to crack the password

349
00:15:27,510 --> 00:15:29,160
for one of these accounts, right?

350
00:15:30,240 --> 00:15:32,400
The problem is that the
hashes for these accounts

351
00:15:32,400 --> 00:15:34,320
were different across each school.

352
00:15:34,320 --> 00:15:36,923
And unfortunately, rocky
didn't work for any of them.

353
00:15:38,190 --> 00:15:40,620
However, I discovered something strange.

354
00:15:40,620 --> 00:15:43,920
It was a local account
with the username district.

355
00:15:43,920 --> 00:15:45,870
And what stood out was that this account

356
00:15:45,870 --> 00:15:47,433
is at the bottom of the table.

357
00:15:48,480 --> 00:15:50,250
It was also created in 2017,

358
00:15:50,250 --> 00:15:52,920
which matches the date of
the other local accounts,

359
00:15:52,920 --> 00:15:54,270
which means that this is an account

360
00:15:54,270 --> 00:15:55,650
created by the manufacturer

361
00:15:55,650 --> 00:15:57,350
not one installed by the district.

362
00:15:58,350 --> 00:16:01,440
I couldn't find any information
online about this account

363
00:16:01,440 --> 00:16:03,570
and it doesn't show up in the users list

364
00:16:03,570 --> 00:16:05,670
on the actual web interface.

365
00:16:05,670 --> 00:16:08,973
So I concluded it's a backdoor account.

366
00:16:10,320 --> 00:16:13,199
And even better, the
password was password.

367
00:16:13,199 --> 00:16:17,449
(audience laughing and applauding)

368
00:16:19,380 --> 00:16:21,630
- So now using the
backdoor control account

369
00:16:21,630 --> 00:16:23,490
we control the bell systems

370
00:16:23,490 --> 00:16:26,100
for all the schools in the district.

371
00:16:26,100 --> 00:16:28,750
And that's how we EPICLY
pawned all the EPIC servers.

372
00:16:29,820 --> 00:16:32,720
All done in less than a day
and a day before the big rick.

373
00:16:34,620 --> 00:16:37,710
And now we upload the
rickroll audio file as a bell.

374
00:16:37,710 --> 00:16:39,631
Can you guess which one is a rickroll?

375
00:16:39,631 --> 00:16:42,480
(audience murmuring indistinctly)

376
00:16:42,480 --> 00:16:43,350
- I'll give you a hint,

377
00:16:43,350 --> 00:16:47,310
one of the lowercase Ls in
musical scale is a capital I.

378
00:16:47,310 --> 00:16:49,343
Also, there's one that's
three minutes long.

379
00:16:51,180 --> 00:16:53,580
Then the final step is
to modify the schedule

380
00:16:53,580 --> 00:16:56,070
to replace the bell with
our newly added bell,

381
00:16:56,070 --> 00:16:56,973
and we're done.

382
00:17:00,090 --> 00:17:01,800
The final task is to set up our stream

383
00:17:01,800 --> 00:17:03,210
with the countdown timer here,

384
00:17:03,210 --> 00:17:05,360
and when it hits zero,
the rickroll begins.

385
00:17:09,425 --> 00:17:10,500
It was a massive success,

386
00:17:10,500 --> 00:17:14,310
and both the IPTV systems and
bell system rickrolls worked.

387
00:17:14,310 --> 00:17:16,823
Here's some gifs across the
district showing the result.

388
00:17:21,742 --> 00:17:24,909
(audience applauding)

389
00:17:35,518 --> 00:17:36,360
- This is one of my favorite ones.

390
00:17:36,360 --> 00:17:38,550
It's a student experiencing a
rickroll from a Zoom meeting

391
00:17:38,550 --> 00:17:40,833
and the teacher is showing it to them.

392
00:17:40,833 --> 00:17:43,833
(audience laughing)

393
00:17:49,620 --> 00:17:51,270
- And this is the final
message that's displayed

394
00:17:51,270 --> 00:17:52,740
when the rickroll was finished.

395
00:17:52,740 --> 00:17:54,750
I was very tame and
careful about the wording

396
00:17:54,750 --> 00:17:56,250
because I did not want to provoke teachers

397
00:17:56,250 --> 00:17:57,483
more than I already did.

398
00:17:59,799 --> 00:18:03,330
So you might be wondering
what happened afterwards.

399
00:18:03,330 --> 00:18:04,890
Well, we compiled all the things we did

400
00:18:04,890 --> 00:18:07,170
into a 26 penetration test report,

401
00:18:07,170 --> 00:18:08,730
26-page, sorry.

402
00:18:08,730 --> 00:18:10,800
And then we sent that to all
the technical supervisors

403
00:18:10,800 --> 00:18:13,020
in the district after
the rickrolls were done.

404
00:18:13,020 --> 00:18:14,920
And of course we did this anonymously.

405
00:18:17,040 --> 00:18:18,840
A few days later, we got a response.

406
00:18:19,830 --> 00:18:22,380
It was from the director of
technology for the district.

407
00:18:22,380 --> 00:18:24,570
And because of our
documentation in ethics,

408
00:18:24,570 --> 00:18:25,650
he said that the administration

409
00:18:25,650 --> 00:18:27,330
would not be pursuing discipline

410
00:18:27,330 --> 00:18:29,330
and actually asked us to hold a debrief.

411
00:18:30,194 --> 00:18:33,180
(audience laughing)

412
00:18:33,180 --> 00:18:35,940
- So you can imagine our reaction.

413
00:18:35,940 --> 00:18:38,160
It was a pretty big relief for all of us.

414
00:18:38,160 --> 00:18:40,290
I'm sure many of you have heard stories

415
00:18:40,290 --> 00:18:42,810
where students report
vulnerabilities to the school

416
00:18:42,810 --> 00:18:45,090
and it does not end well for them.

417
00:18:45,090 --> 00:18:46,350
So we were extremely fortunate

418
00:18:46,350 --> 00:18:48,210
that the district was standing with us,

419
00:18:48,210 --> 00:18:50,763
and in fact, listening to our advice.

420
00:18:52,590 --> 00:18:55,620
Here's the screenshot from
the debrief we had over Zoom.

421
00:18:55,620 --> 00:18:57,450
I was the only one who
revealed my full identity

422
00:18:57,450 --> 00:19:00,085
since my other peers thought
it was a sting operation.

423
00:19:00,085 --> 00:19:02,610
(audience laughing)

424
00:19:02,610 --> 00:19:05,700
- It clearly wasn't,
or we wouldn't be here.

425
00:19:05,700 --> 00:19:07,080
In our debrief presentation,

426
00:19:07,080 --> 00:19:09,150
we referenced each other as a color.

427
00:19:09,150 --> 00:19:11,190
So we thought it would be
funny to identify as crew mates

428
00:19:11,190 --> 00:19:13,486
from the hit game, "Among Us".

429
00:19:13,486 --> 00:19:15,420
(audience laughing)

430
00:19:15,420 --> 00:19:17,010
- Overall, the meeting went extremely well

431
00:19:17,010 --> 00:19:19,660
and we managed to resolve
the issues in the district.

432
00:19:21,600 --> 00:19:23,790
So lessons I learned from a big rick,

433
00:19:23,790 --> 00:19:25,080
always maintain a pivot,

434
00:19:25,080 --> 00:19:26,430
since doing that throughout district tech

435
00:19:26,430 --> 00:19:27,930
and they could not figure
out who did the big rick

436
00:19:27,930 --> 00:19:28,980
until I came forward.

437
00:19:30,092 --> 00:19:31,860
Check your scans carefully

438
00:19:31,860 --> 00:19:33,840
or you might miss a server
that controls all the speakers

439
00:19:33,840 --> 00:19:35,550
and waste two out of three days

440
00:19:35,550 --> 00:19:37,250
before the deadline for an attack.

441
00:19:38,730 --> 00:19:40,650
Try to keep things as tame as possible

442
00:19:40,650 --> 00:19:42,630
so you don't end up in too much trouble.

443
00:19:42,630 --> 00:19:44,220
I could have been a horrible person

444
00:19:44,220 --> 00:19:46,020
and displayed anything else

445
00:19:46,020 --> 00:19:48,120
that would've not been school appropriate.

446
00:19:49,017 --> 00:19:51,300
Document everything to protect yourself,

447
00:19:51,300 --> 00:19:53,280
at least if what you're doing is ethical.

448
00:19:53,280 --> 00:19:55,430
It really helped me in
this case, at least.

449
00:19:57,570 --> 00:19:59,880
I'd like to thank my accomplices,
Shapes, Jimmy and Green

450
00:19:59,880 --> 00:20:01,050
because I wouldn't have
been able to do this

451
00:20:01,050 --> 00:20:02,013
without you guys.

452
00:20:03,180 --> 00:20:04,590
I also wanna give a
shout out to Mr. Drenth

453
00:20:04,590 --> 00:20:06,723
for being the best IT teacher ever.

454
00:20:07,769 --> 00:20:09,510
I'd also like to thank SIGpwny and friends

455
00:20:09,510 --> 00:20:12,051
for encouraging and helping
me prepare for this talk.

456
00:20:12,051 --> 00:20:16,301
(audience cheering and applauding)

457
00:20:21,450 --> 00:20:23,220
- And finally, I wanna
thank my school district

458
00:20:23,220 --> 00:20:25,562
for letting me graduate
and not pressing charges.

459
00:20:25,562 --> 00:20:28,729
(audience applauding)

460
00:20:32,028 --> 00:20:32,861
- Here's my website,

461
00:20:32,861 --> 00:20:34,110
follow me on Twitter,

462
00:20:34,110 --> 00:20:36,284
and thank you for coming to my talk.

463
00:20:36,284 --> 00:20:40,534
(audience cheering and applauding)