but we have a fun talk this afternoon i don't know about you all but i love a good rickroll
and our next speaker rickrolled his entire high school which is pretty awesome so please welcome
min dung for his first time up here defcon speaking telling us about how he rickrolled
his whole high school hi everyone thanks for coming to my talk my name is min i'm 19 years
old and i'm starting my second year as an undergraduate at the university of illinois
at urbana-champaign next week this is my first time at defcon and my second time ever attending
a security conference so it's extremely humbling to be up here on stage as a noob
before you proceed first on disclaimers if you came to this talk expecting anything
uttered in a scripted story then you didn't read the abstract carefully
this presentation is for educational purposes only
i do not condone hijacking and rickrolling other high schools
also please don't hack my own high school district they are very cool people and they don't deserve
that so let's start from the beginning here's a picture of my high school which has about
2 000 students and is part of a larger school district in suburban chicago which has six high
schools in total my school offered some ic classes they essentially had a career pathway that you can
follow from freshmen to high school students and i'm going to talk about that in a little bit
senior year obviously i was running into computers so of course i signed up in my freshman year
those classes were held in this room it's pretty amazing it's where i developed my
cyber security skills thanks to my awesome teacher mr drenth he's got a computer lab
and has shelves full of computer parts cables monitors switches everything a high school
hacker could ever dream of now one of the coolest things about this room was this closet
inside this closet were two desktop pcs that were each running windows 7.
i inherited this space from the upperclassmen and it was here that i really started developing
my script kitty face i never owned my own computer before so this was the next best
thing since i basically had both these computers to myself and like any hacker wannabe i started
running scans against my school network i was quite ambitious and decided to scan the entire 10
dot subnet
i had some help from my upperclassmen friends and we took turns running angry ip scanner
and we had to split the scans into parts because if we tried to open one big scan it would crash
notepad we learned quite a bit from the scans the first being that our school district has its
own metropolitan area network so all the high schools are connected to the same network and
each have their own subnets we also found a ton of different things printers voice over ip phones
switches
one of the coolest things we found was the security cameras
the top left is me when i first found them and the bottom right is my friend giving me the middle
finger after i showed him
now one of the most important things we found in the network that forms the basis for this entire
talk is the iptv system the system is manufactured by xterity and consists of three main products
the first is the video player
the second is the video player which is a device that is attached to projectors
they send serial commands to the projector to control its current state and also what content is displayed
here is the web interface for the video player you can change the input source and volume and you can also change the current channel to a specific rtp or udp stream
next up is the video stream which is attached to the device that displays video output
the encoder then takes that video output and broadcasts it as a network stream which
receivers can connect to and display here is an example of the carousel live stream that for my
high school which is displayed on all the hallway tvs the stream is broadcasted by the encoder to
the video players it's just a slideshow showing special events to time weather etc but it was also
used to show morning announcements and finally we have the evadia server which provides an easy
to use interface to manage all the devices at once
here is the projector control from the vd server where we can drag and drop receivers onto the
control buttons at the top like power on and hdmi now each of the six goals has its own evadia server
which controls the exterior devices in a respective subnet and in this case i'm viewing
the projectors for my specific high school so that was pretty much the bulk of my freshman year
i was just scanning the district network finding random devices to screw around with and figuring
out how things worked so i'm going to show you a few examples of projectors that i've used in my
all right we're going to skip a few years to my senior year and the time skip is because
nothing notable happened in my sophomore year and my junior year is when the coven 19 pandemic hit
and the first semester of my senior year was hybrid learning so not much happened then either
then the district decided in march of my senior year that everyone would
be required to come back in person in april it's at this point that i remember oh hey
i still have access to all those devices from freshman year
and i should probably tell the district about it and then i think oh hey i need to do senior prank
and finally i conclude oh hey i should recall my high school district
so i asked for a few friends for help
so i asked a few friends for help and we officially began working on operation big rick
one of the first things we needed to do was establish access to the district network from home
now i already had a working solution for this because i installed chrome rdp
on every pc in the classroom that i mentioned earlier
on the screen right now is a list of all those pcs um they're grayed out because they reformat
the machines every year so i can't access them anymore now while we did have network access
through those pcs it's not going to be very hard for district tech to pinpoint me if any scan or
exploitation traffic is coming from those machines so we need a way to pivot to different
machines that are not associated with us so we don't get found out so now i will introduce
lan school who here knows what the land school is
okay not a lot for those who don't know land school is a program that
gives teacher control over devices in their classroom there are two applications
one is lan school student which is installed as a background process on old school internet services
the student devices.
And the other application is Lanscale Teacher, which a teacher uses on their computer to
control all the student devices.
So what can you do with Lanscale Teacher?
You can freeze a student computer to make it unusable.
This is the one every student hates.
You can remotely view and control a student.
You can upload arbitrary files.
You can execute arbitrary files.
And you can view keystroke history, which I think is absolutely insane because it opens
up a massive door for abuse.
Imagine what would happen if a threat actor got access to all this control.
Turns out it's pretty easy to obtain a copy of Lanscale Teacher if you know where to look.
And if you're an IT guy provisioning hundreds of student computers, well, you're not exactly
going to prioritize adding passwords to the classrooms.
And here I'm viewing a student's keystroke history.
It looks like they're doing some 3D modeling based on their search history.
Now, it also turns out Lanscale Student was not only installed on the student computers,
but also on some staff computers as well.
Here's a desktop of one of the security guards.
So using our district network application, we can see that the student has a keystroke history.
And if we were to scan the keystroke history to the system, we can see that the user access
and Lanscale Teacher were able to pivot to a different high school.
So that way, when we'd run our scans from there, the district wouldn't be able to track
us.
I now had a better knowledge of what to scan for, so we found a few new things.
It turns out all exterior devices run SSH.
And they let you open a shell, like direct user access to the system.
This makes things way easier, though.
Because instead of sending a bunch of web requests to control each of the receivers,
we can create a payload that runs the serial commands locally on the device.
Now this payload is really just a bash script that makes requests to the web interface locally.
But it's pretty simple, and it boils down to this logic.
The first thing we do is set the receiver to play the RICL stream.
So it's at address 20, 25, 25, 25, 25, 5,000.
The next thing we do is set the input to HDMI, since this is the input where the video
stream is playing.
Then we disable infrared capabilities.
This way, the teacher cannot use the remote to turn off the receiver.
Although they still can technically power off the projector off manually by pressing
the power button.
But we'll get on to how to fix that later.
And the final step in our initial process is to actually turn it on.
Then we enter the first loop for three minutes.
It's during this loop that the countdown is displayed, not the actual RICL yet.
The loop basically sets the volume to the max, and then it sends a power on command
every ten seconds.
And this fixes the issue I mentioned earlier, where the teacher could just manually turn
off the projector, but that doesn't work because it just turns on again.
.
.
7th. It's exactly three days before the big RIC, when we discovered the IP ranges for
network speakers. The reason we didn't find them in my freshman year is because the Epic
system was installed in my junior year. This looks exciting for us. If we can get access
then we can change the bells to use the RIC role. Unfortunately, the default passwords
don't work. Two days pass, it's one past midnight on April 29th. One of my partner's shapes
is sad, because he was the one trying to push us into getting the Epic system. Five minutes
later he finds the password.
So, it turns out the district did change the default password, but, they'd use the example
password from the manual.
When we check the settings, we found the IP address
central. That's an authentic password only an IP address can provide, if you want to
of the server that it was bound to, which brought us to this login page when we connected.
We found out that this was the login page for the Epic server, so we quickly found the
default credentials in the manual, which weren't changed, and boom, we now have control of
the bell system for one of the schools.
However, there's a slight problem.
The Epic system at the other schools had their default passwords changed.
We can't log in.
But all hope is not lost.
In the settings, I found an SMB server was configured for backups with the same default
credentials.
And then I thought, what if the backup servers for the other school still have default credentials?
I was right.
Here are the extracted contents of one of the backup archives for another Epic server
which we did not have initial access to.
And in each archive is a SQL dump of the entire configuration.
Let me show you.
including user entries.
Now, most of these entries were just teacher accounts
connected to LDAP, so no password hashes there.
But, there are a few local manufacturer created accounts,
which you can see in the top left corner.
So, it makes sense that I would try to crack the password
for one of these accounts, right?
The problem is that the hashes for these accounts
were different across each school.
And unfortunately, Rocky didn't work for any of them.
However, I discovered something strange.
It was a local account with the username district.
And what stood out was that this account
is at the bottom of the table.
It was also created in 2017, which matches the date
of the other local accounts, which means that this
is an account created by the manufacturer,
not one installed by the district.
I couldn't find any information online about this account,
and it doesn't show up in the users list
on the actual web interface.
So, I concluded, it's a backdoor account.
And even better, the password was password.
So now, using the backdoor control account,
we control the bell systems for all the schools
in the district.
And that's how we epically pwned all the epic servers.
All done in less than a day, and a day before the Big Rick.
So, this is what happened.
And now, we upload the Rickroll audio file as a bell.
Can you guess which one is a Rickroll?
I'll give you a hint.
One of the lowercase Ls in musical scale is a capital I.
Also, it's the one that's three minutes long.
Then, the final step is to modify the schedule
to replace the bell with our newly added bell,
and we're done.
The final task is to set up our stream
with a countdown timer here, and when it hits zero,
the Rickroll begins.
It was a massive success, and both the IPTV systems
and bell system Rickrolls worked.
Here are some GIFs across the district showing the result.
This is one of my favorite ones.
It's a student experiencing the Rickroll from their Zoom meeting,
and the teacher is showing it to them.
And this is the final message that has to play
when the Rickroll is finished.
I was very tame and careful about the wording,
because I did not want to provoke teachers
more than I already did.
So, you might be wondering what happened afterwards.
Well, we compiled the Rickroll file, and we're done.
We compiled all the things we did into a 26 penetration test report.
26 page, sorry.
And then we sent that to all the technical supervisors
in the district after the Rickrolls were done.
And, of course, we did this anonymously.
A few days later, we got a response.
It was from the director of technology for the district.
And because of our documentation and ethics,
he said that the administration would not be pursuing discipline
and actually asked us to hold a debrief.
So, you can imagine our reaction.
It was a pretty big relief for all of us.
I'm sure many of you have heard stories
where students report vulnerabilities to their school,
and it does not end well for them.
So, we were extremely fortunate that the district
was studying with us and, in fact, listening to our advice.
Here's a screenshot from the debrief we had over Zoom.
I was the only one who revealed my full identity,
since my other peers thought it was a stigma.
It was a disgusting operation.
It clearly wasn't or I wouldn't be here.
In our debrief presentation,
we referenced each other as a caller.
So, we thought it would be funny to identify as crewmates
from the hit game Among Us.
Overall, the meeting went and streaming well,
and we managed to resolve the issues in the district.
So, lessons I learned from the Big Rick.
Always maintain a pivot,
since doing that threw off district tech
and they could not figure out who did the Big Rick
Check your scans carefully,
or you might miss a server that controls all the speakers
and waste two out of three days
before the deadline for an attack.
Try to keep things as tame as possible
so you don't end up in too much trouble.
I could have been a horrible person
and displayed anything else
that would have not been school appropriate.
Document everything to protect yourself,
at least if what you're doing is ethical.
It really helped me in this case at least.
I'd like to thank my accomplices,
Shapes, Jimmy, and Green,
because I wouldn't have been able to do this without you guys.
I also want to give a shout out to Mr. Drenth
for being the best IT teacher ever.
I'd also like to thank Sigpony and friends
for encouraging and helping me prepare for this talk.
And finally, I want to thank my school district
for letting me graduate and not pressing charges.
Here's my website.
Follow me on Twitter.
And thank you for coming to my talk.