SlideShare a Scribd company logo

Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests

�
📡 Sebastien Dudek

The document discusses the use of radio attacks in security testing, focusing on pentests and red team operations. It covers various attack methods including Wi-Fi, mobile devices, and RFID, emphasizing the importance of preparing intrusions with mapping and understanding security protocols. Key tools and techniques are highlighted, along with practical insights from experiences in France and broader Europe.

Technology
Related topics:
Information Security
1 of 82
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
PentHertz The use of radio attacks in red team and pentests By Sébastien Dudek Security PWNing November 19th 2018
About me Sébastien Dudek (@FlUxIuS) Working at Synacktiv: pentests, red team, audits, vuln researches Likes radio and hardware And to confront theory vs. practice First time doing a presentation in Poland...
Dzisiejsze wyzwanie Prezentować w języku polskim...
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
3 Introduction Companies regularly perform security tests Mostly pentests or audits Red Team become more and more popular Last year: “Red teaming w Polsce” Borys Łącki (external tests, physical intrusions, etc.) This year: we will talk about our experience in France (and few others in UE) and the use of radio attacks
4 Red Team Each company use its own style Also its own tools: Houdini: implant we plug and use remotely + bypass 802.1x Oursin: spear-phishing attack Kraqozorus: brute-forcing plateform (distributed, supports lots of algorithms and rules) More of it in our website For physical intrusions: be natural, smile and say “hello” and “thank you” Authorizations give the opportunity: Try new techniques, perform and improve intrusion skills Test every possible scenarios → client can have a better overview of employes reactions in particular cases
5 Can’t raise alerts Anti-viruses and anti-intrusion plateforms: make spear-phishing harder Fence, doors, locks: you can bypass by letting someone go first Turnstiles (bramki obrotowe): need to bypass them with style You can make also fake authorizations But in some cases you do not want to leave traces Use of radio attacks: helpful and could be a real change → with sexy scenarios
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
6 Physical intrusion preparation Map the place first with tools like Google Street Complet the mapping: physical discovery + general schedule (in/out for lunch for example) + an idea of physical anti-intrusion systems But look also Wi-Fi hotspots and other devices!
7 Mapping Wi-Fi hotspots Use of omnidirectional antennas Software: Kismet (optimized for mapping) and/or airodump-ng (slower but gives more informations in PCAPs) Optionally: use a GPS or A(ssisted) GPS to trace a map Caution Do not forget 2.4 GHz and 5 GHz frequencies! ;)
8 AWUS036ACH device Supports both 2.4 and 5 GHz frequencies Runs perfectly with aircrack-ng suite tools Practical Mltiple devices are needed to make complet captures in a short time
9 Cool tools for mapping: Wi-Fi Pineapples Embedded Wi-Fi attack devices (“based” on OpenWRT) Scanned hotspots can be stored in a MicroSD card Could be combined with a mobile battery Sufficient for mapping, fake-APs, and bridges/extensions
9 Cool tools for mapping: Wi-Fi Pineapples Embedded Wi-Fi attack devices (“based” on OpenWRT) Scanned hotspots can be stored in a MicroSD card Could be combined with a mobile battery Sufficient for mapping, fake-APs, and bridges/extensions But... Actually 400MHz-533MHz MIPS CPU: don’t use it for injections → very slow
10 Alternatives Raspberry Pi 3 Some others on steroids: Tinker Board Odroid-XU4 NanoPC-T4 (my prefered one) And others Rockchip MCU based devices...
11 Nexmon Held in a smartphone (mostly Nexus phones) Patch for Wi-Fi Broadcom/Cypress firmwares → add monitoring and injection features Support more than 15 models Can be quickly installed in a rooted Android phone: de.tu_darmstadt.seemoo. nexmon
12 Optimizing transmission Transceiver power adapted to distance and the target Avoid gain losses (adapters, and other extension) Avoid obstacles An adapted antenna is mandatory
13 Antennas Are their own characteristics (frequency use, polarization, directivity, type, and so on). Many types exist: Omnidirectional (λ/2, λ/4...) Directional (e.g Yagi) Parabolic... Parabolic and Directional: great to manage long distances But sometimes this is not sufficient...
14 Amplifiers Allow to leverage Tx/Rx power
14 Amplifiers Allow to leverage Tx/Rx power But... Amplificators should be used with caution
15 Amplifiers impacts Noise is also amplified: Need processing at least some filtering
16 Remember: useful settings in Wi-Fi Transmission power: # iwconfig wlan0 txpower 27 / / 500 m i l l i W a t t s Changing region to bypass regulation limitations: # iw reg set <other region >
17 Identify connected devices: spectral analysis With Gnuradio and a Software-Defined Radio device:
18 Spectral analysis Useful to observe spectral occupations around the target → discover Could be performed with the GQRX software and a Software-Radio Device But also a nice gadget: RF Explorer Captures: discover central frequency, bandwidth, modulation, and so on. Mostly performed during audit tests, rarely in Red team tests
19 Choose your SDR device Depends on few characteristics: Clock precision is also important → could be optimized with an external GPSDO
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
20 Identifying hotspots Generally: ESSID are related to targeted company name SSID: match with found ESSID → spot other AP with != names → maybe w/ a weaker security protocol Hidden ESSID can be spotted: 1 Listen for probe requests 2 Enumerate ESSID of probes 3 Try to connect to a hidden APs refering to captured ESSID in probes Clients: connect to a hidden ESSID during the listening process → efficient with a lot of clients on targeted APs We can also disconnect clients to identify ESSID (a bit intrusive)
21 Current security protocols Wired Equivalent Privacy (WEP): rarely found, but still exist in industrial (found in 2015 and 2016 during tests) Wi-Fi Protected Access (WPA) and WPA2: often in medium-sized company or industrial Wi-Fi Protected Access-Enterprise: found in big compagnies But Guest network could be also interesting!
22 Attacking guest portals We are used to omit Guest Wi-Fi network: “Yeah they are isolated blablaBla!” But they use tons of wonderful technologies: PHP Java and so on. What could go wrong if we get a RCE on these portals?
23 Case of CISCO ISE CISCO ISE use Struts CVE-2017-5638 rings a bell? OGNL injection in header → RCE An another one... CVE-2018-11776 Many equipments remain unpatched
24 Feedbacks We encountered few companies with a vulnerable CISCO ISE: 1 Use a public exploit for CVE-2017-5638: $ . / struts−pwn . py −u ’ https : / / < target >:8443/ p o r t a l / PortalSetup . action ? p o r t a l =a [ . . . ] & sessionId=0a77 [ . . ] & action=cwa ’ −c ’ id −a ’ [ * ] URL: https : / / < target >:8443/ p o r t a l / PortalSetup . action ? p o r t a l =a148 [ . . . ] & sessionId = 0 [ . . ] & action=cwa uid =300( iseadminportal ) gid =300( ise ) groups=300( ise ) ,110( gadmin ) , 200( o i n s t a l l ) ,301( iseadmin ) ,303( i s e i n f r a ) ,304( isemt ) [%] Done . 2 The router was also connected to the corporate network → perfect place to find vulnerable servers and computers → leverage accesses to dump Active Directory → All of that in almost 1 day remotely
25 WEP: our brief feedback Considered as broken aircrack-ng implements a lot of attacks WEP is rare nowadays (Dr. Obvious) But still found in isolated cases: employes extending or adapting the connection with devices not supporting WPA2 and/or WPA Entreprise Clients are also rare in those cases: we mostly perform Interactive Frame Selection attacks with aircrack-ng
26 WPA2: capturing handshake By disconnecting a client This handshake is then submited to our plateform Kraqozorus
27 WPA2: feedbacks Even with a distributed plateform: the time is too just to crack hard passphrases We use different techniques to connect to the targeted network: Use social engineering tricks just by asking the passphrase (a little YOLO but works when playing the “new/lost guy” card) Recover the key in an exposed intranet, that is isolated in a DMZ → mixing external pentest and wireless is more efficient → allows to have a foot in intern without having to fight with DMZ
28 WPA2 Entreprise Most seen in big companies: PEAP with MS-CHAP auth, sometimes EAP-TLS EAP-TLS: secure! PEAP: Normally impossible to break with mutual authentication But all clients do not use the mutual authentication Moreover credentials are related to Active Directory (MS-CHAP auth) → give us a first access to browse shares, find vulnerable services, and so on. We used to be domain admins in only 1 day, few times, mainly thanks to unsecure Wi-Fi clients
28 WPA2 Entreprise Most seen in big companies: PEAP with MS-CHAP auth, sometimes EAP-TLS EAP-TLS: secure! PEAP: Normally impossible to break with mutual authentication But all clients do not use the mutual authentication Moreover credentials are related to Active Directory (MS-CHAP auth) → give us a first access to browse shares, find vulnerable services, and so on. We used to be domain admins in only 1 day, few times, mainly thanks to unsecure Wi-Fi clients Client attacks We are attacking Wi-Fi clients here → very difficult to perform at great distance with a directional antenna =/
29 Attacking WPA2 Entreprise 1 Run a rogue AP: hostpad-wpe (tip: put it in a docker container) 2 Trap client that do not check certificate 3 Capture the challenge in john NETNTLM format: # cat / usr / l o c a l / var / log / radius / freeradius−server−wpe . log [ . . . ] mschap : [ . . . ] username : synacktiv challenge : 8d :23: ca : a3 :2 f : da :4e:8d response : 19:53:90: f2 :23:18:21:20:9 f : bc :90:8 e : bc : ab :1 c :04:1 f :4b:2a : [ . . . ] john NETNTLM: synacktiv : $NETNTLM$8d23caa32fda4e8d$19539 [ . . . ] 4 Crack the challenge with john: # OMP_NUM_THREADS=12 . / run / john −−w o r d l i s t =<wordlist > −−rules=<règles > <hashfile >
30 Attacking WPA2 Entreprise 1 Run a rogue AP: hostpad-wpe (tip: put it in a docker container) 2 Trap client that do not check certificate 3 Capture the challenge in john NETNTLM format: # cat / usr / l o c a l / var / log / radius / freeradius−server−wpe . log [ . . . ] mschap : [ . . . ] username : synacktiv challenge : 8d :23: ca : a3 :2 f : da :4e:8d response : 19:53:90: f2 :23:18:21:20:9 f : bc :90:8 e : bc : ab :1 c :04:1 f :4b:2a : [ . . . ] john NETNTLM: synacktiv : $NETNTLM$8d23caa32fda4e8d$19539 [ . . . ] 4 Crack the challenge with john: # OMP_NUM_THREADS=12 . / run / john −−w o r d l i s t =<wordlist > −−rules=<règles > <hashfile >
31 EAP-GTC downgrade EAP-GTC : EAP Generic Token Card Used in old smartphones (Android 5.0 and some iPhones) Consist of asking for an OTP and respond with PW_EAP_MSCHAPV2_SUCCESS → get a clear-text passphrase Tool that implement the attack: lootbooty (patch PuNk1n.patch for freeradius) Presented at DEF CON 21 par Josh Hoover Rarely encountered (@wishbone1138) and James Snodgrass in 2013
32 Direct Wi-Fi networks Before: We’ve been used to see it for isolated printer networks Broadcast a “DIRECT-*” ESSID Mostly open or protected with a default WPA2 password (that could be found in firmwares) During our tests we have been surprised to see a mirror cast gateway directly connected to the corporate network (#FACEPALM)
33 FQN leaked in captures Captured with airodump-ng: Connecting to this ESSID → bring us to the targeted corporate network
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
34 Contexts Connected devices are expending and use: Zigbee, Wi-Fi, LoRa, Sigfox but also the Mobile network Different kinds: delivery pick-up station (stacje odbioru) connected cars alarms intercoms (awiofon)...
35 Intercoms Connected intercoms are widely deployed in building In previous conferences we showed: Downgrade attacks from 3G to 2G Intercept these devices and command them Command them by attacking the remote web interface Open the doors by commanding them All these attacks could be applied on other devices too...
36 Set-up to attacks mobile devices Basic setup for almost 500€: 1 BladeRF, 2 adapted antennas, and a BTS software like YateBTS
37 Interception today: Security Mechanisms
38 Attracting 3G/4G devices Use a cheap 2G/3G/4G jammer and rework it Or perform smart-jamming: 1 Monitor and collect cells data 2 Jam precise frequencies from collected cells → choose few target operators
39 Monitoring 2G/3G/4G cells Using Modmobmap: $ sudo python modmobmap. py −m servicemode −s <Android SDK path > => Requesting a l i s t of MCC/MNC. Please wait , i t may take a while . . . [ + ] New c e l l detected [ CellID / PCI−DL_freq (XXXXXXXXX) ] Network type=2G PLMN=208−20 ARFCN=1014 Found 3 operator ( s ) {u ’20810 ’: u ’ F SFR’ , u ’20820 ’: u ’ F−Bouygues Telecom ’ , u ’20801 ’: u ’ Orange F ’ } [ + ] Unregistered from current PLMN => Changing MCC/MNC f o r : 20810 [ + ] New c e l l detected [ CellID / PCI−DL_freq (XXXXXXXXXX) ] Network type=2G PLMN=208−20 ARFCN=76 [ . . . ] [ + ] New c e l l detected [ CellID / PCI−DL_freq (XXXXXXXXXX) ] Network type=3G PLMN=208−1 Band=8 Downlink UARFCN=3011 Uplink UARFCN=2786 [ . . . ] [ + ] Cells save as cells_1536076848 . json # with an CTRL+C i n t e r r u p t
40 Jamming with Modmobjam We can then trap the device and command it!
41 Remember its M2M architecture ”Hidden” endpoints could be interesting to study, isn’it?
42 Communications with remote servers Could be performed by activating the GPRS in YateBTS or OpenBTS, or OsmoTRX, ... Somethimes encrypted: the key and algorithms can extracted from device The key could be the same for all distributed devices Devices often identify != authentify themselves to servers Security by obscurity thing: servers and devices often trust each other → what could go wrong?
43 Interesting case: connected cars Mobile network is generally used Board computer contain many applications Update the board computer GPRS is generally used for middle class cars → really easy to intercept
44 Our target As a connected board computer Allows installation of new applications Can be update Plenty of available applications: Twitter application and Facebook (?share your speed excesses?) Meteo GPS etc. And all of that ”in the air”
45 Client-side attack: new captures Surprise: all requests made by the board computer and apps are in clear HTTP...
46 Client-side attack: sweets
47 Opportunities Remember the Android version is 4.0.4: Some apps perform web requests → JavaScript Interface RCE Other request XML files → XXE attacks And all other CVE to replay!
48 Spotted API Looks like API calls in mobile apps!
49 Interception in a parking station Good Faraday cages: > 10 board computers collected in the fake base station during our tests
50 Further readings Our blog post on “Hunting mobile endpoints” More stuff could be found on other systems... Other case: The ComboBox in BMW https://www.heise.de/ct/artikel/Beemer-Open-Thyself- Security-vulnerabilities-in-BMW-s-ConnectedDrive- 2540957.html
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
51 Common types Low frequencies : 125 kHz HID EM41x High frequencies : 13.56 MHz MIFARE Classic → cards replaced by MIFARE Plus MIFARE Ultralight (standard, C et EV1) MIFARE DESFire
52 Prefered tool: Proxmark3 Almost 300€ → it’s an investement Supports LF and HF freq Modular and allow to add support for unknown cards Active support: Iceman1001’s github RDV4 is very small and is able to perfom standalone emulation+cloning RDV4 has a long range antenna
53 Proxmark3 HF medium range antenna Able to read a card separated from 6.51cm book contraint! Default and long range antenna are also very impressive.
54 LF: Looking for UID Are less common nowadays: found in administrative, schools and post offices Proxmark3 software is very complet Common tags are recognized with a simple command: proxmark3> l f search EM410x pattern found : EM TAG ID : 060081DAC2 [ . . . . ] Tip: Card’s decimal number is often written on the card
55 MIFARE Classic Vulnerable to offline and online attack: use of vulnerable CRYPTO1 Public card only attacks: Nested attack: need to know at least 1 key Darkside attack: if no known key Online attacks: Captures → Bruteforce de nounce (https://github.com/J-Run/mf_nonce_brute)
56 MIFARE Plus and Classic EV1 Fix PRNG against Darkside and Nested attacks MIFARE Plus are compatible with MIFARE Classic But are vulnerable to an attacked derived from nested attack
57 Hardnested attack: VIGIK card case Requires at least one known key, for that case we give key from block 0 sector 0: > hf mf hardnested 0 A 484558414354 0 B [ . . . ] 15 | 1333 | Brute force phase completed . Key found : a22ae129c013
58 No known key: go online attack! Process: 1 Use the “snoop” feature from proxmark to collect exchanged data 2 Retrieve from a capture uid, nt encrypted, nt parity err, nr encrypted, ar encrypted, ar parity err, at encrypted, and at parity err 3 Make sure you collected all required data 4 Crack the key using mf_nonce_brute tool → you will get 4 Bytes of the key 5 The rest of the key could be bruteforced with Proxmark3.
59 MIFARE Ultralight Mostly encountered in hotels and public transports (e.g Amsterdam tram) 3 common types: MIFARE Ultralight Everyone can write and read OPT locks exist to prevent from writing MIFARE Ultralight EV1 Everyone can write and read Unless a password is configured The password is sent in clear-text ↔reader (hmm...) MIFARE Ultralight C Everyone can write and read Unless the authentification feature is set We can still try to bruteforce default/leaked/weak keys
60 MIFARE DESFire Exists in V06 (obsolete), EV1 (very common) and EV2 Program applications Access management for each application → like smartcards No known attack except “crazy” sidechannels attacks But we could try to bruteforce weak keys or have a lot of chance
61 Frequent MIFARE DESFire mistakes Installators are sometimes lost and forget to configure at least one application: What could go wrong?
62 MIFARE DESFire: identification only WTF?! The reader only requires a valid UID: And this is a common mistake...
63 LF with obscure cryptography Best example Nedap XS: magically encrypted and highly secure on the paper But in practice: only the UID is encrypted Okey it uses ASK modulation, Biphase coding phase, and 120KHz/125KHz frequency pm3 −−> l f nedap read [ . . . ] NEDAP ID Found − Card : 2788 − Raw: ffbd62003a5f45f5c **************** BIN : …1111111110111101011000100000000000111010010111110100010111110101******* Once read → could be copied in a configured T55xx blanc card. Credz: http://www.proxmark.org/forum/viewtopic.php?id=3332
64 RFID: go further Proxmark3 wiki and forum → very active community Christian Herrmann’s Proxmark3 fork: https://github.com/iceman1001/proxmark3 “A 2018 practical guide to hacking NFC/RFID” by Sławomir Jasek → Regroups a lot nice tips and tricks! + his findings on few hotel keys
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
65 Cheap remotes Found in hold and particular parking, but also alarms... Tool that makes coffee for that: Universal Radio Hacker (URH) → (handle FSK, OOK/AM, PSK and different decodings) Budget for Tx/Rx: HackRF for 300€
66 Secured remotes: attacks upgrades Signal relay/proxy/tunneling Amplification attack Credits: seen via Denis Laskov twitter
67 Connected locks Use Bluetooth Blue-Energy Could be opened with a smartphone Cheapest allows open command replay Expensive ones encrypts keys Use a sort of rolling code (e.g like cars’ remotes) Not found yet in Red Team tests → but might come with time :)
68 Generic attack on locks: “RollJam” Implemented for GATTACKER: https://github.com/FlUxIuS/gat- tacker/tree/master/hookFunctions
69 BLE: go further Cool tools: Btlejuice by Damien Cauquil: The BurpSuite tool for BLE GATTACKER by Sławomir Jasek: very good for direct interception + scripting for packet manipulation Ressources: “Bluetooth low energy attacks” talks of Damien Cauquil “Blue picking” talks by Sławomir Jasek → I highly recommend his training!
1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
70 Conclusion All these techniques are common in Red Team and pentests But this is just a small part of what could be found in radio → protocol stacks are very interesting to look at, but more complex Softwares are more complex to exploit → lot of mitigations → but hardware and radio communications can hide a lot of surprises Current/public tools work in a lab but are not portable enough → encourage us to repackage/readapt them for practical attacks PentHertz project: If you like offensive radio → lets talk! ;)
THANK YOU FOR YOUR ATTENTION, ANY QUESTIONS?

More Related Content

PDF
Ceh v8 labs module 15 hacking wireless networks
Mehrdad Jingoism
 
PDF
IoT security is a nightmare. But what is the real risk?
Zoltan Balazs
 
PDF
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...
Zoltan Balazs
 
PPT
Network Security
DURYODHAN MAHAPATRA
 
PDF
The New Landscape of Airborne Cyberattacks
Priyanka Aash
 
PPT
Network Security fundamentals
Tariq kanher
 
PPTX
Where Are All The ICS Attacks?
EnergySec
 
PPT
Network security
-jyothish kumar sirigidi
 
Ceh v8 labs module 15 hacking wireless networks
Mehrdad Jingoism
 
IoT security is a nightmare. But what is the real risk?
Zoltan Balazs
 
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...
Zoltan Balazs
 
Network Security
DURYODHAN MAHAPATRA
 
The New Landscape of Airborne Cyberattacks
Priyanka Aash
 
Network Security fundamentals
Tariq kanher
 
Where Are All The ICS Attacks?
EnergySec
 
Network security
-jyothish kumar sirigidi
 

What's hot (20)

PDF
Shameful secrets of proprietary network protocols
Slawomir Jasek
 
PPTX
Ángel Palomo Cisneros - Programming and playing a MITM attack [rooted2018]
RootedCON
 
PPT
Anton Chuvakin on Honeypots
Anton Chuvakin
 
PDF
How Automated Vulnerability Analysis Discovered Hundreds of Android 0-days
Priyanka Aash
 
PDF
Wireless security
Aurobindo Nayak
 
PDF
Parrot Drones Hijacking
Priyanka Aash
 
PPT
Skyjacking A Cisco Wlan Attack Analysis And Countermeasures
AirTight Networks
 
PDF
Ceh v8 labs module 08 sniffers
Mehrdad Jingoism
 
PDF
Order vs. Mad Science: Analyzing Black Hat Swarm Intelligence
Priyanka Aash
 
PDF
Database Firewall with Snort
Narudom Roongsiriwong, CISSP
 
PPT
Wireless security testing with attack by Keiichi Horiai - CODE BLUE 2015
CODE BLUE
 
PPTX
Detecting Threats: A Look at the Verizon DBIR and StealthWatch
Lancope, Inc.
 
PPTX
Критически опасные уязвимости в популярных 3G- и 4G-модемах или как построить...
Positive Hack Days
 
PPTX
G3t R00t at IUT
Nahidul Kibria
 
PDF
Exfiltrating Data through IoT
Priyanka Aash
 
PPTX
How Hack WiFi through Aircrack-ng in Kali Linux Cyber Security
Ahmad Yar
 
PPTX
AF-23- IPv6 Security_Final
Musa Stephen HONLUE
 
PPTX
Aircrack
MuhammadHanzalah6
 
PPT
Intrusion Detection System using Snort
webhostingguy
 
PDF
IPv6 Security Potpourri
_xhr_
 
Shameful secrets of proprietary network protocols
Slawomir Jasek
 
Ángel Palomo Cisneros - Programming and playing a MITM attack [rooted2018]
RootedCON
 
Anton Chuvakin on Honeypots
Anton Chuvakin
 
How Automated Vulnerability Analysis Discovered Hundreds of Android 0-days
Priyanka Aash
 
Wireless security
Aurobindo Nayak
 
Parrot Drones Hijacking
Priyanka Aash
 
Skyjacking A Cisco Wlan Attack Analysis And Countermeasures
AirTight Networks
 
Ceh v8 labs module 08 sniffers
Mehrdad Jingoism
 
Order vs. Mad Science: Analyzing Black Hat Swarm Intelligence
Priyanka Aash
 
Database Firewall with Snort
Narudom Roongsiriwong, CISSP
 
Wireless security testing with attack by Keiichi Horiai - CODE BLUE 2015
CODE BLUE
 
Detecting Threats: A Look at the Verizon DBIR and StealthWatch
Lancope, Inc.
 
Критически опасные уязвимости в популярных 3G- и 4G-модемах или как построить...
Positive Hack Days
 
G3t R00t at IUT
Nahidul Kibria
 
Exfiltrating Data through IoT
Priyanka Aash
 
How Hack WiFi through Aircrack-ng in Kali Linux Cyber Security
Ahmad Yar
 
AF-23- IPv6 Security_Final
Musa Stephen HONLUE
 
Aircrack
MuhammadHanzalah6
 
Intrusion Detection System using Snort
webhostingguy
 
IPv6 Security Potpourri
_xhr_
 
Ad

Similar to Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests (20)

PPTX
DevLink - WiFu: You think your wireless is secure?
Rob Gillen
 
PDF
Pentesting Your Own Wireless Networks, June 2011 Issue
Ishan Girdhar
 
PDF
International Conference On Electrical and Electronics Engineering
anchalsinghdm
 
PPTX
Wireless Security null seminar
Nilesh Sapariya
 
PDF
WiFi Intrustion Detection from WireShark SharkFest
David Sweigert
 
PDF
Scenatio based hacking - enterprise wireless security (Vivek Ramachandran)
ClubHack
 
PDF
ECE560 Wireless and Mobile Security Fall2020..pdf
TuulTriyason
 
PDF
Wireless Network Security Software Wireless Network Security Software
BRNSSPublicationHubI
 
PPTX
WiFi security
Ihor Uzhvenko
 
PDF
Wireless Security Architecture Designing and Maintaining Secure Wireless for ...
ortiqbrowny82
 
PDF
DEF CON 23 - vivek ramachadran - chellam
Felipe Prado
 
PPTX
Dncybersecurity
Anne Starr
 
PPTX
501 ch 4 securing your network
gocybersec
 
PPTX
You think your WiFi is safe?
Rob Gillen
 
PPTX
Wireless Pentesting: It's more than cracking WEP
Joe McCray
 
PDF
Understanding WiFi Security Vulnerabilities and Solutions
hemantchaskar
 
PDF
How to WRAPS like Snoop Dogg
Alex Kim
 
PPTX
Wi-Fi Security Presentation.pptx
Mairajuddeen
 
PDF
IT infrastructure security 101
April Mardock CISSP
 
PPT
Ids in wn
sushil yadav
 
DevLink - WiFu: You think your wireless is secure?
Rob Gillen
 
Pentesting Your Own Wireless Networks, June 2011 Issue
Ishan Girdhar
 
International Conference On Electrical and Electronics Engineering
anchalsinghdm
 
Wireless Security null seminar
Nilesh Sapariya
 
WiFi Intrustion Detection from WireShark SharkFest
David Sweigert
 
Scenatio based hacking - enterprise wireless security (Vivek Ramachandran)
ClubHack
 
ECE560 Wireless and Mobile Security Fall2020..pdf
TuulTriyason
 
Wireless Network Security Software Wireless Network Security Software
BRNSSPublicationHubI
 
WiFi security
Ihor Uzhvenko
 
Wireless Security Architecture Designing and Maintaining Secure Wireless for ...
ortiqbrowny82
 
DEF CON 23 - vivek ramachadran - chellam
Felipe Prado
 
Dncybersecurity
Anne Starr
 
501 ch 4 securing your network
gocybersec
 
You think your WiFi is safe?
Rob Gillen
 
Wireless Pentesting: It's more than cracking WEP
Joe McCray
 
Understanding WiFi Security Vulnerabilities and Solutions
hemantchaskar
 
How to WRAPS like Snoop Dogg
Alex Kim
 
Wi-Fi Security Presentation.pptx
Mairajuddeen
 
IT infrastructure security 101
April Mardock CISSP
 
Ids in wn
sushil yadav
 
Ad

More from 📡 Sebastien Dudek (17)

PDF
The current state of LoRaWAN security
📡 Sebastien Dudek
 
PDF
Hack.lu 2012 - Fuzzing the GSM protocol stack (paper)
📡 Sebastien Dudek
 
PDF
33c3 - 2G and 3G intercom attacks
📡 Sebastien Dudek
 
PDF
Beerump 2018 - Modmobmap
📡 Sebastien Dudek
 
PDF
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
📡 Sebastien Dudek
 
PDF
Hack.lu 2012 - Fuzzing the GSM protocol stack
📡 Sebastien Dudek
 
PDF
Hack.lu 2016 - 2G and 3G intercom hacking
📡 Sebastien Dudek
 
PDF
Intercoms presentation OSSIR - IoT Hacking
📡 Sebastien Dudek
 
PDF
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring
📡 Sebastien Dudek
 
PDF
Article on V2G Hacking - V2G Injector: Whispering to cars and charging statio...
📡 Sebastien Dudek
 
PDF
SSTIC 2019 - V2G injector: Whispering to cars and charging units through the ...
📡 Sebastien Dudek
 
PDF
SSTIC RUMP 2018 - Modmobjam
📡 Sebastien Dudek
 
PDF
Intercom hacks with GSM interception
📡 Sebastien Dudek
 
PDF
Synacktiv mobile communications attacks
📡 Sebastien Dudek
 
PDF
Troopers NGI 2019 - Modmobtools and tricks
📡 Sebastien Dudek
 
PDF
Troopers TelcoSec day 2019 - Modmobtools internals
📡 Sebastien Dudek
 
PDF
Usrp episode 1: smoke gets in your eyes
📡 Sebastien Dudek
 
The current state of LoRaWAN security
📡 Sebastien Dudek
 
Hack.lu 2012 - Fuzzing the GSM protocol stack (paper)
📡 Sebastien Dudek
 
33c3 - 2G and 3G intercom attacks
📡 Sebastien Dudek
 
Beerump 2018 - Modmobmap
📡 Sebastien Dudek
 
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring (slides)
📡 Sebastien Dudek
 
Hack.lu 2012 - Fuzzing the GSM protocol stack
📡 Sebastien Dudek
 
Hack.lu 2016 - 2G and 3G intercom hacking
📡 Sebastien Dudek
 
Intercoms presentation OSSIR - IoT Hacking
📡 Sebastien Dudek
 
NSC 2014 HomePlugAV PLC: Practical attacks and backdooring
📡 Sebastien Dudek
 
Article on V2G Hacking - V2G Injector: Whispering to cars and charging statio...
📡 Sebastien Dudek
 
SSTIC 2019 - V2G injector: Whispering to cars and charging units through the ...
📡 Sebastien Dudek
 
SSTIC RUMP 2018 - Modmobjam
📡 Sebastien Dudek
 
Intercom hacks with GSM interception
📡 Sebastien Dudek
 
Synacktiv mobile communications attacks
📡 Sebastien Dudek
 
Troopers NGI 2019 - Modmobtools and tricks
📡 Sebastien Dudek
 
Troopers TelcoSec day 2019 - Modmobtools internals
📡 Sebastien Dudek
 
Usrp episode 1: smoke gets in your eyes
📡 Sebastien Dudek
 

Recently uploaded (20)

PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PPTX
Spectroscopy.pptx food analysis technology
nawahassan45
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
Spectroscopy.pptx food analysis technology
nawahassan45
 
Cloud computing and distributed systems.
kkkkkhan
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 

Security PWNing 2018 - Penthertz: The use of radio attacks during redteam tests

  • 1. PentHertz The use of radio attacks in red team and pentests By Sébastien Dudek Security PWNing November 19th 2018
  • 2. About me Sébastien Dudek (@FlUxIuS) Working at Synacktiv: pentests, red team, audits, vuln researches Likes radio and hardware And to confront theory vs. practice First time doing a presentation in Poland...
  • 4. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 5. 3 Introduction Companies regularly perform security tests Mostly pentests or audits Red Team become more and more popular Last year: “Red teaming w Polsce” Borys Łącki (external tests, physical intrusions, etc.) This year: we will talk about our experience in France (and few others in UE) and the use of radio attacks
  • 6. 4 Red Team Each company use its own style Also its own tools: Houdini: implant we plug and use remotely + bypass 802.1x Oursin: spear-phishing attack Kraqozorus: brute-forcing plateform (distributed, supports lots of algorithms and rules) More of it in our website For physical intrusions: be natural, smile and say “hello” and “thank you” Authorizations give the opportunity: Try new techniques, perform and improve intrusion skills Test every possible scenarios → client can have a better overview of employes reactions in particular cases
  • 7. 5 Can’t raise alerts Anti-viruses and anti-intrusion plateforms: make spear-phishing harder Fence, doors, locks: you can bypass by letting someone go first Turnstiles (bramki obrotowe): need to bypass them with style You can make also fake authorizations But in some cases you do not want to leave traces Use of radio attacks: helpful and could be a real change → with sexy scenarios
  • 8. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 9. 6 Physical intrusion preparation Map the place first with tools like Google Street Complet the mapping: physical discovery + general schedule (in/out for lunch for example) + an idea of physical anti-intrusion systems But look also Wi-Fi hotspots and other devices!
  • 10. 7 Mapping Wi-Fi hotspots Use of omnidirectional antennas Software: Kismet (optimized for mapping) and/or airodump-ng (slower but gives more informations in PCAPs) Optionally: use a GPS or A(ssisted) GPS to trace a map Caution Do not forget 2.4 GHz and 5 GHz frequencies! ;)
  • 11. 8 AWUS036ACH device Supports both 2.4 and 5 GHz frequencies Runs perfectly with aircrack-ng suite tools Practical Mltiple devices are needed to make complet captures in a short time
  • 12. 9 Cool tools for mapping: Wi-Fi Pineapples Embedded Wi-Fi attack devices (“based” on OpenWRT) Scanned hotspots can be stored in a MicroSD card Could be combined with a mobile battery Sufficient for mapping, fake-APs, and bridges/extensions
  • 13. 9 Cool tools for mapping: Wi-Fi Pineapples Embedded Wi-Fi attack devices (“based” on OpenWRT) Scanned hotspots can be stored in a MicroSD card Could be combined with a mobile battery Sufficient for mapping, fake-APs, and bridges/extensions But... Actually 400MHz-533MHz MIPS CPU: don’t use it for injections → very slow
  • 14. 10 Alternatives Raspberry Pi 3 Some others on steroids: Tinker Board Odroid-XU4 NanoPC-T4 (my prefered one) And others Rockchip MCU based devices...
  • 15. 11 Nexmon Held in a smartphone (mostly Nexus phones) Patch for Wi-Fi Broadcom/Cypress firmwares → add monitoring and injection features Support more than 15 models Can be quickly installed in a rooted Android phone: de.tu_darmstadt.seemoo. nexmon
  • 16. 12 Optimizing transmission Transceiver power adapted to distance and the target Avoid gain losses (adapters, and other extension) Avoid obstacles An adapted antenna is mandatory
  • 17. 13 Antennas Are their own characteristics (frequency use, polarization, directivity, type, and so on). Many types exist: Omnidirectional (λ/2, λ/4...) Directional (e.g Yagi) Parabolic... Parabolic and Directional: great to manage long distances But sometimes this is not sufficient...
  • 19. 14 Amplifiers Allow to leverage Tx/Rx power But... Amplificators should be used with caution
  • 20. 15 Amplifiers impacts Noise is also amplified: Need processing at least some filtering
  • 21. 16 Remember: useful settings in Wi-Fi Transmission power: # iwconfig wlan0 txpower 27 / / 500 m i l l i W a t t s Changing region to bypass regulation limitations: # iw reg set <other region >
  • 22. 17 Identify connected devices: spectral analysis With Gnuradio and a Software-Defined Radio device:
  • 23. 18 Spectral analysis Useful to observe spectral occupations around the target → discover Could be performed with the GQRX software and a Software-Radio Device But also a nice gadget: RF Explorer Captures: discover central frequency, bandwidth, modulation, and so on. Mostly performed during audit tests, rarely in Red team tests
  • 24. 19 Choose your SDR device Depends on few characteristics: Clock precision is also important → could be optimized with an external GPSDO
  • 25. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 26. 20 Identifying hotspots Generally: ESSID are related to targeted company name SSID: match with found ESSID → spot other AP with != names → maybe w/ a weaker security protocol Hidden ESSID can be spotted: 1 Listen for probe requests 2 Enumerate ESSID of probes 3 Try to connect to a hidden APs refering to captured ESSID in probes Clients: connect to a hidden ESSID during the listening process → efficient with a lot of clients on targeted APs We can also disconnect clients to identify ESSID (a bit intrusive)
  • 27. 21 Current security protocols Wired Equivalent Privacy (WEP): rarely found, but still exist in industrial (found in 2015 and 2016 during tests) Wi-Fi Protected Access (WPA) and WPA2: often in medium-sized company or industrial Wi-Fi Protected Access-Enterprise: found in big compagnies But Guest network could be also interesting!
  • 28. 22 Attacking guest portals We are used to omit Guest Wi-Fi network: “Yeah they are isolated blablaBla!” But they use tons of wonderful technologies: PHP Java and so on. What could go wrong if we get a RCE on these portals?
  • 29. 23 Case of CISCO ISE CISCO ISE use Struts CVE-2017-5638 rings a bell? OGNL injection in header → RCE An another one... CVE-2018-11776 Many equipments remain unpatched
  • 30. 24 Feedbacks We encountered few companies with a vulnerable CISCO ISE: 1 Use a public exploit for CVE-2017-5638: $ . / struts−pwn . py −u ’ https : / / < target >:8443/ p o r t a l / PortalSetup . action ? p o r t a l =a [ . . . ] & sessionId=0a77 [ . . ] & action=cwa ’ −c ’ id −a ’ [ * ] URL: https : / / < target >:8443/ p o r t a l / PortalSetup . action ? p o r t a l =a148 [ . . . ] & sessionId = 0 [ . . ] & action=cwa uid =300( iseadminportal ) gid =300( ise ) groups=300( ise ) ,110( gadmin ) , 200( o i n s t a l l ) ,301( iseadmin ) ,303( i s e i n f r a ) ,304( isemt ) [%] Done . 2 The router was also connected to the corporate network → perfect place to find vulnerable servers and computers → leverage accesses to dump Active Directory → All of that in almost 1 day remotely
  • 31. 25 WEP: our brief feedback Considered as broken aircrack-ng implements a lot of attacks WEP is rare nowadays (Dr. Obvious) But still found in isolated cases: employes extending or adapting the connection with devices not supporting WPA2 and/or WPA Entreprise Clients are also rare in those cases: we mostly perform Interactive Frame Selection attacks with aircrack-ng
  • 32. 26 WPA2: capturing handshake By disconnecting a client This handshake is then submited to our plateform Kraqozorus
  • 33. 27 WPA2: feedbacks Even with a distributed plateform: the time is too just to crack hard passphrases We use different techniques to connect to the targeted network: Use social engineering tricks just by asking the passphrase (a little YOLO but works when playing the “new/lost guy” card) Recover the key in an exposed intranet, that is isolated in a DMZ → mixing external pentest and wireless is more efficient → allows to have a foot in intern without having to fight with DMZ
  • 34. 28 WPA2 Entreprise Most seen in big companies: PEAP with MS-CHAP auth, sometimes EAP-TLS EAP-TLS: secure! PEAP: Normally impossible to break with mutual authentication But all clients do not use the mutual authentication Moreover credentials are related to Active Directory (MS-CHAP auth) → give us a first access to browse shares, find vulnerable services, and so on. We used to be domain admins in only 1 day, few times, mainly thanks to unsecure Wi-Fi clients
  • 35. 28 WPA2 Entreprise Most seen in big companies: PEAP with MS-CHAP auth, sometimes EAP-TLS EAP-TLS: secure! PEAP: Normally impossible to break with mutual authentication But all clients do not use the mutual authentication Moreover credentials are related to Active Directory (MS-CHAP auth) → give us a first access to browse shares, find vulnerable services, and so on. We used to be domain admins in only 1 day, few times, mainly thanks to unsecure Wi-Fi clients Client attacks We are attacking Wi-Fi clients here → very difficult to perform at great distance with a directional antenna =/
  • 36. 29 Attacking WPA2 Entreprise 1 Run a rogue AP: hostpad-wpe (tip: put it in a docker container) 2 Trap client that do not check certificate 3 Capture the challenge in john NETNTLM format: # cat / usr / l o c a l / var / log / radius / freeradius−server−wpe . log [ . . . ] mschap : [ . . . ] username : synacktiv challenge : 8d :23: ca : a3 :2 f : da :4e:8d response : 19:53:90: f2 :23:18:21:20:9 f : bc :90:8 e : bc : ab :1 c :04:1 f :4b:2a : [ . . . ] john NETNTLM: synacktiv : $NETNTLM$8d23caa32fda4e8d$19539 [ . . . ] 4 Crack the challenge with john: # OMP_NUM_THREADS=12 . / run / john −−w o r d l i s t =<wordlist > −−rules=<règles > <hashfile >
  • 37. 30 Attacking WPA2 Entreprise 1 Run a rogue AP: hostpad-wpe (tip: put it in a docker container) 2 Trap client that do not check certificate 3 Capture the challenge in john NETNTLM format: # cat / usr / l o c a l / var / log / radius / freeradius−server−wpe . log [ . . . ] mschap : [ . . . ] username : synacktiv challenge : 8d :23: ca : a3 :2 f : da :4e:8d response : 19:53:90: f2 :23:18:21:20:9 f : bc :90:8 e : bc : ab :1 c :04:1 f :4b:2a : [ . . . ] john NETNTLM: synacktiv : $NETNTLM$8d23caa32fda4e8d$19539 [ . . . ] 4 Crack the challenge with john: # OMP_NUM_THREADS=12 . / run / john −−w o r d l i s t =<wordlist > −−rules=<règles > <hashfile >
  • 38. 31 EAP-GTC downgrade EAP-GTC : EAP Generic Token Card Used in old smartphones (Android 5.0 and some iPhones) Consist of asking for an OTP and respond with PW_EAP_MSCHAPV2_SUCCESS → get a clear-text passphrase Tool that implement the attack: lootbooty (patch PuNk1n.patch for freeradius) Presented at DEF CON 21 par Josh Hoover Rarely encountered (@wishbone1138) and James Snodgrass in 2013
  • 39. 32 Direct Wi-Fi networks Before: We’ve been used to see it for isolated printer networks Broadcast a “DIRECT-*” ESSID Mostly open or protected with a default WPA2 password (that could be found in firmwares) During our tests we have been surprised to see a mirror cast gateway directly connected to the corporate network (#FACEPALM)
  • 40. 33 FQN leaked in captures Captured with airodump-ng: Connecting to this ESSID → bring us to the targeted corporate network
  • 41. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 42. 34 Contexts Connected devices are expending and use: Zigbee, Wi-Fi, LoRa, Sigfox but also the Mobile network Different kinds: delivery pick-up station (stacje odbioru) connected cars alarms intercoms (awiofon)...
  • 43. 35 Intercoms Connected intercoms are widely deployed in building In previous conferences we showed: Downgrade attacks from 3G to 2G Intercept these devices and command them Command them by attacking the remote web interface Open the doors by commanding them All these attacks could be applied on other devices too...
  • 44. 36 Set-up to attacks mobile devices Basic setup for almost 500€: 1 BladeRF, 2 adapted antennas, and a BTS software like YateBTS
  • 46. 38 Attracting 3G/4G devices Use a cheap 2G/3G/4G jammer and rework it Or perform smart-jamming: 1 Monitor and collect cells data 2 Jam precise frequencies from collected cells → choose few target operators
  • 47. 39 Monitoring 2G/3G/4G cells Using Modmobmap: $ sudo python modmobmap. py −m servicemode −s <Android SDK path > => Requesting a l i s t of MCC/MNC. Please wait , i t may take a while . . . [ + ] New c e l l detected [ CellID / PCI−DL_freq (XXXXXXXXX) ] Network type=2G PLMN=208−20 ARFCN=1014 Found 3 operator ( s ) {u ’20810 ’: u ’ F SFR’ , u ’20820 ’: u ’ F−Bouygues Telecom ’ , u ’20801 ’: u ’ Orange F ’ } [ + ] Unregistered from current PLMN => Changing MCC/MNC f o r : 20810 [ + ] New c e l l detected [ CellID / PCI−DL_freq (XXXXXXXXXX) ] Network type=2G PLMN=208−20 ARFCN=76 [ . . . ] [ + ] New c e l l detected [ CellID / PCI−DL_freq (XXXXXXXXXX) ] Network type=3G PLMN=208−1 Band=8 Downlink UARFCN=3011 Uplink UARFCN=2786 [ . . . ] [ + ] Cells save as cells_1536076848 . json # with an CTRL+C i n t e r r u p t
  • 48. 40 Jamming with Modmobjam We can then trap the device and command it!
  • 49. 41 Remember its M2M architecture ”Hidden” endpoints could be interesting to study, isn’it?
  • 50. 42 Communications with remote servers Could be performed by activating the GPRS in YateBTS or OpenBTS, or OsmoTRX, ... Somethimes encrypted: the key and algorithms can extracted from device The key could be the same for all distributed devices Devices often identify != authentify themselves to servers Security by obscurity thing: servers and devices often trust each other → what could go wrong?
  • 51. 43 Interesting case: connected cars Mobile network is generally used Board computer contain many applications Update the board computer GPRS is generally used for middle class cars → really easy to intercept
  • 52. 44 Our target As a connected board computer Allows installation of new applications Can be update Plenty of available applications: Twitter application and Facebook (?share your speed excesses?) Meteo GPS etc. And all of that ”in the air”
  • 53. 45 Client-side attack: new captures Surprise: all requests made by the board computer and apps are in clear HTTP...
  • 55. 47 Opportunities Remember the Android version is 4.0.4: Some apps perform web requests → JavaScript Interface RCE Other request XML files → XXE attacks And all other CVE to replay!
  • 56. 48 Spotted API Looks like API calls in mobile apps!
  • 57. 49 Interception in a parking station Good Faraday cages: > 10 board computers collected in the fake base station during our tests
  • 58. 50 Further readings Our blog post on “Hunting mobile endpoints” More stuff could be found on other systems... Other case: The ComboBox in BMW https://www.heise.de/ct/artikel/Beemer-Open-Thyself- Security-vulnerabilities-in-BMW-s-ConnectedDrive- 2540957.html
  • 59. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 60. 51 Common types Low frequencies : 125 kHz HID EM41x High frequencies : 13.56 MHz MIFARE Classic → cards replaced by MIFARE Plus MIFARE Ultralight (standard, C et EV1) MIFARE DESFire
  • 61. 52 Prefered tool: Proxmark3 Almost 300€ → it’s an investement Supports LF and HF freq Modular and allow to add support for unknown cards Active support: Iceman1001’s github RDV4 is very small and is able to perfom standalone emulation+cloning RDV4 has a long range antenna
  • 62. 53 Proxmark3 HF medium range antenna Able to read a card separated from 6.51cm book contraint! Default and long range antenna are also very impressive.
  • 63. 54 LF: Looking for UID Are less common nowadays: found in administrative, schools and post offices Proxmark3 software is very complet Common tags are recognized with a simple command: proxmark3> l f search EM410x pattern found : EM TAG ID : 060081DAC2 [ . . . . ] Tip: Card’s decimal number is often written on the card
  • 64. 55 MIFARE Classic Vulnerable to offline and online attack: use of vulnerable CRYPTO1 Public card only attacks: Nested attack: need to know at least 1 key Darkside attack: if no known key Online attacks: Captures → Bruteforce de nounce (https://github.com/J-Run/mf_nonce_brute)
  • 65. 56 MIFARE Plus and Classic EV1 Fix PRNG against Darkside and Nested attacks MIFARE Plus are compatible with MIFARE Classic But are vulnerable to an attacked derived from nested attack
  • 66. 57 Hardnested attack: VIGIK card case Requires at least one known key, for that case we give key from block 0 sector 0: > hf mf hardnested 0 A 484558414354 0 B [ . . . ] 15 | 1333 | Brute force phase completed . Key found : a22ae129c013
  • 67. 58 No known key: go online attack! Process: 1 Use the “snoop” feature from proxmark to collect exchanged data 2 Retrieve from a capture uid, nt encrypted, nt parity err, nr encrypted, ar encrypted, ar parity err, at encrypted, and at parity err 3 Make sure you collected all required data 4 Crack the key using mf_nonce_brute tool → you will get 4 Bytes of the key 5 The rest of the key could be bruteforced with Proxmark3.
  • 68. 59 MIFARE Ultralight Mostly encountered in hotels and public transports (e.g Amsterdam tram) 3 common types: MIFARE Ultralight Everyone can write and read OPT locks exist to prevent from writing MIFARE Ultralight EV1 Everyone can write and read Unless a password is configured The password is sent in clear-text ↔reader (hmm...) MIFARE Ultralight C Everyone can write and read Unless the authentification feature is set We can still try to bruteforce default/leaked/weak keys
  • 69. 60 MIFARE DESFire Exists in V06 (obsolete), EV1 (very common) and EV2 Program applications Access management for each application → like smartcards No known attack except “crazy” sidechannels attacks But we could try to bruteforce weak keys or have a lot of chance
  • 70. 61 Frequent MIFARE DESFire mistakes Installators are sometimes lost and forget to configure at least one application: What could go wrong?
  • 71. 62 MIFARE DESFire: identification only WTF?! The reader only requires a valid UID: And this is a common mistake...
  • 72. 63 LF with obscure cryptography Best example Nedap XS: magically encrypted and highly secure on the paper But in practice: only the UID is encrypted Okey it uses ASK modulation, Biphase coding phase, and 120KHz/125KHz frequency pm3 −−> l f nedap read [ . . . ] NEDAP ID Found − Card : 2788 − Raw: ffbd62003a5f45f5c **************** BIN : …1111111110111101011000100000000000111010010111110100010111110101******* Once read → could be copied in a configured T55xx blanc card. Credz: http://www.proxmark.org/forum/viewtopic.php?id=3332
  • 73. 64 RFID: go further Proxmark3 wiki and forum → very active community Christian Herrmann’s Proxmark3 fork: https://github.com/iceman1001/proxmark3 “A 2018 practical guide to hacking NFC/RFID” by Sławomir Jasek → Regroups a lot nice tips and tricks! + his findings on few hotel keys
  • 74. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 75. 65 Cheap remotes Found in hold and particular parking, but also alarms... Tool that makes coffee for that: Universal Radio Hacker (URH) → (handle FSK, OOK/AM, PSK and different decodings) Budget for Tx/Rx: HackRF for 300€
  • 76. 66 Secured remotes: attacks upgrades Signal relay/proxy/tunneling Amplification attack Credits: seen via Denis Laskov twitter
  • 77. 67 Connected locks Use Bluetooth Blue-Energy Could be opened with a smartphone Cheapest allows open command replay Expensive ones encrypts keys Use a sort of rolling code (e.g like cars’ remotes) Not found yet in Red Team tests → but might come with time :)
  • 78. 68 Generic attack on locks: “RollJam” Implemented for GATTACKER: https://github.com/FlUxIuS/gat- tacker/tree/master/hookFunctions
  • 79. 69 BLE: go further Cool tools: Btlejuice by Damien Cauquil: The BurpSuite tool for BLE GATTACKER by Sławomir Jasek: very good for direct interception + scripting for packet manipulation Ressources: “Bluetooth low energy attacks” talks of Damien Cauquil “Blue picking” talks by Sławomir Jasek → I highly recommend his training!
  • 80. 1 Introduction 2 Preparing an intrusion 3 Wi-Fi attacks 4 Mobile attacks 5 RFID 6 More of it 7 Conclusion
  • 81. 70 Conclusion All these techniques are common in Red Team and pentests But this is just a small part of what could be found in radio → protocol stacks are very interesting to look at, but more complex Softwares are more complex to exploit → lot of mitigations → but hardware and radio communications can hide a lot of surprises Current/public tools work in a lab but are not portable enough → encourage us to repackage/readapt them for practical attacks PentHertz project: If you like offensive radio → lets talk! ;)
  • 82. THANK YOU FOR YOUR ATTENTION, ANY QUESTIONS?