W HY T HE P ARASITE ? Many organizations filter outgoing traffic - - PowerPoint PPT Presentation

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

Introducing

THE PARASITE

Coming Soon to a Network Near You!

Tsagkarakis Nikos

{ ntsag at census-labs.com }

Census, Inc. Athcon 2011, Athens

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

OVERVIEW

INTRODUCTION CONSTRUCTION PLAYING WITH PARASITE FUTURE OF PARASITE CONCLUSIONS

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

INTRODUCTION

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

WHY THE PARASITE?

◮ Many organizations

◮ filter outgoing traffic ◮ host networks that are not connected to the internet

◮ Need for a simple way to gain and retain access in

the above situations

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

WHY THE PARASITE?

◮ An attack vector of low profile and high risk ◮ “We have strong physical security” ◮ “We will arrest a person using the plug next to a

printer”

◮ “What if I construct a device, plug it into the target

infrastructure and then go home?”

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

RELATED WORK

◮ NeoPwn ◮ Weaponizing N900 ◮ Plug Computers for penetration testing ◮ All of the above connect back through the target

infrastructure

◮ Ineffective when there is no connection to the Internet

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

PROTOTYPE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

PROTOTYPE

◮ The idea is to produce a small device that can easilly

be hidden in the target infrastructure

◮ A device that can be built by anyone

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

IT IS AN OLD STORY

◮ Bugs ◮ Microcameras ◮ Q’s gadgets

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

WHAT ALLOWS FOR THE USE OF PARASITE?

◮ Really messy datacenters ◮ The huge amount of cabling in a building ◮ The administrators are usually too busy to notice (or

understaffed)

◮ Noone pays attention to small changes in the

inventory of a datacenter or infrastructure

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

CONSTRUCTION

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

CONCEPT

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

CHALLENGE

Build a device that is

◮ Small ◮ of Low Energy Consumption ◮ Autonomous

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

MATERIALS FOR PROTOTYPE

◮ N900 ◮ USB Ethernet Device ◮ Cables ◮ Batteries

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

COST

◮ N900 - 400 euro ◮ USB Ethernet Device - 15-30 euro ◮ Cables - 5 euro ◮ Batteries - 20-10000 euro ◮ 3G Connection Cost - 1 euro/day

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

NETWORK INTERFACES

◮ GSM Interface ◮ Ethernet ◮ Wifi

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

CONNECT BACK

◮ OpenVPN ◮ SSH

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

BATTERY

◮ Extra battery ◮ Power over ethernet

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

POE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

POE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

TIME TO LIVE

◮ Simple Nokia battery 40 hours ◮ Enchanced Nokia Battery PoE 60-70 hours ◮ Enchanced Nokia Battery 80 hours

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SELF-DESTRUCT MECHANISM

◮ Magnesium ◮ Thermistors ◮ Electric Ignitor ◮ On memory card

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SELF-DESTRUCT MECHANISM

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

PLAYING WITH PARASITE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

USES OF PARASITE

◮ Security Testing

◮ Penetration Testing ◮ Physical Security Testing

◮ Spying

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SOCIAL ENGINEERS

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SOCIAL ENGINEERS

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SOCIAL ENGINEERS

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

MANY WAYS TO PLANT THE PARASITE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

MANY WAYS TO PLANT THE PARASITE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

MANY WAYS TO PLANT THE PARASITE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SOME USES OF PARASITE

nmap

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SOME USES OF PARASITE

sniffing

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

SOME USES OF PARASITE

metasploit

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

FUTURE OF PARASITE

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

MINI COMPUTERS

◮ Use of mini computers to build Parasites ◮ An independent build of such a device

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

MINI COMPUTERS

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

OPENBTS

◮ Use of OpenBTS for connecting back through an

alternate GSM network

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

CONCLUSIONS

A small device that can be planted everywhere and work for some time

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

CAN WE BE PROTECTED?

◮ Yes, but it requires a fair amount of effort! ◮ Employ physical security measures ◮ Monitor any changes in the inventory of an

infrastructure (however small)

◮ Monitor the security of internal networks even if they

are not connected to the Internet

INTRODUCING THE PARASITE :: ATHCON 2011 :: CENSUS, INC.

QUESTIONS?