W HY T HE P ARASITE ? Many organizations filter outgoing traffic - PowerPoint PPT Presentation

Introducing T HE P ARASITE Coming Soon to a Network Near You! Tsagkarakis Nikos { ntsag at census-labs.com } Census, Inc. Athcon 2011, Athens I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

O VERVIEW I NTRODUCTION C ONSTRUCTION P LAYING WITH P ARASITE F UTURE OF P ARASITE C ONCLUSIONS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

I NTRODUCTION I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

W HY T HE P ARASITE ? ◮ Many organizations ◮ filter outgoing traffic ◮ host networks that are not connected to the internet ◮ Need for a simple way to gain and retain access in the above situations I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

W HY T HE P ARASITE ? ◮ An attack vector of low profile and high risk ◮ “We have strong physical security” ◮ “We will arrest a person using the plug next to a printer” ◮ “What if I construct a device, plug it into the target infrastructure and then go home?” I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

R ELATED W ORK ◮ NeoPwn ◮ Weaponizing N900 ◮ Plug Computers for penetration testing ◮ All of the above connect back through the target infrastructure ◮ Ineffective when there is no connection to the Internet I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

P ROTOTYPE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

P ROTOTYPE ◮ The idea is to produce a small device that can easilly be hidden in the target infrastructure ◮ A device that can be built by anyone I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

I T IS AN OLD STORY ◮ Bugs ◮ Microcameras ◮ Q’s gadgets I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

W HAT ALLOWS FOR THE USE OF P ARASITE ? ◮ Really messy datacenters ◮ The huge amount of cabling in a building ◮ The administrators are usually too busy to notice (or understaffed) ◮ Noone pays attention to small changes in the inventory of a datacenter or infrastructure I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C ONSTRUCTION I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C ONCEPT I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C HALLENGE Build a device that is ◮ Small ◮ of Low Energy Consumption ◮ Autonomous I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

M ATERIALS FOR PROTOTYPE ◮ N900 ◮ USB Ethernet Device ◮ Cables ◮ Batteries I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C OST ◮ N900 - 400 euro ◮ USB Ethernet Device - 15-30 euro ◮ Cables - 5 euro ◮ Batteries - 20-10000 euro ◮ 3G Connection Cost - 1 euro/day I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

N ETWORK I NTERFACES ◮ GSM Interface ◮ Ethernet ◮ Wifi I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C ONNECT B ACK ◮ OpenVPN ◮ SSH I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

B ATTERY ◮ Extra battery ◮ Power over ethernet I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

P O E I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

P O E I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

T IME TO LIVE ◮ Simple Nokia battery 40 hours ◮ Enchanced Nokia Battery PoE 60-70 hours ◮ Enchanced Nokia Battery 80 hours I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S ELF - DESTRUCT M ECHANISM ◮ Magnesium ◮ Thermistors ◮ Electric Ignitor ◮ On memory card I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S ELF - DESTRUCT M ECHANISM I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

P LAYING WITH P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

U SES OF P ARASITE ◮ Security Testing ◮ Penetration Testing ◮ Physical Security Testing ◮ Spying I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S OCIAL E NGINEERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S OCIAL E NGINEERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S OCIAL E NGINEERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

M ANY WAYS TO PLANT THE P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

M ANY WAYS TO PLANT THE P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

M ANY WAYS TO PLANT THE P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S OME USES OF P ARASITE nmap I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S OME USES OF P ARASITE sniffing I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

S OME USES OF P ARASITE metasploit I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

F UTURE OF P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

M INI C OMPUTERS ◮ Use of mini computers to build Parasites ◮ An independent build of such a device I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

M INI C OMPUTERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

O PEN BTS ◮ Use of OpenBTS for connecting back through an alternate GSM network I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C ONCLUSIONS A small device that can be planted everywhere and work for some time I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

C AN WE BE PROTECTED ? ◮ Yes, but it requires a fair amount of effort! ◮ Employ physical security measures ◮ Monitor any changes in the inventory of an infrastructure (however small) ◮ Monitor the security of internal networks even if they are not connected to the Internet I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

Q UESTIONS ? I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .