w hy t he p arasite
play

W HY T HE P ARASITE ? Many organizations filter outgoing traffic - PowerPoint PPT Presentation

Dec 28, 2022 •359 likes •776 views

Introducing T HE P ARASITE Coming Soon to a Network Near You! Tsagkarakis Nikos { ntsag at census-labs.com } Census, Inc. Athcon 2011, Athens I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC . O VERVIEW I NTRODUCTION C ONSTRUCTION P

  1. Introducing T HE P ARASITE Coming Soon to a Network Near You! Tsagkarakis Nikos { ntsag at census-labs.com } Census, Inc. Athcon 2011, Athens I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  2. O VERVIEW I NTRODUCTION C ONSTRUCTION P LAYING WITH P ARASITE F UTURE OF P ARASITE C ONCLUSIONS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  3. I NTRODUCTION I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  4. W HY T HE P ARASITE ? ◮ Many organizations ◮ filter outgoing traffic ◮ host networks that are not connected to the internet ◮ Need for a simple way to gain and retain access in the above situations I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  5. W HY T HE P ARASITE ? ◮ An attack vector of low profile and high risk ◮ “We have strong physical security” ◮ “We will arrest a person using the plug next to a printer” ◮ “What if I construct a device, plug it into the target infrastructure and then go home?” I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  6. R ELATED W ORK ◮ NeoPwn ◮ Weaponizing N900 ◮ Plug Computers for penetration testing ◮ All of the above connect back through the target infrastructure ◮ Ineffective when there is no connection to the Internet I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  7. P ROTOTYPE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  8. P ROTOTYPE ◮ The idea is to produce a small device that can easilly be hidden in the target infrastructure ◮ A device that can be built by anyone I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  9. I T IS AN OLD STORY ◮ Bugs ◮ Microcameras ◮ Q’s gadgets I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  10. W HAT ALLOWS FOR THE USE OF P ARASITE ? ◮ Really messy datacenters ◮ The huge amount of cabling in a building ◮ The administrators are usually too busy to notice (or understaffed) ◮ Noone pays attention to small changes in the inventory of a datacenter or infrastructure I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  11. C ONSTRUCTION I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  12. C ONCEPT I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  13. C HALLENGE Build a device that is ◮ Small ◮ of Low Energy Consumption ◮ Autonomous I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  14. M ATERIALS FOR PROTOTYPE ◮ N900 ◮ USB Ethernet Device ◮ Cables ◮ Batteries I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  15. C OST ◮ N900 - 400 euro ◮ USB Ethernet Device - 15-30 euro ◮ Cables - 5 euro ◮ Batteries - 20-10000 euro ◮ 3G Connection Cost - 1 euro/day I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  16. N ETWORK I NTERFACES ◮ GSM Interface ◮ Ethernet ◮ Wifi I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  17. C ONNECT B ACK ◮ OpenVPN ◮ SSH I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  18. B ATTERY ◮ Extra battery ◮ Power over ethernet I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  19. P O E I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  20. P O E I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  21. T IME TO LIVE ◮ Simple Nokia battery 40 hours ◮ Enchanced Nokia Battery PoE 60-70 hours ◮ Enchanced Nokia Battery 80 hours I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  22. S ELF - DESTRUCT M ECHANISM ◮ Magnesium ◮ Thermistors ◮ Electric Ignitor ◮ On memory card I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  23. S ELF - DESTRUCT M ECHANISM I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  24. P LAYING WITH P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  25. U SES OF P ARASITE ◮ Security Testing ◮ Penetration Testing ◮ Physical Security Testing ◮ Spying I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  26. S OCIAL E NGINEERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  27. S OCIAL E NGINEERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  28. S OCIAL E NGINEERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  29. M ANY WAYS TO PLANT THE P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  30. M ANY WAYS TO PLANT THE P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  31. M ANY WAYS TO PLANT THE P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  32. S OME USES OF P ARASITE nmap I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  33. S OME USES OF P ARASITE sniffing I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  34. S OME USES OF P ARASITE metasploit I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  35. F UTURE OF P ARASITE I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  36. M INI C OMPUTERS ◮ Use of mini computers to build Parasites ◮ An independent build of such a device I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  37. M INI C OMPUTERS I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  38. O PEN BTS ◮ Use of OpenBTS for connecting back through an alternate GSM network I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  39. C ONCLUSIONS A small device that can be planted everywhere and work for some time I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  40. C AN WE BE PROTECTED ? ◮ Yes, but it requires a fair amount of effort! ◮ Employ physical security measures ◮ Monitor any changes in the inventory of an infrastructure (however small) ◮ Monitor the security of internal networks even if they are not connected to the Internet I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

  41. Q UESTIONS ? I NTRODUCING THE P ARASITE :: A THCON 2011 :: C ENSUS , I NC .

Recommend

More recommend