[Music]
thank you
[Music]
all right
foreign
er uh I work for cigarettes as a
penetration tester I am the Wireless
technical lead which sounds really fancy
um and it's easy so I appreciate you all
coming to the very last talk after
closing ceremonies are already all over
because yeah it shows how dedicated you
really are or the fact that your flights
just haven't taken off yet yeah exactly
except for watch this I'm pretty sure
I'm gonna only talk right now so like
win win by being the only one available
I guess
so uh the reason that this is called
compromise from park bench is because
it's inspired by a story of an old
co-worker that we had named Scott ortel
so Scott
uh if nobody knows who Scott is I'm
gonna just kind of give you some insight
Scott is like the original steampunk he
lives in an apartment and he has like a
compost pile and Bin on his apartment
balcony like he is somebody that uh
takes the train from Chicago to Defcon
right
um and he well you know so that's like
what three four days on a train so it's
got Scott Scott always likes to take
public transit
um and for this particular pen test it's
in Chicago and decides you know what I'm
not gonna drive there if yet
uh so he decides you know what I'm gonna
I'm gonna drive or I'm I'm gonna take
the bus to this client site call the
client the weekend at a time client's
like yeah sure we'll see you there you
know it sounds good it's wireless
penetration test
um so he takes like this two-hour bus
ride to get to the client site which
probably would have been like a 15
minute drive for him but hey he did it
he shows up the client's site and it's a
bank and he walks into this bank and
he's like hey I'm here to do the
wireless pen test I'm here to you know
try and break it and compromise to your
wireless network and we go sir we don't
know who you are
and he's like well I talked with you
know client name she's on vacation this
week
okay well can I just like test from the
lobby
no sir you're gonna have to actually
leave the building you don't have
permission to be here mind you like they
paid us to do this penetration test
right so uh so Scott's like okay like
I'll leave the building and I'll just
sit in the parking lot he doesn't have a
car or anything to go like charge a
laptop or anything right so like he's on
his own the next bus doesn't come for
another four hours
okay and so then he sits he's sitting in
the parking lot and the security guard
comes up and says sir you can't be on
Bank of premises
and so they chase him across the street
to a park bench and that's what inspired
this talk I'm just like yeah compromise
you can do it all of this with zero
physical access from just across the
street on a park bench uh the other like
inspiration for the talk is if anybody's
a tablespoon fan there's also a a uh
song that goes along with this so if you
know what it is feel free to shoot shot
shout it out and I have a prize for the
person that can figure it out
I'm not gonna show the pictures if you
want to see pictures of me and Taylor
Swift you can see me after uh I have
several
um
to go further into that context uh I met
Taylor Swift when I was in high school
she was in high school and then she blew
up in the game Super Famous and she does
not remember me so that's totally fine
however I have pictures to prove it
pictures because it happened right so
anyways there's no crash to go along
with this that was just my story about
Scott to preface hey you can do all of
this sitting from a park bench
um so okay so these boxes that are in
the picture uh during covid pre-covered
we didn't want to travel to all of our
sites so we built these boxes these
boxes were shipped to clients so that
they plug it in and it's just as if I'm
sitting there with a laptop
um and when I started everything uh so
imposter syndrome is a real thing and I
just wanna I could talk to several
people that have been here and like hey
I want to be starting penetration
testing or hey I want to get started in
security but man you know I work in the
restaurant industry right now or hey I
work in this industry right now like how
do I get started and it's one of those
things that kind of the beautiful thing
we're in the wild west
um you don't need a computer science
degree you don't need a degree
um with a couple surfs and just you know
knowing knowing the right things to say
and you know what certain words mean and
knowing how technology works and just
having a curious mind you can figure out
a lot with just Google
um and so just kind of put that in
perspective I started as a civil
engineer and made my way to the security
career path and
um they don't at all there's no Venn
diagrams if it were a Venn diagram it
would be a bicycle right there's no
interest in there so
um yeah if you're if you're feeling like
hey I want to get involved in security
by all means um it's never too late
all right so today we're basically just
talking about different types of
penetration testing but really we're
going to focus on on wireless the whole
point of wireless penetration testing is
to breach the wireless network to then
get into the juicy stuff that is your
internal Network
um this uh this picture is basically our
little mobile rig that we have which is
just a Raspberry Pi hooked up to a fat
battery uh 3D printed by Matt warm over
there and it has our cute little Shelly
logo on there that marketing doesn't
like us to use
um also marketing is watching this video
I love you Natasha and Stacy thank you
for everything
so uh the best part about Wireless pen
testing is that it's like a decade
behind all other types of penetration
testing right
um with like external penetration
testing where you're coming in attacking
somebody from the public internet like
there's firewalls IDs IPS they'll block
things like there's logs and all that
great stuff right for an internal
penetration test like an Insider threat
okay well like you know there's again
logging ACLS like all these Protections
in place
um you know logging yeah just all the
stuff that can catch you right
um with wireless penetration testing you
really know that exists like if you were
to attack somebody if you were to try a
password spray from the wireless network
it's gonna look like it's coming from
inside the building even though I'm
sitting across the street on the Park
Bench right
um and so that's that's really the fun
part of this is that Wi-Fi extends past
the building so if you're thinking of
like oh a red team engagement we're
gonna go and Michael Brian back there
dancing
um you know if you think that hey you're
gonna do a red team testing you're gonna
need to like clone all these Badges and
sneak your way in interior pants through
Chris carlis
um you know it's one of those things
that you don't have to worry about that
you can just sit in a rented car or
across the street and just capture
hashes that way and then you're not on
any camera you're not going to be
fingerprinted at all
um and it's just like if you can just
solidly go through a wireless
penetration test you can be completely
undetected
um so I don't even know if the slide
says let me see it for a second
yeah so it's easy to say Anonymous this
is like what our original like like
handheld thing would have been just a
small little battery Raspberry Pi run in
you know Cali or whatever your flavor of
Debian is and a wireless adapter you can
stick that in a pocket and just use your
phone and so the next slide that I'm
gonna have this is just me using you
know air dump just off of an iPhone and
I mean if you look at me you look at
like you know uh like what I know what
you would think a hacker looks like if I
just have that sitting in my pocket and
I just have an iPhone well now all of a
sudden I look like any Joshua sitting in
your lobby waiting for an appointment
when in reality uh you know I'm
capturing handshakes on your networks
I'm capturing credentials uh and you
have no idea that I'm doing that because
it's all passive
um and so these are the things that like
I'm not like I'm not super smart like we
have Geniuses on our team I'm just
clever like I can just like plug things
into other things and just like
hopefully it works out right
um and so what's nice about this is that
you stick the little Raspberry Pi in
your pocket you're talking a hundred
dollars off Amazon and you can stay
Anonymous and if you for any data you
can exfiltrate it just through your
pocket right you know there's nothing
that's gonna that's gonna show up and if
it does show up if you are logged
somewhere again you're connected to
Wi-Fi which looks like it's coming from
internal to the corporation also if
anybody has any questions just feel free
to like shoot up your hand
um I don't want to be like oh wait till
the end and you have to ask all your
questions there I'm really informal
about all of this
um so we have several different types of
clients and I reused a lot of images but
we walk around uh large Amusement parts
from time to time trying to do wireless
penetration testing right and so what's
funny is that there's a large client of
ours that we walk around we have to
cover several hundred thousand acres
um all while trying to stay out of sight
and so if you look at this backpack you
probably wouldn't really think a whole
lot about that backpack but if you look
a little bit harder you can actually see
that there's what four five six antennas
on there that are just on the outside
right and this is what we would walk
around with and stay pretty
inconspicuous all the while we're
capturing traffic on you know 2.4 5.8
gigahertz uh you know capturing
credentials as we walk around and again
we're just looking at our phones we're
just normal tourists
um and uh and it's one of those things
again this is something that you can do
with staying out of sight staying you
know
um saying not getting detected
uh there's a close-up of what's actually
in there again it's Raspberry Pi's which
Matt marziel hates so uh he's looking at
me with disgusting everybody hates them
okay but they're really great and
they're really small and I use them for
a lot of things I really like them but I
mean really yeah thanks thank you back
there I mean it's really one of those
things that like that small Computing
platform like you can do so much with it
it's so versatile and you put them in a
backpack
um yeah but airport security doesn't
know what they are so just watch out for
that
all right so uh I'll talk a little bit
going down into the nitty grittier of
like what Wireless pen testing we do and
kind of how it works so if you think
about you know hey you're trying to
secure a wireless network most of us if
you have a home network it's probably
WPA2 psk where you just have a password
you should have a password with
everybody or you know your devices on
your network and you go from there
um that's a really hard hash to crack if
you're ever trying to crack you know
something Wireless something Wi-Fi and
WPA2 it goes like I think what 10 000
times slower than you know standard ntlm
hash which is really really slow if
you're trying to crack something
um but there are easier ways and again
I'm not super smart I don't know how
hashing like I don't know the exact
algorithm or the mechanics behind it but
if I can just get somebody to give me
that password that's infinitely easier
um and so somebody stands up a rogue
access point and if you're not familiar
Rogue access point is basically just a
wireless network that you the company or
you an individual don't control that's
trying to basically coerce your end
users into connecting to it right
um and so it's not hard they sell you
know kits that are prefab online hacker
Warehouse that you know look at
pineapple that do this a Raspberry Pi
with just a standard wireless adapter in
there and it can also create a rogue
access point and the whole end goal of
this is to just coerce somebody
connecting to you and then you know
everybody's used to cap their portal
popping up and who validates it that
Cafe portal you know belongs where it
shouldn't belong
um almost no one and somebody that's
going to submit user credentials to you
is not somebody that's going to look at
that either and who would do that right
it's one of those things that like well
who's going to buy a ticket or who's
going to try and sit in our lobby and
try and steal credentials um and if
you're a big enough Target you know if
you're in a very famous person or if
you're you know a company with anything
reasonable to try and hide or try and
secure
um you know there's a reasonable chance
that somebody's just going to try and
try and do this method right
um and so again this is uh if you're
going to run a tool called Wi-Fi Fisher
it does everything everything that I
said but does it super easily and it
just you know uh push button get bacon
right you stands a broke access point it
stands up um you know so it looks like
it closed the right Network it stands up
uh you know the captive portal for you
does all the DHCP all the networking and
everything for you and so then devices
will basically say hey I recognize that
access point I'm going to try and
connect to it because it's a stronger
signal than the one that I'm you know
the one I normally used to connect into
and so as as devices start to auto
connect to this access point traffic
starts going through there captive
portals start getting you know put in
front of end user devices and somebody
who's on a mobile phone that's trying to
you know it's trying to just get access
to the internet they're really not going
to think too hard about it
um and so then you'll have something
like this pop up now if you look at it
yeah this is like a splash page that you
know probably many of you used to seeing
on the Windows you know 10 laptop when
in reality this is all just on the
website itself this is all just you know
HTML JavaScript or whatever so when an
end user were to go type in credentials
into that page they're just going to
submit that to my web page which means
it's submitted in clear text which means
I don't have to crack anything I don't
have to do anything they just gave me
the passwords I don't have to worry
about like oh gosh how long is this you
know going to take on our cracking rig
right I have to worry about any of that
they just give it to me in clear text
which is really nice of them
and that's where Rogue access points you
can really go down the rabbit hole of
like what actually matters so
everybody's I should say everybody many
clients this is like the hardest thing
that they have is they have no detection
they have no logging they have no
information about their Wireless
airspace and so I'd say for 99 of our
clients if we go in there and do
wireless penetration test this is always
going to be a finding they never detect
that we stand up a rogue access point
that looks identical to theirs
um and so that's like the bare minimum
if you are you know the security person
at your company just kind of alerting
just have logging for an access point or
an SSID so like the name of your Wi-Fi
that exactly matches you know what what
is there because that's going to be 95
of the attacks that that come from you
know an attacker or threat actor that's
trying to get into your wireless network
right
um and with that like I mean there's
there's stuff that's like the prosumer
wireless gear like ubiquity that does
this out of the box and so I don't know
why you have the bigger companies that
run you know Wireless infrastructure
that don't just provide something easy
like this out of the box because think
of the power of just knowing that hey
somebody is just poking at our uh
external infrastructure somebody's
poking at a wireless network just that
little bit of visibility knowing that
hey there's something kind of weird
going on um it's going to generate a
couple hundred alerts just like that
I've I've accidentally cloned my own AP
at home and then all of a sudden my
ubiquity equipment sends me 300
notifications because they're like hey
hey hey hey hey hey hey hey there's
something here you should look at this
you should really look at this and it's
just right out of the box that it does
that
um and so that's that's like the number
one recommendation but then you can go
down this Rabbit Hole of you know maybe
not having an exact match of the of the
wireless network or maybe you're going
to randomize the MAC address or maybe
you're going to clone the same Mac
address like we could go down this whole
rabbit hole and say say you have a bank
with multiple branches what happens if
you went to another Branch clone that
Mac address went to the second branch
and then use that to broadcast the AP
the wireless controller would have no
idea that it's a rogue access point so
there's lots of ways that you can bypass
you know Wireless intrusion prevention
your wireless intrusion detection but I
think the heart of this is not oh
there's so many different ways that you
can bypass it but that people fail at
Step Zero and that's even looking to see
what's out there what's available and
what's doing what
uh um let's see what does this one say
sorry I can't see my slides on there
um
yeah so the next part of this is uh okay
so you have a wireless network say your
company everybody has you know a guest
wireless network and there's a lot of
implications of guest Wi-Fi that that
many people don't think about no there's
the obvious ones right hey is your guest
Wi-Fi segmented from your corporate
Wi-Fi that's like one of the number one
things we check for and surprisingly you
think like hey you know this is
something that everybody's gonna pass
but there's always exceptions the amount
of times that I found a printer on the
guest Wi-Fi because hey somebody needs
to print out this patient record
somebody needs to print out this order
form right from the guest wireless
network well guess what that printer is
authenticated to active directory and if
you can pivot through it well hey now
you have a set of credentials and now
you can talk to domain controller for
authentication you can use that for user
enumeration and further pivoting to the
network so that's the first thing is
just hey if somebody's on the gas
wireless network can they talk to
somebody uh that's on the corporate
Network let's first thing to look at if
you know this is something that that
again you're concerned with the next
thing though that that is often not
covered is do your are your devices
isolated from one another so if me and
wooly are on the same wireless network
can my device talk to his device and if
so what are the implications of that so
many people think like hey guest Wi-Fi
it's the wild west we don't really care
people use the guest we have that little
captive portal thing that pops up that
says oh you know what we're not that
worried about it because ah it's just
iPhones it's just people trying to get
internet access and no sweat
um where that falls down is what happens
the first time core Wi-Fi is down say no
users can connect to court Wi-Fi what
happens well everybody hops onto the
guest Wi-Fi well now all of a sudden
that means that all of your devices you
know for your corporation have now
migrated over to the guest Wi-Fi where
there's no protections where there's
Open Access and anybody can interact
with those laptops so on more than one
occasion what I've done is walked up
said oh there's a lot of devices on
Quark Wi-Fi and there's no devices on
guest Wi-Fi let me just nuke and kick
everybody off of corporate Wi-Fi they
hop over to guest Wi-Fi now I can
interact with laptops and and I can run
tools like responder all your normal net
pen tools that are going to give you
hashes and that's exactly what we did
and so we got a whole bunch of hashes
cracked a whole bunch of passwords and
then I instantly made the you know Quark
Wi-Fi it stopped de-authing it and so
everybody reconnected to it but it
didn't matter because at that point I
already had domain admin credential that
then I could use for whatever I wanted
to going forward right
um or in that in that same time you can
pivot into another house if there's like
SMD signing not enabled or I can reuse
that credential and then if I have a
beacon on that say say I couldn't figure
so say it say I have a I'm not going to
say Vegan because that's uh too deep but
like say say I was able to compromise a
laptop that while it was on the guest
Wi-Fi well now the second that that
laptop is on the guest Wi-Fi and then
it's compromised if all of a sudden now
it reconnects you know back to the
normal corporate Wi-Fi great I've tried
your course my way into that corporate
Network and it doesn't matter if there's
certificate signing doesn't matter if
they're using you know 30 character long
password if I was able to compromise
that device and now it's on your
corporate Wi-Fi now I've now I have
basically full C2 control over that you
know over that device and potentially
that Network and we we've used that
method you know a handful of times to
gain access to a network that was
otherwise fully secure where hey in
order to connect to this corporate
Network you needed certificates you
needed strong user credentials you
needed it to come from a proper device
um and again it's one of these things
that I have the easy job I only need to
find one way to attack a computer on
your network whereas if you're a
Defender you have to find all the ways
that somebody's potentially going to do
it and you have to also be you know
accountable to stakeholders that want an
easy you know end user experience right
because not everybody's a tech owner
like like us right
I thought somebody raised their hand the
neighbors for stretching
um so I'm going to talk about uh other
implications of guest Wi-Fi because
again it's one of those things that yeah
we just host guest Wi-Fi so what what's
a second um
we're gonna talk about egress IPS so we
have clients that uh they have a
perfectly separated corporate corporate
network from their guest Network so what
that means is that I can't talk to any
devices that are on the guest Network so
they're all isolated from each other I
can't talk to anything on the corporate
Network awesome super good job
um but what's interesting is that a lot
of the times uh the
public IP address that that Corporation
uses the egress IP the internet service
that they use is the same public IP
address just you know on a segmented
Network and so if you were you know if
you were on the corporate Network and
you were to say what's my IP address it
would be the same if you were on a guest
network instead what's my IP address as
far as the public internet is concerned
they see the same exact public IP
address well one of the things with
everything moving to the cloud is that
yeah everybody has earning we'd like to
see companies have multi-factor
authentication everywhere so you picture
Office 365 you log in username password
and then hey you get prompted from
multifact authentication but at some
point you know user usability comes into
play here and they say hey you know what
look we require badges we require access
we have cameras to get into the building
let's just assume that if they're in the
building and they're using valid
credentials like guess what we're just
going to let these users go by without
using multi-factor authentication if
you're in the office we don't need any
use for multi-factor authentication
um on something like Office 365
well the problem with that is the way
that you enable that is by saying hey uh
Microsoft's a sure Office 365 there's a
trusted IP address and that trusted IP
address we're not going to require
multi-factor Authentication but if you
hop on the guest Network you have the
same public IP address so now all of a
sudden you can log into somebody's
Office 365 with zero multi-factor
authentication and then you can do
everything that would then go from an
external penetration test from an
internal penetration test all of your
other typical ways of penetration
testing but you've bypassed multi-factor
authentication and again everybody I
mean maybe not everybody but a common
thing is like dude who is going to go
show up to your organization who's going
to go show up to your branch who's going
to go buy a plane ticket and use this to
you know compromise or company and it's
like sure you know it's definitely a
threat you know it may not be the first
thing on anybody's priority list but
think if you're a large chain think if
you're a large chain restaurant they
give your large chain retailer now all
of a sudden you know you probably if
there's an attacker in your city that
wants to do this they don't have to go
very far it might just be a grocery trip
for them where they can then use this to
their advantage to then compromise the
whole rest of the organization
um so again you know is this gloom and
doom absolutely not but it's just
something to consider when you're giving
Public Access and you're giving you know
wireless access that extends Beyond you
know your typical brick and mortar walls
has anybody have any questions with that
anybody find the Taylor Swift song
[Music]
you look at my egress
for my company
and
you can see look at the square handles
that are out there and see if that data
I mean the the problem with the problem
that I see in men again I know not a
whole lot of things but the problem that
I see with that is uh you like if you're
the system administrator you're the one
that's already allowing the IP address
and so you just be checking the
reputation of your own IP address and
really
um I mean you can see that but there's
not going to be a way for you to
potentially differentiate hey is this a
thread actor that's coming from inside
our corporate Network like maybe just
the the you know malicious employee
versus somebody on the guest Wi-Fi
because as far as you can see it's only
coming from your public IP address is
that answer it all right
um so the other thing that I meant oh
well done well done I'm a prize for you
at the end of this everybody give him a
round of applause
sitting on our park bench thank you
anymore on the songs uh you can keep
guessing all the songs
what was that he has to sing it now oh
yeah if somebody wants to sing it that's
another prize
um so okay say somebody has an Uber
secure network there's no way you're
getting in they don't have guest Wi-Fi
everything is certificates everything is
as good as it can be there's still more
fun that can be had so if you look at
the screen this is a screen from one of
the tools that we mainly use called
error dump right
um and really there's a whole just a
bunch of weird numbers and those weird
numbers and symbols are Mac addresses so
that's the hardware address of that
device is connecting the wireless
network now this is always in plain text
because this is what has to be used for
devices to negotiate who hey who is this
device on the network this is how you
know the base thing that that Wi-Fi uses
to communicate device to device
um and so I can see on the left side and
on the right side the the station do I
have that right yeah so the station on
the right is like a client device so you
can think maybe this is my Nest
Thermostat maybe this is my wise camera
right
um and on the left hand side that is the
wireless access point that it's
connecting to what's interesting about
this again all this information is
included text and you're probably
thinking error this is useless to pretty
much anybody because it's just random
numbers what information could that give
you and so if you were to see this so
this is just a bigger view of it
so if you were to take that Mac address
each Hardware manufacturer has a MAC
address that's registered to them when
they're manufacturing devices
um that way there's not you know it's
supposed to prevent like you know uh
duplicate Mac addresses from duplicate
um you know manufacturers right but I
can see hey just based upon that that
address right there that Mac address
even though I have no information about
the wireless network even though I can't
compromise the security at all I can
still see that they're running the nest
thermostat and what's interesting about
that is that say I find out that you're
running you know some wise devices some
Google Nest devices some Alexa some you
know all these smart home things right
well they have other Wireless
connectivity in there they have
Bluetooth they have NFC they have Aurora
they have all this other technology
that's on there and so now I know what's
in your house without ever having
compromised the wireless security just
because of what they're beaconing just
because of their IDs that they're
beginning and so there's potentially
some other vulnerability that gets
disclosed about any of those devices on
any other different protocol well now
you have another vector or another way
into this you know users Network plus
you have a bunch of information about
them right and it doesn't have to be an
end user or house it could also be a
building you could know that this
building is using ring security or
Sentry safe or maybe they're using
that's an alarm and you can know that
based upon just the hardware information
that's beaconed out completely nuclear
text
what does this saying
yeah so uh what's I figure with the
adage is you know something can be
simple but it's not easy to do right so
it's really easy for me to get up here
and be like yeah everybody you should do
this you should secure your networks
this way but having been on the other
side of it it's way way way harder to
put this into practice and I sympathize
with that right I sympathize that every
single time I run a penetration test but
again I only needs to find the easy way
in I don't have to you know block all
the holes or one of the other things
that frequently comes up is hey if we
were to patch this if we were to upgrade
from Windows XP to you know Windows 10
all of a sudden well now that's not
going to work with all of this Hardware
that we have so I'm sympathetic to all
of that stuff so so don't take this
whole presentation again like oh yeah
wow everybody's doing wireless security
terribly because there's a lot of other
things that come into play I mean we
test hospitals all the time the amount
of times that we find a wireless network
that's running WEP is you know
frequently quite frequent and that's
completely broken protocol that you know
in about seven minutes you can fully
compromise but you know you think hey
this isn't a hospital and there's
pumps using WEP that are connected to
this wireless network that's terrifying
and so it's easy for me to say well just
upgrade in WPA2 and then you realize oh
well the vendor went out of business and
so there's no more firmware you know
upgrades available or to upgrade to that
is going to mean you know a 10 million
dollar roll out of all these new insulin
pumps that they've already invested
money in so so it's not an easy fix for
anything by any means and it's simple
for me to be up here and just to say ah
do it right you know don't do it wrong
there's a lot of considerations that
have to be taken
um yeah so understand what information
you're beginning out
um log your data have logs available the
amount of times that uh we run a
penetration test and I'm like oh well we
saw your Rogue access point and I was
like okay can you just give me some line
information so I can include that in the
report
and then I never hear anything back and
then I give him the report and it's like
log your data you know know what
wireless access points are out there
um and again it comes stock on on many
common platforms so just just Google it
yeah anyways questions comments want to
hear a joke
uh what do you run on the Raspberry Pi
is Holly or Kelly you're just or just
raspbian yeah Cali typically has like
the better libraries like everything
like kind of works whether you use
active install
um but you know when you install Cali
it's like oh great you get everything in
the kitchen sink installed on there
um and if you just want to keep it
leaner you can run just raspbian um I
don't do anything like again like I'm
not gonna like build my own custom pen
two thing I'm not that smart so
do you use open heart at all
yeah I use it for like some of our
captive portal like little devices
um it's yeah I mean like I use it
sometimes not all the time though
any other questions anybody want to sing
a song
Michael Aguilar right here no awesome
well thank you everybody
right here
[Music]