Wireless Village - Detcting the unseen adversary
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Escobar, Eric
Wireless security is often overlooked, or deemed "good enough". However, for many companies, access to the corporate Wi-Fi means direct access to the internal network. This talk will demonstrate a variety of opening attacks performed by threat actors whose goal it is to infiltrate your organization. These tactics are detectable to the vigilant sysadmin, but all too often go unnoticed in a sea of log files. Check out this talk for access to the "Free Public WiFi".
 Hey everyone, my name is Eric Escobar and today my talk is going to be on detecting the unseen adversary, which is really just wireless blue teaming with a snappy-sounding name to it. So this talk is going to be a one-cut take. There's going to be a lot of ums, a lot of us, a lot of me fumbling with my mouse trying to transition a slide. So this is going to be just as if I were up on stage and the demo gods are just going to be as much of a problem. So without further ado, let's talk about me. So I like to kind of pose the point that I'm the forever noob. The best thing about computers and computer security is that no one is ever going to know everything and the person that says that they do is just completely lying. I started off my professional career as a civil engineer. You know, I got my degrees in civil engineering to build bridges, dams and all these big things that you see out on the highway. I got the opportunity to basically be an analyst at a company. I got a great opportunity there. We started coming to DEF CON from I believe DEF CON 22. And from there I was competing in the wireless capture the flags. We won a couple of times and now I'm one of the village members and yeah, I get to help make the challenges. And my full-time job now is as a pentester for secure words where I basically just pentest wireless all day. And this talk is really one of these talks of stuff that isn't crazy super hackery, stuff that isn't completely unobtainable. It's a lot of simple tactics that I used to get into a lot of really large companies. And really this talk kind of stems from the fact that these are conversations that I have with my clients day in and day out. And it'd be really nice to point people in the direction of kind of like my overall summary of this stuff. Okay, so detecting the unseen adversary. It's like a super marketing title that I'm not in love with obviously, but whatever. I needed a tagline. So one of the things that I've discovered just doing wireless pentest is that a lot of my clients have robust logging and alerts for all of their internal network security and all their external network security. No one to say external, I'm talking about like the public internet. So they have firewalls that detect when scans get run. They can detect somebody doing some nefarious stuff on their internal environment. But they almost all fall down when it comes to detecting anything on their enterprise wireless. So any, you know, wids or whips, which is wireless intrusion prevention or intrusion detection. It's basically, you know, back into the 90s, you know, there are not a lot of companies that do it. And if they do anything regarding it, it's not, it's not really that robust and can get knocked over pretty easily. So some of the benefits of wireless attacks, I don't have to have any internal access to any to any network to any environment, you know, I have to sneak in anywhere, I don't have to clone keys, badges or do any of this, I can typically just post up in a park with a, you know, with a long range antenna or, you know, sit in some kind of lobby or common area and, you know, I don't need any special access like I would if I were going to try and plug in a device. It's way easier for me to stay anonymous and I can stay out of sight. And then especially if I'm attacking somebody's external infrastructure, there's really not any IP addresses that are going to be logged or anything along those lines that are going to get me caught or at least create a footprint. So that's a lot of the reasons why I like, you know, doing wireless from that kind of standpoint. This is kind of an old image, but this kind of goes back to my old kit of what I, you know, what was founded out of competing in the wireless CTF. Basically, it's just comprised of a little lithium or a little lipo battery. No, it's a whatever, just a little anchor battery connected to a Raspberry Pi and the Raspberry Pi has a USB, you know, wireless adapter that I can put in a monitor mode. That's an old TP-Link network adapter. It's, you know, old compared to today's standards. You know, now I use something like a Panda that can do 2.4 and 5 gigahertz frequencies. But at the end of the day, that can easily just fit in my pocket, fit in a backpack, and I can then use my phone to connect into that Raspberry Pi and simply have, you know, an Airmon screen or any of my normal tools that run off of, you know, whatever flavor of operating system that you want on the Raspberry Pi. I can sit there with this device in my pocket, pen testing your network, you know, just sitting like, you know, any other college student just, you know, leaned up against a wall, you know, wouldn't attract a ton of attention. I'm not going to be like, you know, some of the wireless CTF, you know, members or competitors that walk around with like a laptop in their face, you know, with all these antennas and porcupine, you know, stuff all over. I'm not going to be the Wi-Fi cactus or anything like that when I come to try and pen test your site. And this is just a screenshot of my iPhone, you know, just some of the things that I can see out of the glance. And again, if you just see somebody walk in with their cell phone, you're not going to think anything of it, right? And then this is something that we've taken on engagements where we've, you know, gone on to a large, large site that we have to walk around. And really, this is just a black backpack, you know, you'd have to look a little bit harder to see that there are actually a bunch of omnidirectional antennas along with, you know, a bunch of just different network adapters all put into this backpack. And it's one of those things that if you're not looking for it, you know, these antennas could easily be placed inside of the backpack. But at the end of the day, we've been able to do engagements that cover thousands of acres worth of, you know, worth of a client's site. And you know, there was full on, you know, public people there, there were, you know, staff there, there were security people there. And no one saw us, we didn't stick out at all just because we're normal people with normal backpacks. And again, it's one of those things that it's easy to remain unseen and still do nefarious things. Here's another clip of the backpack. Basically, it's just some larger anchor batteries hooked into multiple Raspberry Pis. And again, you can see on the right hand side, a bunch of omnidirectional antennas that are kind of just placed, you know, in not necessarily covert, but in a way that you'd have to really look at that to know what's going on. So I think one of the biggest things, the biggest plan on the wall here is rogue access points. At least I shouldn't say everybody, a large amount of my clients are all very concerned with rogue access points, but they really don't, they really don't have any idea what they say or what they mean when they talk about rogue access points. And really by definition, a rogue access point is just any wireless access point that's not within your control that, you know, that's in your airspace, you know, that your physical airspace that you do control where your access points might be. So I mean, really at the end of the day, technically any phone or any hotspot could be a rogue access point or it could be considered rogue access point. But that's not really what clients most care about. They most care about access points that are designed to mimic their own access points that then their users will connect to and get tricked into, you know, potentially providing credentials or some other type of data that they shouldn't, right? So I'll just give you a couple of access points of what rogue access point can do. There's this tool that I use from time to time called Wi-Fi Fisher. And essentially all that it does is it just stands up, you know, a hotspot with whatever name I want to give it and it will kick off users by de-authenticating them from their current network with the goal of having them connect to my rogue access point. And when they connect to my rogue access point, I send them to a captive portal. And the captive portal looks like a, you know, just a simple, it takes their user agent. So if they're coming from an iPhone, this would be like the iPhone Wi-Fi screen. This example is coming from a, you know, Windows 10 laptop. So when they open up their browser, it looks like, oh man, I need to type in my wireless network key. What most users don't realize, and most users, you know, aren't security people or tech wizards that are really going to, you know, analyze this. But if you have a full screen browser window open, you'll notice that that's all just rendered in the browser that, you know, what's asking for your key. Now if a user types in their key and hits next, that will then submit it to me in clear text because I run that web server. That's my rogue access point. And then it's configured in such a way that the second that they give me a valid credential, it will then shut down my rogue access point so that me as an attacker can just automatically just say, hey, okay, like I'm going to be quiet now. I'm not going to try and draw any more attention to myself. As one of those things that like, is this a crazy super sophisticated hacker technique? Absolutely not. Are people in the wireless village going to make fun of me for even probably talking about this? Sure. But at the end of the day, this has gotten me so many credentials that it's kind of sad. And this has, you know, been the downfall of so many corporate networks that it's, it's definitely worth mentioning because people use it and it works as an attack vector and people are tricked by it. Because at the end of the day, if you're watching this, you're probably a security minded person and you would probably say, oh man, there's no way that I would fall for it. But you know, take a, take a step back and think of everybody in your organization that, you know, that deals with Wi-Fi that deals with, you know, just any device that's connected to the internet, would they fall for it? Well, at the end of the day, I just need a single person to fall for it. And that's it. I need one person to fall for it. And then I have your, you know, in this case, it's a, you know, pre-shared key. So WPA2, PSK network. But there are other attacks such as ePammer that, you know, they can mimic a corporate internet, you know, that's WPA2 enterprise where a user were typing their credentials and then I could get hash credentials, clear text credentials if there's, you know, GTC downgrade. But really at the end of the day, this all surrounds, you know, rogue access points and somebody standing up an access point that mimics your own and being able to detect that it's happening because at the end of the day, I'd say that fewer than 10% of our clients even know when we stand up a rogue access point that they're even looking for it. And even if they're looking for it, they may not even get the alerts. I've had plenty of clients that have said like, oh yeah, we have rogue access point detection. And, you know, after the pen test, we went back and looked at our logs and we got all these alerts, but, you know, they were never configured to go anywhere. They were never, you know, configured to get acted upon really is the best case for that. And again, it seems super silly that this is all that my attack vector is is standing up rogue access point and hoping to fish some credentials. But at the end of the day, it works. And just the fact that it works is scary enough because it's a really old style kind of attack really. Rogue access points like I was talking about, they can lead to stolen credentials if you're using say ePammer to get WPA to enterprise credentials or in the case of Wi-Fi Fisher, you can use that for PSK. So just, you know, share a network key like you probably have at home, you know, and that can lead then to a full internal network compromise. So it can lead to compromise work stations. They can also, it can also basically lead to data being exfiltrated, right? So if if an end user connects to my access point, I can exfiltrate data off that system without it going through any of the normal controls or processes that it normally would. And then it can also allow users to circumvent corporate policies. So a lot of time that say, say your corporate, your corporation blocks Netflix or Facebook or something and users might connect their, their laptop or their mobile device that's work provided, they might connect it to another rogue access point in hopes that that they can circumvent that and that they can watch Netflix that they can do any other basically types of types of activities that would probably be blocked on any other network. So it's one of those things that that end users, you know, may not always get tricked. They might willingly connect to other access points to get to, you know, whatever stuff that they want to that's being blocked by corporate policies. And so this is this is one of these matrices that I kind of like to reference and use. It might seem a little bit dense, but really at the end of the day rogue access points are kind of summed up in this way. So the easiest rogue access point for, you know, corporation detect is an exact match of whatever the SSID is and SSID is just their wireless name. So so say that's like, you know, home network 123. So you would see then a second home network 123 with a MAC address of 0012, you know, all the way through 555. That would be the easiest to detect because that is completely different, you know, than your than your normal whatever your your normal MAC address would be. And that's just a hardware address that that is associated with that wireless radio. The next hardest would be then basically that exact same SSID with just some some random characters that, you know, just randomly a generated MAC address hardware address. Then as you kind of like go down that difficulty scale or up the difficulty scale, you're going to see it's going to be an exact match of that, you know, SSID with then a MAC address that's similar to the MAC addresses of the access points that you run. That might be harder for some, you know, for some intrusion prevention detection software to detect is something that's similar to what would be expected. And then if you're talking about a larger client, say I go to, you know, say they had say it's a bank, right, a bank will have multiple branches say I went to one bank and copied a MAC address from that site and took it to another branch, you know, in the same town or you know, same vicinity where wirelessly they won't touch, but they but that MAC address is at least valid on the network, right. And I stand that up as an access point. Well now the intrusion prevention detection system is not going to detect me because it is technically somewhere in the system. The controller will just not have any idea of the geography behind that. And so that's makes it harder to detect, you know, and then you keep going and then now you can make you say your SSID is just similar but not an exact match to to what that that Wi-Fi would be with again, random MAC addresses and then, you know, similar and then going down that same spectrum. At the end of the day, this is just something that an attacker can use and kind of see like, okay, well, you know, what level of sophistication does your does your monitoring hardware, you know, in detection system, what does that look like? Because for example here, say you were looking for an SSID that matched exactly and it was cloned from a MAC address of the same site. Well, what happens if there's some weird reflection or attenuation there that makes your wireless signals bounce from place to place? Well, if you're doing detection on a MAC address seen by different access point, now all of a sudden that gets a lot harder and a lot more complicated of a thing to program and it's probably going to generate a lot of false positives. So it's one of these things that at the end of the day, it's easy to say, oh man, we need, you know, row access point detection or row access point detection really is an entire, you know, suite of what is an attacker doing. And so it's really important just to kind of break down that nuance and see that, you know, some clients might, might see an exact match of 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, or maybe even random, but similar to known access points or cloned from a different site or the same site. That's typically not going to get picked up and it allows an attacker like myself, who's already, you know, attacking wirelessly and is not going to be seen. It allows me to basically not trigger any logs or trigger any detection, which again, you know, is there some software that can detect that? Absolutely. How many clients actually run it? Not a lot. Again, I probably didn't been detected less than 5, 10% of the time, which is kind of surprising. And this kind of brings me into simple is not the same thing as easy, right? Like all of these things that I've talked about, they're simple to understand, but they may not be that easy to configure, right? And that's an important distinction because just looking for excessive password spraying, you know, watching for devices that continually try credentials over and over and over and over again, there's been a number of sites where I basically just sprayed an access point with user credentials that I got off LinkedIn with the attempt of trying to authenticate to their access point. And eventually it worked. Sure, it took a long time. I spent all night trying to, you know, associate with credentials until a pair of them worked. But at the end of the day, that's all that it took. And if somebody was watching their logs, they would have seen, wow, 10,000 attempts. That seems a bit strange. But again, a lot of people don't look at their logs. And is that a simple thing for me to say? Yeah, absolutely. Is it easy? Definitely not. And then same thing, get alerts from rogue access points. A bunch of my clients will have, you know, software or some type of a controller available to them that will actually look for rogue access points. I mean, at home I run Ubiquiti. And it will, you know, if I check that box, it will determine, you know, hey, there's a rogue access point detected. I'm going to send you a push notification to your phone. There's a lot of end users, a lot of clients, a lot of corporations out there that don't even have that box checked. And even though their controller, even though whatever software they have is capable of seeing it, they don't even check the box. So they'll never even get that notification, even though their software, their controller, whatever it may be, has that, you know, out of the box as an option. And then have a plan to what to do when you do detect a rogue access point. That's one of those things that's like, cool, you detect a rogue access point. Now what? You know, depending on the size of your site, that might be just, you know, taking a walk around the office, or it might be trying to take a walk around a multi-acre, you know, area, or an entire campus, or an entire outdoor place, or an entire sporting arena. And so it's one of those things that, you know, you have to plan to the scale of your corporation, your company, your organization, whatever it may be, is to, you know, how are you going to locate these? Is your controller software, is it capable of saying, you know, this was seen from this access point or from this location? Or is that something you're going to have to deploy? Is there going to have to be somebody trained in that? A lot of times it's not enough just to detect them. You have to locate them to see, you know, is this somebody that was doing this nefariously, or is it, you know, some error in the system? Being able to distinguish that and being able to have a game plan for when that happens will make it less of a panic situation, right? And a lot of that is having a wireless pen test, right? Like knowing where your weakness is lie before you actually have to, you know, rely on your logs and rely on your locating, relying on pretty much everything, right? Really log your data. It's one of those things, it's simple. It's not easy, like to log your data and look at your logs. Because a lot of the times when I'm doing something, when I'm pen testing, all that data is probably logged somewhere or at least can be enabled or there's some logging software or, you know, something available to you, but people don't look at their logs, you know, SysAdmins have a busy job and typically don't look at their logs or really investigate that stuff or there may not even be a person dedicated to just wireless. It might just be the network security team and they don't even bother to ingest, you know, their wireless logs that are being generated. So again, all of these things, they're really simple. I feel a little bit sheepish giving to talk about how simple these things are. But each and every one of these things, you know, I haven't been done when I've been on a pen test at times and it's allowed me to compromise a full entire organization, you know, because any number of these, you know, or combination of these weren't done. But again, they're simple, but they're not easy to enact. And it's just one of those things. Again, these are simple ways that somebody could get in that typically aren't covered. Now okay, so like kind of switching gears, there's a bunch of other information that wireless devices emit and there's far more than this, but I just kind of want to give out the basics of it. But really devices, you know, they can allow users to be tracked, you can identify the type of device. You can see what devices are connected to what networks, just using tool like Airdump, which again is a super old tool, but still works great. You can take a look at the screen and if you're not familiar with the screen, then I'll kind of explain it right now. So if you look at the top left corner, there's BSS ID and that is basically, you know, the access point hardware address. And then down below you see the access point and then devices connected to that access point. And if you just take a quick look, you can see the power levels will kind of associate roughly with, you know, distance away from that access point, the power levels, what you'd be looking at. And then if you can see devices that are connected to that access point, well MAC addresses are basically handed out, or at least ranges of them are handed out to hardware manufacturers and they can be identified by just a couple of octets. And so if you were to plug in, so if you have a holo, I'll switch back. If you look at this, you'll see that basically, you know, that 18B430, if you're to plug that into Google, what that gets you is that it says, oh, that's Nest. And so from that I can say, okay, well, maybe they have a Nest camera on this network. Should I look for Nest cameras? You know, maybe there is a Nest thermostat, you know, and you can basically as an attacker, I don't need to know what your username, your password is. I don't need to know, you know, really anything else about your company organization or wireless networks because I can see all of that in the clear. I can see, you know, what the least types of devices are connected. And so really it's one of these things, I know I'm going to keep saying it over and over and over and over, but it's simple to detect somebody like me on your network, but it's typically not easy. And really I just kind of want this to be one of those wake up calls that, you know, if you are a sysadmin, if you do control wireless networks, to kind of take a look at the security policies, the monitoring capability that you have, because at the end of the day you don't want to be scrambling if you do detect something or if you do detect a breach or some weirdness. And again, I think just going back to this last slide and showing, you know, check for password spraying, you know, check for any rogue access points that are in your area, have a plan on how to locate them, you know, understand what data somebody like me can see, you know, know how far your access points, you know, broadcast, you know, log the data that you do collect, that you have the capability of collecting and then look at them from time to time and notice if there's anything strange or weird, and then maybe build some policies out to alert you if anything funky does look like it's happening. Again, I think this is all simple. It's not easy always to configure. So hopefully that was helpful. I will be around in the wireless village if anybody wants to send me questions, and maybe I'll add some contact information to this on the page after it gets posted. But again, I hope it's helpful. I know this may seem like a super one-on-one easy mode talk, but each and every one of these aspects is something that, you know, one of my clients has potentially not done that has led me to compromise their organization. And if everybody looked at this and kind of had this in the back of their mind, if you're a sysadmin that controls networks, or maybe you're not even a sysadmin that controls your wireless networks, but you could bring this to them, it would go pretty darn far. Because at the end of the day, everybody has logging in place for their external network infrastructure and for their internal network infrastructure. But wireless for some reason is the extension of your internal network beyond your walls potentially. And it can let somebody like me, or somebody worse than me, somebody who actually is trying to do some harm to your network in, and you won't even see them. You won't even know that they're there. They will be, you know, for your eyes unseen. Again, hopefully it's helpful. I know this may seem like kind of like a one-on-one-ish talk, but it might be something that you need to hear. So take it forward. It's worth. And if you have any questions, feel free to contact me and I'll be in Discord. All right. Of course I'm in Discord. All right, Areas.
 Hey everyone, my name is Eric Escobar and today my talk is going to be on detecting  the unseen adversary, which is really just wireless blue teaming with a snappy-sounding  name to it.  So this talk is going to be a one-cut take.  There's going to be a lot of ums, a lot of us, a lot of me fumbling with my mouse trying  to transition a slide.  So this is going to be just as if I were up on stage and the demo gods are just going  to be as much of a problem.  So without further ado, let's talk about me.  So I like to kind of pose the point that I'm the forever noob.  The best thing about computers and computer security is that no one is ever going to know  everything and the person that says that they do is just completely lying.  I started off my professional career as a civil engineer.  You know, I got my degrees in civil engineering to build bridges, dams and all these big things  that you see out on the highway.  I got the opportunity to basically be an analyst at a company.  I got a great opportunity there.  We started coming to DEF CON from I believe DEF CON 22.  And from there I was competing in the wireless capture the flags.  We won a couple of times and now I'm one of the village members and yeah, I get to help  make the challenges.  And my full-time job now is as a pentester for secure words where I basically just pentest  wireless all day.  And this talk is really one of these talks of stuff that isn't crazy super hackery, stuff  that isn't completely unobtainable.  It's a lot of simple tactics that I used to get into a lot of really large companies.  And really this talk kind of stems from the fact that these are conversations that I have  with my clients day in and day out.  And it'd be really nice to point people in the direction of kind of like my overall summary  of this stuff.  Okay, so detecting the unseen adversary.  It's like a super marketing title that I'm not in love with obviously, but whatever.  I needed a tagline.  So one of the things that I've discovered just doing wireless pentest is that a lot  of my clients have robust logging and alerts for all of their internal network security  and all their external network security.  No one to say external, I'm talking about like the public internet.  So they have firewalls that detect when scans get run.  They can detect somebody doing some nefarious stuff on their internal environment.  But they almost all fall down when it comes to detecting anything on their enterprise wireless.  So any, you know, wids or whips, which is wireless intrusion prevention or intrusion detection.  It's basically, you know, back into the 90s, you know, there are not a lot of companies  that do it.  And if they do anything regarding it, it's not, it's not really that robust and can get  knocked over pretty easily.  So some of the benefits of wireless attacks, I don't have to have any internal access to  any to any network to any environment, you know, I have to sneak in anywhere, I don't  have to clone keys, badges or do any of this, I can typically just post up in a park with  a, you know, with a long range antenna or, you know, sit in some kind of lobby or common  area and, you know, I don't need any special access like I would if I were going to try  and plug in a device.  It's way easier for me to stay anonymous and I can stay out of sight.  And then especially if I'm attacking somebody's external infrastructure, there's really not  any IP addresses that are going to be logged or anything along those lines that are going  to get me caught or at least create a footprint.  So that's a lot of the reasons why I like, you know, doing wireless from that kind of  standpoint.  This is kind of an old image, but this kind of goes back to my old kit of what I, you  know, what was founded out of competing in the wireless CTF.  Basically, it's just comprised of a little lithium or a little lipo battery.  No, it's a whatever, just a little anchor battery connected to a Raspberry Pi and the  Raspberry Pi has a USB, you know, wireless adapter that I can put in a monitor mode.  That's an old TP-Link network adapter.  It's, you know, old compared to today's standards.  You know, now I use something like a Panda that can do 2.4 and 5 gigahertz frequencies.  But at the end of the day, that can easily just fit in my pocket, fit in a backpack,  and I can then use my phone to connect into that Raspberry Pi and simply have, you know,  an Airmon screen or any of my normal tools that run off of, you know, whatever flavor  of operating system that you want on the Raspberry Pi.  I can sit there with this device in my pocket, pen testing your network, you know, just sitting  like, you know, any other college student just, you know, leaned up against a wall,  you know, wouldn't attract a ton of attention.  I'm not going to be like, you know, some of the wireless CTF, you know, members or competitors  that walk around with like a laptop in their face, you know, with all these antennas and  porcupine, you know, stuff all over.  I'm not going to be the Wi-Fi cactus or anything like that when I come to try and pen test your  site.  And this is just a screenshot of my iPhone, you know, just some of the things that I can  see out of the glance.  And again, if you just see somebody walk in with their cell phone, you're not going to  think anything of it, right?  And then this is something that we've taken on engagements where we've, you know, gone  on to a large, large site that we have to walk around.  And really, this is just a black backpack, you know, you'd have to look a little bit  harder to see that there are actually a bunch of omnidirectional antennas along with, you  know, a bunch of just different network adapters all put into this backpack.  And it's one of those things that if you're not looking for it, you know, these antennas  could easily be placed inside of the backpack.  But at the end of the day, we've been able to do engagements that cover thousands of  acres worth of, you know, worth of a client's site.  And you know, there was full on, you know, public people there, there were, you know,  staff there, there were security people there.  And no one saw us, we didn't stick out at all just because we're normal people with normal  backpacks.  And again, it's one of those things that it's easy to remain unseen and still do nefarious  things.  Here's another clip of the backpack.  Basically, it's just some larger anchor batteries hooked into multiple Raspberry Pis.  And again, you can see on the right hand side, a bunch of omnidirectional antennas that  are kind of just placed, you know, in not necessarily covert, but in a way that you'd  have to really look at that to know what's going on.  So I think one of the biggest things, the biggest plan on the wall here is rogue access  points.  At least I shouldn't say everybody, a large amount of my clients are all very concerned  with rogue access points, but they really don't, they really don't have any idea what  they say or what they mean when they talk about rogue access points.  And really by definition, a rogue access point is just any wireless access point that's not  within your control that, you know, that's in your airspace, you know, that your physical  airspace that you do control where your access points might be.  So I mean, really at the end of the day, technically any phone or any hotspot could be a rogue access  point or it could be considered rogue access point.  But that's not really what clients most care about.  They most care about access points that are designed to mimic their own access points that  then their users will connect to and get tricked into, you know, potentially providing credentials  or some other type of data that they shouldn't, right?  So I'll just give you a couple of access points of what rogue access point can do.  There's this tool that I use from time to time called Wi-Fi Fisher.  And essentially all that it does is it just stands up, you know, a hotspot with whatever  name I want to give it and it will kick off users by de-authenticating them from their  current network with the goal of having them connect to my rogue access point.  And when they connect to my rogue access point, I send them to a captive portal.  And the captive portal looks like a, you know, just a simple, it takes their user agent.  So if they're coming from an iPhone, this would be like the iPhone Wi-Fi screen.  This example is coming from a, you know, Windows 10 laptop.  So when they open up their browser, it looks like, oh man, I need to type in my wireless  network key.  What most users don't realize, and most users, you know, aren't security people or tech  wizards that are really going to, you know, analyze this.  But if you have a full screen browser window open, you'll notice that that's all just rendered  in the browser that, you know, what's asking for your key.  Now if a user types in their key and hits next, that will then submit it to me in clear  text because I run that web server.  That's my rogue access point.  And then it's configured in such a way that the second that they give me a valid credential,  it will then shut down my rogue access point so that me as an attacker can just automatically  just say, hey, okay, like I'm going to be quiet now.  I'm not going to try and draw any more attention to myself.  As one of those things that like, is this a crazy super sophisticated hacker technique?  Absolutely not.  Are people in the wireless village going to make fun of me for even probably talking about  this?  Sure.  But at the end of the day, this has gotten me so many credentials that it's kind of  sad.  And this has, you know, been the downfall of so many corporate networks that it's, it's  definitely worth mentioning because people use it and it works as an attack vector and  people are tricked by it.  Because at the end of the day, if you're watching this, you're probably a security minded person  and you would probably say, oh man, there's no way that I would fall for it.  But you know, take a, take a step back and think of everybody in your organization that,  you know, that deals with Wi-Fi that deals with, you know, just any device that's connected  to the internet, would they fall for it?  Well, at the end of the day, I just need a single person to fall for it.  And that's it.  I need one person to fall for it.  And then I have your, you know, in this case, it's a, you know, pre-shared key.  So WPA2, PSK network.  But there are other attacks such as ePammer that, you know, they can mimic a corporate  internet, you know, that's WPA2 enterprise where a user were typing their credentials  and then I could get hash credentials, clear text credentials if there's, you know, GTC  downgrade.  But really at the end of the day, this all surrounds, you know, rogue access points and  somebody standing up an access point that mimics your own and being able to detect that it's  happening because at the end of the day, I'd say that fewer than 10% of our clients even  know when we stand up a rogue access point that they're even looking for it.  And even if they're looking for it, they may not even get the alerts.  I've had plenty of clients that have said like, oh yeah, we have rogue access point detection.  And, you know, after the pen test, we went back and looked at our logs and we got all  these alerts, but, you know, they were never configured to go anywhere.  They were never, you know, configured to get acted upon really is the best case for that.  And again, it seems super silly that this is all that my attack vector is is standing  up rogue access point and hoping to fish some credentials.  But at the end of the day, it works.  And just the fact that it works is scary enough because it's a really old style kind of attack  really.  Rogue access points like I was talking about, they can lead to stolen credentials if you're  using say ePammer to get WPA to enterprise credentials or in the case of Wi-Fi Fisher,  you can use that for PSK.  So just, you know, share a network key like you probably have at home, you know, and that  can lead then to a full internal network compromise.  So it can lead to compromise work stations.  They can also, it can also basically lead to data being exfiltrated, right?  So if if an end user connects to my access point, I can exfiltrate data off that system  without it going through any of the normal controls or processes that it normally would.  And then it can also allow users to circumvent corporate policies.  So a lot of time that say, say your corporate, your corporation blocks Netflix or Facebook  or something and users might connect their, their laptop or their mobile device that's  work provided, they might connect it to another rogue access point in hopes that that they  can circumvent that and that they can watch Netflix that they can do any other basically  types of types of activities that would probably be blocked on any other network.  So it's one of those things that that end users, you know, may not always get tricked.  They might willingly connect to other access points to get to, you know, whatever stuff  that they want to that's being blocked by corporate policies.  And so this is this is one of these matrices that I kind of like to reference and use.  It might seem a little bit dense, but really at the end of the day rogue access points are  kind of summed up in this way.  So the easiest rogue access point for, you know, corporation detect is an exact match  of whatever the SSID is and SSID is just their wireless name.  So so say that's like, you know, home network 123.  So you would see then a second home network 123 with a MAC address of 0012, you know,  all the way through 555.  That would be the easiest to detect because that is completely different, you know, than  your than your normal whatever your your normal MAC address would be.  And that's just a hardware address that that is associated with that wireless radio.  The next hardest would be then basically that exact same SSID with just some some random  characters that, you know, just randomly a generated MAC address hardware address.  Then as you kind of like go down that difficulty scale or up the difficulty scale, you're going  to see it's going to be an exact match of that, you know, SSID with then a MAC address  that's similar to the MAC addresses of the access points that you run.  That might be harder for some, you know, for some intrusion prevention detection software  to detect is something that's similar to what would be expected.  And then if you're talking about a larger client, say I go to, you know, say they had  say it's a bank, right, a bank will have multiple branches say I went to one bank and copied  a MAC address from that site and took it to another branch, you know, in the same town  or you know, same vicinity where wirelessly they won't touch, but they but that MAC address  is at least valid on the network, right.  And I stand that up as an access point.  Well now the intrusion prevention detection system is not going to detect me because it  is technically somewhere in the system.  The controller will just not have any idea of the geography behind that.  And so that's makes it harder to detect, you know, and then you keep going and then now  you can make you say your SSID is just similar but not an exact match to to what that that  Wi-Fi would be with again, random MAC addresses and then, you know, similar and then going  down that same spectrum.  At the end of the day, this is just something that an attacker can use and kind of see like,  okay, well, you know, what level of sophistication does your does your monitoring hardware,  you know, in detection system, what does that look like?  Because for example here, say you were looking for an SSID that matched exactly and it was  cloned from a MAC address of the same site.  Well, what happens if there's some weird reflection or attenuation there that makes your wireless  signals bounce from place to place?  Well, if you're doing detection on a MAC address seen by different access point, now all of  a sudden that gets a lot harder and a lot more complicated of a thing to program and  it's probably going to generate a lot of false positives.  So it's one of these things that at the end of the day, it's easy to say, oh man, we need,  you know, row access point detection or row access point detection really is an entire,  you know, suite of what is an attacker doing.  And so it's really important just to kind of break down that nuance and see that, you  know, some clients might, might see an exact match of 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, or maybe  even random, but similar to known access points or cloned from a different site or the same  site.  That's typically not going to get picked up and it allows an attacker like myself, who's  already, you know, attacking wirelessly and is not going to be seen.  It allows me to basically not trigger any logs or trigger any detection, which again, you  know, is there some software that can detect that?  Absolutely.  How many clients actually run it?  Not a lot.  Again, I probably didn't been detected less than 5, 10% of the time, which is kind of surprising.  And this kind of brings me into simple is not the same thing as easy, right?  Like all of these things that I've talked about, they're simple to understand, but they may  not be that easy to configure, right?  And that's an important distinction because just looking for excessive password spraying,  you know, watching for devices that continually try credentials over and over and over and  over again, there's been a number of sites where I basically just sprayed an access point  with user credentials that I got off LinkedIn with the attempt of trying to authenticate  to their access point.  And eventually it worked.  Sure, it took a long time.  I spent all night trying to, you know, associate with credentials until a pair of them worked.  But at the end of the day, that's all that it took.  And if somebody was watching their logs, they would have seen, wow, 10,000 attempts.  That seems a bit strange.  But again, a lot of people don't look at their logs.  And is that a simple thing for me to say?  Yeah, absolutely.  Is it easy?  Definitely not.  And then same thing, get alerts from rogue access points.  A bunch of my clients will have, you know, software or some type of a controller available  to them that will actually look for rogue access points.  I mean, at home I run Ubiquiti.  And it will, you know, if I check that box, it will determine, you know, hey, there's  a rogue access point detected.  I'm going to send you a push notification to your phone.  There's a lot of end users, a lot of clients, a lot of corporations out there that don't  even have that box checked.  And even though their controller, even though whatever software they have is capable of  seeing it, they don't even check the box.  So they'll never even get that notification, even though their software, their controller,  whatever it may be, has that, you know, out of the box as an option.  And then have a plan to what to do when you do detect a rogue access point.  That's one of those things that's like, cool, you detect a rogue access point.  Now what?  You know, depending on the size of your site, that might be just, you know, taking a walk  around the office, or it might be trying to take a walk around a multi-acre, you know,  area, or an entire campus, or an entire outdoor place, or an entire sporting arena.  And so it's one of those things that, you know, you have to plan to the scale of your  corporation, your company, your organization, whatever it may be, is to, you know, how are  you going to locate these?  Is your controller software, is it capable of saying, you know, this was seen from this  access point or from this location?  Or is that something you're going to have to deploy?  Is there going to have to be somebody trained in that?  A lot of times it's not enough just to detect them.  You have to locate them to see, you know, is this somebody that was doing this nefariously,  or is it, you know, some error in the system?  Being able to distinguish that and being able to have a game plan for when that happens  will make it less of a panic situation, right?  And a lot of that is having a wireless pen test, right?  Like knowing where your weakness is lie before you actually have to, you know, rely on your  logs and rely on your locating, relying on pretty much everything, right?  Really log your data.  It's one of those things, it's simple.  It's not easy, like to log your data and look at your logs.  Because a lot of the times when I'm doing something, when I'm pen testing, all that  data is probably logged somewhere or at least can be enabled or there's some logging software  or, you know, something available to you, but people don't look at their logs, you know,  SysAdmins have a busy job and typically don't look at their logs or really investigate that  stuff or there may not even be a person dedicated to just wireless.  It might just be the network security team and they don't even bother to ingest, you  know, their wireless logs that are being generated.  So again, all of these things, they're really simple.  I feel a little bit sheepish giving to talk about how simple these things are.  But each and every one of these things, you know, I haven't been done when I've been on  a pen test at times and it's allowed me to compromise a full entire organization, you  know, because any number of these, you know, or combination of these weren't done.  But again, they're simple, but they're not easy to enact.  And it's just one of those things.  Again, these are simple ways that somebody could get in that typically aren't covered.  Now okay, so like kind of switching gears, there's a bunch of other information that  wireless devices emit and there's far more than this, but I just kind of want to give  out the basics of it.  But really devices, you know, they can allow users to be tracked, you can identify the type  of device.  You can see what devices are connected to what networks, just using tool like Airdump,  which again is a super old tool, but still works great.  You can take a look at the screen and if you're not familiar with the screen, then I'll kind  of explain it right now.  So if you look at the top left corner, there's BSS ID and that is basically, you know, the  access point hardware address.  And then down below you see the access point and then devices connected to that access  point.  And if you just take a quick look, you can see the power levels will kind of associate  roughly with, you know, distance away from that access point, the power levels, what  you'd be looking at.  And then if you can see devices that are connected to that access point, well MAC addresses  are basically handed out, or at least ranges of them are handed out to hardware manufacturers  and they can be identified by just a couple of octets.  And so if you were to plug in, so if you have a holo, I'll switch back.  If you look at this, you'll see that basically, you know, that 18B430, if you're to plug that  into Google, what that gets you is that it says, oh, that's Nest.  And so from that I can say, okay, well, maybe they have a Nest camera on this network.  Should I look for Nest cameras?  You know, maybe there is a Nest thermostat, you know, and you can basically as an attacker,  I don't need to know what your username, your password is.  I don't need to know, you know, really anything else about your company organization or wireless  networks because I can see all of that in the clear.  I can see, you know, what the least types of devices are connected.  And so really it's one of these things, I know I'm going to keep saying it over and  over and over and over, but it's simple to detect somebody like me on your network, but  it's typically not easy.  And really I just kind of want this to be one of those wake up calls that, you know,  if you are a sysadmin, if you do control wireless networks, to kind of take a look at the security  policies, the monitoring capability that you have, because at the end of the day you don't  want to be scrambling if you do detect something or if you do detect a breach or some weirdness.  And again, I think just going back to this last slide and showing, you know, check for  password spraying, you know, check for any rogue access points that are in your area,  have a plan on how to locate them, you know, understand what data somebody like me can  see, you know, know how far your access points, you know, broadcast, you know, log the data  that you do collect, that you have the capability of collecting and then look at them from time  to time and notice if there's anything strange or weird, and then maybe build some policies  out to alert you if anything funky does look like it's happening.  Again, I think this is all simple.  It's not easy always to configure.  So hopefully that was helpful.  I will be around in the wireless village if anybody wants to send me questions, and maybe  I'll add some contact information to this on the page after it gets posted.  But again, I hope it's helpful.  I know this may seem like a super one-on-one easy mode talk, but each and every one of  these aspects is something that, you know, one of my clients has potentially not done  that has led me to compromise their organization.  And if everybody looked at this and kind of had this in the back of their mind, if you're  a sysadmin that controls networks, or maybe you're not even a sysadmin that controls your  wireless networks, but you could bring this to them, it would go pretty darn far.  Because at the end of the day, everybody has logging in place for their external network  infrastructure and for their internal network infrastructure.  But wireless for some reason is the extension of your internal network beyond your walls  potentially.  And it can let somebody like me, or somebody worse than me, somebody who actually is trying  to do some harm to your network in, and you won't even see them.  You won't even know that they're there.  They will be, you know, for your eyes unseen.  Again, hopefully it's helpful.  I know this may seem like kind of like a one-on-one-ish talk, but it might be something that you need  to hear.  So take it forward.  It's worth.  And if you have any questions, feel free to contact me and I'll be in Discord.  All right.  Of course I'm in Discord.  All right, Areas.
DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_0_623.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_624_2543.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_2544_3887.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_3888_4943.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_4944_5987.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_5988_6695.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_6696_7115.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_7116_8411.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_8412_8951.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_8952_10343.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_10344_10895.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_10896_15323.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_15324_17195.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_17196_22583.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_22584_25127.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_25128_28763.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_28764_29351.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_29352_30359.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_30360_30431.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_30432_30671.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_30672_32171.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_32172_32219.png DEF_CON_Safe_Mode_Wireless_Village_-_Eric_Escobar__NtiqbJi33EY_32220_35131.png