How to build Big Brother With blackjack and h--kers€¦ · How to build Big Brother With blackjack...

How to build Big Brother With blackjack and h--kers

Yunusov Timur, Senior expert, Head of dept

How to build Big Brother With blackjack and h--kers With 3G modems and hackers Yunusov Timur, Senior expert, Head of dept

How to build Big Brother

When/Who/Where/Andwhy???

•   2014-2015



•   2014-2015•   «rootviaSMS»SCADAStrangeLoveh@ps://youtu.be/T9AFFIVpCa8

•   Russiaandthewholeworld



•   2014-2015•   «rootviaSMS»SCADAStrangeLoveh@ps://youtu.be/T9AFFIVpCa8

•   Russiaandthewholeworld•   Causenobodycares(((


Boringnumbers


Boringnumbers

•   >10(8diff)3G/4Gmodems/routers•   75%vulnstoRCE/fwmodifica]on•   60%RCEare0days


Boringnumbers

•   ~60000devices/1M/Telco•   5000devices/1W/SecurityLab•   100%vulnstoRCE/fwmodifica]on


How?


How?

+


How?1.   Iden]fica]on2.   Codeinjec]on3.   Dataintercep]on4.   SIMcloning/GSMA@acks5.   HostInfec]on6.   APT7.   Returnto1.


Iden]fica]on


Iden]fica]on•   WHOIS?


Iden]fica]on<imgsrc="h@p://192.168.0.1/img/1.png"style="height:0;width:0;"onload="set('1')"><imgsrc="h@p://192.168.0.1/img/2.jpg"style="height:0;width:0;"onload="set('2')"><imgsrc="h@p://hostname/img/3.png"style="height:0;width:0;"onload="set('3')"><imgsrc="h@p://127.0.0.1:5000/request"style="height:0;width:0;"onload="set('4')">


Iden]fica]on•   GeoIP?


CodeInjec]on•   Publicexploits+oldFW•   Blackbox•   FWAccess+FWRE+IDA•   FWmodifica]on+Arbitraryupload


CodeInjec]on•   Publicexploits+oldFW


CodeInjec]on•   Blackbox

•   ?ac]on=ping||shutdown–r0||•   ?date=;pingblahblah.com;


CodeInjec]on•   Blackbox


CodeInjec]on•   FWAccess+FWRE+IDA•   Gree]ngs:

•   KirillNesterov,•   DmitrySklyarov


CodeInjec]on•   FWmodifica]on+Arbitraryupload



•   Integritya@acks



•   Integritya@acks•   Remoteupload(CSRF/XSS)



•   Integritya@acks•   Remoteupload(CSRF/XSS)•   Localupload(diagmode)



•   Integritya@acks


FWIntegrityControl•   FWencryptedviaRC4•   RSADigitalSignature+SHA1


FWIntegrityControl


FWIntegrityControl•   FWencryptedviaRC4


FWIntegrityControl•   FWencryptedviaRC4

•   Constantkeystream FAIL•   Part1XORPart2 FAIL•   FW1XORFW2 FAIL•   Lotofplaintext(CDROM) FAIL


FWIntegrityControl•   FWencryptedviaRC4 FAIL


FWIntegrityControl•   RSADigitalSignature+SHA1

•   AR:!<arch>:•   FW•   pkginfo:<7742526>•   Sign=RSA(SHA1(FW[0..7742526]))



•   ar--adddata.tar.gz•   ar-v

•   data.tar.gz•   sign•   pkginfo•   data.tar.gz


FWIntegrityControl•   RSADigitalSignature+SHA1 FAIL

•   ar--adddata.tar.gz•   ar-v

•   data.tar.gz•   sign•   pkginfo•   data.tar.gz


FWupload/CSRF

h@p://blog.kotowicz.net/2011/04/how-to-upload-arbitrary-file-contents.html


FWupload/XSS•   HUAWEIPSIRT436642(2015-05-29)

h@p://www1.huawei.com/en/security/psirt/security-bulle]ns/security-no]ces/archive/hw-436642.htm


Dataintercep]on•   CellID•   WiFi•   SMS•   HTTP•   SSL


Dataintercep]on•   CellID

•   h@p://opencellid.org/+XSS


Dataintercep]on•   WiFi


Dataintercep]on•   SMS


Dataintercep]on•   HTTP

•   ARP-spoofing•   DNS-spoofing


Dataintercep]on•   SSL

•   HostRCE


SIMCloning•   FakeBTS+BinarySMS•   GEO(!)•   IMSI

h@ps://media.blackhat.com/us-13/us-13-Nohl-Roo]ng-SIM-cards-Slides.pdf


SIMCloning•   UseTheForce


SIMCloning•   Diagmode


SIMCloning•   SendATcommands

•   AT+CMGF=0


GSMA@acks•   Huawei:Remote(!)osmocommforbeggars•   VxWorksonbasebandhi6920

―LoadedbyLinux―Packedonflash―dmesg=>loadvxworksok,entey0x50d10000―Cshell •OScommunica]on •Buil]ndebuger―Nearlyallnamesofobjects/func]ons―POSIX+documenta]on


HostInfec]on•   BadUSB•   Fakediagnos]ctools/CDROM•   HTMLInjec]on+0day•   Evenrealdiagnos]ctools=))


HostInfec]on•   BadUSB

•   Androidgadgetdriver(supported_func]onspatching)

•   HIDGadgetonboard!•   Lotsofboringstuff


HostInfec]on•   DriveByDownload•   CDROM


HostInfec]on•   HTMLInjec]on+0day


HostInfec]on•   Kudosto@cyberpunkych•   Lotsofotherstuffatyota.hlsec.ru•   Butnobodycares(((


APT


APT•   Subscribersa@acksSubscribers

•   LISTEN0.0.0.0:80•   Firewalls


Boringnumbers


Funnumbers

•   RemoteCodeExecu]onviaWEB:5dev•   ArbitraryFWmodifica]on(rem/loc):6dev•   CSRF:5dev•   XSS:4dev


DEMO


Kudos

•   @cyberpunkych•   D.Sklyarov•   K.Nesterov•   Al.Osipov•   @SCADASL

Stay secure! Questions?

How to build Big Brother With blackjack and h--kers€¦ · How to build Big Brother With blackjack...

Documents

Transcript of How to build Big Brother With blackjack and h--kers€¦ · How to build Big Brother With blackjack...