PHILIP POLSTRA: All right, guys.
Just want to talk a little bit about how
with your own little pentest army.
So as you can see, by the way,
I social engineered myself.
I'm very proud of that.
I social engineered myself a title
at the University of Redacted.
So what is this talk about anyway?
I am going to talk a little bit
with some small low power devices.
It turns out that
devices in the BeagleBoard family
is pretty much made my own custom
And The Deck is essentially
out of backtrack and none
The stuff that people haven't used
I didn't port that stuff.
I ported everything else.
I'll talk very briefly about porting stuff
I don't want to focus on that too much.
A lot of the stuff I want to talk
Mostly just so it's in the slides, it's
up later.
Ask me questions, whatever.
I also want to talk
coordinated attacks
of pentesting minions.
So who am I anyway?
I am a Prof at the University
in residence somewhere in the Midwest.
I have been programming
Been hacking hardware since I was 12.
Also been known to fly some planes,
What I'm going to talk
a platform that was appropriate,
a base OS, building a base system
getting some tools
and also talk
get things out of a repository;
for a little arm-based device?
I'll move into networking
Talk to you guys a little bit, talk
and I'll have some demonstrations.
I apologize, via screen shot.
As we all know live demos are never
in a crowd this size.
But I will be available later
to get touchy-feely with some
Talk about attack networks
So picking a platform.
This is my criteria.
I wanted something that was small,
Something I could afford.
You know, I don't make much
Something that was mature,
good community support.
Had some nice input
And the winning platform, I kind
is the BeagleBoard family of devices.
In particular I started out doing this
a desktop replacement device
to having something that runs
the new BeagleBone Black,
Pretty cheap stuff, BeagleBoard XM,
The BeagleBone Black lists
for less than list price
Half a gig of RAM.
Networking, USB, DVID output,
Here is a little picture
This is stolen
It gives you some of the specs.
You can see it's three and
It's pretty small.
And here is the other device that you
if you were starting today.
This is the BeagleBone Black,
All right?
This came out in late April.
It lists for 45 bucks.
I've spent an average of $42
It's a nice piece of hardware.
I know at least somebody is going
Well, here is why I didn't use the Pi.
The Pi is not near as powerful.
Doesn't run to Ubuntu.
It has ancient ARM are architecture that
It is not as mature, the platform.
The original BeagleBone has been
There is no cost savings, if any.
I think if you try
you would spend more money,
Even now it's not easy to go buy 50 Pis,
A lot
with flakey boards.
Also even though they are not
they consume
So you know, I've talked to a lot
with the Pi and I hear a couple
I hear the: I never got it
you know, Raspion and that stuff never
I also hear it worked great two weeks
the Flakey power circuits failed.
And then the other,
story I hear is yeah, I wanted
and then it wasn't powerful enough.
But it can flash LEDs!
It's really cool.
(Cheering.) PHILIP POLSTRA: Blink
I think I'm doing something
You can judge for yourselves here,
Now that I've selected a device,
to start with.
Well, again unlike the Pi,
it actually comes with an OS
They even give you a power cable
Amazing, don't have to buy extra stuff.
So it comes
most people never heard
like to do embedded Linux stuff.
It is not a bad distro, it's optimized
it's not the best.
The guys who made it initially aren't
They didn't say hey, I want
on my little board.
Until recently, nobody was doing that.
So I chose the Ubuntu.
It's available, as you all probably know,
Lot a support in the community
So now that I have
to go about installing it.
So on the Beagles,
it has two gig
enough for me.
The image for The Deck
I have just a few tools in there.
I forgot, though,
in there to blink LEDs, but I didn't do it.
I apologize.
(Chuckles.) PHILIP POLSTRA: You're
Maybe I'll add it.
So what you want to do,
an image and if you're going
Get their images or there's
Nelson.
He writes stuff for images all day.
I chose to use his branch for it
You can find good instructions
at the link provided if you want
So now I have a device.
Got a starting point.
I've ported some of the tools
of the tools.
So what is the easiest thing?
Well, I want this tool.
App, get, install, pray, right?
And a lot of times you get lucky.
Now, sometimes you don't get quite
A lot of people like Ubuntu.
A lot of times if you can't get that
a dev final and use D-package
In case of a dev file, what I found is,
on an interpreted language like PERL,
to work pretty well kind
If it's a C-based program,
you are probably okay as well.
Now, sometimes you actually have
Now, in my experience this was roughly
So 90 percent
and it worked or I got some dev files
and it worked.
A couple times you actually have
So you have to build this stuff,
You have to say: Do I want to build it
Or do I want to build it
and gobs of RAM?
If you build it on the Beagle, it has
of being pretty straightforward.
It has the disadvantage
if it's a big program.
Of course, you can cross compile,
but you can take advantage
All right.
So if you're going to go
Do a pseudo-app get,
and not plural.
I don't know why, but that's
You are pretty much on your way.
Download the code, do
Something to keep in mind
the BeagleBoard XM, be aware
in there and use DHCP,
you get a new Mac address
If you wonder,
Just don't ever turn it off; you'll be fine.
All right.
I'm not going to cover this in detail.
I just want to include this in the slides,
The most simple way
you download
the standard thing.
You go get your source code
make install, and
The only difference is if you look
says configure and then there's a dash,
All that is telling the compiler is: Hey,
I'm not building
whatever machine I'm running
I want to compile
And other than that, it's pretty much
for your own machine.
You can be a little bit more fancy.
You can start using Eclipse.
And there's some good instructions
And if you get really, really fancy
I prefer you
a link to that at the bottom of the page,
If you have questions about this stuff,
Okay.
So now we have a device.
We select a device.
We have an OS.
We ported all of our tools over.
Now let's talk about networking.
How many of you are familiar
All right, like maybe ten of you.
Not a lot.
All right.
Also sometimes called XB networking.
Sometimes you might hear
is built on top of Zigbee.
I'm going to give you a brief overview
Talk about some of the hardware,
2XB radios and some slightly harder
up to the hard stuff where you're doing
So typically you'll find these XB
in industrial settings when people are
with low power embedded devices.
They like to use XBs and
They usually come in two flavors.
They have the basic ones,
you know, of one,
And then we have
of up to a mile.
They have two different modes
They have what we call AT mode which
of the olders among us you might
It's from these things called modems.
Some of you are like, I heard
(Chuckles.) PHILIP POLSTRA: It's
And it supports a lot
as peer-to-peer networks,
It's by a company called Midgy
They have pro formats.
They are interchangeable
I can have a network where part
the regular adapters and part
the pro adapters and that works.
They interoperate just fine.
One thing that is a pain
they use a 2-millimeter spacing.
Not the standard 2.54-millimeter
You have to get some sort of adapter.
A lot of different antenna options.
When you're buying these things,
You'll see series one and series two
to as ZB adapters.
You can interoperate's and pro,
and series two together.
So buy all the same kind, okay?
So if you get these little XB modules
pretty much what you can do
those are the easiest way of doing this,
plug it into your computer.
They provide some software you can
You set up different things.
You configure each of these modems.
You give it a baud rate.
Tell it what kind of device it should be,
You set the channel and you also set
You can choose something great
You know or you can -- probably
but you can change it.
You pick a destination low address
And it is pretty simple.
I'll talk about the different modes that it
And you just write this information
Then you label it with a piece of tape
all confused because they all look
And go forth and do some XB
All right.
So what is the absolute simplest thing
You have one drone and you just want
So I might have one little drone device
to sit maybe
My lunch box, of course, has
Why is it Buzz Lightyear?
I'm going to hack you to infinity
By default these XB adapters are meant
Basically what it does, if you set
of these are pointing at each other,
So stuff just goes back and forth using
And you can do this and then set
which again some
Something that people used
So it is pretty simple.
There's a lot of information
up and you can do it.
That's one way you can go.
Now, you can go and do
of thing and have multiple drones.
All you need to do
of those drones is having
of your command center and
For them, they think that it's exclusive.
It's like they are
or something.
They all think it's just them.
They don't know about the rest.
And it's pretty simple.
You don't have to do any programming.
You can just use the AT commands.
How does that work?
You open
If you want to change something,
is hit plus three times.
Wait a little bit and it will say okay.
Then you can give it
as this command that says hey,
I can talk to this drone now.
And then I can go and write those
I can also use an API mode which
The nice thing about API mode
It's a lot better performance.
And error correction, all that good stuff.
By the way, a little tip.
If you didn't configure
and you're standing there
why isn't it do anything?
You think it's my Python scripting.
It's probably just that you
There are different ways that you can
You can use Java.
There's a Java protocol and a library
There's a Python library, which I use.
Or if you want to kick it old school,
You can do that.
I recommend that you use API mode
So you can also go to multiple drones.
Again, this
networking at this point.
It's really point to multi-point.
And you set up this peer
performance and all that.
So it's a good thing.
All right.
One possibility you can do is what I did.
You can write some simple Python
a command center and then have
and just wait.
Wait for commands on the XB.
You know, wait for commands
It's not a line or wire, I guess,
One down side
you can't run an interactive program,
the way I've done my scripting.
But it does work pretty well.
You can send commands.
You can get responses.
There's also a facility in there
I might say: Hey, you drone over here,
When it's done, it send me
Hey, Phil, guess what?
The password was: Password 1.
So all the code
about today is available
but I'll give you some of the highlights.
If you need to do
you can do it.
One thing that is cool
to change anything.
There's no changes in your scripts.
It all just works.
All right?
You can take
in series 2 modules.
Really, it's a matter
before you plug them into your drones.
Something to keep in mind, though, if,
as a router, routers are not allowed
because routers that don't respond are
End devices are allowed to sleep
What is the simplest case?
Again, let's back up a little bit.
We selected a device, got our OS,
And figured out how to do
Well, the simplest case,
You set it up.
And you can hack from a distance.
What is the advantage of this?
It is running 24/7.
You are not suspiciously sitting
on your van.
(Laughter.) PHILIP POLSTRA: It's
That's the famous FBI van number 6,
Little story on that.
Last weekend I was at maker fair
I was running some of this stuff.
Someone came up to my booth
there's FBI van number 6 right there.
I was like dude, I know it's you.
I mean, dude, you're 6 inches
the strongest signal.
So I'm pretty sure you're FBI van
So okay, you can lounge by the pool
Especially if you go someplace
You want to sit by the pool or whatever,
Other things you can do.
You can have multiple drones.
And you can interopt with each
Use your imagination, okay?
Again, I want to reiterate, one
can you get things
Of course you can.
Of course, the nice thing
and every one of them has a full copy
So they each have six gig worth
So you don't have to go oh,
You know, it's on there.
It's pretty much all there.
And again you can retest drones
and such.
All right.
So let's talk a little bit
So you want to build accessories.
This picture here
Right?
So first thing you want to do
You can see the scale.
It's pretty small.
It's next to an SD card.
So you want to power your drones.
I'm not doing anything real fancy here.
I'm using a 7805 linear power regulator
in order to smooth stuff out.
And battery or two, right?
A word on batteries.
Now, I just showed you a picture
That works great and 9-volts are nice
but it's not really figures.
For one thing, I'm dropping 9 volts to 5.
I'm wasting a lot of energy.
It all goes to heat.
Also 9-volt batteries don't have
compare them to things like D-cells
Something to keep in mind.
Other things to keep
You can have a BeagleBoard
blast, right?
Running 100 percent CPU
Like 1.1-watts or so of power.
Not a lot.
How much do you think
It's over 2.
And it does less.
But witness doesn't matter.
All you can do is blink LEDs
That's all good.
One thing to keep
networks, they do use power,
Don't sit there and transmit constantly.
Make use of things
So some power options.
Here we have a couple of options.
USB capable, different power adapters,
see some
We've got one with two 9-volt clips
on you and another one
80215 hardware looks like this.
Here I just made some simple adapters
Four wires that you have to solder.
Here is the same thing in a little case.
By the way,
It doesn't look like an XB.
In order to get it in my little case,
That's why you don't see an antenna
You probably need an adapter
Again you can get two kinds
You can get a UART or serial adapter.
It's basic and you have four wires
You can also get a USB adapter.
You're probably going to want
to hook it up to your PC and
You don't have to solder or anything.
So if you're connecting it
the USB adapter there's nothing to do.
Just plug it in.
If you have the UART adapter,
You can find more details about that
You have to tell the Beagle: Hey, this
all right?
A little note on that.
The older BeagleBone,
an older kernel version.
There was a way of doing this stuff.
You just have
The new BeagleBone Black uses
They changed how stuff works.
I don't have time to go
Have a look
home to have a nice detailed article
All right.
Other hardware.
Capes or if you're familiar with Arduino,
in the BeagleBone world.
Something I'm working on now,
by some folks
like to solder, which is cool.
I like to solder.
We are working on developing
a network switch so you can inline it
in case you need some more USB
80211 buy fine and maybe
That's something that might be coming
Other things are in terms of hardware,
for your stuff.
I have my GI Joe backpack,
If you look inside, it looks like this.
The touch screen, Beagle
USB hub, keyboard, mouse,
All right.
This is just an example of minus
how could you make it plannable?
Get a USB power cable, get
plugs someone's network
Plug your power into their USB port
until they clean under their desk.
Which happens a lot, right?
You go to the offices,
under their desk every day.
Or every five years, seems like.
Pretty cool.
All right.
There we go.
Other things you can do.
This is just showing you
Okay, so for the rest
to real quick show you what kinds
starting with what can you do,
and what could you do
and put it together, all right?
Here is the first demo.
Some of you might recognize
as last year's DEF CON CD.
Run it on my lunch box, in an NMap
I see -- I don't know how visible.
It's kind of visible.
I tried to highlight some stuff.
Oh, there's something running
That tells me it's probably what kind
AUDIENCE: Windows.
PHILIP POLSTRA: Windows!
Our favorite target.
So port 445 means let's try our favorite
What is our favorite in the whole world?
AUDIENCE: 067.
PHILIP POLSTRA: 067, right?
It's at every Con.
So sure enough,
and successfully getting the shell
You Raspberry Pi people,
I'm running exploit.
But your LEDs are cool.
What about something else?
Crack a LIM WiFi.
Run Airmon.
Do some scanning.
Find someone to attack.
This guy has a great password.
Password 1.
It is!
So you know, crack, crack
Of course, we
Run up Hydra.
This is Hydra running against a router.
You can see that this guy
He went with straight up "password."
couldn't do the 1.
All right.
Maybe people have stuff that's
But how many of you
What is your favorite tool for that?
(Speaker away
POLSTRA: Reaver, right?
Little tip.
Some of those cheap routers,
it's still on.
You might want to call out Reaver
to make sure it's actually turned off.
Here is just a little run with Reaver
boom, I got the password, which was,
Again I call this pwning Windows 7
Some of you might say it should be
But yeah, kind of, but about a year
big vulnerability that came out.
Some of you were like 400,000 Macs
and all the PCs went: Uh-huh?
All of us did.
But so the Macs had a problem, right,
And then you got these smug Mac
Well, you did.
You get
Well, see, I told you!
Guess what?
They had the same vulnerability.
Again, I load up melt exploit.
This is all running on little Beagle,
I might even flash some LEDs
So sure enough, bam, here you go.
I've got a shell
from University of redacted.
Pretend you can't read what it says
All right.
The final so low demo
Some of you probably are familiar
Aaron Finex and myself came
That's someone who
They can only use GUIs.
They can only use things
which came out last year.
It's a nice little tool
It's basically point and click pwnage
You pull it
which one shall I attack?
It tells you when it's done.
Basic, pretty neat.
Enough of that.
Let's talk a little bit about bringing
So again if you take
mode and a couple of drones,
You can connect to one.
If you want to switch again, you do
give it some commands and then start
It sort of is legible, I guess.
I'm actually running two drones here
And I'm sending commands to both.
If you want to use the Python scripting,
fancy, right?
I've got a little command console
You can send it commands
commands
in that window as well.
I have all of the responses I captured
sophisticated tool
is called tail dash F.
Basically here you can see, this
I have a really simple API, right?
It will say: Hey,
to this drone?
If you say colon and a number
it switches to another drone.
Here is some basic output.
They'll tell you, hey, this
and this is what I got back.
Pretty basic stuff.
This is giving you an idea.
There's nothing like really awesome
anything like that.
Okay.
So some future directions.
I'm going to continue to try
You know, I started in this work
after DEF CON last year.
I actually added some packages.
The basic, very first version
of last year.
Between DEF CON and that time
And optimizing some packages.
Looking at some other output options.
Possibly exploiting some USB
Some of you may have done some work
Any of you use the teensy?
A couple of you?
Done a little bit of hid hacking?
You know, you set
and enter some commands.
Well, that's
eight-bit processor.
I have a 32 gig git-ARM processor.
I can push some commands
The other thing I'm working
is literally making this platform fly.
Hoping to have this done for GrrCON
but basically I am going
inside of an aerial drone that
and landings, so you can drive
Land it on the roof, hack them
(Laughter.) PHILIP POLSTRA: There
You can potentially use
in the drone as a router
the lower powered drones
wherever you can.
So that's something I'm working on.
The other thing is, you know,
from down the street.
So why don't you hack
There's this beautiful thing called
I have a couple of these at my office.
And so what you do
is in the range of your drones
possibly hook
at their cafe, right?
Plug it
over in Australia doing this pentest.
It doesn't matter.
And as I said before, I'm working
and also right now I'm currently
I didn't quite have it finished.
Probably in the next couple weeks.
If you look at my website again it
I want to be able
For example if I want to send
to be able to send that over the XB
all that good stuff.
Here's some references that you can
And if there's any questions,
which went away.
So I'm going to recommend that
at the Chill-out Lounge later.
I'll bring my little toys.
And you can have
about out of time.
Do you have like three minutes?
One question?
(Applause.) PHILIP POLSTRA: One
Okay, thank you.
I think we have time
If not, I'll head that way.
AUDIENCE: How do you secure your
PHILIP POLSTRA: I do not currently.
There is support for that in encryption,
is essentially it's out of band
If you use 80211 networks, people
what thee's this rogue network?
If you use 80234, it's
no idea that's going on.
You can easily do that,
and it takes a performance hit.
AUDIENCE: (Speaker away
POLSTRA: Basically I'm writing my own
on Ubuntu with all of the good tools
AUDIENCE: (Speaker away
POLSTRA: I do.