JOSHUA YAVOR: Hi, everyone, I'm Joshua Yavor.
I'm from iSEC partners and you're currently attending BYOD
PEAP show.
Today we're going to be playing with the wireless here,
specifically DEF CON secure.
It is not my fault that it is down right now.
I had nothing to do with that.
It helps us and makes it easier and makes me not have
to blast you with that thing.
We'll let you know when that's going to happen.
It's completely voluntary.
We've made it so it will likely only affect you guys
but who knows what everyone else is doing with the wireless.
You'll have full warning, I encourage you to participate
because I know the credentials you used
for DEF CON Wi Fi are not the same as your gmail at home, I hope.
When the time comes it would be nice if you turn your phones on,
I'll let you know.
So over the past five years or so, a perfect storm has been brewing.
This perfect storm has three components much
like the perfect storm of '91 which you see
the NOAA weather graph from.
These started in 2008 at a single event at DEF CON 2008,
which we'll talk about, and the growth at BYOD.
And a talk last year here at DEF CON that made everything easy
for what we're trying to do.
Let's look at those.
In 2008 at SHMOO con.
Joshua White and Brad shared a talk
about how PEAP was misconfigured and this worked with desktop systems.
BYOD wasn't a thing yet and the iPhone was less than a year old.
This was not on anybody's radar that this would
eventually affect BYOD and mobile devices.
So this research included a tool equaled free radius WPE
and that's been a standard for network presentation tests
ever since.
What Josh and Brad found was that by default
the main configuration that were in use on desktop operating systems
did not do certificate validation.
There were some other findings within the research, I encourage you
to look at it but that's the thing we're going to leverage today.
Because they didn't check the certificates they had no way
to know if the authentication server they were talking
to was legitimate or rogue.
So the result from this research was that desktop
systems were changed.
They were upgrades and patches, there were security advisories that
came out tell people how to configure things properly
and this has largely gone the way of the dinosaur as far as an issue.
We still run across it once in a while but typically it's largely mitigated
at this time at least in desktop operating systems.
One of the lessons that came out of that research at that time was
the notion that PEAP network can actually still be configured
and be secure.
And that's something that we're going to revisit today in the light
of the other two parts of the storm.
Then there's bring your own device.
I have to apologize for how many times I'm going
to say that buzz word but know when I say bring your own
device, I'm not just talking about BYOD
as in its true definition which is users actually bringing
the devices that they own.
The research and the tools and techniques we're going
to talk about also works against mobile deployments
within a corporation.
So, if your business buys you an Android device or an iPhone
or BlackBerry, these attacks can still work against you.
It's not just the devices that users bring that they personally own.
So BYOD is huge.
I don't think I need to talk too much about that.
What's been really amazing is how fast it's grown
in the past five years.
So it's just yeah, it's absolutely crazy.
It's grown so fast that metrics that are reliable are really difficult to find.
So the best I can give you is that anywhere between 60 and 85%
of companies support BYOD in some shape or form.
Whether or not that means hey, we give you an open Wi Fi or we set
up WPA enterprise with PEAP is hard to tell and there are no real hard
numbers we can give you There's also the issue where we don't really know
what the definition of BYOD is when we're trying to collect metrics.
Because that definition changes between environments and based
on who's actually collecting those metrics.
What we can tell you is that in BYOD deployments that support
WPA 2 enterprise, the vast majority of those deployments use PEAP
for the authentication protocol.
And we'll go into a little bit more detail as to why that is in a few minutes.
But just know that by and large, that is the most common WPA 2 enterprise
authentication protocol which is why it was the juiciest target.
And the third part of our storm and the most recent was Moxie's research
last year that was presented here at DEF CON in at DEF CON 20
and his associated product called cloud Cracker.
So Cloud Cracker, for those of you who might not have heard
about this or weren't here last year, is a commercial service that's available
now and through Moxie's research where
he was able to reduce the strength of v2 challenge and responses,
he was actually able to work with some other guys to come
up with some heavy duty computing systems that were available online now
that guarantee that they can crack
a MSv2 credential challenge or response in 24 hours or less
for 100 bucks.
And so, if you think about the companies that tend
to use BYOD deployments, they tend to have a lot of users.
That would be a network that I'd really like to get on.
So 100 bucks is really not that much money when
we're talking about a type of credential that will get me
on a network.
While we're talking about that credential, it's important
to know it's not just some random user name and password that that person
is using for logging on to the network.
That's typically because of the way deployments work,
these are typically AT creds, domain creds that get you into VPN,
e mail and any other services that are managed through active directory
or the equivalent.
So this is a credential that we'd really like to have and that makes it much
more likely that someone is going to be willing to spend the 100 bucks
in order to get that Also don't forget if it's a weak password,
you can also crack it locally.
All right.
I'm going to spoil the rest of my talk here.
So I'm going to tell you everything that we want you
to walk away from this talk.
So on paper PEAP should work.
As long as everything is perfectly configured,
PEAP should work.
If all the devices validate the certificate, everything's going
to be okay But that doesn't actually happen in real world deployments.
Even when you have a multimillion dollar company
with huge and really expensive and really fancy mobile device
management system or MDM, those networks still have
the same issue.
And we know that because we've worked
with those organizations.
And we found this issue.
And so this isn't something that you can say just flat out that you know,
it's going to always be okay if you configure everything properly
and we'll talk why that is later as well.
The impact is staggering if you know who could be affected.
The organizations that use BYOD are growing, the vast number
of organizations that are using BYOD are growing.
And over the next few years it's expected that we're going
to get closer and closer to 80 90% acceptance and that means
that by default, we're going to see the use of WPA 2 enterprise increase
as security becomes more of a concern with mobile devices
and as mobile devices need more access
to internal network assets and that's something that we're seeing
with the development of more mobile to mobile applications that integrate
with more what used to be traditionally only internal
or nonmobile internal assets and services.
If you support one of these networks, first of all, I did come prepared.
I have two motion sickness bags if you need to come up and get one.
They're right here.
(Applause.) JOSHUA YAVOR: So the impact is enormous and there
is no corrective action that's going to fix this really easily.
But we need to start working on it immediately.
We'll have some ideas as we start to wrap up near the end here
on what you can do to actually fix this issue if you're
in the position of needing one of those.
The key thing that damages the assertion that PEAP can work
is the users are in complete control.
All I need to know my user name and password to get a mobile device
on the network.
I don't know about you but, if I was running the wireless network
for an organization that had 10, 20, 30,000 users, I'm not going to trust
all of them to know how to configure their devices right
and even if I configure their devices right for them and hand it to them,
nothing stops them from bringing on their own mobile device
because they know how to connect because it's just their user
name and password.
So here's the bottom line.
Again, vomit bags up here.
On defense, this is bad news.
We'll go through some things that you can do to make this a little better.
But it's going to take a while for this to be fixed and for these issues
to go away.
(Applause) Fucking A right Lafoy, now that is rocking.
What's this called?
"
shot the n00b" thank you very much.
Why are we doing it?
First time speaker.
Who do we need on stage?
Someone whose first time at DEF CON.
All right, this guy over here.
Thank you.
Yeah.
So good question.
Only second person who's asked that.
(off mic) So are the speaker goons doing a shot
in every track for every new speaker.
The answer is yes.
How many is that during this DEF CON?
We have way freaking lost count.
There is no chance we know that number.
Think about it this way Wait, we're almost ready.
It's 4 6 an hour since 10:00 a.m.
every day.
(Applause) We're here for you!
All right.
To our new speaker and our new attendee.
(Applause.) JOSHUA YAVOR: All right, if you happen to be
on the other side of the fence you should be happy.
This is an appropriate crowd to share both those images.
The barrier to entry to gain local access
to wireless network has been drastically lowered and
the credentials that are exposed to the Internet is also reduced
and you don't really need that much equipment to do that.
There are some people who disagree and this dates back to right
after Moxie's talk last year and some of the things you'll find and there's lots
of follow up after Moxie's talk last year mainly about the VPN issue
but also WPA 2 enterprise from PEAP there was a lot
of response from technical writers and people interested in security.
Some of it is absolutely right but some of it I tend to disagree
with as well.
So like I said earlier, it is completely true that
a perfectly configured PEAP deployment is going to be just fine.
But that never happens in reality.
So what we're going to see is that we're going to rely
on the same people who did the same follow up last year
after Moxie to hopefully help come up with better deployment guides
and configuration guides because we typically still see these
issues in pen tests with mobile devices where some
features that exist within mobile platforms aren't
being used.
A good example that comes to mind is iOS profiles.
That can be installed on phones, that makes it really easy
to deploy things.
Deploy configuration including WPA 2 enterprise configuration.
So that's one of the things that we're going to rely
on the people who a year ago were saying this isn't
a problem to then turn around and say hopefully, this
is a problem, let's figure out some more solutions on how
to fix it easier.
So let's talk about some of the risks.
These are broad generalizations just to kind of give you a decent overview
of course it drastically differs in site to site and organization to organization.
But typically, we find that individual users,
the chances of you being targeted and the chances
of you really caring that much if your work e mail is compromised.
Chances are if that's a device the employer handed to you,
you can say hey, that's not my problem, I didn't configure it.
The user experience varies.
In the type of attack we'll talk about in a few minutes you'll see why
that is.
There are certain attack methodologies you can use
to target really high profile users.
So let's say for example that you knew that
if you a few COs from a group of companies were going to be
in a certain location, the type of attack we're going to talk
about shortly would be a lot easier and more impactful.
The smaller organization, I'm talking about smaller
in both size and IT resources will also tend to have a smaller
in numbers of people, not resources, smaller number of people
will likely have lower risk.
And that's primarily because you have fewer devices that
you need to actually configure.
If you're a mom and pop shop that uses WPA 2 enterprise with PEAP, well, first,
kudos to you for configuring that on your own.
But you probably have your hands on every single 1
of those devices every single day and probably make physical contact
with every person that carries one of those devices.
So it's probably going to be easy to manage.
The twist to that is once you get into small and medium size full grown
businesses but they lack those IT resources
to come up with a full-fledged MDM solution we
see they're much more likely to be vulnerable.
If you have a user base that doesn't change very
much, you're going to have an easier time configuring
and managing those devices regardless of your MDM solution or
if you have one or not.
The higher risks or to the internal network assets that exist
within the network that can then be compromised with those credentials.
Large organizations with more users of course have more users that are
likely to have misconfiguration.
I'll share metrics from my testing experience a little later.
And of course the more phones and devices you have coming
in and out, the more likely you are to make mistakes.
And this configuration is everywhere.
And one of the things I wanted to point out is a public example that we
can share.
I'm not going to call out any individual universities
or public education institutions, you can do that yourself.
It's really easy.
Because those types of organizations have
to support so many users, and their IT Help Desk staff
is typically just swamped regardless of trying to manage
the WPA 2 enterprise, they tend to put all their instructions
for accessing the wireless network online which
private companies tends not to do.
But, if you can see their Wikis like if you go back
to your employer and you want to check to see what the likelihood
of your organization being vulnerable to this type of attack is,
check your internal Wiki that tells you how to configure your devices
if you have a BYOD policy at your employer.
And that will tell you pretty quickly whether or not you're going
to have an issue.
And we'll show you what that looks like.
So this is taken from one of the universities in that search result.
And typically what we find is that the instructions are super old.
Really old versions of Android, BlackBerry, the Windows phone before,
Windows mobile is on there too often and what we see
as well is either the user is explicitly told not
to install a certificate or they don't say anything
about the certificate and just put up a screen shot like this.
So that's the configuration I need and what I'm going to go with.
And we still see that for Windows as well.
Even today, even after Brad and Josh's talk in 2008,
we still see publicly available information from the authority
for it a network telling users not to validate the certificate
and you see that in the other settings comment
at the bottom there.
So that's pretty scary.
So we have a lot of catching up to do even in 2008.
But now we have to catch up even faster because BYOD
is growing so much.
So why PEAP?
Well, this shows a little bit of it.
So PEAP and each TLS, EAPTLS requiring
mutual authentication.
So the user validates that hopefully and sends their own certificate back.
So it's not actually using AD creds.
EAP TLS and PEAP are the two most woo idly supported EAP
types across platforms and as well desktop operating systems.
It used to be that the Wi Fi alliance required support
for EAP TLS if you were going to be WPA 2 enterprise certified.
That's no longer true.
I think that changed back in 2005 or 2006.
I wasn't quite able to get an exact date on that.
But what you see is that PEAP is the most widely supported
across mobile devices.
So, if your goal is to just support as many devices as you can,
truly be a BYOD organization, then PEAP
is a very attractive objection.
It's also much easier to configure.
Because I don't know about you, but I know that, like,
my mom doesn't know how to actually download and install
a client certificate.
I mean, it's hard enough trying to tell her how to find a pdf that
she downloaded on her mobile operating system that.
Can be tricky and trying to manage a certificate and get that
on the device securely, especially for a device platforms that don't
support MDM solutions or that don't have a robust integration with them,
that can be troublesome.
There are many other EAP types.
But other ones that you see on the screen are
the ones supported by those devices or not.
So really quick just for a few people who might not be
familiar with WPA enterprise and the difference why we use that versus
a shared key like open we'll talk about that.
It's about access controlled granularity.
In an open network, it's open.
We get that.
With WPA 2 you just need one shared key, the pass phrase.
And everybody knows it.
And that's great for like your family network
and what you go home to.
But as an organization grows and you get 100, 200, thousands
of users, it gets pretty bulky and cumbersome
because what ends up happening
unlike WPA 2 enterprise where each individual user has a user name
and password or some other credential that associates that device to that user,
when we actually have a compromise of those credentials or let's say it's not
a compromise or let's say somebody leaves an organization
and we don't want them to know the password, it becomes an issue.
Because in WPA 2 what you have to do is change the password
of the Wi Fi network and change that setting on every single one
of your wireless devices and that does not scale well
and that's why WPA 2 enterprise is used so widely
in large organizations.
Because at that point all you have to do is lock a single account
and you're good.
So let's talk about where these issues actually lie
and this will build up the path to talking about the actual more likely
than notation methods.
Exploitation methods.
There's a request for the user name, identity, the identity is then given back.
That's actually outside directly speaking
to the radius server as far as establishing a secure tunnel.
So regardless of whether or not you have a rogue
or real access point, access point displaying
a rogue or real radio server, you can still get the user name
of the person that's trying to connect their device,
that's something we've known for a really long time.
It's just fun to know.
So outer authentication and this is what was broken by Brad and Josh.
So that identity goes to the radius server,
the radius server then sends back a certificate.
The client is supposed to validate that certificate,
but in order to do that, it just has to have either that certificate pinned
already or it has to have a trusted root for the CA identified.
And we'll get more into that later.
But that establishes the secure tunnel and
inside that secure tunnel is where Moxie comes in.
Now that that secure tunnel has been published, there's
an access challenge that comes from the radius server
to the mobile device and a challenge response that goes back
from the mobile device to the radius server, that's
the part where if you can get a mobile device to connect to you,
even with a invalid certificate, the fact that you can capture those
challenges means you can reverse that using Moxie's tools and research.
Mobile platforms and talk about how they differ.
What's really interesting in doing research and live testing
with organizations is that none of the mobile device platforms
are perfect.
Somewhere better, some are worse, but it's a really diverse set
of support and features for WPA 2 enterprise.
One thing we want to note is that remember that I'm not saying
that one platform is more secure than the other over all,
we're specifically just talking about WPA 2 enterprise.
We're going to talk about the four major platforms,
Android, BlackBerry, iOS, and Windows phone 8.
So for Android, Android has the largest user base just
in the population worldwide.
What's difficult to find metrics on is in organizations that support
BYOD is how many users are using Android
versus iOS, that data is not readily available at this time.
But from the experience I've had doing tests at different environments iOS
and Android from the organizations I've worked
with are probably about 50/50, 60/40, somewhere in there.
So Android supports those.
What's interesting for configuring WPA 2 enterprise
is it's reused between EAP TLS and all the other EAP types.
It made it easy because nothing is going to move
around but people actually tend to start to ignore
the certificate configuration part if they don't
if they're not specifically told what they're supposed to do with it.
You can see I'm configuring my device here following
the instructions we found on the college's Web site.
By default if I click on the certificate, there's nothing available to me.
That's both good and bad.
It's good because public CAs can be used
but there's some drawbacks to using public CAs
for authenticating the radius server.
The reason that can be a challenge is because mobile devise don't validate
the CN name and the certificate.
Let's say they use trust wave for your or Verisign for your certificate.
That means all of your mobile devices are going
to have that root CA as the trusted CA
for your wireless network.
All I need is a certificate from one of those public CAs and their public so
I'm going to spend 100 bucks, 150 bucks, something like that
and then I can then potentially get your devices to connect
to me and I'll pass that validation.
It's good and bad.
This selects you from public CAs by default but didn't prompt you
to connect with the radius server and see what the certificate is or
to install one that's available externally.
Inside Phase II that leads to misconceptions outside the scope
of what we're talking about here.
Let's say when you're doing testing and Android devices are misconfigured
you can see silly things come across the network.
On to iOS.
IOS has a strong business presence parts
of that from the feedback I've received comes
from their configurability especially from iOS profiles that can be pushed
out to the devices.
The PEAP configuration is straightforward.
You enter your user name and password.
It actually prompts you to validate the certificate.
It's trust on first use approach.
So the user is actually shown a certificate.
It says not verified if it's not in one of the installed CAs
within the operating system.
And before you accept it, you can actually take a look
at the details.
And this way you can see whether it's
the default service that comes with radius EAP or what you're
expecting from your organization.
Users are terrible atrophying that out but often times
if the organization says, for example, Inc.
and you're expecting it's going to be your business's certificate,
hopefully, that's going to raise a flag.
BlackBerry: And I do apologize for the screen shots.
It's not easy to get a screen capture out of an old BlackBerry.
So BlackBerry actually has a lot of different EAP types that
they support.
They have the most of any of the mobile platforms.
Not all EAP types are created equal though and only a handful
of them remain secure.
And if you want more information on that, Josh and Brad's research goes
into a lot of details there.
So this is both good and bad.
There's wide support on the platform for just
about every EAP type you can find in a mobile environment.
But again, some of those are not that great to use.
The PEAP configuration is nice.
In that if you see the blue bar at the bottom, you actually have
to explicitly disable certificate validation
if that's what you want it to do.
By default, BlackBerry requires you to validate the certificate.
You can't complete that configuration until you've either disabled it
or given it a CA.
But this one, BlackBerry, has all the public CAs available.
Again, it's both good and bad, depends on your risk per file
and things like that.
Windows Phone 8 doesn't have a very large business presence
right now.
But since it comes from such a well known vendor and manufacturer,
it's something worth talking about.
The PEAP configuration is similar to iOS at the start where it's just
a simple user interface.
User name and password.
But you'll notice that the validate server certificate option
is at the very bottom and it's off by default.
So that's something that makes it easy to click
through without installing the certificate.
In fact, you don't even see a certificate prompt or
a place that you can enter a certificate until you turn that on.
The certificates available on Windows Phone 8 are interesting.
There's a small number which is good.
The fewer CAs you trust the better.
But they actually and this has nothing to do with security of the platform
but I find it interesting that there are two expired certificates that it has.
Odd, strange finding.
So you understand now the different platform support
for WPA enterprise.
You see that PEAP is the most widely supported
and Oh, yeah.
Just wanted to mention again that you saw
on the table that Windows phone 8 only supports PEAP not TOS
or other EAP types.
But now that we've gone through the different mobile platforms,
you understand that the user experience varies
and that's one of the reasons why it's so difficult
to write instructions for your users to follow.
If you're a university or other large organization
for example.
So the chances for misconfiguration are pretty high.
Let's take a look at how we attack then.
That's the fun part.
When I'm telling you about these things
in the traditional network, we're going
to be using some anonymized data about some real life attacks we're able
to do as we get into the more exotic and fun attacks.
There will be some hypothesized things based on some other fun stuff.
An attritional attack is a rogue access point.
All you need is a laptop really.
My setup up here, we'll talk about that later but I'm using
a regular router and another wifi card and antenna because I expected
a lot more pushback from the audience and hostility
of the wireless network here, but it turns out we might not run
into any problems there.
Now since I said that, I see all the laptops coming on.
That would be good for me, I'd really like that now actually
in a few more minutes.
An attritional attack is just like trying to capture somebody
on an open Wi Fi network with a pineapple or something like that.
The best way to perform these attacks
is to broadcast as an access point connected
to a radius server.
The de facto standard is free radius WEP right now
but we'll talk about other tools that do that as well.
I'll broadcast the SSID, network name of company X and the best way
to do this attack is actually not to be on site at company X what you want
to do is go to someplace where you you're going
to find their employees and users but away from their wireless networks
and that's for multiple reasons, first, it makes it easier to get them
to associate with you because then you're not fighting
the broadcast and the power of the other real access points.
You can D off but that makes it a lot more of a headache.
Additionally testing away from buildings and
the real network reduces the likelihood that you're going
to be caught.
A lot of wireless systems now come with features where you can triangulate
the location rogue access points and so, if you're camped
out in a parking lot and you're too close, there's
a good chance that physical security might come knocking on the door.
I can tell you from experience having your daughter
holding the router makes it a lot less likely that anybody
from physical security is going to mess with you.
(Laughter) So story time.
So an example that I can tell you about is an organization
with about 50 or 100 users, they don't have
a building or anything like that, they are on a multi level building
on one of the floors.
Their access points were weak enough where you couldn't really get reception
outside of the building, though, so a great way to perform an attack
is to sit out if there's a park or lobby out front.
If you can find any choke point entryway or exit that's great.
Was able to sit down in the lobby and actually get everyone
on their way in and out as they're going to the elevator
or the stairs.
There's a choke point.
That will be difficult to target out in the gem population,
I'm saying that because I'm going to lead up to some
of the more fanciful attacks that are coming next.
When you have a much larger organization though
for about a thousand people or more, some of the organizations that come
to find can even be in the 10s and maybe even hundreds
of thousands of people you're much more likely
to run across those users other places just out in the general public.
For organizations that have their own campus, one of the best ways to pull
off this attack is actually to sit at the edge of the parking lot especially
if there's a major freeway there or stoplight or anything
like that where they're queuing up to come into the parking lot.
One of my favorite experiences was doing a test like this on the edge
of a campus and there was a lot of people who rode their bicycles
to work and as I'm monitoring the tools and you can see who
is trying to access your access point
and you talk to the radio server and you see all this traffic goes
by and it drops off as they ride by.
So that was pretty fun.
So finding a choke point, a physical presence is great.
Now these traditional attacks are well known, well established.
Everyone can do this.
The trouble is what if you're not there?
What if you want to be able to compromise somebody's active
directory creds from their mobile devices and you can't
get access to where they actually work?
Well, they have to go find them somewhere else.
That's where the more interesting attacks would
come up.
For multiple networks, what if I didn't just want to get
into my bank's network?
What if I wanted to get into any or all bank's networks?
Can't do a traditional attack but I'd have to sit in one place,
one network name, one SSID for a long time, wait, stop, do it again.
It's going to take a long time.
What if we did something like create a tool that would actually let
us rotate the SSIDs on a predetermined basis?
What that would let us do is hop in the car and do
like word driving 3.0 where you're not actually targeting access points.
You are the access point and you're targeting multiple
device users.
So I'm going to use San Francisco which
is where our headquarters is as an example.
If I wanted to target banks what I would do is hop in the car with my list
of SSIDs matched to a whole bunch of banks or any other organization that
would be around there and all I have to do is drive
around the financial district at lunchtime.
Chances are I'm going to find a bunch of people who are
out to lunch away from the organization.
Away from with wifi networks and that means it's going to be easy
to connect to my access point.
The only catch is we have to rotate SSID frequently enough
in order to make it effective.
If you think that you can curate this by industry or geographical location.
In that example we did both.
You can get awesome extra credit if you do it on public transit as well.
That's fantastic especially in the Bay Area because you have
a lot of tech companies that use services
like BART and CAL tran.
So public transportation services can be a really good hunting area.
Finally what if we don't care.
I want to get on some network, I want ED creds, I just think it's fun.
We can do that too.
That means instead of a predetermined curated list,
we're going to dynamically change the list.
We can do that by listening for probe requests,
beacons and also going a little further and using some
outside tools.
So let's talk about that.
The existing tools that we have for BPE which you heard me talk
about a radius server that's been modified to shoot
out the MS chap v2 challenge and response
instead of keeping it secret.
That's pretty fun.
Host ADP and host ADP WEP for testing EAP fest which you should
look into if you want to support that.
There's also DD word and open word which you can easily script and one
of the things I haven't done yet but I'd like to look at is patching
the free radius tool that's available for Open Word with free radius WEP.
That would be cool because you'd have
a stand alone router that you drop somewhere and let it go.
So the goal of this tool is to give every single network a PEAP.
Just give it to everyone.
You can script in open WURT.
You have to listen to them and build the list and get them
on to the WURT somehow.
You could probably do it on the WURT.
There's a host APD python script which allows you to do SCAPI to listen
for probes and beacons and then dynamically add those
to the list.
That's fantastic.
That just made things easier, but host APD karma.
Getting fancy, what else could we do?
We could use GPS potentially.
Haven't done that yet.
But, if you can give coordinates and query a resource saying hey,
I want every WPA 2 enterprise SSDI within two miles where I am,
you can go anywhere in the world and potentially exploit a bunch
of networks you don't know exist and do the research and figure
out where they are and what networks you
got into.
So the goal is to get this into a single tool.
My colleague Ryan lacy and I have been working on this a little bit.
It's difficult, not easy at all.
There's a group called called EA peak that was presented at one
of the black hats in 2011 that got far along that path
but I think they took a different approach later on.
But it's not easy but we're getting there.
Hopefully, eventually we'll be able to release a full single tool that
will actually do all this in one install.
We'll use tools we've been using to build the logic to build
the dynamic SSIDs.
So how do we fix this?
You can't just turn off your Internet.
I bring that up because well, it actually happened here which
reminds me of a place we did this once.
We're working with an organization where there was
and we were working with a network and said we can't
support this.
Rolls out an EAP TLS network.
You can exploit this without a network.
So 5, 6 months later you can go back and broadcast
as that old network name if you happen to know it
and still communicate with the devices.
And if they don't rotate their credentials regularly and
if they don't have high device turnover, there's ray really good chance that
you're still going to find somebody who
is misconfigured even though the network doesn't exist which
is creepy.
EAP TLS is difficult to support and difficult to roll out but it leads
to more security.
We also need better mobile device management.
Quick comparison.
EAP TLS is nearly universal as is PEAP.
Difference is that PEAP is easy.
PEAP is hard.
PEAP ELTS is hard.
Let's look at why I'm running out of time and I want to get
to the demo.
So doing PEAP takes a lot of work.
We talked about a perfect storm.
To do PEAP right, you have to do so much work that hopefully
and this is what I hope you experience for those of you
on the defensive side of this.
In order to do PEAP ride you have to do so much work that it's probably
going to still be easier to deploy EAP TLS
because in the end even if you perfectly configure your network,
that one user or 10 users that want to add their own device still know their
user name and password and your MDM solution isn't going
to touch that especially if they misconfigure it so badly that
they don't bring it in and you can pick it
up in your car and pick up 3.0 all the way around.
DEF CON is secure, I'm hoping some of you didn't install the certificate.
Those of you using iOS probably are going to be more okay.
Right now we're going to get into the demo.
We have four minutes for that.
Last warning.
I'm asking all of you to be victims.
This is not going to hurt, I promise.
I I will not crack your passwords.
I don't really think your DEF CON secure password is worth 100 bucks
or the time or energy it would take for me to do on my own.
No man in the middle is going to be conducted.
I'm not connected to the Internet here.
So I can't even provide you a service even if I wanted to.
So you're going to be all set there.
And yeah.
We'll see what happens.
Last chance if you don't want to participate, turn your phones off.
Switch your laptops off.
This is end of DEF CON.
This would be fun if I got 40 of you.
Turn your phones on please and participate and let's get into that.
By the way, that's everyone probing for DEF CON secure right now.
So this might actually work.
I was going to need DEF CON, but I don't think I need to any more.
We got to make sure I'm on the right address.
Should be.
Anyone picking up DEF CON secure now?
No?
Okay, might take a second here.
Got to turn my Wi Fi back on.
Still booting up.
Okay.
Should be coming up.
Wow, yeah.
Okay.
Some of you are hitting it.
All right, now, let's see if I can show you not there yet.
One of the problems is even if you don't even if you still validate
the certificate, you still talk to this and a lot of you are still talking to it
and this is falling apart.
But I do have a backup example I can show you.
I just saw my name go by.
Oops, sorry.
So on the screen what you see is the output every time somebody
is trying to connect to me.
And when you see the big TLS blobs go by,
that's when I get happy.
Really?
That's awesome.
That's a good name.
You guys are validating your certificates.
Black hat, no.
No, that was not me at black hat.
Well, that's disappointing, yes, I'm in the right directory.
Thanks, though.
No, other way at least in my experience.
I've had it when the log is there, it won't update.
I'm running out of time.
So what I'm going to do is I'm going to leave this
on for another couple seconds, make
a minute or 2 and hopefully get more.
We see EAP traffic.
Somebody had strong feelings about black hat.
So what I can tell you is that I see, like, my name coming
by and when you see that big blop there, that's the certificate
and that's the challenge and the EAP challenge going back
and forth.
We're getting it but it's just not logging.
There's too many of you.
I've got to wrap up.
But thank you, it's been a lot of fun (Applause.) So go forth
and deploy EAP TLS.