Hi, everybody.
Welcome
intrusion detection.
This is Scott Fretheim,
we're from LMG Security.
(Applause).
So if your cell phone were hacked,
Probably half of you today
hacked, but you can't tell.
You can pick it up and look at it.
The video that you see
and I don't know why it's not displaying
The video displayed on the screen
a video that's infected
It's sending data out to the Netherlands.
If you were a user looking at this phone,
There's been an explosion
I don't know if you have seen
It was very good, very interesting
the number
between March 2012 and March 2013.
It's teeny, tiny little computers.
They can record you and track you
And they can do anything that you can
This is a screen shot of Tigerbot.
It is record the surrounding audio
It can also track your GPS location
I think it's really cool and sort
because you can have botnets
on normal LANs and soon we're also
of infected smartphones.
When they came
attackers can segment that
So you have nodes communicating
If you have ten infected systems
they are communicating
and that means
An attacker will be able
And they will be able
in and segment them
You can say I have ten infected bots
of Defense building.
I have 20 infected bots
how much do you want them?
Maybe they are worth different amounts
Mobile malware can record surrounding
and send out your contacts list
is something that we
in doing so, they get more lists
the same way the Spam.
We will probably get
You can of course,
and key strokes and control your phone
This is a chart that we made using
of the phone home traffic
This is an infected laptop.
It reflects
to the attacker's system.
This was over a 24 hour period.
All the normal windows traffic has been
home to systems.
Actually, I think first it phoned home
IP addresses.
You can see that little blip there.
And it started talking
The same thing happens
The Android Stels malware.
It phoned home everybody 15 minutes.
So would you see
to this with your smartphone and
Now, on LANs,
the option of inspecting network traffic.
They can make charts like that.
So even
installed on a laptop, we can still tell
on the patterns
on the network.
We don't have that same option
within our enterprises and that means
in meetings having their audio recorded
corporate information on them,
is also true.
You might be sitting
and never know it or having your
the ability to inspect your traffic to tell
an attacker, whether it's
is collecting information
and sending it outbound.
The problem is that cellular traffic
to the key stakeholders who really care
One of the folks in our last talk asked
if their phone was infected
if they were inspecting that traffic,
to be able to chase
Nobody cares
as you do, unfortunately.
So what is the solution?
We propose
Within the past few years,
little femtocell, miniature bay stations,
in places you might otherwise have
They are being marketed
You can get one
Your cell phone connects
across the Internet back
In this case, we were playing
Samsung femtocells.
They are fairly inexpensive this entire
a cellular intrusion detection system
We used both
the SCS 26UC4 and it would probably
Our goal is to enable defenders
to detect when our cell phone
are monitoring our traffic.
So we gained route
and then we modified
so that it started exporting traffic.
And David will go into this
Then we sent it
which embarrassingly only cost us $44
an old dealt Optiplex and it was running
When we infected a phone
Snort would alert on it.
The roadmap today, number one,
through the femtocell modification
We will show you examples
We used some interesting stuff
We will do a demonstration?
Which we actually boot
gets modified in realtime.
And then we'll show you a little video
in which we infected a phone
captured the traffic and used
the alerts pop up.
And then we'll go
and finally Scott and Randi Price did
And she will show how it corroborated
and Scott Fretheim will show how
and controlled it.
We have a lot to cram in here.
There's also
It's 77 pages.
Lots of information
afterwards LMGsecurity.com/blog.
So who are we?
We are LMG Security.
We are a security consulting
We kind of support our research habit
We do penetration testing,
digital forensics and more.
We also teach
And that's where the idea
Mobile network forensics, that's
Let's grab some packet captures
it and write a class about it.
It turns out it was not so easy.
It's really hard to get access
If you have $300,000 to spend,
telecommunications equipment,
for most of us out there.
Our core project team, myself, I'm
consultant and the author
tracking hackers through cyberspace.
David is our lead research scientist
is our certified forensic examiner
of our penetration tester team.
I want to give a big shout
to use some of your items.
This is parts list.
First, you need a femtocell.
You can get it used.
The one that we used
We had a dell Optiplex GX260,
Obviously if you want to,
but that was totally fine
We had a hub.
A hub is really nice to have.
It's a real hub, an old hub.
More valuable than switches
on the wire a lot easier.
We have an FTID friend and that lets
on the femtocell and a couple
which we'll talk about today.
So a little introduction
is what we will focus on.
It came to the public attention
So just a few months ago.
And it's distributed by Spam email.
People click on a link.
The one that Dell wrote their paper
So it's distributed
as other malware.
Normally they use
but that doesn't work
They are using
You click on the link and it says, sorry,
of Adobe Flash player to read this file,
And the user walks
Stels is capable
and also filtering and intercepting SMS
This isn't this isn't surprising
since banks started coming
like you go to log
and sometimes it will send you a PIN
If an attacker has
into that web page
in the browser attack and ask you
You type in your phone number
from that point on,
to your phone.
So they can grab those PINs
So they can link them
they gain
can't see some of them,
to if someone is trying to get
because it would be funny for you
a text message with the PIN
trying to log in.
They filter that so you can't see it.
It can make phone calls
to premium numbers.
Again, direct financial incentive
It can also update itself.
Any behavior we don't see
they could totally add tomorrow.
The behavior
change overnight
This is our RF shielded cage.
As we were doing this,
with legal counsel extensively
to make sure that no one else's cell
as they were taking these packet
This device
in our cell phone forensic lab.
We have the only shielded case
David, do you want to talk
DAVID HARRISON: Let's talk
So the RF shielded cage here,
out of an abundance
up accidentally capturing your traffic.
Now, these femtocell can be configured
But in addition,
an absolute guarantee that we wouldn't
that wasn't ours.
So on the side of this box here,
of configurable ports.
The first of which is currently set
a filtered ethernet jack
We then have sorry.
We then have
to the FTID frim that's inside that we
We also added on the instructions
Ramsey, added
GPS in.
One of the requirements is and one
in inside the middle of a hotel
for the femtocell to boot up.
So we had to run a GPS signal
Let's see, so what's our setup look
This is the other side
of those ports.
We have the GPS antenna,
the USB cable running
And then we have
to an HDMI cable where Samsung put
of an HDMI two pins
of the thing.
You can also see we have power
Let's see.
So cellular intrusion detection.
This wasn't originally
we were looking at network forensics,
about the the cellular network.
And it quickly became this big project
So as soon as we did get access,
What can we do?
And we thought, here's something cool,
We can hook it up to Snort.
This is just going
at some level, we assumed at least,
Let's hook it
find, if we can see
and control traffic.
So when we first got root access
will step how we got root access
We hooked up TCP dump to it.
It has a copy of TCP dump.
The box itself
of Linux called Monta Vista and so, like,
It turns out, of course, everything
an IPsec tunnel back
and just running TCP dump gets us you
and not so useful to us.
To step backwards how did we get root
On the bottom, there's an HDMI port.
It has 3.3 volt console access
We hooked that up to an FTDI friend,
It was a $15 part or something.
I got really antsy while we waited
of this and it was right
So I just grabbed my badge
an FTDI connector on, it I ended
It's a little bit
but I thought you would enjoy that.
So as soon as we got console access,
of the stack is a Uboot boot loader.
Samsung has done a bit to modify
You can go to their website
And in the old versions and old being
January or February of this year,
the boot process was
you would type sys return.
The thing is the code for that was
And we actually didn't figure that out.
That was another gentlemen,
in our white paper, linked
So we took that and, okay,
So then we just did init equals NSH
through the boot up process manually,
We then started looking
We saw there's DHCP going on,
about a little bit ago.
And it has IP tables.
It's using that to filter
addresses can connect to some
since we saw TCP dump wasn't
Let's see if we can get access
That was a good enough idea,
on there
of IP tables 137.
No NF queue, no way to copy
There's not even
It's an embedded system.
It's not that surprising.
So he went back
and we really wanted to use NFqueue.
We grabbed the source code
However, it doesn't want
with modern versions of GCC.
So it's really picky
with Monta Vista's armed tool chain.
Now, that encountered
which was that Monta Vista doesn't
despite everything being GPL licensed.
They don't openly distribute that.
They only distribute their tool chain
however, one of the customers
the OMAP series of boards,
So the OMAP,
uses the same version
The chip set in here is actually
is a very similar Texas Instruments
You can grab the tool chain
We used that to then build
all of the dependencies
And what NFqueue does,
it pulls packets out.
It routes them with the rule in IP tables,
Then you have a user space program,
mark it as do whatever you want
You can modify it, send it back.
In this case, we are just marking it
Sending it back and then sending
will then pipe
in a minute.
Oh, yes, here's
Kernel modules.
IP tables.
So we wrote
compiled statically
the packets out of the queue,
This is an ARM926EJ processor what
rather than dealing with cross compiler,
You don't want to cross compile
So the Netcat, we wanted
as quickly as possible.
It doesn't have much power.
It's a pain to work with.
Word to the wise, if you do this, there
to sig term.
Don't run ping, without a count
I was like, oh, my God, I really want
as possible, send it to Netcat
of our processing
that old Dell Optiplex.
So we can see on the other end,
a Netcat listener which pipes
program that leverages Skapy
as a hexadecimal stream
which we then write to a file.
And hey, lo and behold,
And then we looked at that traffic.
(Laughter).
And let's let Sherri talk about that.
SHERRI DAVIDOFF: It took us
to get to this point where we had traffic.
We were a little bit slowed down.
We started the project in August and
all of this and we were just
and start collecting packets when
We had to break back into the system.
We did figure out how to do that
By the time we were able
it was around May.
When we finally got it, it was beautiful!
So this is the first
to show you
hierarchy summary.
You can see here, this is just
There's 82.04%
normal traffic that you might expect
So NTP, SNMP, DNS, that kind of stuff.
You scroll down, okay, you start
That's .21%.
I was pretty intrigued
in there and then we start getting
There's GRE.
So that's used
from the femtocell
And then you see I don't know
in PPP in GRE.
Okay.
I can handle that.
Here's the next screen.
(Laughter).
All right.
So we have TCP IP within IPv4,
So this is where your web traffic lives
In some cases Wireshark can dissect
of the higher layer traffic
You see TCP in IPv4 and PPPE
(Laughter).
I don't know how far this rabbit hole
Just kept going and going and going.
So David didn't believe that this was
DAVID HARRISON: I just figured it
in Wireshark or something.
SHERRI DAVIDOFF: So
of these packets.
This is an example.
This is data in data in TCP in IPv4
in PPP in GRE in IPv4 in a frame.
DAVID HARRISON: Keep in mind,
in iSEC tunnel and goes back
SHERRI DAVIDOFF: And I know
on another phone.
AUDIENCE MEMBER: It sounds
DAVID HARRISON: Dr. Seuss, yep.
SHERRI DAVIDOFF: Here's
We will not dig into this stuff too much.
It seems to be used
between the femtocell and Verizon.
So it will go out and this
It will enter a password it
down some configuration files,
So I just thought that was kind
the reconstructed stream here.
The phone does mobile handset
We were able
So that means that any time
we have a little smart alert that pops up.
The string that
with is "welcome
something, something."
So you can tell as soon as there's
to your femtocell, which is kind
if you deploy it on your home network.
And it can only to specific phones,
if you are inspecting traffic, of course.
So we also wrote
Our efforts
by the fact that Verizon doesn't seem
of the standard.
So we had to go digging
out exactly which version
This is an example
dissecting an set up A9.
So that's used to set
to transfer user data.
And this is available on Sourceforge.
As soon as we get to a clean network,
of us is home, we will upload this stuff.
We ended up examining
and that's
Android.Stels actually transmits signals
So we wanted to pull
and figure out how
There were two kinds
and Wireshark was dissecting them
This was a default version of Wireshark.
There was GRE type 8881, which
This was used
Wireshark didn't dissect this
However, there were also GRE 88D2
and Wireshark did decode more.
It could get all the way up to TCP.
It didn't get the HTTP in most cases.
When we looked at first in Wireshark,
and there was no matching outgoing
to dissect with our eyeballs.
That was a bit of a pain.
I think I have to step down to be able
DAVID HARRISON: Sorry,
SHERRI DAVIDOFF: Okay.
So here you see can everyone hear me.
Here you see an GRE8881 packet
dissects as far as that PPP.
It doesn't dissect the IP or the TCP.
So we started looking a little further
Anybody in our network class
the 4500 is?
This should AUDIENCE MEMBER:
SHERRI DAVIDOFF: Yes, it's start
It's IPv4.
You will probably only see 4 or 6 there.
The five represents the length,
In this case, that's a 20
of service field which you see 00.
Any time you start looking
you think maybe that's an IP packet
We saw indeed it was.
You could see
the destination IP address.
For a ninja duck, what is hex 50.
AUDIENCE MEMBER: 80.
SHERRI DAVIDOFF: David,
This was traffic that should be
I'm not sure why Wireshark can't pick
It can't get very far
And then here's the 88d2 packets
There's the IPv4.
So it actually got it that time
You can see inside,
right here, HTTP, and higher layer stuff.
It didn't get that far
but it was useful that it could dissect
So here's some threat indicators that
for the Android Stels malware.
You can see that it so Android.Stels has
that are known.
There's 31.170 something, something,
actually and then the other one 95
There's also
is typically distributed, a flash player.
And there's two domains that are
the free IZ.com one and
And those are
into our Snort alerts.
Here's some Snort alerts we used
We put the IP addresses in here.
You can't just look for an IP address
like for an IP address in an IP packet
Snort can't dissect
You have to look at it
Hopefully that will pop
Sometimes this can be fragmented
but we found this actually worked most
Same thing here,
we have to look for it as a string
because these are longer,
up across multiple packets.
We saw, in particular,
containing this these domains,
the domain was broken
would show you there was I'm sorry,
an alert on the response and not
And then if you want to detect
we can take a snippet of the binary
on that and that worked really well.
You can see
themselves, you can see when
Player update.
So now we are going to do
In our lab, I was the attacker.
And the attacker can be any phone
an AT&T smartphone that we used
from our Verizon phone and
we sent a nasty text message.
And David was the victim.
DAVID HARRISON: Sad day.
SHERRI DAVIDOFF: So
a Verizon Android smartphone
So now, let's switch over to our box.
DAVID HARRISON: This
SHERRI DAVIDOFF: Yes, we
We need our lab coats hold on.
DAVID HARRISON: Safety first.
That's mine.
Who buttoned this thing?
Someone is trying to sabotage me!
Sorry for switching, engineer.
I know it's a pain.
I used to do that for a living.
SHERRI DAVIDOFF: Sorry.
DAVID HARRISON: So all right.
As soon as you okay.
Yeah.
We have this here up on the screen.
I will restart this femtocell.
Don't worry, we are not setting
So if you have an Android phone
As soon as we plug it in here, we
if you could see it,
modified by Samsung here
into the command prompt.
And let's see.
So
DAVIDOFF: Going through our script.
So onand boot.
DAVID HARRISON: So onand boot
because the chip set on there uses
proprietary to Samsung.
Here we see we now dropped
up because we didn't actually run
SHERRI DAVIDOFF: Now we are
DAVID HARRISON: Most of this
There's a couple
There's one S70 app that actually starts
for the cellular traffic.
And so we're choosing
to do before we run that.
Another thing that's a quirk
is accessible until you run some
because of the way ONAND works,
of different blocks and block devices.
SHERRI DAVIDOFF: Extract RFS.SH.
DAVID HARRISON: What we do
and sim linking them in the file.
So for instance, /ubin contains lots
but that's not mounted
of these init scripts, rfs.sh.
So let's see, what are we seeing here?
SHERRI DAVIDOFF: Now we are
and then we'll set up networking.
The reason we set up networking
to download those extra binaries that
and we need to copy over.
DAVID HARRISON: Fortunately there
FTP is there.
We will use that to connect.
That's the address
Going to say CD
The binaries we are downloading are
the kernel modules,
into NFqueue and a binary for Netcat,
We won't keep copying
So we will run that script.
It is going to print
can see them.
SHERRI DAVIDOFF: We are inserting
DAVID HARRISON: Order
SHERRI DAVIDOFF: We will start
DAVID HARRISON: These two
they are something Samsung put
They just automatically configure
and this usually takes a couple
It sets up and tears down.
It grabs like NTP and tears
up its final connection.
So next.
SHERRI DAVIDOFF: So then we kill
the SSH and then we start
So at this point we are waiting
So as soon as I collect the traffic
over to the SIDs.
So press enter to input pockets
DAVID HARRISON: It's really
for that netcat tunnel.
Otherwise, you will have
SHERRI DAVIDOFF: Then you hit
the rule routing.
We wouldn't always want to start
Sometimes we were just working
and it can take a few minutes
Now, if you look at the size
that's increasing and that's what you
When you make a call, it
DAVID HARRISON: It can take
It requires a correct GPS lock
it likes.
So it can establish
will sit and think, sometimes
will actually have the connection
SHERRI DAVIDOFF: So then,
set up, you can use this tail command,
So Snort is reading
And we have uploaded
on there and you can see it loading.
Commencing packet processing
DAVID HARRISON: Yep.
SHERRI DAVIDOFF: Now we
we show you us actually infecting
We were hoping to do this here,
So we will talk you through it.
So you just watched us start up Snort.
And here's what our screen looks like.
DAVID HARRISON: KBM button.
SHERRI DAVIDOFF: Good.
Okay.
So you just watched us start
the full screen looks like.
In the top left,
That second window down there
to the console point on the femtocell.
Here, if I hit play you will see you
of that increase over time,
down there.
Now this is a phone starting
This is recorded using that audio
And this is David.
DAVID HARRISON: Compressed
SHERRI DAVIDOFF: This is David,
We are watching for Snort alerts
As the phone starts up, boom,
welcome to welcome to the network,
We know that there's a new phone
So jumping ahead a little bit,
David, you got a text message.
Someone says, hey, check this out.
It was sneakynet.com.
And we will go poor David
Now usually you will see this be
with the Stels malware.
That actually said we
So this attacker was more creative.
It said, you would like some candy
DAVID HARRISON: I love candy.
SHERRI DAVIDOFF: And as soon
the malware started to download it.
Detected that binary just based
So now the user installs it.
It always boggles my mind that this
users know they have to download
We try to train them.
And here's David installing the update.
Now it warns you that this this malware
permissions to make phone calls.
DAVID HARRISON: Whatever.
Who actually reads all of that stuff?
SHERRI DAVIDOFF: Yeah.
Now the application is installed.
And funny,
your Android version does not support
Set up is canceled.
So the user will say, damn it.
Sorry, darn it!
And I guess Flash Player hasn't been
So the application which appeared
but it is still running as we will see
I believe it takes, was it 60 seconds?
DAVID HARRISON: Yes,
to the first connection of CNC.
There you go,
To the user, I zoomed in here.
It doesn't look
But here you see possible CNC server
in the United States, 31.170.161.216,
from the infected client.
That's
using HTTP post messages
allow us to tell specifically when it's
We will show those here
And I believe we are seeing multiple
because of the way that we are sniffing.
So that's something that we might want
so that we are only seeing one copy.
We are sniffing on all the interfaces
Okay.
So here, again, that phone
And every 15 minutes it sends
First time it happens it sends
That system in the United States,
change the CNC server address.
So next you see it start talking
right here, that's based
That 95 IP address said remove SMS
So whatever SMS traffic was being
it's removing those filters and now
That's nice.
And then you saw a wait 900.
Let me back up here.
We saw a wait 900 command
that's 900 seconds or 15 minutes.
So then we look this run
every 15 minutes
the post command
the server would respond back and say,
So not a whole lot was happening right
over and actually intercepting things.
Any questions on the demo so far?
Anything you wanted to add?
DAVID HARRISON: A question?
AUDIENCE MEMBER: Good.
AUDIENCE MEMBER: If you are not
and you have an Android device that
through Wi Fi, let's say,
DAVID HARRISON: Some
It uses also some SMS messages that
That's true of a couple of different bots.
There's some that use exclusively SMS
This one you would still see
would you still see that over Wi Fi.
SHERRI DAVIDOFF: Yep.
So let's dig into Stels
through this a little more slowly.
All right.
So here you see
Hey, check this out!
Sneakynet.com and here's welcome
like some candy?
And unfortunately David clicked
We saw this first alert in there,
There was an alert
name, flashplayer.Android.update.apk.
If you yourself were
could you see this alert pop
And here's the I think I will have
down there again so I can see this.
Sorry.
Sorry, sound guys.
All right.
So here you see the Android file name.
It's actually part
The HTTP get.
So it's buried
did not dissect this
of the 8081 RDE packets
and that correlates
Flashplayer.Android.update apk.
The second Snort alert was first 42
we saw the first 42 bytes come
up multiple times actually.
Here it is in Wireshark.
Now, because this was coming
an inbound instead of an outbound,
Wireshark actually dissected it
We saw the TCP and it didn't get
of the Android Stels malware,
a Windows executable file.
So then you saw the Flash player
It means it's safe and really
on to the phone, and David used
Here's a clearer version
Do we want to allow this application
read your contact information,
to send out the contact information.
It had full Internet access
on the smartphone and services that
So it can call premium numbers
to premium numbers and it can read
Do you want to install this application?
Why, yes, we do.
Application installed.
Here's what it looked
on the desktop.
Then we get this message saying your
update, setup is canceled and then,
it was still running in the background.
Your mic is not on, David.
DAVID HARRISON: Honestly,
the malware authorities, oh,
We don't have to make it look pretty.
They just put a white screen with text
SHERRI DAVIDOFF: Yeah.
So, again, the user cannot tell that
This is invisible to the end user.
And while this is going on, we saw
and we were alerting on that IP address,
inside the packet.
Here you can see here you can see
So before it starts talking
it has to do a DNS request
a DNS request.
And in the request it was broken
It's interesting that Wireshark actually
We see PPP and IP and then UDP
the highest layer protocol, DNS.
So a challenge to the audience, I
if you fix those protocol dissectors.
It's totally worth it and we saw
Here's fragmentation,
something, the rest
Okay.
So here is an HTTP post.
This HTTP post message
and control traffic.
This is what
like when it's talking
in the Netherlands.
So you can see here PPP Wireshark
but you can see post/data/php.
This was broken
and I had to reassemble them manually,
Here's the first half of it.
It's pretty long.
It has that unique multipart boundary
aabo3x and that's pretty easy
You can see that to Snort.
And you can tell
to the attacker, and
Information about the phone,
Also the name bot ID and some other
the manufacturer.
So it sends a bunch
the bot sends a bunch
to the attacker every 15 minutes
And we can see that happening here,
I alerted on the string bot ID and
in an HTTP post.
Here's the server's response.
So the server is going
and start sending commands
It's just it's a very simple thing.
We actually there's no authentication
and the server.
We have seen malware more complex
when I think it was
we had authentication.
So here, IP, TCP, HTTP,
the HTTP this time.
This is an incoming message
in the Netherlands.
And here's if you reassemble it,
Remove all SMS filters true, okay.
Wait 60.
So it's telling it only wait 60 seconds
And then it changed the server address.
So that's kind of cool.
Scott will talk to you
It can send lots of other commands
Pretty much anything in this let's see,
Pretty much anything
the server can tell to send
It can tell it to delete an SMS,
out to the attacker, or update itself,
It can make phone calls
Where were we?
Okay.
So remove all SMS filters.
We put some of those commands
will alert individually an each
You will have a log
if you set it up this way.
And then again,
we then saw
for the new server name
to go along with it.
So the bot sent a post
over the Netherlands and it received
This time, that second server said,
So instead of telling it wait 60 seconds,
every 15 minutes this would still be
if you were watching your traffic
Every 15 minutes is still pretty noisy
But the attacker could tell it wait
for a month.
And that would be a lot harder
So here's a screen shot.
Our cellular intrusion detection system,
We alerted on the initial infection.
We alerted
the bot made to the attacker.
And you can use this same method
in your environment, whether you are
So now Randi Price is going
about the device forensic analysis.
(Inaudible question).
Were you able to see SMS going
Were you able to inspect it
Did you set maybe
or DAVID HARRISON: Ah.
SHERRI DAVIDOFF: So
to see SMS messages and set
We do have SMS I'm sorry,
We do have SMS traffic.
We haven't really had too much time
the next step that we are going
around with when we get home.
I'm hoping Tom Ritter
DAVID HARRISON: The thing
but it's reverse 7 or something like that,
As far as the C & C, we will get to that
RANDI PRICE: After capturing traffic
device forensic analysis.
The forensic analysis corroborated
We took a physical extraction
with the UFED
MEMBER: Can't hear.
RANDI PRICE: Okay.
Sorry.
Please note is that better?
Okay.
Please note that the infecting and
with an RF shielded test enclosure,
Okay?
The cellebrite physical analyzer was
The malware scanner identified four
The cellebrite looked
as Android Trojan fakeapp.k.
And we should the SHA1,
the SHA1 matched
for the Android Stels malware recorded
in the Trojan malware analysis report.
We found a file called Stels settings
to contain malware configuration
As you can see
is assigned a bot ID.
This allows the bot herder
The server listed is the command
the bot where to phone home to.
The period value of 300 seconds
is the initial phone home interval.
This tells the bot
SCOTT FRETHEIM: Thank you.
All right.
Good morning, DEF CON!
AUDIENCE MEMBER: Good
SCOTT FRETHEIM: I'm super stoked
at 10 a.m.
on a Saturday.
I I'm going to happen down here
AUDIENCE MEMBER: (Inaudible).
SCOTT FRETHEIM: Stronger ones.
All right.
So because of the research that Randi
to determine the way that Stels
We knew the address
We also knew kind
So let's be a man in the middle.
When you want to do man
I had to set
the traffic back through there.
So enter Burp suite professional.
To set this up, we had to tunnel
through Burp suite and we were looking
Just to be sure, that I was getting
the Android device.
What I do mobile Android testing.
I take a rooted device in order to get
Perhaps Stels is using two forms
seeing that encrypted portion of that.
Doing that on an Android phone
You have
packet to the device itself.
But to do that, you have
You have to use an outdated version
I think I was using 0.98.
I think that shifted
is the virtual machine I set
You have to create
of the subject line of the certificate,
to that and install that
down into the system directory
To do, that you have to have root
Once I had root, I launched it.
And now we can see
through that phone, if it's
just a mobile banking app, I can see
through and actually intercept that
In this case, I didn't have to end
All the traffic was going over port 80,
and let's take a look here.
We turn on intercept, of course.
So what I saw was, I will show you,
So it's not listening on that,
It's saying wait 60.
It is telling it to wait 60 seconds
set the command and control filter.
I wonder if it's going to be this easy.
All I had to do was replace
with a server that my own
will be calling back to me.
I did that.
I told it to wait 60.
I set the remove all SMS filters true
Sure enough it worked
instead of the all C & C server.
The server I set
It would get a 404 error.
When the bot actually received that 404
out and then you have
until you can actually start
I thought this is kind of troublesome.
It.
Take me way more time
I continued to keep intercepting
to wait 60 or wait 5 or 30, depending
I found out when I tried to wait 2
fast, it would eventually time
between 5 and 15 minutes
out again and that was even less
You can also adjust it for, you know,
if you want to take a break and go
I found that pretty helpful.
So controlling Stels.
I wanted to see
to export that contact list
And sure enough, you can.
I just had to set send contact list true,
And 60 seconds later,
out that contact information
of the page here, I actually got
off of that device and you can read that.
It sent it right back to the attacker
command and control server,
in my device and
servers to infect more phones.
I find this really helpful if you are
I don't know how many of you have
to manage IT where you are from.
If you have a device on your network,
because we have
to find that device,
and you can't gain access to it
Using this method.
We never even touched the device
off the head of the snake, so to speak.
If the attacker
with that device, the attacker
to steal that data this buys us a lot
down, get
and get that virus cleaned off of there.
SHERRI DAVIDOFF: Nice.
Thank you, Scott!
So that pretty much concludes our
As you saw, we were able to infect
as a demonstration.
We detected the infection
and no agent was actually needed
We could have shut this down remotely,
This was all for $285 and a little bit
And, of course, if you wanted
you certainly could.
Again, here's the parts list.
All you need is a femtocell,
whether it's a laptop or
is, a hub or
Thank you all so much.
We will take questions,
a little bit closer up,
to be in afterwards?
We will tear
So feel free to come visit us.
LMGsecurity.com/blog.
(Applause).
Questions?
DAVID HARRISON: Anyone have any
AUDIENCE MEMBER: Can you put
SHERRI DAVIDOFF: It's
for the paper.
It's up there right now.
AUDIENCE MEMBER: (Inaudible
the malware defect it it's actual
DAVIDOFF: Can you make phones
instead of a tower?
DAVID HARRISON: No.
No.
No if I'm right, can you can could
on a CIDS system?
At this point, probably.
You could certainly design one
or someone or maybe even just modify
Right now, you can see if you have
you will see it pops
connected to a femtocell.
It's in our white paper.
And if you download our paper, you
(Inaudible question) DAVID
SHERRI DAVIDOFF: Which phone
AUDIENCE MEMBER: The 50 phones
DAVIDOFF: For Android Stels, it was
When it communicates
here's my phone number.
DAVID HARRISON: We can see
And I want to say that we can see
SHERRI DAVIDOFF: We can see
number out to Verizon to register
I'm not sure how programmatically, like,
is to find that out.
But theoretically, sure.
You could also figure out a way
Yep?
AUDIENCE MEMBER: You said you
Can it spoof saying it's
in airplane mode
DAVIDOFF: That's a great question,
in airplane mode this particular
with root access to your device could.
DAVID HARRISON: It would be
for the malware authors
a theoretical barrier to that.
AUDIENCE MEMBER: How did you
through SHERRI DAVIDOFF: That
DAVID HARRISON: Yeah.
SHERRI DAVIDOFF: I think
AUDIENCE MEMBER: So what was
since the first one got fixed?
And how much does the sheilding
SHERRI DAVIDOFF: The shield
depending whether or not you want
Yeah, they are real nice.
Tell them that you saw it over here.
AUDIENCE MEMBER: And what
DAVID HARRISON: That
Other people published that one.
You should be able to find it.
(Inaudible question) AUDIENCE
in IP tables.
Do you have any plans to, I don't know,
instead of running through Netcat
HARRISON: Right.
SHERRI DAVIDOFF: Yes.
AUDIENCE MEMBER: I hear Snort
DAVID HARRISON: That would be
We are running
is the exact AUDIENCE MEMBER: So
we can probably help you with that.
DAVID HARRISON: I figured.
SHERRI DAVIDOFF: Awesome!
DAVID HARRISON: We would
to run it more smoothly
AUDIENCE MEMBER: About
through your devices, the devices
in the network traffic?
SHERRI DAVIDOFF: There
I believe that Tom Ritter got his traffic
like to sit down and compare
to do it.
We have just done it this one way.
DAVID HARRISON: Like we said,
you are seeing it after it passes
all encrypted, and if you pull it
before it gets passed
all unencrypted and it doesn't have
The magic was bypassing
AUDIENCE MEMBER: I'm saying it
If you have' device saying so basically
to you don't need to (Inaudible).
captured here, versus the traffic
up to say AUDIENCE MEMBER:
DAVID HARRISON: So
are we seeing a difference
DAVID HARRISON: A wireless
AUDIENCE MEMBER: No, a device.
DAVID HARRISON: Oh, oh, so
on the Android device.
SHERRI DAVIDOFF: Oh, yeah.
DAVID HARRISON: We tried that.
We just wanted access
So we were like, oh, that's easy.
Tried that.
Didn't work
of the network traffic back out,
all of that SHERRI DAVIDOFF: We
DAVID HARRISON: It goes straight
captured by software you put
So SHERRI DAVIDOFF: Also,
up your IDS that way anyway.
If you have an infected system,
traffic you see.
So really, you want it
that's not infected.
AUDIENCE MEMBER: Is the list
to the femtocell, is that controlled
DAVID HARRISON: I want
it's managed through, like,
so you register the femtocell, go
I want these devices that I own that are
So and then it passes that
It would be really great
core network so that they so that
about who connected to femtocells.
Because these things have been
The original malware came
It would be great
about what when you were
and so
whether or not they hooked
So SHERRI DAVIDOFF: Can we get
DAVID HARRISON: This sounds
Okay.
Other questions?
Yeah?
AUDIENCE MEMBER: What
SHERRI DAVIDOFF: We have not
Honestly, we are not
a consulting firm.
And yeah, we wanted to put this
to make a ton
is Verizon here today?
Is anyone here from Verizon
Just curious.
Yes?
AUDIENCE MEMBER: I wonder what
SHERRI DAVIDOFF: Great question.
I think the first thing that comes
will be giving people the ability
right or text messages,
people are already using the Internet,
and Google voice.
So your phone calls are already going
to be no issue
in that traffic.
I think it's pretty similar.
We have been DAVID HARRISON:
This one is now on.
SHERRI DAVIDOFF: Okay.
We have been represented
If you are careful to restrict access
capturing packets and call content
then they didn't see any issue with it,
DAVID HARRISON: Also keep
I would be way more concerned
to get malware on my device
to my phone calls that way than there's
That's a concern but between the two,
SHERRI DAVIDOFF: And in terms
modifying the open source piece
modifying standard open source Linux
the proprietary software.
DAVID HARRISON: That's
in the GPL licensed stuff that's
That was
and thought about.
SHERRI DAVIDOFF: And we also
We chose to take another route
DAVID HARRISON: Question?
(Inaudible question) DAVID
like legitimate apps,
I haven't looked at a wide variety
But some probably would
like, there's.
AUDIENCE MEMBER: (Inaudible
would love
sending back.
SHERRI DAVIDOFF: We looked
If you play
we have some of that stuff.
AUDIENCE MEMBER: (Inaudible
was a great article
they are looking at 20 or 30 apps
Caller IQ, you would be able
You would really be able
to send information
I think we have to wrap
for questions after this.
We have business cards here.
We have some other swag by the door.
So feel free to talk to us after the talk
if you have any more questions.