Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (11)
Similaire à Internet of Terrible: Can you hear me meow?
Similaire à Internet of Terrible: Can you hear me meow? (20)
Dernier
Dernier (20)
Internet of Terrible: Can you hear me meow?
- 1. Internet of Terrible Can you hear me meow?
- 2. ©2016 RSEC.US -=- Brandon McCrillis • Name: Brandon McCrillis • Company: Rendition InfoSec • Email: brandon@renditioninfosec.com • URL: RSEC.US • Twitter: @13M4C • Model: DA243A-ABA 6415cl NA910 • TotalPhysicalMemory: 804765696 Get-WmiObject -Class Win32_ComputerSystem
- 3. ©2016 RSEC.US -=- Brandon McCrillis Objectives: Discuss case studies of conducting network enumeration using VoIP infrastructure and other embedded devices
- 4. ©2016 RSEC.US -=- Brandon McCrillis Objectives: Highlight attack methodologies that can be used for credential harvesting, enumeration, denial of service, and persistence
- 5. ©2016 RSEC.US -=- Brandon McCrillis Objectives: Practical Defensive techniques and real-world attacker mitigations via monitoring and secure configuration
- 6. ©2016 RSEC.US -=- Brandon McCrillis Objectives: Therapeutically work through some *minor* cat issues
- 7. ©2016 RSEC.US -=- Brandon McCrillis Times have changed…
- 8. ©2016 RSEC.US -=- Brandon McCrillis The Internet of Terrible CSI++
- 9. ©2016 RSEC.US -=- Brandon McCrillis IoT: All the things!
- 10. ©2016 RSEC.US -=- Brandon McCrillis©2016 RSEC.US Spy-on-you Barbie!
- 11. Embedded Devices …Doing things with stuff
- 12. ©2016 RSEC.US -=- Brandon McCrillis Embedded Devices In-flight Entertainment
- 13. Much Services, Many Lulz Y’know, living off the land…
- 14. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 15. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 16. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 17. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 18. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 19. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 20. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 21. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 22. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 23. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 24. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 25. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 26. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 27. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 28. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 29. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 30. ©2016 RSEC.US -=- Brandon McCrillis Real-world Assessments…
- 31. Voice over IP …Teh VoIP
- 32. ©2016 RSEC.US -=- Brandon McCrillis What is VoIP?
- 33. ©2016 RSEC.US -=- Brandon McCrillis What is Asterisk?
- 34. Where it’s at.. Two turn-tables and a Polycom phone
- 35. ©2016 RSEC.US -=- Brandon McCrillis What’s in the box…
- 36. ©2016 RSEC.US -=- Brandon McCrillis Reduce, Reuse, Recycle
- 37. ©2016 RSEC.US -=- Brandon McCrillis Can you hear me meow?
- 38. ©2016 RSEC.US -=- Brandon McCrillis Factory Reset Devices pls!
- 39. ©2016 RSEC.US -=- Brandon McCrillis Meh?
- 40. ©2016 RSEC.US -=- Brandon McCrillis I have wut u need…
- 41. ©2016 RSEC.US -=- Brandon McCrillis Default SoundPoint 501 Creds • Default TFTP || FTP: username: PlcmSpIp password: PlcmSpIp • DEFAULT HTTP: username: Polycom password: 456 Default User Pass: 123 Default Admin Pass: 456
- 42. ©2016 RSEC.US -=- Brandon McCrillis Ye Old Web GUI
- 43. ©2016 RSEC.US -=- Brandon McCrillis Sure, I’ll bite…
- 44. ©2016 RSEC.US -=- Brandon McCrillis Sure, I’ll bite…
- 45. ©2016 RSEC.US -=- Brandon McCrillis Base64 Decode Polycom : 456
- 46. ©2016 RSEC.US -=- Brandon McCrillis AsteriskNOW
- 47. ©2016 RSEC.US -=- Brandon McCrillis AsteriskNOW
- 48. ©2016 RSEC.US -=- Brandon McCrillis AsteriskNOW
- 49. Attacking VoIP …Calling your mother
- 50. ©2016 RSEC.US -=- Brandon McCrillis • Information Gathering / Enumeration • Monitoring and Eavesdropping • Attacking Authentication • VLAN Hopping • Denial of Service / Flooding • Spoofing Caller ID Common Attack Vectors
- 51. VoIP Weaponized I shouldn’t be able to do this!
- 52. ©2016 RSEC.US -=- Brandon McCrillis Oh so sexy….
- 53. ©2016 RSEC.US -=- Brandon McCrillis CHECK-SYNC Many vendors allow for a remote reboot of phones to facilitate SIP configuration updates. When an attacker 0wn yer VoIP
- 54. ©2016 RSEC.US -=- Brandon McCrillis CHECK-SYNC When an attacker 0wn yer VoIP
- 55. ©2016 RSEC.US -=- Brandon McCrillis CHECK-SYNC Using this for pure evil, an attacker can force consumption of a tampered configuration to the phone… unauthenticated. When an attacker 0wn yer VoIP
- 56. ©2016 RSEC.US -=- Brandon McCrillis CHECK-SYNC Check-sync DoS When an attacker 0wn yer VoIP
- 57. ©2016 RSEC.US -=- Brandon McCrillis • Python-based SIP Packet Forging Tool by Pietro Bertera (bertera.it) https://github.com/pbertera/SIPPing Also, wrote a blog post regarding SIP packet filtering using iptables SIPPing …FTW!
- 58. ©2016 RSEC.US -=- Brandon McCrillis Crafted check-sync packet
- 59. ©2016 RSEC.US -=- Brandon McCrillis SPECIAL EXTENSIONS Configuration of a “special extension” with auto-answer can force the phone to answer a call (without ringing) and immediately force the speakerphone mic to listen. …a real time audio feed… without user interaction or knowledge. When an attacker 0wn yer VoIP
- 60. ©2016 RSEC.US -=- Brandon McCrillis SPECIAL EXTENSIONS When an attacker 0wn yer VoIP
- 61. ©2016 RSEC.US -=- Brandon McCrillis SPECIAL EXTENSIONS When an attacker 0wn yer VoIP
- 62. ©2016 RSEC.US -=- Brandon McCrillis VLAN Hopping Often times VoIP VLANs are not monitored (read: trusted) -- “Plug and Play” hopping… When an attacker 0wn yer VoIP
- 63. ©2016 RSEC.US -=- Brandon McCrillis VLAN Hopping When an attacker 0wn yer VoIP
- 64. ©2016 RSEC.US -=- Brandon McCrillis VLAN Hopping When an attacker 0wn yer VoIP
- 65. ©2016 RSEC.US -=- Brandon McCrillis More phun with VoIP auxillary/voip auxillary/scanner/sip SIPvicious / SIPdump / SIPCrack Kali/Metasploit
- 66. ©2016 RSEC.US -=- Brandon McCrillis Future Development • SIP Tunneling • Exploit and Exfiltration Framework • Enumeration of trusted devices within the information system • Flashing Custom Firmware
- 67. ©2016 RSEC.US -=- Brandon McCrillis Trusted can’t be trusted Wrapping it up… ©2016 RSEC.US
- 68. ©2016 RSEC.US -=- Brandon McCrillis Secure configuration and Monitoring FTW! Wrapping it up… ©2016 RSEC.US
- 69. ©2016 RSEC.US -=- Brandon McCrillis Know your network better than I will Wrapping it up… ©2016 RSEC.US
- 70. ©2016 RSEC.US -=- Brandon McCrillis The Last Meow…