Hacking and penetration testing with low power devices

245 Pages·2015·70.07 MB·English

by  Philip Polstra

Hacking and
Penetration Testing
with Low Power
Devices
Hacking and
Penetration Testing
with Low Power
Devices
Philip Polstra
Technical Editor: Vivek Ramachandran
AMSTERDAM (cid:129) BOSTON (cid:129) HEIDELBERG (cid:129) LONDON
NEW YORK (cid:129) OXFORD (cid:129) PARIS (cid:129) SAN DIEGO
SAN FRANCISCO (cid:129) SYDNEY (cid:129) TOKYO
Syngress is an Imprint of Elsevier
AcquiringEditor:ChrisKatsaropoulos
EditorialProjectManager:BenjaminRearick
ProjectManager:PriyaKumaraguruparan
Designer:MarkRogers
SyngressisanimprintofElsevier
225WymanStreet,Waltham,MA02451,USA
Copyright#2015ElsevierInc.Allrightsreserved.
Nopartofthispublicationmaybereproducedortransmittedinanyformorbyanymeans,electronicor
mechanical,includingphotocopying,recording,oranyinformationstorageandretrievalsystem,without
permissioninwritingfromthepublisher.Detailsonhowtoseekpermission,furtherinformationaboutthe
Publisher’spermissionspoliciesandourarrangementswithorganizationssuchastheCopyrightClearance
CenterandtheCopyrightLicensingAgency,canbefoundatourwebsite:www.elsevier.com/permissions.
ThisbookandtheindividualcontributionscontainedinitareprotectedundercopyrightbythePublisher
(otherthanasmaybenotedherein).
Notices
Knowledgeandbestpracticeinthisfieldareconstantlychanging.Asnewresearchandexperiencebroaden
ourunderstanding,changesinresearchmethods,professionalpractices,ormedicaltreatmentmaybecome
necessary.
Practitionersandresearchersmustalwaysrelyontheirownexperienceandknowledgeinevaluatingand
usinganyinformation,methods,compounds,orexperimentsdescribedherein.Inusingsuchinformation
ormethodstheyshouldbemindfuloftheirownsafetyandthesafetyofothers,includingpartiesforwhom
theyhaveaprofessionalresponsibility.
Tothefullestextentofthelaw,neitherthePublishernortheauthors,contributors,oreditors,assumeany
liabilityforanyinjuryand/ordamagetopersonsorpropertyasamatterofproductsliability,negligenceor
otherwise,orfromanyuseoroperationofanymethods,products,instructions,orideascontainedinthe
materialherein.
LibraryofCongressCataloging-in-PublicationData
Polstra,Philip,author.
Hackingandpenetrationtestingwithlowpowerdevices/PhilipPolstra,associateprofessor,Bloomsburg
University,Bloomsburg,PA;technicaleditor,VivekRamachandran.
pagescm
ISBN978-0-12-800751-8
1. Penetrationtesting(Computersecurity)–Equipmentandsupplies.2. BeagleBone(Computer) I.
Ramachandran,Vivek,editor.II.Title.
QA76.9.A25P59652015
005.8–dc23
2014027430
BritishLibraryCataloguing-in-PublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary
ISBN:978-0-12-800751-8
ForinformationonallSyngresspublications,
visitourwebsiteatstore.elsevier.com/syngress
ThisbookhasbeenmanufacturedusingPrintOnDemandtechnology.Eachcopyisproducedtoorderand
islimitedtoblackink.Theonlineversionofthisbookwillshowcolorfigureswhereappropriate.
Dedicated to my favorite wife, my favorite daughter, and
my favorite son.
Foreword
SoIwillstartoutthisforewordbywarningyoudearreaderofthepoweryounow
hold in your hands! This book does not only educate but also create a defining
moment on how business, organization, and peoplewill fromnowon look at their
network security. For too long we have led ourselves to believe that the dangers
ofouronlineinteractionswerelimitedandshieldedbecauseoftheneedforanInter-
netconnectionoranIPaddress.Well,nomore!Theauthorhasbroughttolightthe
grimtruththatwithoutphysicalsecurityyouhavenoonlinesecurity.Heshowshow
everydaygadgets,gizmos,andcomputeraccessoriesthatwetakeforgrantedcanbe
usedtopenetrateournetworks.Heshowsthattheskyisnowliterallynolongerthe
limit. By showing how devices ready to attack your network can even fly to their
target! These devices are not from the future; they are not even from DARPA!
He will walk you through how you too can create these cyber-weapons using
low-cost parts and this book. The golden age of cyberwar has long since passed
where only nation states had this power. Thanks to the author’s diligent efforts,
he has brought this kind of know-how and technology to the masses! This book
shouldbegiventoeveryCIO,CEO,CFO(well,anypersonwhohasatitlethatstarts
with “C”), sothat theycan realize the threats that areoutthere! I’ve said, “Idon’t
havetobypassyourfirewallifIcanbypassyourreceptionist.”Well,theauthordoes
anexcellentjobshowingingraphicdetailjusthoweasythathasbecome.Thisisnota
bookforthosewhoareafraidtolookintothevoid(orintotheircurrentinformation
security policies and procedures)! This is a book for those who dare to ask, “Why
doesthatpowerplughaveanEthernetcableattachedtoit?”andwhoareneverafraid
to ask, “I wonder what this does?” This is not a “light reading on a rainy Sunday
afternoon”book.Thisisa“breakoutthesolderingiron,mylaptop,andaboxofband
aids”book!Goforth,reader,andlearnofthewondersofweaponizingyourmouse,
makingatoyrobotmoreterrifyingthantheTerminator,andhowsometimesseeinga
blue police box should fill you with dread!
I’mserious,thisisagreatbookandI’velearnedsomereallygreatthingsfromit.
Enjoy!
Jayson E. Street
June 2014
xi
Author Biography
Dr.PhilipPolstra(knowntohisfriendsasDr.Phil)isaninternationallyrecognized
hardwarehacker.Hisworkhasbeenpresentedatnumerousconferencesaroundthe
globe including repeat performances at DEF CON, BlackHat, 44CON, GrrCON,
MakerFaire, ForenSecure, and other top conferences. Dr. Polstra is a well-known
experton USBforensics andhas publishedseveral articleson this topic.
Dr.Polstrahasdevelopeddegreeprogramsindigitalforensicsandethicalhacking
while serving as a professor and Hacker in Residence at a private university in the
MidwesternUnitedStates. He currently teaches computer science and digitalforen-
sicsat Bloomsburg UniversityofPennsylvania.In additiontoteaching, heprovides
trainingandperformspenetrationtestsonaconsultingbasis.Whennotworking,he
hasbeenknown tofly,buildaircraft,and tinkerwith electronics.His latest happen-
ingscanbefoundonhisblog:http://polstra.org.Youcanalsofollowhimat@ppolstra
on Twitter.
xiii
Acknowledgments
Firstandforemost,Iwouldliketothankmywifeandchildrenforallowingmetotake
the time to write this book, also known as Daddy’s second dissertation. This book
would never have happenedwithouttheir support.
Many thanks to my friend and technical editor, Vivek Ramachandran, for his
advice on all things infosec and on writing a book. I am eternally grateful that he
agreedtobethe technical editor for thisbook despite his busyschedule.
ThankstomyfellowauthorsT.J.O’ConnorandJaysonStreetforofferingadvice
and encouragementwhen Iwas contemplatingwriting this book.
Finally,Iwouldliketothankorganizersofqualitysecurityconferencesforpro-
vidingaforumtosharemylittlesliceofinfosecwithothers.Inparticular,Iwishto
thankSteveLordandAdrianfrom44CONandChrisandJaimePaynefromGrrCON
for initially taking a risk accepting an unknown speaker and later allowing me the
privilege ofspeakingat their conferences multipletimes.
xv
CHAPTER
1
Meet the deck
INFORMATION IN THIS CHAPTER:
(cid:129) TheDeck—acustomLinuxdistribution
(cid:129) SmallcomputerboardsrunningLinux
(cid:129) Standardpenetrationtestingtools
(cid:129) Penetrationtestingdesktops
(cid:129) Dropboxes—attackingfromwithin
(cid:129) Drones—attackingfromadistancewithmultipledevices
INTRODUCTION
Weliveinanincreasinglydigitalworld.Thenumberofinterconnecteddevicesinour
world is constantly on the rise. Businesses worldwide rely on computers, tablets,
smartphones,andotherdigitaldevicesinordertocompeteinaglobaleconomy.Many
businesses are necessarily connected to the Internet. Newly connected systems can
comeunderattackbymaliciouspersonsand/ororganizationsinamatterofminutes.
Becauseofthis,thedemandforinformationsecurity(infosec)professionalsisstrong.
Penetrationtesters(pentesters)aresomeofthemostsoughtafterinfosecpeople.
Chancesarethatifyouarereadingthisbook,youalreadyknowwhatpenetration
testing entails. Penetration testing (pentesting) is authorized hacking performed at
the request of a client in order to ascertain how easily their digital security may
be penetrated and steps that should be taken to improve their security posture.
The need for penetration testing has led to the creation of a number of specialized
Linuxdistributions.Upuntilnow,thesecustomLinuxdistributionshavebeencre-
atedalmostexclusivelytoberunbyasinglepenetrationtesterusinganIntel-based
(or AMD-based)desktop or laptop computer.
FEAR NOT
Before getting started with the main topic of this chapter, I wanted to provide you
with some assurances up front. This book is written under the assumption that
youhaveanunderstandingofgeneralpenetrationtestingconceptsandbasicLinux
usage. Everything else you need to know will be provided in this book. You need
not be an elite hacker (but if you are, then good for you!) or advanced Linux
user/administrator to get something out of this book. Most importantly, absolutely
1
HackingandPenetrationTestingwithLowPowerDevices
©2015ElsevierInc.Allrightsreserved.
2 CHAPTER 1 Meet the deck
no hardware knowledge is assumed. While information will be provided for those
wishingtocreatetheirowncustomcircuitboardsandsuch,mostofwhatisdescribed
in thisbook isalsocommerciallyavailable.
Ifyouarenewtotheideaofhardwarehacking,youcanchoosetheleveltowhich
youwanttopushyourself.Youcansimplyplayitsafeandbuycommerciallyavail-
ableBeagleBonecapes(expansionboardsthatplugintotheBeagleBonedirectly;see
http://beagleboard.org/capeformoreinformation).Ifyouwanttogetyourfeetwet,
youmightsolderfourwirestoacommerciallyavailableXBeeadapter(suchasthis
Adafruit adapter (http://www.adafruit.com/products/126)) to create a mini-cape as
described later in this book. Information is provided for advanced users who want
to etch their own custom circuit boards. You can do as little or as much hardware
hackingasyouwishwithoutaffectingyourabilitytoperformpowerfulpenetration
testsasdescribed inthis book.
THE DECK
TheDeck,thecustomLinuxdistributiondescribedinthisbook,breaksthetraditional
model by providing penetration testers with an operating system that runs on low-
powerARM-basedsystemsdevelopedbythenonprofitBeagleBoard.orgFoundation
(these will be described more fully in the next chapter, but see http://beagleboard.
org/Getting%20Started if you just cannot wait till then). This permits devices run-
ningTheDecktobeeasilyhiddenandopensupthepossibilityofrunningoffofbat-
tery power. At the time of this writing, The Deck contained over 1600 packages,
making it extremely useful for penetration testing. The Deck is extremely flexible
andisequallyadeptatbeingusedasatraditionaldesktop,dropbox,orremotehack-
ing drone.
WHAT’S IN A NAME?
TheDeck
Ifyouareareaderofsciencefiction,youmayalreadyhaveasuspicionwherethenameTheDeck
comesfrom.TheDeckcanrefertothecustomLinuxdistributiondescribedinthisbookortoa
devicerunningTheDeckoperatingsystem.Inthe1984sciencefictionclassicNeuromancerbyWil-
liamGibson,cyber-cowboysusingcomputerterminalsattachedtotheInternetaresaidto“punch
deck.”Gibsondescribedafuturewhereadvanceddevices(decks)areusedtoaccesstheInternet.In
mymind,theBeaglesandsimilarsmall,low-power,inexpensivedevicesrepresentthefutureof
penetrationtesting.NamingthesystemTheDeckisatributetoGibson.Additionally,theBeagle-
Boneisroughlythesizeofadeckofcards.
DEVICES RUNNING THE DECK
All of the devices shown in Figure 1.1 are running The Deck. At the time of this
writing, The Deck runs on three devices in the Beagle family: the BeagleBoard-
xM, BeagleBone, and BeagleBone Black edition. These boards will be described
The deck 3
FIGURE1.1
CollectionofdevicesrunningTheDeck.
morefullyinthenextchapter.YoucanalsofindoutmoreaboutthemattheBeagle-
Board Web site (http://beagleboard.org). For now, we will describe them as low-
powerboardsbasedonARMCortex-A8processorsrunningatupto1GHz.Despite
providingdesktop-likeperformance,thesedevicesrequireafractionofthepowerof
anIntel-basedorAMD-basedsystem.Evenwhendrivinga7in.touchscreen(suchas
this one: http://elinux.org/Beagleboard:BeagleBone_LCD7) and external wireless
adapter, a 10W (2A at 5V) power adapter is more than sufficient. Compare this
with triple-and quadruple-digit wattages found inlaptop and desktop systems.
PENETRATION TESTING TOOLS
The Deck contains a large number of penetration testing tools. The intention is to
haveeverytoolyouwouldlikelyneedavailablewithoutthetroubleofdownloading
additionalpackages.Installingnewpackagestoahackingdroneduringapenetration
test ranges from difficult to impossible. Some desktop-oriented penetration testing
Linuxdistributionssufferfromhavingmanyoldpackagesthatarenolongerincom-
monuse.EachpackageincludedinTheDeckwasevaluatedbeforeinclusion.Any-
thingdeemedredundanttoanewpackagewasleftout.Someofthemorefrequently
used toolsare introduced here.
Wirelessnetworkinghasbecomeextremelyprevalent.Asaresult,manypenetra-
tion tests start with the need to crack a wireless network. The aircrack-ng suite is
included in The Deck for this purpose. The airodump-ng utility is used for basic
packetcapturesandanalysis.Capturedpacketscanthenbefedtoaircrack-nginorder
to crack network encryption. Screenshots of airodump-ng and aircrack-ng are pro-
videdinFigures1.2and1.3,respectively.Moredetailsonusingtheaircrack-ngsuite
will be provided infuture chapters.