nullcon 2010 - The evil karmetasploit upgrade

Veysel Oezer

The Evil
Karmetasploit Upgrade

nullcon Goa 2010 http://nullcon.net

Overview
Introduction
Background
Title
Realization
Results
Conclusion
Demos in between !


Introduction
IT Security
Increasing attacks


Introduction
IT Security
Increasing attacks
also in Germany


Introduction
Know your enemy !
”So it is said that if you know your
enemies and know yourself, you will
fight without danger in battles.
If you only know yourself, but not your
opponent, you may win or may lose.
If you know neither yourself nor your
enemy, you will always endanger
yourself.”


Background

The man in the middle
The hacker tools
Evilgrade
Metasploit
Karma + Karmetasploit


The man in the middle attack


Known MitM attacks
ARP spoofing
DNS spoofing
BGP hacking
ICMP redirect, ...
Karma !
The evil twin hotspot


Background

The hacker tools


Evilgrade

Framework for attacking weak update
mechanisms
”The idea..is the centralization
and exploitation of different
update impl. all together in one
tool”
Written in Perl and published
2007-2008
Existing Module
Sun Java
Apple OS X

Evilgrade

How does it work


Evilgrade


Metasploit
Vulnerability development framework
Reduce the work for creating an exploit
Penetration testing
Several hundert exploits
#5 from top 100 security tools
Written in Ruby and BSD licensed
"Don't try to teach yourself how to
use metasploit under the security
camera at the airport"

Metasploit architecture


Karma

The evil twin access point
MitM attack on WinXp
Wireless Zero Configuration...
Or just name ”FreeWifi” ;)
After MitM, steal authentication
data
Http, Ftp, Pop3, Imap and so on
Released in 2004


Karmetasploit
Reimplemantion of Karma into
Metasploit
Fake access point integrated into
aircrack-ng
Authentication capturing
implemented as auxiliary modules
for Metasploit
Several improvements
Better hardware support
Cookie,Form data stealing
Browser exploitation

Goals
Evilgrade 2 Metasploit
Reimplement functionality as metasploit
module
Improve new system
• Port Sharing, Stealth mode, faster
metasploit payload generation
Transfer existing evilgrade modules
into new system
Create new fake servers
Sip and XMPP
Find new vulnerabilities in
software

Fake XMPP

Based on TCP
Used for Jabber → Instant Messaging
Google Talk...
Has built-in strong security, but
depends on server and client
Cleartext password transmission
possible


Fake Sip Server

UDP based protocol
Redefined in serveral RFCs
Authentication similar to HTTP
Digest
Challenge – Response
Try downgrade attack to use Basic
Authentication


Realisation

Environments
Evilgrade 2 Metasploit
Authentication capturing servers
Analysis of update mechanisms


Used tools

Wireshark
Jacksum
Vbindiff
VmWare Workstation
Netcat
Ghex


Attack Environment

DEMO


Realisation E-2-M


Fake XMPP


Fake Sip Server


Analysis
1. Install an old version on the target.
2. Sniff the update process on the attacker.
3. Analyze network communication.
4. If possible, try to simulate the update
server.
5. If possible, install latest version on
the target.
6. Improve server to be version independent.
7. Improve server to allow to configure
options, like the description shown as
update information to the client.

Results

Fake SIP and XMPP servers
Reimplementation of Evilgrade
Analysis of update implemenations
Not hacked
Indirect hacks
Hacked


Results – fake server

XMPP
Works
SIP
Downgrade attack had no success
Capturing of Digest Authentication is
working
DEMO


Results

Evilgrade in Metasploit
Reimpl. the old functionality
Old modules ported
Several improvements
• All mentioned ones
• Anti-virus bypassing for metasploit
payloads
( DEMO at the end if time left )
• Some others...


Results - Analysis
Not hacked
uTorrent
Avira Antivir
Foxit Reader
Vlc uses PGP
Ad-Aware only one that uses SSL
Spybot, AVG Antivir, Comodo Firewall,
Picasa, ZoneAlarm, Winrar, flashget,
camfrog..


Results – Not hacked

Not hacked
uTorrent uses binary signed data ?!?


Not hacked
Avira Antivir

MASTER.IDX
CRDATE=20090505_1833
<3f76d242c16a5491bfe98540f68c36c9>



Foxit Reader and the fzip file
format


Results - Analysis

Indirect hack
Skype
Quicktime
Orbit Downloader
Miranda IM
DEMO


Results Analysis

Hacked
Trillian
Kerio Firewall
SuperAntiSpyware
Filezilla
GomPlayer
Divx Player


Trillian update mechanism

Binary update information
Can you read that ?


Trillian update mechanism

Binary update information


Results - Hacked

DEMO


Conclusion

Release candidate of evil
karmetasploit upgrade is ready
No need for Evilgrade anymore
Several improvements compared to
Evilgrade
New authentification capturing servers
Several weak update implementations
found,
over 100 million downloads from
www.cnet.com

Conclusion
Feature list for version 2
SIP downgrade attack on old SIP
hardware
Fake server XMPP over HTTP
Improve design to handle Avira Antivir
Feature list of version 3
Advanded stealth mode
• Intelligent fake DNS server
Find more vulnerabilites


Conclusion
Software developers
Please make secure software
Use standards and deny weak stuff by
default
And for the rest of us
Be aware of this attack vectors
Do not install every ”important
security update”
Do not trust security software by
default
Do not trust the Internet,
especially (public) Wifi networks

That's it !

Q & A


nullcon 2010 - The evil karmetasploit upgrade

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (13)

Ähnlich wie nullcon 2010 - The evil karmetasploit upgrade

Ähnlich wie nullcon 2010 - The evil karmetasploit upgrade (20)

Mehr von n|u - The Open Security Community

Mehr von n|u - The Open Security Community (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

nullcon 2010 - The evil karmetasploit upgrade