Polstra Hacking and Penetration Testing with Low Power Devices

1. Auflage 2014
ISBN: 978-0-12-800824-9
Verlag: Elsevier Science & Techn.
Format: EPUB
Kopierschutz: 6 - ePub Watermark

E-Book, Englisch, 260 Seiten

Hacking and Penetration Testing with Low Power Devices shows you how to perform penetration tests using small, low-powered devices that are easily hidden and may be battery-powered. It shows how to use an army of devices, costing less than you might spend on a laptop, from distances of a mile or more. Hacking and Penetration Testing with Low Power Devices shows how to use devices running a version of The Deck, a full-featured penetration testing and forensics Linux distribution, and can run for days or weeks on batteries due to their low power consumption. Author Philip Polstra shows how to use various configurations, including a device the size of a deck of cards that can easily be attached to the back of a computer. While each device running The Deck is a full-featured pen-testing platform, connecting systems together via 802.15.3 networking gives you even more power and flexibility. This reference teaches you how to construct and power these devices, install operating systems, and fill out your toolbox of small low-power devices with hundreds of tools and scripts from the book's companion website. Hacking and Pen Testing with Low Power Devices puts all these tools into your hands and will help keep you at the top of your game performing cutting-edge pen tests from anywhere in the world! - Understand how to plan and execute an effective penetration test using an army of low-power devices - Learn how to configure and use open-source tools and easy-to-construct low-power devices - Leverage IEEE 802.15.4 networking to perform penetration tests from up to a mile away, or use 802.15.4 gateways to perform pen tests from anywhere in the world - Access penetration testing operating systems with hundreds of tools and scripts on the book's companion web site

Dr. Philip Polstra (known to his friends as Dr. Phil) is an internationally recognized hardware hacker. His work has been presented at numerous conferences around the globe including repeat performances at DEFCON, BlackHat, 44CON, GrrCON, MakerFaire, ForenSecure, and other top conferences. Dr. Polstra is a well-known expert on USB forensics and has published several articles on this topic.Dr. Polstra has developed degree programs in digital forensics and ethical hacking while serving as a professor and Hacker in Residence at a private university in the Midwestern United States. He currently teaches computer science and digital forensics at Bloomsburg University of Pennsylvania. In addition to teaching, he provides training and performs penetration tests on a consulting basis. When not working, he has been known to fly, build aircraft, and tinker with electronics. His latest happenings can be found on his blog: http://polstra.org. You can also follow him at @ppolstra on Twitter.

Autoren/Hrsg.

Polstra, Philip

Inhaltsverzeichnis

1;Front Cover;1
2;Hacking and Penetration Testing with Low Power Devices;4
3;Copyright;5
4;Dedication;6
5;Contents;8
6;Foreword;12
7;Author Biography;14
8;Acknowledgments;16
9;Chapter 1: Meet the deck;18
9.1;Introduction;18
9.1.1;Fear Not;18
9.2;The Deck;19
9.2.1;Devices Running The Deck;19
9.2.2;Penetration Testing Tools;20
9.2.3;Modes of Operation;24
9.2.3.1;The Deck as a desktop system;24
9.2.3.2;The Deck as a dropbox;25
9.2.3.3;The Deck as a hacking drone;26
9.3;Summary;28
10;Chapter 2: Meet the beagles;30
10.1;Introduction;30
10.2;Texas Instruments Devices;31
10.2.1;BeagleBoard-xM;31
10.2.2;BeagleBone;35
10.2.3;BeagleBone Black;38
10.3;Summary;43
11;Chapter 3: Installing a base operating system;44
11.1;Introduction;44
11.1.1;Non-Linux Options;44
11.1.1.1;Windows CE;44
11.1.1.2;QNX;45
11.1.1.3;FreeBSD;45
11.1.1.4;StarterWare;46
11.1.1.5;Android;46
11.1.2;Linux Options;48
11.1.2.1;Ångström;49
11.1.2.2;Arch Linux;51
11.1.2.3;Gentoo;52
11.1.2.4;Sabayon;54
11.1.2.5;Buildroot;54
11.1.2.6;Nerves Project with Erlang/OTP;54
11.1.2.7;Fedora;55
11.1.2.8;Debian;56
11.1.2.9;Ubuntu;58
11.2;Desired Attributes for Penetration Testing Linux Distribution;59
11.3;Ubuntu Options;60
11.3.1;Ubuntu Variants;61
11.3.2;Kernel Choices;61
11.3.2.1;Device trees;62
11.4;Creating a microSD Card;62
11.5;Summary;63
11.6;Chapter 3 Appendix: Digging Deeper into the Setup Script;63
12;Chapter 4: Filling the toolbox;72
12.1;Introduction;72
12.2;Adding a Graphical Environment;72
12.3;Adding Tools the Easy Way;79
12.3.1;Using Repositories;79
12.3.2;Using Packages;82
12.4;Adding Tools the Hard Way;86
12.4.1;Native Compilation;87
12.4.2;Simple Cross compilation;87
12.4.3;Cross compiling Using Eclipse;88
12.4.3.1;Using existing make files;88
12.4.3.2;Creating new projects;91
12.4.3.3;Adding remote debugging;92
12.4.4;Automating Source Builds;96
12.4.5;Installing Python Tools;102
12.4.6;Installing Ruby;103
12.5;Starter Set of Tools;103
12.5.1;Wireless Cracking;103
12.5.2;Password Cracking;105
12.5.3;Scanners;106
12.5.4;Python Tools;107
12.5.5;Metasploit;107
12.6;Summary;109
13;Chapter 5: Powering The Deck;110
13.1;Introduction;110
13.2;Power Requirements;111
13.3;Power Sources;113
13.3.1;Wall Power;114
13.3.2;USB Power;114
13.3.3;Battery Power;115
13.3.4;Solar Power;119
13.4;Reducing Power Consumption;120
13.5;Penetration Testing With a Single Beagle;122
13.5.1;Getting on the Wireless;123
13.5.2;Finding What Is Out There;126
13.5.3;Looking for Vulnerabilities;129
13.5.4;Exploiting Vulnerabilities;131
13.5.5;Attacking Passwords;134
13.5.6;Detecting Other Security Issues;137
13.6;Summary;138
14;Chapter 6: Input and output devices;140
14.1;Introduction;140
14.2;Display Options;140
14.2.1;Traditional Monitors;140
14.2.2;Directly Attached Devices;141
14.3;Keyboards and Mice;143
14.4;IEEE 802.11 Wireless;143
14.5;IEEE 802.15.4 Wireless;145
14.6;Network Hubs and Switches;146
14.7;BeagleBone Capes;146
14.7.1;XBee Mini-Cape;148
14.7.2;XBee Cape;152
14.7.2.1;Single-sided XBee cape;156
14.8;Penetration Testing With a Single Remote Drone;158
14.8.1;Getting on the Wireless;159
14.8.2;Finding What is Out There;165
14.8.3;Looking for Vulnerabilities;167
14.8.4;Exploiting Vulnerabilities;170
14.8.5;Attacking Passwords and Detecting Other Security Issues;170
14.9;Summary;170
15;Chapter 7: Building an army of devices;172
15.1;Introduction;172
15.2;Using IEEE 802.15.4 Networking;173
15.2.1;Point-to-Multipoint Networking;173
15.2.2;Mesh Networking;175
15.3;Configuring IEEE 802.15.4 Modems;176
15.3.1;Series 1 Modem Configuration;178
15.3.2;Series 2 Modem Configuration;180
15.4;Remote Control the Easy Way;183
15.5;Remote Control via Python;185
15.6;Saving Power;201
15.7;Adding Security;203
15.8;Expanding Your Reach;205
15.8.1;IEEE 802.15.4 Routers;205
15.8.2;IEEE 802.15.4 Gateways;206
15.9;Penetration Testing With Multiple Drones;207
15.9.1;Meet Phil's Fun and Edutainment;207
15.9.2;Planning the Attack;208
15.9.3;Configuring Devices;209
15.9.4;Executing the Attack;210
15.10;Summary;220
16;Chapter 8: Keeping your army secret;222
16.1;Introduction;222
16.2;Hiding Devices;223
16.2.1;Hiding Devices in Natural Objects;223
16.2.2;Hiding Devices in and Around Structures;224
16.2.3;Using Toys and Trinkets to Hide Devices;231
16.3;Installing Devices;233
16.3.1;Initial Hiding;237
16.3.2;Maintaining Devices;239
16.3.3;Removing Devices;239
16.4;Summary;239
17;Chapter 9: Adding air support;240
17.1;Introduction;240
17.2;Building the AirDeck;240
17.2.1;Selecting a Platform;240
17.2.2;The Router-only Option;243
17.2.3;A Fully-functional Drone and Router;244
17.3;Using Your Aerial Drone;246
17.3.1;Router-only Operation;246
17.3.2;Using the AirDeck;247
17.3.3;Conserving Power;247
17.4;Alternative Aircraft;250
17.4.1;Quadcopter;250
17.4.2;An Improved Flying Wing;250
17.5;Summary;251
18;Chapter 10: Future directions;252
18.1;Introduction;252
18.2;Current Happenings with The Deck;252
18.3;Cape Contemplations;253
18.4;Ports of The Deck;253
18.5;Ultralow Power with Microcontrollers;254
18.6;Closing Thoughts;254
19;Index;256

Leseproben

Chapter 1 Meet the deck
Abstract
This chapter introduces The Deck, a Linux distribution based on Ubuntu 13.04 that runs on the BeagleBoard and BeagleBone family of ARM-based computer boards. The Deck includes many powerful tools used by penetration testers and forensics experts. Unlike desktop Linux systems that have been ported to ARM-based boards, The Deck is optimized for this platform. The Deck is meant to operate in one of three modes: a traditional desktop, a dropbox to be planted, or a drone, which will use IEEE 802.15.4 networking to be controlled from distances of up to a mile away. Keywords Penetration testing The Deck IEEE 802.15.4 BeagleBone Black BeagleBoard-xM ARM Information in This Chapter • The Deck—a custom Linux distribution • Small computer boards running Linux • Standard penetration testing tools • Penetration testing desktops • Dropboxes—attacking from within • Drones—attacking from a distance with multiple devices Introduction
We live in an increasingly digital world. The number of interconnected devices in our world is constantly on the rise. Businesses worldwide rely on computers, tablets, smartphones, and other digital devices in order to compete in a global economy. Many businesses are necessarily connected to the Internet. Newly connected systems can come under attack by malicious persons and/or organizations in a matter of minutes. Because of this, the demand for information security (infosec) professionals is strong. Penetration testers (pentesters) are some of the most sought after infosec people. Chances are that if you are reading this book, you already know what penetration testing entails. Penetration testing (pentesting) is authorized hacking performed at the request of a client in order to ascertain how easily their digital security may be penetrated and steps that should be taken to improve their security posture. The need for penetration testing has led to the creation of a number of specialized Linux distributions. Up until now, these custom Linux distributions have been created almost exclusively to be run by a single penetration tester using an Intel-based (or AMD-based) desktop or laptop computer. Fear Not
Before getting started with the main topic of this chapter, I wanted to provide you with some assurances up front. This book is written under the assumption that you have an understanding of general penetration testing concepts and basic Linux usage. Everything else you need to know will be provided in this book. You need not be an elite hacker (but if you are, then good for you!) or advanced Linux user/administrator to get something out of this book. Most importantly, absolutely no hardware knowledge is assumed. While information will be provided for those wishing to create their own custom circuit boards and such, most of what is described in this book is also commercially available. If you are new to the idea of hardware hacking, you can choose the level to which you want to push yourself. You can simply play it safe and buy commercially available BeagleBone capes (expansion boards that plug into the BeagleBone directly; see http://beagleboard.org/cape for more information). If you want to get your feet wet, you might solder four wires to a commercially available XBee adapter (such as this Adafruit adapter (http://www.adafruit.com/products/126)) to create a mini-cape as described later in this book. Information is provided for advanced users who want to etch their own custom circuit boards. You can do as little or as much hardware hacking as you wish without affecting your ability to perform powerful penetration tests as described in this book. The Deck
The Deck, the custom Linux distribution described in this book, breaks the traditional model by providing penetration testers with an operating system that runs on low-power ARM-based systems developed by the nonprofit BeagleBoard.org Foundation (these will be described more fully in the next chapter, but see http://beagleboard.org/Getting%20Started if you just cannot wait till then). This permits devices running The Deck to be easily hidden and opens up the possibility of running off of battery power. At the time of this writing, The Deck contained over 1600 packages, making it extremely useful for penetration testing. The Deck is extremely flexible and is equally adept at being used as a traditional desktop, dropbox, or remote hacking drone. What's in a Name? The Deck If you are a reader of science fiction, you may already have a suspicion where the name The Deck comes from. The Deck can refer to the custom Linux distribution described in this book or to a device running The Deck operating system. In the 1984 science fiction classic Neuromancer by William Gibson, cyber-cowboys using computer terminals attached to the Internet are said to “punch deck.” Gibson described a future where advanced devices (decks) are used to access the Internet. In my mind, the Beagles and similar small, low-power, inexpensive devices represent the future of penetration testing. Naming the system The Deck is a tribute to Gibson. Additionally, the BeagleBone is roughly the size of a deck of cards. Devices Running The Deck
All of the devices shown in Figure 1.1 are running The Deck. At the time of this writing, The Deck runs on three devices in the Beagle family: the BeagleBoard-xM, BeagleBone, and BeagleBone Black edition. These boards will be described more fully in the next chapter. You can also find out more about them at the BeagleBoard Web site (http://beagleboard.org). For now, we will describe them as low-power boards based on ARM Cortex-A8 processors running at up to 1 GHz. Despite providing desktop-like performance, these devices require a fraction of the power of an Intel-based or AMD-based system. Even when driving a 7 in. touchscreen (such as this one: http://elinux.org/Beagleboard:BeagleBone_LCD7) and external wireless adapter, a 10 W (2 A at 5 V) power adapter is more than sufficient. Compare this with triple- and quadruple-digit wattages found in laptop and desktop systems. Figure 1.1 Collection of devices running The Deck. Penetration Testing Tools
The Deck contains a large number of penetration testing tools. The intention is to have every tool you would likely need available without the trouble of downloading additional packages. Installing new packages to a hacking drone during a penetration test ranges from difficult to impossible. Some desktop-oriented penetration testing Linux distributions suffer from having many old packages that are no longer in common use. Each package included in The Deck was evaluated before inclusion. Anything deemed redundant to a new package was left out. Some of the more frequently used tools are introduced here. Wireless networking has become extremely prevalent. As a result, many penetration tests start with the need to crack a wireless network. The aircrack-ng suite is included in The Deck for this purpose. The airodump-ng utility is used for basic packet captures and analysis. Captured packets can then be fed to aircrack-ng in order to crack network encryption. Screenshots of airodump-ng and aircrack-ng are provided in Figures 1.2 and 1.3, respectively. More details on using the aircrack-ng suite will be provided in future chapters. Figure 1.2 Using airodump-ng to capture and summarize wireless packets. Figure 1.3 A successful crack with aircrack-ng. Even in cases where a client is not using wireless networking, the aircrack-ng suite can be useful for detecting and possibly cracking any rogue access points on the client's network. A very easy to use point-and-click wireless cracking tool known as Fern WiFi Cracker is also included with The Deck. A screenshot showing a successful crack with Fern is shown in Figure 1.4. Those newer to penetration testing might find Fern easier to use. Due to their interactive nature, neither aircrack-ng nor Fern is suitable for use in a hacking drone. For this reason, the Scapy Python tool (http://www.secdev.org/projects/scapy/) is included in The Deck. Figure 1.4 Fern WiFi Cracker. Regardless of whether they are from wired or wireless networks, network packets are potentially interesting to the penetration tester. The Deck includes Wireshark (http://www.wireshark.org/) for capturing and analyzing captured packets. Nmap (http://nmap.org/), a standard network mapping tool, is also provided for identifying services and hosts on a target network. A collection of vulnerability scanners and a powerful exploitation framework known as Metasploit (http://www.metasploit.com/) are also bundled in the standard version of The Deck. Some of these tools are presented in Figure 1.5. Figure 1.5 Wireshark, Nmap, Nikto, and Metasploit. Metasploit is a very popular tool maintained by Rapid 7 (http://www.rapid7.com/). Numerous books, training classes, and videos covering Metasploit...