Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Inside the Wire - thotcon 0x9
Similar to Inside the Wire - thotcon 0x9 (20)
Recently uploaded
Recently uploaded (20)
Inside the Wire - thotcon 0x9
- 1. Inside The Wire Network Attacks Against Physical Access Controls Mike Kelly Chris Carlis thotcon 0x9
- 3. What this talk is about • Physical attacks • But also network attacks • But ALSO embedded devices
- 4. Leveraging Network Attacks To Gain Physical Access
- 6. Rationales and Reasons • Standalone Assessments • Red Team Network Foothold • Non-Networked Assets
- 7. Traditional • Tailgate / Piggyback • Lockpicking • Dumpster Diving • B&E
- 8. Contemporary • RFID Badge Cloning • RFID Reader Compromise • Social Engineering
- 9. Challenges & Limitations • Risk • Reliability • Persistence • Depth of Access
- 11. Network Attacks To Physical Access Benefits • Lower Risk • Known Access • Additional Intel
- 12. Network Attacks To Physical Access Disadvantages • Previous Compromise Required • Scope / Objectives • Limited Public Research
- 13. THE SYSTEM: Physical Access Control Infrastructure
- 15. PACS Infrastructure Client & Servers • Access Control Server • Admin Workstations • Guard Workstations • Web Frontends
- 16. PACS Infrastructure Responsible Parties • Information Security • Facilities / Physical Security • Integrators
- 17. RTFM (Read THEIR F***ing Manuals)
- 18. RTFM Profiling & Data Collection • OSINT • Email / Organizational Structure • SharePoint / Wiki / Confluence
- 19. RTFM Quick Wins • Badge Numbers / Facility Code • Alarm Codes • Floorplans
- 20. RTFM Slow Wins • PAC Hardware / Software • Hostnames / IP Addresses • Credentials
- 22. Network Compromise Reconnaissance • Previous Intel • Discovery Methods • Hostnames • Discovery Protocols • Headers and Banners
- 24. Gaining Access PACS Server/Workstations • Pentest 101 • Stolen / Default Credentials • Pivoting / Tunneling
- 25. Targeted Compromise Attacks • Clone / Add Badges++ • Manual Door Control • Alert / Log Tampering
- 26. Sniffing Traffic PACS / Door Controllers • Plaintext Communications
- 27. Sniffing Traffic Demo • Sniff plaintext comms via MitM • Parse out RFID credentials • https://youtu.be/DK00JJjlZXw
- 29. Assuming Direct Control Door Controller Vulnerabilities • Unencrypted Comms/Storage • Default Creds / No Auth • Remote Command Injection
- 30. Assuming Direct Control Demos • Door Controller Discovery • HID Evo Exploit • AMAG EN Series Exploit
- 31. Assuming Direct Control Demos • HID EVO Discovery • Pull database (it’s empty) • Implant card value • Pull DB again to show new card value • https://youtu.be/biNaPsvDpr0
- 32. Assuming Direct Control Demos • AMAG EN-1DBC Discovery • Implant card value via CVE- 2017-16241 • https://youtu.be/OQ-7ixDIGXg
- 33. Help me secure my stuff.
- 34. Existence Is Pain • Network Segmentation • Changing Default Credentials • Enabling Encryption • Two-Factor Authentication • Data Hygiene 101
- 35. Further Research • Vendors / Device Types • Discovery Techniques • Vulnerability Research • Exploit Development
- 36. Q & A
Editor's Notes
- Read the slide.
- Where to look? OSINT Searching job descriptions… Read people emails like a freaking stalker, digging through the org chart to find the people who have the info we want And then all the places that people store documents (list them) Depending on the level of compromise you might get to the point where you are targeting the desktops and backup of those key personnel
- Classic hits