BSidesAthens 2016 Wrap-Up

Here is my wrap-up for the first edition of BSidesAthens. There are more and more BSides events organized across the world and the Greek capital has now one! It was also a good opportunity to spend the weekend in this nice city. Grigorios Fragkos kicked off the event a few minutes late (“but is normal for Greek people” as he said). Usual stuff for a BSides event: coffee, free WiFi and plenty of people. According to the organization, ~200 people joined (it was sold-out). The schedule was split across three tracks. Two for regular presentations and one dedicated to workshops.

My first choice was to attend the read teaming workshop but the speaker… never joined the event! So, I went to the track 1 to attend the talk about OWASP ASVS by Panagiotis Yialouris. “ASVS” is an OWASP project and is the abbreviation of “Application Security Verification Standard” (more info here).

Based on a real project realized by his company, Panagiotos explained what’s behind the ASVS and how it can help to find more vulnerabilities that can not easily (or not at all) detected by classic vulnerability scanners. Also, performing a penetration test is not enough to have a full coverage of the application. Design security must also be evaluated. Here is a good example of vulnerability find:

sendEmail(
    “Your password is: “ + getUserPassword(user))

Indeed not very secure to send a password in the wild! The conclusion was: “Security is better and easier when integrated in a built-in manner”. We agree on this but it’s not yet implemented in many organisations!

• An open WiFi with a captive portal: just a stronger signal is required.
• WPA(2) with a pre-shared key: often the key is shared by people or written somewhere. It’s easy to grab it. If the key is unknown, a downgrade attack can be performed using the KARMA attack. But it has less impact on modern operating systems.
• WPA enterprise: If not authenticating the AP, clients are also vulnerable. Offline brute-force is doable with captured challenge-response.

Note that guessing the SSID is also very easy. There are good chances that people who attend BSidesAthens will use a SSID called “BSidesAthens“! Using a deauth attack: DEAUTH frames are sent in clear. If you send back an answer: “Sorry PSK is incorrect”. It’s some kind of DoS and there are chances that the victim will search for another network (read: yours).

Finally, some phishing scenarios were reviewed (that Wifiphiser can perform): A captive portal or fake social network page. More evil: a fake page coming from the wireless device stating that a firmware upgrade is ready to be installed. It’s also possible to imitate the network manager login page (based on the User-Agent, we can guess the victim’s OS). This is a very nice tool available on GitHub.

The next talk was really funny! Steve Lord talked about malicious IoT devices.

The next talk was the one of Steve Lord (@stevelord) about malicious  IoT devices. Steve started with some example of stupid Internet of Things devices that are completely useless… Like the smart egg minder! Steve calls this the Internet of Wrongs. But we can have much more find when designing some connection object to play with your friends (or enemies). Here are some examples. All of them are based on micro computers like Arduino’s or Raspberry Pi’s.

WOLter is a small project designed to flood a network with WOL (Wakeup on LAN) packets. The result is that it will drain batteries of devices like MacBooks. Evil! :). Poephol is a WiFi SSID generator “because Steve’s mate’s neighbours are Poephols”. Etc… Lot of nice toys build to fight against people that upset you. Note that most of those toys are prohibited by local laws…

1. Come in
2. Connect the WarBerry
3. Get out
4. Pwn!