BruCON Network 0x09 Wrap-Up

BruCON 0x09 is over! It’s time to have a look at the data captured during the last Thursday and Friday. As the previous years, the setup was almost the same: An Internet pipe with a bunch of access-points, everything interconnected through a pfSense firewall. The guest network (dedicated to attendees) traffic is captured and processed by a SecurityOnion server + basic full packet capture. We also used our classic wall-of-sheep to track the web browsing activity of our beloved visitors.

Let’s start with a few raw numbers. With the end of the 3G/4G roaming costs in Europe since June, most European visitors avoid the usage of wireless networks and prefer to remain connected via their mobile phone. In a few numbers:

• 206 Gigabytes of PCAP files
• 50.450 pictures collected by the wall-of-sheep
• 19 credentials captured
• 500+ unique devices connected to the WiFi network
• 150 PE files downloaded (Windows executables)
• 3 blocked users
• 1 rogue DHCP server

We saw almost the same amount of traffic than the previous years (even if we had more people attending the conference!). What about our visitors?

Strange that we had some many “unknown” device. Probably due to an outdated MAC address prefixes databases.

Good to see that SSL is the top protocol detected! UDP reached the third-position due to the massive use of VPN connections. Which is also good!

Our visitors communicated with 118K+ IP addresses from all over the word:

Here is the top-20 of DNS requests logged:

As most of the traffic captured was web-based, I had a look at the different tools/applications used to access web resources. Here is the top-20:

(1) https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-metadata-retrieval-client

I uploaded the 200+ gigabytes of PCAP data into my Moloch instance and searched for interesting traffic. What has been found:

• One visitor polled his network devices (172.16.x.x) during the two days (5995 SNMP connections detected)
• Two visitors performed RDP sessions to two external IP addresses
• Two visitors generated SIP (VoIP) traffic with two remote servers
• 29 remote IMAP servers were identified (strange, no POP3! 🙂
• SSH connections were established with 36 remote servers (no telnet!)

Finally, our wall-of-sheep captured web traffic during the whole conference:

Of course, we had some “p0rn denial of service attacks” but it’s part of the game right? See you for the 0x0A (10th edition) next year with, crossing fingers, more fun on the network!