Now I have got into vulnerability testing tools from the users’ perspective!  This week I set up a Metasploitable machine, to use Metasploit from my Kali VM to scan for vulnerabilities and generate tool output.  It’s very cool to see how Metasploit had writeups on the individual vulnerabilities and procedures to exploit them right from the command line.

Even cooler was Nexpose.  Again I got a solid overview of the sort of vulnerabilities found and how they could be exploited.  By referring to material outside the Metasploit Community, it feels very connected to the wider InfoSec world out on the internet.  The automatic report generation and automated scans were also handy features.

I have been working on some improvements to the base Dradis CE application this week as well, so this tied in neatly with the studies.  I have only just started with tool output generation, and already I’m manipulating data from Metasploit, Nexpose, and Nmap, all of which are supported in Dradis.  Now that I’m getting the actual user’s view of tool usage I can better put myself in the shoes of hackers starting out with Dradis for the first time to generate customised reports using data from multiple sources.

Having spent so much time with Dradis Pro, it’s fun to get back to basics with Dradis CE.  I’m not bothered by not having access to Word templates.  I gave up using Windows years ago, even my Steam library wasn’t worth the hassle of dealing with it – and I think there’s a lot of potential in well-made HTML templates.  For my purposes, learning and experimenting at home, and showing off to the people at the sailing club bar, it’s a good tool to play with; scan with all the tools and plug all the results into a simple collated report.

Next up in the course is client-side attacks; technical exploits as well as the social engineering exploits of the PEBKAC vulnerabilities!

The view from the bar

This week I finished up the section of the course regarding basic network hacking.  I learned some more about man-in-the-middle attacks, and got started with Wireshark to start actually analysing the data packets flowing through the network. Combined with attacks to make users use HTTP instead of HTTPS, that made target data (including usernames and passwords) totally readable and even searchable.

The obvious next step was “honeypot” attacks, creating a fake wi-fi access point using mana-toolkit. Combined with methods I learned earlier, this would make every user’s data transmitting through my fake network openly visible.  Once again I am struck by how easy all of this is, with freely available easy-to-use software and a cheap USB wi-fi device.  I am right next to a luxury marina and I have excellent mobile internet; it would be trivial to set up a fake hotspot to appear to be set up by the town for foreign visitors, and then ultimately read the visiting yacht owners’ data.

Having covered attacks and basic fake access point creation, I learned about preventing these sorts of attacks, for example by using Wireshark to look for unusual network activity and using XArp to detect ARP poisoning.  It was interesting to get a better look at more good reasons why the sysadmins of an organisation with a medium-sized or larger pool of devices face challenges protecting all their devices – hardly convenient to make the ARP tables static for hundreds of devices at once without good scripting and a good deployment system.

I have noted before that people and organisations in general seem to have a more lax view of data security than I would be comfortable with, but here at the system level, it feels a little more disturbing.  Perhaps I’m missing something, but I would think standard mass-market OSes like Windows, Ubuntu, Android, and such ought to have built-in tools for monitoring network safety and at least natively allow pop-up messages to show that your router appears to have changed its MAC address or that there are duplicates in the ARP table?  Microsoft regularly gets a lot of criticism for its update services, but how can their multi-GB updates not include simple utilities for guarding against MITM attacks?

By coincidence I’m looking into appropriate hardware for better internet connections on my boat, like a powerful active wi-fi range extender combined with mobile internet connections bridged into a router with failover.  If I’m going to be setting up a powered wi-fi antenna on the masthead, perhaps I should look at getting one with AP and Monitor mode capability…

Anyone for free wi-fi?

This week I have been learning about man-in-the-middle attacks.  This section of my course started out with learning more about network discovery, including my first hands-on experience with Nmap as an actual user.  First impressions of Nmap: it’s amazing how much data you can gather so simply.  Just discovering which devices are visible and which ports are open is very powerful information.  And then we get into the possibilities for exploiting that information!

Noodling around with MITMF is a lot of fun.  With just a few short commands and plugins, I could do cool tricks in no time:

• ARP spoofing for my Kali VM to become the MITM
• DNS spoofing – I get to decide which pages the victim’s browser gets sent to
• Screenshotting – I see what the victim sees
• Keylogging – obfuscated password field? Not to me!
• Javascript and HTML injection – here, have some popups

Two things really strike me here.  First, once again I’m astounded by how little is done for security or at least security-consciousness.  The above tricks were tested out using the MITM to turn HTTPS pages into HTTP.  Of course that’s a huge security issue, but the user-facing warnings in the browsers – particularly to people not in IT and not interested in computers, like my parents for example – are easy to ignore.  How likely are they to spot the missing padlock icon, how likely are they to even understand Firefox’s warning that the password field they are seeing is not secure?

Second, I’m always amazed by how powerful and excellent free open-source software can be.  MITMF, and indeed Linux (and Kali as a subset) are all free and anyone can modify them, yet a simple video guide showing a few simple canned commands allow anyone to potentially access very sensitive data.

I think there will always be a game of cat-and-mouse, with major developers trying to construct more secure software and communication, and the open-source world finding the vulnerabilities and exploits.  State actors will continue to try to exploit infosec vulnerabilities for snooping, and the open-source world will find ways to protect their data, for those with the will and know-how to do so.  I used to play with VPN setups, and I found that one that I made based on SoftEther circumvented state censorship easily – very cool stuff with a day’s configuration of a spare server.  Will the Great Firewall of China ultimately harm information security, or in the long term, will it lead to improving it?

China built and maintained the Great Wall to keep out foreign invaders. Even so, the Mongols invaded and built a Chinese dynasty

Earlier I looked at the security and privacy issues surrounding AIS (the Automatic Identification System) and other navigational aids aboard ships.  Today there was an interesting article about this on the BBC.  Essentially, while commercial vessels are generally required to carry AIS transponders on board, it is also possible to switch them off.  Vessels have therefore been able to bust sanctions by switching off their transponders, e.g. to make deliveries or enter ports that they are not supposed to.  However, satellite imagery combined with big data analysis is being used to combat this.

Surface ships do not really have anywhere to hide on the sea, so they can be tracked by satellite imagery.  Their shadows will change depending on the size of the load they are carrying.  Data is available regarding which ports in which locations typically load or unload which types of cargo.  The result is that it is now proving possible to track shipping and even types of cargo on the high seas, using data and satellites.  Not only does this make it possible to detect when ships are carrying out illegal activity, such as ship-to-ship transfers circumventing sanctions, but also shows changes in the flow of trade, such as oil tankers diverting en-route to new destinations based on fluctuations in oil prices.

I’m concerned about privacy implications.  Once again it shows how actors with access to significant resources – hardware manufacturers, state intelligence agencies, software companies – can extract more data from users (and even non-users!) of seemingly straightforward products and services than we may be aware of or be prepared to accept.  As the resources required for big data decrease, with cloud computing and accessible user platforms, the barrier to entry will also decrease.  If a country’s coast guard is capable of identifying vessels and their cargo on the high seas, that’s one thing – if a RIBload of pirates are able to do so as well, that’s another.

One of the techniques I enjoy for hiding data is steganography, hiding a message in plain sight disguised as something else.  After all, even the best cryptography is susceptible to “ball peen hammer decryption” if someone knows you have something to hide.  Incredibly, the principle of steganography has even been used at sea.

During the Second World War, the Japanese invasion of the Dutch East Indies left the Dutch navy in the area in grave danger.  Their ships tried to escape to Australia, but were all soon sunk – except for one.  The captain of HNLMS Abraham Crijnssen realised that their ship was all too visible at sea from the air – so in a stroke of mad genius, he had the warship disguised as an island!  Moving only at night, and slowly, they evaded detection and arrived safely in Australia 8 days later.  HNLMS Abraham Crijnssen served out the rest of the war operating out of Australia, and well done to the ship and her crew. Read more here!

HNLMS Abraham Crijnssen at sea