Protección de comunicaciones en dispositivos móviles (NFC, Bluetooth & Wi-Fi)

Transcripción

1 w w w. d i n o s e c. c o d i n o s e c Protección de comunicaciones en dispositivos móviles (NFC, Bluetooth & Wi-Fi) Escenarios de ataque Raúl Siles 3 abril 2014 TASSI 2014 Dino Security S.L.

2 w w w. d i n o s e c. c o d i n o s e c Mobile Devices Communications Protection (NFC, Bluetooth & Wi-Fi) Attack Scenarios Raúl Siles April 3, 2014 TASSI 2014 Dino Security S.L.

3 Outline Introduction NFC Bluetooth Wi-Fi References Crypt4You: Lección 4. Protección de comunicaciones en dispositivos móviles (ES) 3

4 Introduction 4

5 Mobile Security Challenges Nowadays? 5

6 Market Share Sep 4, 2013: Android: 75,3% ios: 16,9% WP: 3,9% BB: 2,7% Others: 1,2% Reference: 6 6

7 Device discovery Security Threats Clients & infrastructure Communications interception Voice & data Communications manipulation Device impersonation Unauthorized access Devices, services (capabilities) & data Mobile devices: personal & corporate (privacy) 7

8 8

9 NFC (Near Field Communication) NFC technologies Short distance, 13,56Mhz, Kbps Active (energy) or passive modes (tag) Most mobile devices except ios Multiple usage scenarios Proximity and micro payments Establish secure communications Pairing & key exchange Bluetooth or Wi-Fi Direct (data exchange) E.g. Android Beam or Samsung-Beam 9

10 NFC (Near Field Communication) Store NFC payment information SE: Secure Element Mobile device (integrated smartcard chip), UICC (SIM card) or advanced SD card (ASSD) or SW Applications: applets or cardlets E.g. (Android) Google Wallet, (BlackBerry 7.1+) BlackBerry Tag, (WP8) Wallet Hub Vulnerabilities in Android implementations BH US 2012 & EuSecWest Access user data, malware download, RCE 10

11 11

12 Bluetooth Bluetooth technologies , 2,4Ghz (79), FHSS, specs & classes Piconet & profiles Hopping pattern BD_ADDR Two modes Phases: inquiry, paging & SDP Security Authentication, authorization & encryption 12

13 Discovering the Undiscoverable Hidden devices: BD_ADDR Guessing, pairing, mixing wireless technologies, brute force (2 48 ) Traffic capture (partially: LAP) How? USRP (1 freq.) GNU-Radio gr-bluetooth Security by obscurity Known default & fixed PIN 13

14 Obtaining the LAP LSB Bluetooth Frame MSB 72 bits 54 bits bits Access code Baseband header Message data Master LAP (Last 3 bytes from BD_ADDR) LSB Bluetooth Access Code (72 bits) MSB 4 bits 64 bits 4 bits Preamble Sync Word Finalization Syncronization (1) Piconet identification (1) 14

15 Obtaining the BD_ADDR Once we know the LAP... we need to get the rest: NAP+UAP Optimized brute force techniques Multiple Bluetooth devices Reduce the address range: OUI s (IEEE) BNAP-BNAP project (Joshua Wright) 70 OUI s BTScanner: LAP patch (1-10 mins) 15

16 Reanalyzing the BD_ADDR BD_ADDR: libbtbb LAP: Lower (Address Part) Access Code UAP: Upper (Address Part) HEC & CRC NAP: Non-significant (Address Part) 00:00:? 16

17 Ubertooth One Michael Ossmann ($120) Kickstarter, Great Scott Gadgets, HakShop Open-source Bluetooth sniffer: LAP + UAP Wi-Fi adapters (RFMON) ( 10 years) 2,4 Ghz + injection + spectrum analyzer Class 1 (Basic Rate + LE) Follow devices Kismet, Wireshark 17

18 Real & Personal Bluetooth Threats Trustwave advisory: August TWSL txt Inax's Satis automatic toilet Remote control via Bluetooth Android app: My Satis Bluetooth PIN (default): 0000 (hardcoded) BluetoothDevice localbluetoothdevice = BluetoothManager.getInstance().execPairing(paramString, "0000") Download app and use its functions: Repeatedly flush the toilet, unexpectedly open/close the lid, activate bidet or air-dry functions (discomfort to user) 18

19 Security Recommendations (1/2) Turn it off! Save the planet! Hidden (or non-visible) device Enable just the required profiles (?) Enable authentication & authorization (?) Change default values: name Vendor & model, owner, etc. Software & firmware updates Corporate security policy 19

20 Security Recommendations (2/2) Usage in dangerous environments Initial pairing process PIN selection (16 chars) & renewal Unsolicited pairing/connect requests Proximity marketing (user awareness) Management of the pairing DB Remove those not used 20

21 21

22 Wi-Fi Wi-Fi challenges nowadays Wi-Fi (mobile) clients behavior The PNL Wi-Fi network impersonation Attacking Wi-Fi enterprise clients Wi-Fi clients security recommendations 22

23 Wi-Fi Challenges Nowadays? 23

24 Wi-Fi Challenges Nowadays? 24

25 Wi-Fi Security Challenges Nowadays? Super Bowl Security Command Center 2014: Broadcast on TV 25

26 Wi-Fi (Mobile) Clients Behavior 26

27 How Wi-Fi Clients Work? Users connect to Wi-Fi networks by 1. Selecting them from the list of currently available networks in the area of coverage 2. Adding them manually to the Wi-Fi client Security settings are mandatory (if any) Open, WEP, WPA(2)-Personal & WPA(2)- Enterprise Networks are remembered and stored for future connections: list of known networks The Preferred Network List (PNL) 27

28 How Wi-Fi Clients Discover Available Wi-Fi Networks? Passive scan Beacons Every 100ms (10 frames/sec) SSID? Active scan Probe request / response (Wildcard or broadcast) SSID? 28

29 Hidden Wi-Fi Networks Hidden Wi-Fi networks (cloaked or non-broadcast) Still today a very common security best practice with relevant security implications for the Wi-Fi clients Beacon frames do not contain the SSID (empty) Visible (or broadcast) Wi-Fi networks include the SSID in their beacon frames Wi-Fi clients need to know the SSID to connect to the network So how Wi-Fi clients connect to hidden Wi-Fi networks? Wi-Fi clients have various networks (SSIDs) in their PNL Wi-Fi clients have to specifically ask for the hidden Wi-Fi networks in their PNL by sending probe requests containing the SSID As a result they have to disclose their PNL!! PNL was disclosed by Wi-Fi clients in the past (2005; Win XP fix in 2007) 29

30 Security Risks of Disclosing the PNL 30

31 Security Risks of Disclosing the PNL An attacker can impersonate the various Wi-Fi networks available in the PNL Different methods based on the security settings People didn t pay enough attention to this because there was no name for it! War Standing or War Statuing (Statue) 31

32 War Standing Risks 32

33 Wi-Fi Network Impersonation 33

34 Wi-Fi Network Impersonation (1/2) When entries in the PNL are disclosed by Wi-Fi clients someone can force the victims to (silently) connect to the attacker s Wi-Fi network Karma-like attacks (since 2004) AP impersonation (or fake AP): anywhere in the world Evil-twin: area of coverage of the legitimate network Strongest signal wins (or less battery drawing network) The victim shares the network with the attacker Full network connectivity at layer 1&2 and above MitM: Man-in-the-Middle attacks 34

35 Wi-Fi Network Impersonation (2/2) Fully impersonate the Wi-Fi network AP, DHCP server, DNS server, routing and NAT capabilities, RADIUS server Two prerequisites SSID (Wi-Fi network name) Disclosed from the PNL Wi-Fi network security type Security type requirements Open, WEP & WPA(2)-Personal, WPA(2)-Enterprise 35

36 Open Wi-Fi Networks 36

37 Attacking Wi-Fi Clients: Open Nobody never ever connects to an open Wi-Fi network! Right? 37

38 WPA(2)-Enterprise Wi-Fi Networks 38

39 Wi-Fi Enterprise Networks Wi-Fi client, access point (AP), and RADIUS server Multiple user credentials allowed (802.1X/EAP types) How to verify the RADIUS certificate? CN, CA, expiration + revocation & purpose There is no URL like in the web browsers (X.509 CN) server 39

40 FreeRADIUS-WPE FreeRADIUS-Wireless Pwnage Edition (WPE) SchmooCon 2008: Joshua Wright & Brad Antoniewicz Attacker impersonates the full Wi-Fi network infrastructure (AP + RADIUS server + ) PEAP & TTLS Inner authentication: MS-CHAPv2 (or others) Username + Challenge/Response (hash) Mutual authentication

41 MS-CHAPv2 Cracking asleap (+v2.1) - Joshua Wright Crack challenge (-C) and response (-R) Dictionary attack (DES x 3) genkeys Precomputed MD4 hashes (indexed list of passwords) Indexed by the last two bytes of MD4 hash (brute force) Challenge (8-byte) & MD4 hash (16-byte) Response (24-bytes) MS-CHAPv2 cloud cracking Defcon 20 (2012): Moxie Marlinspike & David Hulton Brute force attack (2 56 DES) FPGA box: ~ 12-24h & chapcrack (100% success rate = $200) Strength of user passphrase... not any more! 41

42 FreeRADIUS-WPE in Action 42

43 (FreeRADIUS) EAP Dumb-Down Multiple EAP types available Mobile devices seem to prefer to use PEAP (MS-CHAPv2) by default But in reality they use the preferred EAP method set by the RADIUS server GTC-PAP: Log credentials in cleartext Username and passphrase Additionally it might allow automatic full Wi-Fi network impersonation (MitM) SANS SEC575 Strength of the user passphrase is irrelevant 43

44 EAP Dumb-Down in Action 44

45 Mobile Devices Behavior Against FreeRADIUS-WPE & EAP Dumb-Down FreeRADIUS-WPE ios: UI & configuration profile Android WP 7.x & 8 BlackBerry 7.x EAP Dumb-Down ios: UI & configuration profile Android WP 7.x & 8 BlackBerry 7.x User creddentials (not just the Wi-Fi secret): Other corporate services? Full MitM connectivity "Why ios (Android & others) Fail inexplicably" 45

46 Full Wi-Fi Network Impersonation For Fun & Profit by Example 46

47 Wi-Fi Network Impersonation Exploitation For Fun 47

48 Wi-Fi Network Impersonation Exploitation For Profit - Goto Fail ios update to (Feb 21, 2014) (iphone 3GS & ipod Touch 4th) OS X 10.9 Mavericks (no patch) Lack of proper certificate validation DHE & ECDHE (CVE )

49 Wi-Fi Clients Security Recommendations 49

50 Wi-Fi Clients Configuration Recommendations Turn off the Wi-Fi interface if not in use Do not configure Wi-Fi networks as hidden Do not add Wi-Fi networks manually to mobile devices (= hidden network) Manage & clean-up the PNL periodically Individually and enterprise level (MDM) Wi-Fi policy: What type of networks? Properly add Wi-Fi enterprise networks 50

51 Wi-Fi Enterprise Recommendations (1/2) Wi-Fi supplicants must always Trust only the specific CA used for the Wi-Fi network Not a good idea to use the full list of public trusted CAs A private CA is a better option than a public CA assuming an attacker cannot get a legitimate certificate from it Define the specific (set of) RADIUS server(s) name(s) used (X.509 CN) Do not provide options to disable certificate validation Define and force the specific EAP type used Define the inner authentication method (e.g. MS-CHAPv2) Do not downgrade to other EAP types (EAP dumb-down) 51

52 Wi-Fi Enterprise Recommendations (2/2) WPA2-Enterprise: Full Wi-Fi network validation Do not ask the user! Wi-Fi Enterprise is inherently broken How to add a new RADIUS server? Modify the config of all Wi-Fi clients in the organization User credentials strength Passphrase EAP/TLS: client digital certificates + PKI WIDS (evil-twin) 52

53 References 53

54 References Crypt4You: Lección 4. Protección de comunicaciones en dispositivos móviles -proteccion/leccion4/leccion4.html TASSI DinoSec Lab Publications DinoSec Security Advisories 54

55 You think that s air you re breathing now? Morpheus to Neo during the scene when he was teaching him in the virtual dojo on board the ship The Nebuchadnezzer

56 Questions 56

57 w w w. d i n o s e c. c o d i n o s e c R a ú l S i l e s r a u d i n o s e c. c o r a u l s i l e s