CIRCO Def CON 27 (Demo Labs)

CIRCO v1.5 presented at Demo Labs (10-Aug 2019)
https://defcon.org/html/defcon-27/dc-27-demolabs.html#CIRCO

Transcript

1. C I R C O Cisco Implant Raspberry Controlled Operations https://circo.cc
2. ▪ Allow existing IP-Phone to co-exist with CIRCO ▪ Eliminate template files (craft all packets) ▪ Support NTP exfiltration ▪ Software encrypted via Bluetooth (prevent forensic) ▪ Self destroy and alarm switch (thanks Will) ▪ Bypass active & passive fingerprinting (NAC) ▪ Credentials integration into Faraday (thanks Fran) https://circo.cc What’s new?
3. ▪ Cisco DNA (Digital Network Architecture) ▪ Infoblox NetMRI ▪ Micro Focus® Network Automation (formerly HP NA) ▪ Service Now Discovery* ▪ ForeScout CounterACT (NAC) ▪ Trusted network administrators ▪ Others * SNMP discovery only https://circo.cc Who we target?
4. https://circo.cc CIRCO Evolution
5. CIRCO Demo Box (v1 - 2018) ▪ Raspberry Pi Zero W ▪ USB LAN Adapter ▪ USB Hub ▪ Wireless Dongle (WLI-UC-GNM2S) ▪ PoE LAN Adapter (12V) ▪ Bucket Regulator (12V-5V) https://circo.cc
6. CIRCO Production Box #1 (v1.4) ▪ Raspberry Pi 3B ▪ PoE LAN Adapter (5V) https://circo.cc ▪ Quad RJ45 Wall Faceplate ▪ Desk/Mount Box Network Outlet
7. CIRCO Production Box #2 (v1.4) ▪ Raspberry Pi Zero W ▪ PoE LAN Adapter (5V) ▪ USB LAN Adapter https://circo.cc ▪ 1 RJ45 Socket ▪ Desk/Mount Flat Network Outlet
8. CIRCO Production Box #1 (v1.5) § Quad RJ45 Wall Faceplate § Desk/Mount Box Network Outlet § Raspberry Pi 3B+ § Magnets mount (3D printed) § USB LAN Adapter § DC-DC LM2596HVS (56V-5V) § Magnetic switch and magnet (4mm) § USB Wireless Adapter https://circo.cc
9. CIRCO Production Box #2 (v1.5) ▪ Raspberry Pi Zero ▪ DC-DC LM2596HVS (56V-5V) ▪ 2 x USB LAN Adapter ▪ Micro USB HUB https://circo.cc ▪ 2 x RJ45 Socket ▪ Desk/Mount Flat Network Outlet ▪ Push switch
10. ▪ LM2596HVS (DC-DC 56V/5V) = $3 (Amazon) ▪ 2 x USB LAN Adapter = $18 (Amazon) ▪ Raspberry Pi Zero W = $10 (Adafruit) ▪ Micro USB Hub = $9.99 (Tindie) ▪ Flat Network Outlet = $9 (eBay) https://circo.cc Hardware Cost (v1.5) Get CIRCO for $49.99 bucks!
11. ▪ Cisco CDP & LLDP Advertisement (as IP-Phone & Network Switch) ▪ Cisco SNMP Agent ▪ Cisco Telnet CLI (IOS 15.x) ▪ Cisco SSH CLI (IOS 15.x) ▪ Mimic packets format like IOS to avoid NAC/IDS/IPS https://circo.cc Fake Services (Honeypots)
12. https://circo.cc Logic Flow (single mode)
13. https://circo.cc Logic Flow (bridge mode)
14. https://circo.cc Lab Network Diagram
15. https://circo.cc Exfiltration Format ▪ Telnet □ t,<username>,<password>,<src_IP> □ t,e,<enable_password>,<src_IP> ▪ SSH □ s,<username>,<password>,<src_IP> □ s,e,<enable_password>,<src_IP> ▪ SNMP (v1/v2) □ p,<community>,<src_IP> ▪ net-creds* (optional) □ n,<credentials>,<src_IP> * Under development
16. https://circo.cc ICMP Exfiltration Flow
17. https://circo.cc Traceroute Exfiltration Flow
18. https://circo.cc HTTP/HTTPS Exfiltration Flow
19. https://circo.cc NTP Packet “Fraction”
20. https://circo.cc NTP Exfiltration Flow
21. https://circo.cc DNS Exfiltration Flow
22. https://circo.cc Proxy (DHCP) Exfiltration Flow
23. https://circo.cc Proxy (WAP) Exfiltration Flow
24. Proxy (DNS Guessing) Exfiltration Flow https://circo.cc
25. https://circo.cc Wireless Exfiltration Flow
26. Emilio ekio_jp https://github.com/ekiojp/circo https://circo.cc Thank You!