BYOD: Bring your own Darkside

Explorer the dangers and capabilities of attackers when you introduce BYOD on your Enterprise.

Transcript

1. Obsidis Consortia, Inc. BYOD:Bring Your Own Darkside José L. Quiñones-Borrero, BS MCP, MCSA, MCT, CEH, CEI, GCIH, GPEN, RHCSA
2. What is OC, Inc? • Obsidis Consortia, Inc. [OC, Inc.] is a non-profit organization that promotes security awareness in the community and supports professional development of security professionals, students and enthusiasts in Puerto Rico. • OC, Inc. has develop and is supporting initiatives like the Init6 Security User Group, Professional Training & Workshops, Network and Security Systems Simulation Scenarios (Capture the Flag), Security BSides Puerto Rico Conference and a Community Outreach Program.
3. Why BYOD? • What's Mine Is Mine, What's Yours Is Mine, Too • Employees Happier, More Productive? • Gartner Predicts by 2017, Half of Employers will Require Employees to Supply Their Own Device for Work Purposes
4. Why NOT? • Little or no control over devices • Privacy issues about device’s content • No jurisdiction over devices
5. What are these devices?
6. Laptops • Live CD/USB – Live USB Creator – Unetbootin • Virtual Machines – VMware Player – VirtualBox • Full OS on Hardware – Kali/Backtrack – Pentoo – BackBox
7. Smartphones and Tablets • Jailbreak iOS • Rooted Android • Ubuntu Touch (Phone)
8. Others • Home Routers – Linksys WRT-54G – Alfa Network AP-121U – TP-Link WR703N • Custom Firmware – DD-RWT – OpenWrt w/Jasager – Totmato Router
9. Let focus on iOS …
10. Apple iOS AppStore Goodness • iNet • TIOD • IPScanner • zScan Pro • Whois • TCPinger • Net Utility • VNC viewer • RDP client • aSubnet • Python 2.7
11. Cydia
12. Jailbroken iOS • Tools – nmap, tcpdump, ettercap, aircrack-ng*, dns2tcp, netcat • Development – Python, Ruby, Perl, SQLite • OS – wget, curl, grep, sed, awk, inetutils, whois, locate • Deamons – dns, http, dhcp, ftp, vnc
13. Installing Metasploit on iOS 1. Jailbrake your iOS devices 2. Install BigBoss Recomended Tools 3. ruby_1.9.2-p180-1-1_iphoneos-arm.deb 4. iconv_1.14-1_iphoneos-arm.deb 5. zlib_1.2.3-1_iphoneos-arm.deb 6. metasploitframework4.5.tgz
14. What about Android?
15. PwnPad ($895.00) •Wireless ToolsAircrack-ng •Kismet •Wifite •Reaver •MDK3 •EAPeak •Asleap •FreeRADIUS-WPE •Hostapd Bluetooth Tools: •bluez-utils •btscanner •bluelog •Ubertooth tools •Web ToolsNikto •Wa3f •Network ToolsNET-SNMP •Nmap •Netcat •Hping3 •Macchanger •Tcpdump •Tshark •Ngrep •Dsniff •Ettercap-ng •SSLstrip •Hamster & Ferret •Metasploit 4 •SET •Easy-Creds •John (JTR) •Hydra •Pyrit •Scapy
16. Can we be more creative?
17. Red Teaming BYOD • Raspberry Pi ($35) – 700 Mhz A7, 512MB, HD, 2 USB 2.0, Ethernet – Huge development community – Debian and Red Hat based distros • CubieBoard ($80) – 1 Ghz A10, 1 GB, HD, 2 USB 2.0, Ethernet – Some community support – Ubuntu and Android • Odroid ($90) – 1.7 Quad A9, 2GB, HD, 2USB 2.0, Ethernet – No community yet(new platform) – Ubuntu and Android
18. Demo
19. Open Discussion … Q & A
20. Please visit us to keep in touch … www.ObsidisConsortia.org www.BSidesPR.org https://www.youtube.com/channel/UCtpOw0dKOIVJu7JZqHx4oQg https://plus.google.com/u/0/communities/102771209982001396923 https://facebook.com/obsidisconsortia https://twitter.com/BSidesPR Affiliates: www.TalktoanIT.com www.codefidelio.org www.darkoperator.com