Network/Mobile Sniffing, Protocol Deobfuscation, Reverse Engineering Posted on June 20th, 2014 by matt • Filed under Events • No Comments BE THERE FRIDAY, June 20th at 8p for what will prove to be a very informative class with Samy Kamkar FREE and open to the public! Network/Mobile Sniffing, Protocol Deobfuscation, Reverse Engineering To go over some of the cross-over, I think what we'll do for this class is go through a real-world and step-by-step walk-through of an encrypted, obfuscated, undocumented protocol on the Android or iOS stack which was NOT open source (source was NOT in Android), yet binaries included in all Android installations (and similarly iOS). From reasons to investigate these funny packets and how I ultimately found Android (and iPhone, and Windows 8 mobile) were sending massive amounts of encrypted, obfuscated GPS/geolocation data and MAC addresses of all networks around you (correlated to GPS) and storing it all, from every single smartphone. Even when you turned GPS off. So we'll go over: top-down approach of trying to examine something undocumented wireless/network sniffing mobile sniffing packet injection man in the middle attacks (SSL and non-SSL)/decrypting SSL connections fuzzing unknown protocol investigation By the end of the class, not only do I hope you will be able to do this process or use any of these methods yourself in other areas, but you will be able to manipulate Google/Apple Maps' Traffic, meaning you can make Venice Blvd look green for fast or red for slow (for anyone using Google/Apple Maps) to reroute them, and you will be able to find the physical address of anyone by obtaining their router's MAC address (which you can often get by having them visit a page without authorization — more will be discussed in the class). That wasn't my intention, but a side effect of learning about one thing opens up some pretty crazy, unexpected possibilities. By the end you should have a basic understanding of doing this process yourself, have a pretty good toolchain for this type of research, and also be able to use any of these a la carte for useful reasons in the future. Links crash http://blog.crashspace.org/2014/06/networkmobile-sniffing-protocol-deobfuscation-reverse-engineering/ next time: fuzzing transparent mitm start here: http://www.charlesproxy.com/ airport -s is sweet for osx. find it here: sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport oui database for mac addresses to vendor xss bugs in routers cross site scripting via iframes to find you without location check google can still find you without the street view cars androids might be sniffing locations enter ssl man-in-the-middle (mitm) tcpdump understand this: https://en.wikipedia.org/wiki/Man-in-the-middle_attack fire sheep came out to force everyone to start using ssl and browsers started making things trickier. enter charles. charles will create a cert. CAs in your phone keep you from mitm. you can install your own charles cert: http://samy.pl/x.crt great public dns 8.8.8.8 sudo tcpdump -i en0 -n port 53 nslookup chase2.com hub we see everything arp spoofing will allow you to see other wireless traffics arp -na apple is tracking your ass every time you are on a network: http://apple.com/library/test/success.html starbucks is always att-wifi setup your pc to act like ssid: att-wifi with a second wifi card and sharing nothing is secure. just assume it. ngrep is network grep ngrep -d en1 crashspace -x hex be mindful of the datatype / encoding and regex! cr.shsp[aei]\w nslookup blog.crashspace.org http://samy.pl/3.pl to convert to 3 arpspoof via dsniff perl imll of cross platform networking and injection: http://samy.pl/packet checkout arp requests sudo tcpdump -i en0 arp nmap as port scanner. ping everyone: nmap -sn 172.16.16.0/24 view raps arp -na|grep -v incomplete send arp to spoof router use ipfw (available on all os) http://samy.pl/tools/ipfwd find other super cool stuff for this and productivity http://samy.pl/tools learn a shit load from TCPIP illustrated volume 1 arm frame and dive into rfcs with google arpspoof -i en -t 172.16.16.143 172.16.16.1 prevent with static arp routes pcap files record packets. the ngrep can read em later. or you can replay them.

• published: 27 Jun 2014
• views: 1913