https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=FPaschinger 2026-09-10T19:41:36Z User contributions MediaWiki 1.41.5 https://elvis.hcw.ac.at/wiki/index.php?title=Saleae_Logic_Analyzer_Setup&diff=11505 2023-02-20T13:33:47Z

<p>FPaschinger: Created page with &quot;== Summary == This article shows how the Saleae Logic Analyzer is set up. == Requirements == * Operating system: Windows 10 * Software: Logic 2.4.4 (or newer versions) == Description == === Step 1 === Download the software for analyzing the traffic captured on the digital circuit: * Go to https://www.saleae.com/downloads/ * Click on &quot;Download for Windows&quot; * The download starts automatically * Follow the instructions of the installation wizard === Step 2 === * C...&quot;</p> <hr /> <div>== Summary == <br /> <br /> This article shows how the Saleae Logic Analyzer is set up.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Windows 10<br /> * Software: Logic 2.4.4 (or newer versions)<br /> <br /> == Description ==<br /> <br /> === Step 1 ===<br /> <br /> Download the software for analyzing the traffic captured on the digital circuit:<br /> <br /> * Go to https://www.saleae.com/downloads/<br /> * Click on &quot;Download for Windows&quot;<br /> * The download starts automatically<br /> * Follow the instructions of the installation wizard<br /> <br /> === Step 2 ===<br /> <br /> * Connect the wires with the logic analyzer <br /> ** The black wires represent GND which are connected to the lower part of the channels<br /> * Connect the Logic Analyzer via USB to the PC or Laptop<br /> <br /> === Step 3 ===<br /> <br /> * Open the Logic 2.4.4 (or newer versions)<br /> * The device should connect automatically<br /> * [[File:Logic 2.4.4 Start.png]]<br /> <br /> On the right side the 8 channels are listed with colored backgorunds. In this case the Saleae Logic Analyzer 8 provides 8 channels of which each channel can be activated/deactivated individually by clicking the corresponding button. On the navigation bar of the software the category &quot;Capture&quot; is found. When clicking on it, the option &quot;Start/Stop Capture&quot; is shown. After clicking &quot;Start/Stop Capture&quot; the analyzer starts capturing.<br /> <br /> <br /> [[File:Logic 2.4.4 Capture.png]]<br /> <br /> == References ==<br /> <br /> * https://www.saleae.com/downloads/<br /> * https://support.saleae.com/getting-started/setup<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=File:Logic_2.4.4_Capture.png&diff=11504 2023-02-20T13:27:34Z

<p>FPaschinger: </p> <hr /> <div></div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=File:Logic_2.4.4_Start.png&diff=11503 2023-02-20T13:19:03Z

<p>FPaschinger: </p> <hr /> <div></div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Endpoint_security_using_Cortex_XDR&diff=11468 2023-02-03T16:50:23Z

<p>FPaschinger: /* Pentesting With Cortex XDR */</p> <hr /> <div>== Summary == <br /> <br /> Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).<br /> <br /> Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.<br /> <br /> With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.<br /> <br /> Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.<br /> <br /> In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.<br /> <br /> == Description ==<br /> <br /> Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.<br /> <br /> Endpoint security pentesting can include a variety of different techniques and tools, such as:<br /> <br /> * Vulnerability scanning: Identifying known vulnerabilities on endpoint devices<br /> * Social engineering: Attempting to trick users into providing sensitive information or executing malicious code<br /> * Application testing: Identifying vulnerabilities in software installed on endpoint devices<br /> * Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means<br /> * Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices<br /> <br /> The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.<br /> <br /> It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.<br /> <br /> It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> <br /> == Ransomware ==<br /> <br /> Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.<br /> <br /> Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.<br /> <br /> === Cerber Ransomware ===<br /> <br /> Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.<br /> Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.<br /> It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.<br /> <br /> === WannaCry Ransomware ===<br /> <br /> WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.<br /> Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.<br /> WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.<br /> <br /> == Tools ==<br /> <br /> === Cortex XDR ===<br /> <br /> Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.<br /> <br /> Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.<br /> <br /> Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.<br /> <br /> The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.<br /> <br /> === Mimikatz ===<br /> <br /> Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.<br /> <br /> Mimikatz can extract a variety of information, including:<br /> <br /> * Passwords stored in memory<br /> * Encryption keys<br /> * Hashes of passwords<br /> * Kerberos tickets<br /> * Credentials for services and scheduled tasks<br /> <br /> Mimikatz can also be used to perform actions such as:<br /> <br /> * Changing a password for a user account<br /> * Adding new user account<br /> * Dumping the LSASS process memory.<br /> <br /> Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> === BC-Security / Empire ===<br /> <br /> Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.<br /> <br /> Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.<br /> <br /> Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.<br /> <br /> It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> <br /> === Porchetta-Industries / CrackMapExec ===<br /> <br /> CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.<br /> <br /> CME can perform various tasks, including:<br /> <br /> Enumerating users, groups, and computers on a network<br /> Dumping password hashes for offline cracking<br /> Executing arbitrary commands or scripts on remote systems<br /> Attempting to authenticate to remote systems using a list of provided credentials<br /> CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> ==Pentesting With Cortex XDR ==<br /> <br /> === Installation ===<br /> <br /> # From Cortex XDR, select Endpoints → Agent Installations.<br /> # Create a new installation package.<br /> # Enter a unique Name and an optional Description to identify the installation package.<br /> # Select the Package Type.<br /> <br /> ###Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.<br /> <br /> ##Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.<br /> <br /> ##(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.<br /> <br /> ##Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.<br /> <br /> # Specify the installation package settings.<br /> # Create the installation package.<br /> <br /> Cortex XDR prepares your installation package and makes it available on the Agent Installations page.<br /> # Download your installation package.<br /> <br /> When the status of the package shows Completed, right-click the agent version, and click Download.<br /> #*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.<br /> <br /> #*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.<br /> <br /> #*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.<br /> <br /> == Used Hardware ==<br /> <br /> HP Notebook<br /> <br /> == Used Software ==<br /> <br /> * Cortex XDR<br /> * WannaCry Ransomware<br /> * Cerber Ransomware<br /> * Gentilkiwi / Mimikatz <br /> * BC-Security / Empire <br /> * Porchetta-Industries / CrackMapExec<br /> <br /> == Results ==<br /> <br /> Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the &quot;Ransomware&quot; section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.<br /> <br /> == References ==<br /> <br /> *https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide<br /> *https://github.com/gentilkiwi/mimikatz<br /> *https://github.com/Porchetta-Industries/CrackMapExec<br /> *https://github.com/BC-SECURITY/Empire<br /> *https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.<br /> *https://de.wikipedia.org/wiki/WannaCry<br /> *<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Endpoint_security_using_Cortex_XDR&diff=11465 2023-02-03T16:47:37Z

<p>FPaschinger: /* Pentesting With Cortex XDR */</p> <hr /> <div>== Summary == <br /> <br /> Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).<br /> <br /> Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.<br /> <br /> With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.<br /> <br /> Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.<br /> <br /> In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.<br /> <br /> == Description ==<br /> <br /> Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.<br /> <br /> Endpoint security pentesting can include a variety of different techniques and tools, such as:<br /> <br /> * Vulnerability scanning: Identifying known vulnerabilities on endpoint devices<br /> * Social engineering: Attempting to trick users into providing sensitive information or executing malicious code<br /> * Application testing: Identifying vulnerabilities in software installed on endpoint devices<br /> * Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means<br /> * Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices<br /> <br /> The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.<br /> <br /> It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.<br /> <br /> It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> <br /> == Ransomware ==<br /> <br /> Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.<br /> <br /> Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.<br /> <br /> === Cerber Ransomware ===<br /> <br /> Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.<br /> Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.<br /> It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.<br /> <br /> === WannaCry Ransomware ===<br /> <br /> WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.<br /> Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.<br /> WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.<br /> <br /> == Tools ==<br /> <br /> === Cortex XDR ===<br /> <br /> Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.<br /> <br /> Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.<br /> <br /> Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.<br /> <br /> The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.<br /> <br /> === Mimikatz ===<br /> <br /> Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.<br /> <br /> Mimikatz can extract a variety of information, including:<br /> <br /> * Passwords stored in memory<br /> * Encryption keys<br /> * Hashes of passwords<br /> * Kerberos tickets<br /> * Credentials for services and scheduled tasks<br /> <br /> Mimikatz can also be used to perform actions such as:<br /> <br /> * Changing a password for a user account<br /> * Adding new user account<br /> * Dumping the LSASS process memory.<br /> <br /> Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> === BC-Security / Empire ===<br /> <br /> Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.<br /> <br /> Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.<br /> <br /> Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.<br /> <br /> It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> <br /> === Porchetta-Industries / CrackMapExec ===<br /> <br /> CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.<br /> <br /> CME can perform various tasks, including:<br /> <br /> Enumerating users, groups, and computers on a network<br /> Dumping password hashes for offline cracking<br /> Executing arbitrary commands or scripts on remote systems<br /> Attempting to authenticate to remote systems using a list of provided credentials<br /> CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> ==Pentesting With Cortex XDR ==<br /> <br /> === Installation ===<br /> <br /> # From Cortex XDR, select Endpoints → Agent Installations.<br /> # Create a new installation package.<br /> # Enter a unique Name and an optional Description to identify the installation package.<br /> # Select the Package Type.<br /> <br /> *Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.<br /> <br /> *Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.<br /> <br /> *(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.<br /> <br /> *Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.<br /> <br /> # Specify the installation package settings.<br /> # Create the installation package.<br /> <br /> Cortex XDR prepares your installation package and makes it available on the Agent Installations page.<br /> # Download your installation package.<br /> <br /> When the status of the package shows Completed, right-click the agent version, and click Download.<br /> *For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.<br /> <br /> *For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.<br /> <br /> *For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.<br /> <br /> == Used Hardware ==<br /> <br /> HP Notebook<br /> <br /> == Used Software ==<br /> <br /> * Cortex XDR<br /> * WannaCry Ransomware<br /> * Cerber Ransomware<br /> * Gentilkiwi / Mimikatz <br /> * BC-Security / Empire <br /> * Porchetta-Industries / CrackMapExec<br /> <br /> == Results ==<br /> <br /> Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the &quot;Ransomware&quot; section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.<br /> <br /> == References ==<br /> <br /> *https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide<br /> *https://github.com/gentilkiwi/mimikatz<br /> *https://github.com/Porchetta-Industries/CrackMapExec<br /> *https://github.com/BC-SECURITY/Empire<br /> *https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.<br /> *https://de.wikipedia.org/wiki/WannaCry<br /> *<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Endpoint_security_using_Cortex_XDR&diff=11463 2023-02-03T16:46:14Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).<br /> <br /> Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.<br /> <br /> With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.<br /> <br /> Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.<br /> <br /> In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.<br /> <br /> == Description ==<br /> <br /> Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.<br /> <br /> Endpoint security pentesting can include a variety of different techniques and tools, such as:<br /> <br /> * Vulnerability scanning: Identifying known vulnerabilities on endpoint devices<br /> * Social engineering: Attempting to trick users into providing sensitive information or executing malicious code<br /> * Application testing: Identifying vulnerabilities in software installed on endpoint devices<br /> * Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means<br /> * Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices<br /> <br /> The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.<br /> <br /> It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.<br /> <br /> It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> <br /> == Ransomware ==<br /> <br /> Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.<br /> <br /> Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.<br /> <br /> === Cerber Ransomware ===<br /> <br /> Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.<br /> Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.<br /> It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.<br /> <br /> === WannaCry Ransomware ===<br /> <br /> WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.<br /> Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.<br /> WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.<br /> <br /> == Tools ==<br /> <br /> === Cortex XDR ===<br /> <br /> Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.<br /> <br /> Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.<br /> <br /> Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.<br /> <br /> The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.<br /> <br /> === Mimikatz ===<br /> <br /> Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.<br /> <br /> Mimikatz can extract a variety of information, including:<br /> <br /> * Passwords stored in memory<br /> * Encryption keys<br /> * Hashes of passwords<br /> * Kerberos tickets<br /> * Credentials for services and scheduled tasks<br /> <br /> Mimikatz can also be used to perform actions such as:<br /> <br /> * Changing a password for a user account<br /> * Adding new user account<br /> * Dumping the LSASS process memory.<br /> <br /> Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> === BC-Security / Empire ===<br /> <br /> Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.<br /> <br /> Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.<br /> <br /> Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.<br /> <br /> It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> <br /> === Porchetta-Industries / CrackMapExec ===<br /> <br /> CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.<br /> <br /> CME can perform various tasks, including:<br /> <br /> Enumerating users, groups, and computers on a network<br /> Dumping password hashes for offline cracking<br /> Executing arbitrary commands or scripts on remote systems<br /> Attempting to authenticate to remote systems using a list of provided credentials<br /> CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> ==Pentesting With Cortex XDR ==<br /> <br /> 1- From Cortex XDR, select Endpoints → Agent Installations.<br /> 2- Create a new installation package.<br /> 3- Enter a unique Name and an optional Description to identify the installation package.<br /> 4- Select the Package Type.<br /> <br /> *Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.<br /> <br /> *Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.<br /> <br /> *(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.<br /> <br /> *Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.<br /> <br /> 5- Specify the installation package settings.<br /> 6- Create the installation package.<br /> <br /> Cortex XDR prepares your installation package and makes it available on the Agent Installations page.<br /> 7-Download your installation package.<br /> <br /> When the status of the package shows Completed, right-click the agent version, and click Download.<br /> *For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.<br /> <br /> *For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.<br /> <br /> *For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.<br /> <br /> == Used Hardware ==<br /> <br /> HP Notebook<br /> <br /> == Used Software ==<br /> <br /> * Cortex XDR<br /> * WannaCry Ransomware<br /> * Cerber Ransomware<br /> * Gentilkiwi / Mimikatz <br /> * BC-Security / Empire <br /> * Porchetta-Industries / CrackMapExec<br /> <br /> == Results ==<br /> <br /> Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the &quot;Ransomware&quot; section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.<br /> <br /> == References ==<br /> <br /> *https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide<br /> *https://github.com/gentilkiwi/mimikatz<br /> *https://github.com/Porchetta-Industries/CrackMapExec<br /> *https://github.com/BC-SECURITY/Empire<br /> *https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.<br /> *https://de.wikipedia.org/wiki/WannaCry<br /> *<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Endpoint_security_using_Cortex_XDR&diff=11460 2023-02-03T16:40:29Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).<br /> <br /> Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.<br /> <br /> With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.<br /> <br /> Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.<br /> <br /> In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.<br /> <br /> == Description ==<br /> <br /> Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.<br /> <br /> Endpoint security pentesting can include a variety of different techniques and tools, such as:<br /> <br /> * Vulnerability scanning: Identifying known vulnerabilities on endpoint devices<br /> * Social engineering: Attempting to trick users into providing sensitive information or executing malicious code<br /> * Application testing: Identifying vulnerabilities in software installed on endpoint devices<br /> * Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means<br /> * Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices<br /> <br /> The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.<br /> <br /> It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.<br /> <br /> It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> <br /> == Ransomware ==<br /> <br /> Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.<br /> <br /> Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.<br /> <br /> === Cerber Ransomware ===<br /> <br /> Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.<br /> Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.<br /> It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.<br /> <br /> === WannaCry Ransomware ===<br /> <br /> WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.<br /> Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.<br /> WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.<br /> <br /> == Tools ==<br /> <br /> === Cortex XDR ===<br /> <br /> Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.<br /> <br /> Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.<br /> <br /> Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.<br /> <br /> The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.<br /> <br /> === Mimikatz ===<br /> <br /> Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.<br /> <br /> Mimikatz can extract a variety of information, including:<br /> <br /> * Passwords stored in memory<br /> * Encryption keys<br /> * Hashes of passwords<br /> * Kerberos tickets<br /> * Credentials for services and scheduled tasks<br /> <br /> Mimikatz can also be used to perform actions such as:<br /> <br /> * Changing a password for a user account<br /> * Adding new user account<br /> * Dumping the LSASS process memory.<br /> <br /> Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> === BC-Security / Empire ===<br /> <br /> Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.<br /> <br /> Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.<br /> <br /> Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.<br /> <br /> It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> <br /> === Porchetta-Industries / CrackMapExec ===<br /> <br /> CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.<br /> <br /> CME can perform various tasks, including:<br /> <br /> Enumerating users, groups, and computers on a network<br /> Dumping password hashes for offline cracking<br /> Executing arbitrary commands or scripts on remote systems<br /> Attempting to authenticate to remote systems using a list of provided credentials<br /> CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.<br /> <br /> It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.<br /> <br /> == Used Hardware ==<br /> <br /> HP Notebook<br /> <br /> == Used Software ==<br /> <br /> * Cortex XDR<br /> * WannaCry Ransomware<br /> * Cerber Ransomware<br /> * Gentilkiwi / Mimikatz <br /> * BC-Security / Empire <br /> * Porchetta-Industries / CrackMapExec<br /> <br /> == References ==<br /> <br /> *https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide<br /> *https://github.com/gentilkiwi/mimikatz<br /> *https://github.com/Porchetta-Industries/CrackMapExec<br /> *https://github.com/BC-SECURITY/Empire<br /> *https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.<br /> *https://de.wikipedia.org/wiki/WannaCry<br /> *<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Rowhammer/Throwhammer/Nethammer&diff=10952 2023-01-08T17:28:02Z

<p>FPaschinger: Created page with &quot;== Summary == Rowhammer is an attack which manipulates bits stored in the DRAM without accessing them. It is working and does damage directly on the hardware. Throwhammer and Nethammer are further implementations of Rowhammer the basic concept therefore is the same the execution however is different. How exactly they work will be discussed in detail in the corresponding subsections. For demonstrating, the software &quot;Hammertime&quot; from the Systems and Network Security Grou...&quot;</p> <hr /> <div>== Summary == <br /> <br /> Rowhammer is an attack which manipulates bits stored in the DRAM without accessing them. It is working and does damage directly on the hardware. Throwhammer and Nethammer are further implementations of Rowhammer the basic concept therefore is the same the execution however is different. How exactly they work will be discussed in detail in the corresponding subsections. For demonstrating, the software &quot;Hammertime&quot; from the Systems and Network Security Group at Vrije Universiteit Amsterdam is shown.<br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> * Packages: git emacs<br /> <br /> == Description ==<br /> <br /> === DRAM ===<br /> <br /> Even though the name Rowhammer does not give an idea what is it in first place when looking deeper at what it is it makes absolutely sense. Firstly, let's look at the DRAM which is the main victim of this attack. The DRAM consists of several rows and columns like a Matrix for example. A collection of rows is called a &quot;bank&quot; with the characteristic of each row sharing the same row buffer. Furthermore a collection of banks is called a rank. The DRAM cells are made out of a transistor and capacitor. Depending on the charge of the capacitor the value of the cell is either a 1 or a 0. Since the RAM is volatile, the charge in the cells must be refreshed regularly, so it does not loose the original value. When a row is accessed the horizontal line of the DRAM Matrix of the specific row called the word-line is activated. With the vertical line called the bit-line connecting the different rows vertically with each other. When the wordline is now given a high voltage the values of the row is written into the row buffer, where the values can be modified or read. <br /> <br /> === Rowhammer ===<br /> <br /> Due to the development and enhancement of the performance of DRAMs the cells got denser. A team of researchers found out that, when a row is accessed multiple times and in this case multiple times are at least 139 thousand times within the refresh cycle which is 64 milliseconds for a DDR3 DRAM, disturbance errors occurred. Disturbance errors is a phenomenon where the charge of adjacent cells is leaking to the high amount of accesses of another row. In other words, when row A is accessed 139 thousand times at a minimum row B and C, both are neighbour rows, experience loss of the charge of cells. If the charge however, is not refreshed timely, the cell cannot reproduce the original value. This is called a bit flip. A 1 is recognized as a zero and vice versa.<br /> <br /> As mentioned at the beginning of this section, the row must be activated 139 thousand times. Therefore two things must be taken into consideration:<br /> <br /> # Cache eviction<br /> # Closing row after being activated<br /> <br /> <br /> The cache eviction mechanism manages the flushing of the row buffer, so that the row needs to be written into the cache again. Secondly, the row must be closed which happens automatically when another row is activated, if not the row must be closed manually. Rowhammer must be executed locally on the target machine for example via a software downloaded on to the device. <br /> <br /> === Throwhammer ===<br /> <br /> An advanced technique of Rowhammer is the bit flip induction over the network with network packets called Throwhammer. Throwhammer requires a Remote Direct Access Memory enabled network. This allows to bypass the CPU when exchanging network packets, which enhances the performance of the network. Bit flips can be achieved when sending 560.000 packets as a minimum over a internet connection of at least 10Gbps. <br /> <br /> === Nethammer ===<br /> <br /> Another Rowhammer attack caused by network packets is called Nethammer. This does not need the Remote Direct Access Part. All it needs is a fast internet connection and handcrafted packets. If there is an application on the target machine using uncached memory, bit flips can be induced. However, there are many ways to bypass a cache or to implement cache eviction mechanism, like: <br /> <br /> <br /> * evicting and reloading the addresses<br /> * using uncached memory which is used on all ARM-based machines for interacting with the hardware<br /> * using non-temporal instructions performing their operations directly on the DRAM<br /> * flushing and reloading the addresses for example<br /> <br /> == Hammertime ==<br /> <br /> Hammertime is a software which simulates, profiles and tests the DRAM for the vulnerability.<br /> <br /> === Step 1 ===<br /> * git clone https://github.com/vusec/hammertime.git<br /> * cd hammertime<br /> * rm -rf ramses <br /> * git rm --cached ramses<br /> * git submodule add https://github.com/vusec/ramses.git<br /> <br /> go to hammertime root directory and build it with <br /> * make<br /> <br /> Search for the memory configuration with<br /> <br /> * sudo ramses/tools/msys_detect.py<br /> <br /> Executing the code for profiling the vulnerability<br /> <br /> * sudo profile/profile --s 256m mem.msys<br /> <br /> Execute the code for profiling the vulnerability and store it in file<br /> <br /> * sudo profile/profile --s 256m mem.msys &gt;&gt; example.res<br /> <br /> Prettify the file to get a readable output<br /> <br /> * py/prettyprofile.py example.res<br /> <br /> == References ==<br /> <br /> * https://ieeexplore.ieee.org/document/6853210<br /> * https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&amp;arnumber=9229701<br /> * https://www.usenix.org/system/files/conference/atc18/atc18-tatar.pdf<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=AirDrive_Forensic_Keylogger_Cable&diff=10465 2022-12-12T17:39:54Z

<p>FPaschinger: </p> <hr /> <div>[[File:AirDrive Forensic Keylogger Cable.PNG|250px|thumb|right|AirDrive Forensic Keylogger Cable]]<br /> <br /> == Summary == <br /> <br /> This keylogger is one with WiFi access and a minimized risk of detection. The USB keylogger module is hidden in a USB extension cable. Externally, the USB cable does not differ from conventional cables.<br /> <br /> The AirDrive Forensic Keylogger Module which was built into the cable is an ultra-small USB keylogger module designed for installation in a USB keyboard. The small size makes it easy to install in any USB keyboard. This is available as standard and pro version. <br /> Exact information can be found [https://www.keelog.com/de/forensic-keylogger/ here]. A video with detailed installation instructions can be found [https://www.youtube.com/watch?v=7AUssrySD2I here].<br /> <br /> [[File:AirDrive Forensic Keylogger Module.PNG|250px|thumb|right|AirDrive Forensic Keylogger Module]]<br /> <br /> == Characteristics ==<br /> <br /> * Stores input from any USB keyboard<br /> * 16MB internal flash memory<br /> * Undetectable by security software<br /> * Supports over 40 national keyboard layouts<br /> * Compatible with barcode readers<br /> * Works as a wireless Wi-Fi hotspot<br /> * Connect from any computer, smartphone or tablet<br /> * Data access via web browser<br /> * Remote data retrieval without touching the device<br /> * Supports WEP, WPA and WPA-2 network security<br /> * Memory secured by hardware encryption<br /> <br /> <br /> == Description ==<br /> <br /> The AirDrive cable acts as a Wi-Fi hotspot. This means that the cable can establish a Wi-Fi connection with any Wi-Fi device (smartphone, tablet or laptop). The selected Wi-Fi device can then connect to the interface with the data protocol. There, there is the possibility to set configurations, such as the WLAN settings of the WLAN access point and the options for logging the keyboard strokes. Over 40 national keyboard layouts, including the world's most popular languages and keyboard layouts, are supported. Installation requires no additional software or drivers.<br /> <br /> === Hands-On ===<br /> <br /> 1. Connect the USB keylogger cable to the external keyboard and the target host. 2.<br /> <br /> 2. Connect your smartphone, tablet or computer to the Wi-Fi network &quot;AIR_XXYYZZ&quot;, where &quot;XXYYZZ&quot; is the device ID of the USB cable. 3.<br /> <br /> 3. You can then use any web browser to access the interface under the IP &quot;192.168.4.1&quot;.<br /> <br /> [[File:Webinterface 1.PNG|800px|thumb|none|]]<br /> <br /> 4. Open the settings to configure the keylogger cable. Various configurations can be made there:<br /> <br /> [[File:Webinterface 2.PNG|800px|thumb|none|]]<br /> <br /> [[File:Webinterface 3.PNG|800px|thumb|none|]]<br /> <br /> [[File:Webinterface 4.PNG|800px|thumb|none|]]<br /> <br /> To apply the settings, click on &quot;Save data logging settings&quot; and/or on “Save Access Point settings”.<br /> <br /> 5. Since this is not a &quot;Pro&quot; device, there are no advanced settings available. Features like an internet connection via the access point, timestamps, reporting via email and data streaming can be set via this sub-menu.<br /> <br /> 6. However, we can download the &quot;Data Log&quot; under the &quot;Download&quot; button, which can be several pages long.<br /> <br /> 7. With a click on &quot;Data Log&quot; we can observe what is typed on the external keyboard.<br /> <br /> '''Example of a Data Log'''<br /> <br /> In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.<br /> <br /> [[File:Webinterface 5.PNG|800px|thumb|none|]]<br /> <br /> === Important Legal Notice [1] ===<br /> <br /> The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.<br /> <br /> [[File:This PC is monitored.PNG|300px|thumb|none|]]<br /> <br /> == Hardware Used ==<br /> <br /> [[Forensic USB keylogger cable]]<br /> <br /> == References ==<br /> <br /> * https://www.keelog.com/de/forensic-keylogger/<br /> * https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=AirDrive_Keylogger_Max&diff=10464 2022-12-12T17:37:21Z

<p>FPaschinger: </p> <hr /> <div>[[File:AirDrive Keylogger Max.PNG|350px|thumb|right|AirDrive Keylogger Max]]<br /> <br /> == Summary == <br /> <br /> The '''AirDrive Keylogger Max''' is comparable to the '''AirDrive Forensic Keylogger Cable (Pro Version)'''. <br /> It has additional connectivity and more download options. It works both as a Wi-Fi hotspot, and as a Wi-Fi device, enabling features such as Email reports and time stamping. 8GB of built-in memory was used.<br /> <br /> == Features==<br /> <br /> * Records keystrokes from any USB keyboard<br /> * 8 gigabytes of built-in memory<br /> * Memory accessible as a USB Hi-speed flash drive (480 Mbps)<br /> * Undetectable for security software<br /> * Supports over 40 national keyboard layouts<br /> * Compatible with barcode readers<br /> * Works as a Wi-Fi hotspot, or as a Wi-Fi device<br /> * Sends Email reports with recorded keystroke data<br /> * Supports time-stamping<br /> * Supports live data streaming over network<br /> * Connect from any computer, smartphone, or tablet<br /> * Access keystroke data from web browser<br /> * Supports WEP, WPA, and WPA-2 network security <br /> <br /> == Description ==<br /> <br /> You don’t need any physical access to access the logged data. It is available on its interface, which is accessible by connecting to it over Wi-Fi. Once you are connected, you can view the logged data in real-time or just download it. <br /> To hide the keylogger, you can erase the log, disable further logging, or even hide the WLAN network.<br /> It is simply installed by just connecting any types of USB keyboards or barcode reader. Just connect the keylogger in-line with the keyboard and all keystrokes will be recorded.<br /> <br /> There are a lot of configuring options, which will be shown in the practical part. <br /> <br /> === Hands-On ===<br /> <br /> &amp;emsp;1. Connect the USB keylogger in-line with the external keyboard and the target host. <br /> <br /> &amp;emsp;2. Connect your smartphone, tablet or computer to the Wi-Fi network &quot;AIR_XXYYZZ&quot;, where &quot;XXYYZZ&quot; is the device ID of the USB cable. <br /> <br /> &amp;emsp;3. You can then use any web browser to access the interface under the IP &quot;192.168.4.1&quot;.<br /> <br /> [[File:Web Interface 1.PNG|600px|thumb|none|]]<br /> <br /> &amp;emsp;4. Open the settings to configure the keylogger cable. Various configurations can be made there:<br /> <br /> [[File:Web Interface 2.PNG|600px|thumb|none|]]<br /> <br /> [[File:Web Interface 3.PNG|600px|thumb|none|]]<br /> <br /> We can click on “Toggle Keyboard” to make the keylogger act as a normal flash drive. <br /> <br /> &amp;emsp;5. Since the Keylogger Max version has more features, we can take a look at the advanced settings: For every of the advanced settings, an internet connection will be needed. <br /> <br /> [[File:Web Interface 4.PNG|600px|thumb|none|]]<br /> <br /> After you entered the SSID and the password of your WLAN network, you have to press the save button and restart the device, to activate the configurations. <br /> <br /> [[File:Web Interface 5.PNG|600px|thumb|none|]]<br /> <br /> You can also use a specific NTP server from https://ntp.org<br /> After configuration, keystrokes will be shown with timestamps in data log.<br /> <br /> [[File:Web Interface 6.PNG|600px|thumb|none|]]<br /> <br /> Find out your SMTP server addresses either by command line or by an online-tool like https://www.dnswatch.info.<br /> <br /> '''Example (if you would use GMAIL):'''<br /> <br /> * Gmail SMTP server address: smtp.gmail.com<br /> * Gmail SMTP name: Your full name<br /> * Gmail SMTP username: Your full Gmail address (e.g. you@gmail.com)<br /> * Gmail SMTP password: The password that you use to log in to Gmail<br /> * Gmail SMTP port (TLS): 587<br /> * Gmail SMTP port (SSL): 465<br /> <br /> Don’t forget to press the “Save” button.<br /> <br /> [[File:Web Interface 7.PNG|600px|thumb|none|]]<br /> <br /> The IP of the target out by typing “ipconfig” in the terminal (Windows) and reading out the local IP address. Choose a free target port of your choice. <br /> <br /> You can download a UDP client or use instead the example client, which was already linked in the there.<br /> <br /> Don’t forget to press the “Save” button.<br /> Don’t forget to apply settings with pressing for each section the “Save … “-button.<br /> <br /> &amp;emsp;6. We can download the “Data log” under the “Download” button.<br /> <br /> [[File:Web Interface 8.PNG|600px|thumb|none|]]<br /> <br /> &amp;emsp;7. With a click on &quot;Data Log&quot; we can observe what is typed on the external keyboard.<br /> <br /> '''Example of a Data Log'''<br /> <br /> In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.<br /> <br /> [[File:Web Interface 9.PNG|600px|thumb|none|]]<br /> <br /> === Important Legal Notice [1] ===<br /> <br /> The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.<br /> <br /> [[File:This PC is monitored.PNG|600px|thumb|none|]]<br /> <br /> === Keyboard compability limitations [1] ===<br /> <br /> The device will work with almost all types of physical USB keyboards (it won't work with internal laptop keyboards). It works fine with wireless keyboards, with exception of Bluetooth keyboards. It won't work a few types of keyboards with built-in high-speed USB hubs (primarily Apple A1243 and Dell KB522), for which the Mac/MCP series should be used. Support for some gaming keyboards is not fully guaranteed, as they often use proprietary protocols.<br /> <br /> == Hardware Used ==<br /> <br /> [[USB Keylogger Max 8GB]]<br /> <br /> == References ==<br /> <br /> * https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10463 2022-12-12T17:33:21Z

<p>FPaschinger: /* Boot Mechanisms */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software &lt;ref&gt;Inverse Path, Hardware, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> ===Software ===<br /> <br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> <br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * Hardware Security Module (HSM)<br /> * file storage with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunnelling, Tor<br /> * password manager with integrated web server<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low level USB security testing &lt;ref&gt;Inverse Path, Applications, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted. &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10462 2022-12-12T17:30:40Z

<p>FPaschinger: /* Design Goals */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software &lt;ref&gt;Inverse Path, Hardware, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> ===Software ===<br /> <br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> <br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * Hardware Security Module (HSM)<br /> * file storage with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunnelling, Tor<br /> * password manager with integrated web server<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low level USB security testing &lt;ref&gt;Inverse Path, Applications, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted. &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10461 2022-12-12T17:30:22Z

<p>FPaschinger: /* Hardware */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software &lt;ref&gt;Inverse Path, Hardware, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> ===Software ===<br /> <br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> <br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * Hardware Security Module (HSM)<br /> * file storage with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunnelling, Tor<br /> * password manager with integrated web server<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low level USB security testing &lt;ref&gt;Inverse Path, Applications, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted. &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10460 2022-12-12T17:28:25Z

<p>FPaschinger: /* Getting Started */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software<br /> <br /> ===Software ===<br /> <br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> <br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * Hardware Security Module (HSM)<br /> * file storage with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunnelling, Tor<br /> * password manager with integrated web server<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low level USB security testing &lt;ref&gt;Inverse Path, Applications, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted. &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10459 2022-12-12T17:11:08Z

<p>FPaschinger: /* Software */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software<br /> <br /> ===Software ===<br /> <br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> <br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * Hardware Security Module (HSM)<br /> * file storage with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunnelling, Tor<br /> * password manager with integrated web server<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low level USB security testing &lt;ref&gt;Inverse Path, Applications, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted in the device or the MMc (16 GB) in it must be booted. Mk II supports 3 boot mechanisms &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> <br /> [[File:Armory-mark-two-boot-switch.png||Firmware|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)|USB armory Mk II boot modes &lt;ref name=&quot;And&quot;/&gt; ]]<br /> <br /> * internal 16GB eMMC<br /> * external microSD<br /> * USB Serial Download Protocol (SDP) &lt;ref name=&quot;And&quot;&gt;Andrea Barisani, USB armory Mk II boot modes, https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)#usb-armory-mk-ii-boot-modes&lt;/ref&gt;<br /> if we want to boot the MMC we have to drag the inverter to the left, and if we want to boot the SD micro card we have to drag the inverter to the right. If we want to put it in SDP mode we have to leave it in the middle.<br /> How to boot a microSD card?<br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10458 2022-12-12T17:04:09Z

<p>FPaschinger: /* Application examples */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software<br /> <br /> ===Software ===<br /> * Boots from onboard eMMC or microSD (or via USB serial downloader)<br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * Hardware Security Module (HSM)<br /> * file storage with advanced features such as automatic encryption, virus scanning, host authentication and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunnelling, Tor<br /> * password manager with integrated web server<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low level USB security testing &lt;ref&gt;Inverse Path, Applications, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted in the device or the MMc (16 GB) in it must be booted. Mk II supports 3 boot mechanisms &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> <br /> [[File:Armory-mark-two-boot-switch.png||Firmware|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)|USB armory Mk II boot modes &lt;ref name=&quot;And&quot;/&gt; ]]<br /> <br /> * internal 16GB eMMC<br /> * external microSD<br /> * USB Serial Download Protocol (SDP) &lt;ref name=&quot;And&quot;&gt;Andrea Barisani, USB armory Mk II boot modes, https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)#usb-armory-mk-ii-boot-modes&lt;/ref&gt;<br /> if we want to boot the MMC we have to drag the inverter to the left, and if we want to boot the SD micro card we have to drag the inverter to the right. If we want to put it in SDP mode we have to leave it in the middle.<br /> How to boot a microSD card?<br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10457 2022-12-12T17:02:33Z

<p>FPaschinger: /* How to connected */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software<br /> <br /> ===Software ===<br /> * Boots from onboard eMMC or microSD (or via USB serial downloader)<br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> === How to connected ===<br /> * HS USB 2.0 On-The-Go (OTG) with device emulation<br /> * TCP/IP communication via CDC Ethernet emulation<br /> * flash drive functionality via mass storage device emulation<br /> * serial communication over USB or physical UART<br /> * stand-alone mode with dedicated host adapter &lt;ref&gt; Inverse Path, How to Connect, https://inversepath.com/usbarmory_mark-one.html &lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * mass storage device with advanced features such as automatic<br /> * encryption, virus scanning, host authentication, and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunneling, Tor<br /> * password manager with integrated webserver<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low-level USB security testing &lt;ref&gt;Andrea Barisani, Applications, https://github.com/f-secure-foundry/usbarmory/wiki/Applications&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted in the device or the MMc (16 GB) in it must be booted. Mk II supports 3 boot mechanisms &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> <br /> [[File:Armory-mark-two-boot-switch.png||Firmware|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)|USB armory Mk II boot modes &lt;ref name=&quot;And&quot;/&gt; ]]<br /> <br /> * internal 16GB eMMC<br /> * external microSD<br /> * USB Serial Download Protocol (SDP) &lt;ref name=&quot;And&quot;&gt;Andrea Barisani, USB armory Mk II boot modes, https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)#usb-armory-mk-ii-boot-modes&lt;/ref&gt;<br /> if we want to boot the MMC we have to drag the inverter to the left, and if we want to boot the SD micro card we have to drag the inverter to the right. If we want to put it in SDP mode we have to leave it in the middle.<br /> How to boot a microSD card?<br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10456 2022-12-12T16:59:43Z

<p>FPaschinger: </p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> <br /> === Hardware ===<br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software<br /> <br /> ===Software ===<br /> * Boots from onboard eMMC or microSD (or via USB serial downloader)<br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> === How to connected ===<br /> * USB 2.0 over USB-C plug to host with full device emulation<br /> * USB 2.0 over USB-C receptacle for the additional devices or as a connection to the host<br /> * Full TCP/IP connection to/from USB armory via USB CDC Ethernet emulation<br /> * Flash drive functionality via USB mass storage device emulation<br /> * Serial communication over USB or physical UART using the Debug Board<br /> * Wireless connectivity over BLE &lt;ref&gt;Mouser Electronic, F-Secure USB Armory Mk II, https://www.mouser.at/new/f-secure/crowd-supply-usb-armorymkii/&lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * mass storage device with advanced features such as automatic<br /> * encryption, virus scanning, host authentication, and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunneling, Tor<br /> * password manager with integrated webserver<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low-level USB security testing &lt;ref&gt;Andrea Barisani, Applications, https://github.com/f-secure-foundry/usbarmory/wiki/Applications&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted in the device or the MMc (16 GB) in it must be booted. Mk II supports 3 boot mechanisms &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> <br /> [[File:Armory-mark-two-boot-switch.png||Firmware|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)|USB armory Mk II boot modes &lt;ref name=&quot;And&quot;/&gt; ]]<br /> <br /> * internal 16GB eMMC<br /> * external microSD<br /> * USB Serial Download Protocol (SDP) &lt;ref name=&quot;And&quot;&gt;Andrea Barisani, USB armory Mk II boot modes, https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)#usb-armory-mk-ii-boot-modes&lt;/ref&gt;<br /> if we want to boot the MMC we have to drag the inverter to the left, and if we want to boot the SD micro card we have to drag the inverter to the right. If we want to put it in SDP mode we have to leave it in the middle.<br /> How to boot a microSD card?<br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10455 2022-12-12T16:56:50Z

<p>FPaschinger: /* Hardware */</p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> === Hardware ===<br /> <br /> * NXP i.MX53 ARM® Cortex™-A8 800MHz, 512MB DDR3 RAM<br /> * USB host powered (&lt;500 mA) device with compact form factor (65 x 19 x 6 mm)<br /> * ARM® TrustZone®, secure boot + storage + RAM<br /> * microSD card slot<br /> * 5-pin breakout header with GPIOs and UART<br /> * customizable LED, including secure mode detection<br /> * excellent native support (Android, Debian, Ubuntu, Arch Linux)<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.)<br /> * Open Hardware &amp; Software<br /> <br /> ===Software ===<br /> * Boots from onboard eMMC or microSD (or via USB serial downloader)<br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> === How to connected ===<br /> * USB 2.0 over USB-C plug to host with full device emulation<br /> * USB 2.0 over USB-C receptacle for the additional devices or as a connection to the host<br /> * Full TCP/IP connection to/from USB armory via USB CDC Ethernet emulation<br /> * Flash drive functionality via USB mass storage device emulation<br /> * Serial communication over USB or physical UART using the Debug Board<br /> * Wireless connectivity over BLE &lt;ref&gt;Mouser Electronic, F-Secure USB Armory Mk II, https://www.mouser.at/new/f-secure/crowd-supply-usb-armorymkii/&lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * mass storage device with advanced features such as automatic<br /> * encryption, virus scanning, host authentication, and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunneling, Tor<br /> * password manager with integrated webserver<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low-level USB security testing &lt;ref&gt;Andrea Barisani, Applications, https://github.com/f-secure-foundry/usbarmory/wiki/Applications&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted in the device or the MMc (16 GB) in it must be booted. Mk II supports 3 boot mechanisms &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> <br /> [[File:Armory-mark-two-boot-switch.png||Firmware|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)|USB armory Mk II boot modes &lt;ref name=&quot;And&quot;/&gt; ]]<br /> <br /> * internal 16GB eMMC<br /> * external microSD<br /> * USB Serial Download Protocol (SDP) &lt;ref name=&quot;And&quot;&gt;Andrea Barisani, USB armory Mk II boot modes, https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)#usb-armory-mk-ii-boot-modes&lt;/ref&gt;<br /> if we want to boot the MMC we have to drag the inverter to the left, and if we want to boot the SD micro card we have to drag the inverter to the right. If we want to put it in SDP mode we have to leave it in the middle.<br /> How to boot a microSD card?<br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=USB_Armory&diff=10454 2022-12-12T16:55:58Z

<p>FPaschinger: </p> <hr /> <div>== Introduction ==<br /> Launched in 2014, USB Armory is a small and portable USB-sized personal computer created by Andrea Barisani &lt;ref&gt;Andrea Barisani. Forging the USB armory, https://www.youtube.com/watch?v=bE5licRHMFs ,2014.&lt;/ref&gt;. Originally intended to be produced as a secure data store, USB Armory managed to become a versatile device with the development of its Hardware and Software. With its hardware sufficient as a computer, it can be configured on an installed Linux system that boots and thus powers up when plugged into any computer, for example, so that data not only ends up on an encrypted partition but is automatically re-encrypted when transferred &lt;ref&gt;NXP Community, Introducing USB armory, an Open Source Hardware Freescale i.MX53 Dongle<br /> , https://community.nxp.com/t5/i-MX-Solutions-Knowledge-Base/Introducing-USB-armory-an-Open-Source-Hardware-Freescale-i-MX53/ta-p/1126823, 2014&lt;/ref&gt; .<br /> [[File:Usbarmory coin.jpeg|Firmware|thumb|center|500px|link=https://inversepath.com/usbarmory_mark-one.html|OPEN SOURCE FLASH-DRIVE SIZED COMPUTER &lt;ref&gt;Inverse Path, OPEN SOURCE FLASH-DRIVE SIZED COMPUTER, https://inversepath.com/usbarmory_mark-one.html&lt;/ref&gt; ]]<br /> <br /> == Design Goals ==<br /> * The microSD hinge replacement with a push/pull slot.<br /> * Real USB plugs, plug + socket for integrated host adapter.<br /> * Enclosure design right from the beginning.<br /> * Full internal and third-party security audit for HABv4 and chain of trust.<br /> * Addition of built-in eMMC storage and external crypto authenticator.<br /> * Bluetooth communication &lt;ref&gt;Andrea Barisani, USB ARMORY RELOADED, https://www.nohat.it/2019/slides/nohat_barisani.pdf, 2019&lt;/ref&gt;.<br /> === Hardware ===<br /> [[USB armory + Enclosure ]]<br /> * SoC: NXP i.MX6ULZ ARM® Cortex™-A7 900 MHz<br /> * RAM: 512 MB DDR3<br /> * Storage: internal 16 GB eMMC + external microSD<br /> * Bluetooth module: u-blox ANNA-B112 BLE<br /> * USB-C ports: DRP (Dual Role Power) receptacle + UFP (Upstream Facing Port) plug, USB 2.0 only (no * video support)<br /> * LEDs: two<br /> * Slide switch: for boot mode selection between eMMC and microSD<br /> * External security elements: Microchip ATECC608A + NXP A71CH<br /> * Physical size: 66 mm x 19 mm x 8 mm (without enclosure, including USB-C connector)<br /> * Enclosure: included with all units for device protection &lt;ref&gt;Hacker Warehouse, USB Armory MK II, https://hackerwarehouse.com/product/usb-armory-mkii/, 2019&lt;/ref&gt;<br /> <br /> ===Software ===<br /> * Boots from onboard eMMC or microSD (or via USB serial downloader)<br /> * Native Linux support – creating boot images is easy<br /> * Precompiled images are available for Debian 9 (Stretch) and Arch Linux, with more on the way<br /> * USB device emulation (CDC Ethernet, mass storage, HID, etc.) &lt;ref&gt;Andrea Barisani, MK II Introduction, https://github.com/f-secure-foundry/usbarmory/wiki/Mk-II-Introduction#software&lt;/ref&gt;<br /> === How to connected ===<br /> * USB 2.0 over USB-C plug to host with full device emulation<br /> * USB 2.0 over USB-C receptacle for the additional devices or as a connection to the host<br /> * Full TCP/IP connection to/from USB armory via USB CDC Ethernet emulation<br /> * Flash drive functionality via USB mass storage device emulation<br /> * Serial communication over USB or physical UART using the Debug Board<br /> * Wireless connectivity over BLE &lt;ref&gt;Mouser Electronic, F-Secure USB Armory Mk II, https://www.mouser.at/new/f-secure/crowd-supply-usb-armorymkii/&lt;/ref&gt;<br /> <br /> == Application examples ==<br /> <br /> * mass storage device with advanced features such as automatic<br /> * encryption, virus scanning, host authentication, and data self-destruct<br /> * OpenSSH client and agent for untrusted hosts (kiosk)<br /> * router for end-to-end VPN tunneling, Tor<br /> * password manager with integrated webserver<br /> * electronic wallet (e.g. pocket Bitcoin wallet)<br /> * authentication token<br /> * portable penetration testing platform<br /> * low-level USB security testing &lt;ref&gt;Andrea Barisani, Applications, https://github.com/f-secure-foundry/usbarmory/wiki/Applications&lt;/ref&gt;<br /> <br /> == Getting Started ==<br /> === Boot Mechanisms ===<br /> In order for USB Armory to work in a certain operating system, either the microSD card inserted in the device or the MMc (16 GB) in it must be booted. Mk II supports 3 boot mechanisms &lt;ref&gt;Getting started, https://github.com/f-secure-foundry/usbarmory/wiki/Starting#getting-started&lt;/ref&gt;:<br /> <br /> <br /> [[File:Armory-mark-two-boot-switch.png||Firmware|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)|USB armory Mk II boot modes &lt;ref name=&quot;And&quot;/&gt; ]]<br /> <br /> * internal 16GB eMMC<br /> * external microSD<br /> * USB Serial Download Protocol (SDP) &lt;ref name=&quot;And&quot;&gt;Andrea Barisani, USB armory Mk II boot modes, https://github.com/f-secure-foundry/usbarmory/wiki/Boot-Modes-(Mk-II)#usb-armory-mk-ii-boot-modes&lt;/ref&gt;<br /> if we want to boot the MMC we have to drag the inverter to the left, and if we want to boot the SD micro card we have to drag the inverter to the right. If we want to put it in SDP mode we have to leave it in the middle.<br /> How to boot a microSD card?<br /> USB Armory has a valid Pre-Image file for each operating system on its own page. Optionally, booting can be done either manually or by downloading the appropriate file and flashing the microSD card (before it is inserted into the USB Armory) with balenaEtcher software &lt;ref name=&quot;And&quot;/&gt;.<br /> <br /> === 1. Step ===<br /> <br /> You can find the following Pre-Image files at this link: https://github.com/f-secure-foundry/usbarmory/wiki/Available-images<br /> <br /> [[File:Preimages.jpeg|thumb|center|500px|link=https://github.com/f-secure-foundry/usbarmory/wiki/Available-images|Available images &lt;ref&gt;Andrea Barisani, Available images, https://github.com/f-secure-foundry/usbarmory/wiki/Available-images&lt;/ref&gt; ]]<br /> <br /> === 2. Step ===<br /> <br /> You can download the following software here: https://www.balena.io/etcher/<br /> <br /> [[File:balenaET.jpeg||thumb|center|500px|link=https://www.balena.io/etcher/|Flash OS images to SD cards &amp; USB drives, safely and easily &lt;ref&gt;balenaEtcher, https://www.balena.io/etcher/&lt;/ref&gt;]]<br /> <br /> === Host communication ===<br /> Since the booted microSD card is ready in the operating system, Host communication can be started &lt;ref&gt;Andrea Barisani, Setup &amp; Connection Sharing: Linux , https://github.com/f-secure-foundry/usbarmory/wiki/Host-communication#setup--connection-sharing-linux&lt;/ref&gt;.<br /> <br /> # look up the name of the USB virtual Ethernet interface which was created by the USB Armory<br /> ifconfig<br /> <br /> # bring the USB virtual Ethernet interface up<br /> /sbin/ip link set usb0 up<br /> <br /> # set the host IP address<br /> /sbin/ip addr add 10.0.0.2/24 dev usb0<br /> <br /> # enable masquerading for outgoing connections towards wireless interface<br /> /sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE<br /> <br /> # enable IP forwarding<br /> sudo sysctl -w net.ipv4.ip_forward=1<br /> <br /> #connect to USB Armory via ssh - password: USB armory<br /> ssh usbarmory@10.0.0.1<br /> <br /> #install Lynx Web browser on USB Armory<br /> sudo apt-get install Lynx<br /> <br /> #launch Lynx Web browser on USB Armory<br /> lynx google.com<br /> <br /> == Hardware Used ==<br /> <br /> [[USB armory + Enclosure]]<br /> <br /> == References ==<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Beagle_USB_12_Protocol_Analyzer:_Test&diff=10453 2022-12-12T16:34:14Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> The Beagle USB 12 Protocol Analyzer is a nice tool to setup it quick and ease and allows engineers to debug problems quickly. You can capture, display and filter high-, full- and low-speed USB traffic in real time. <br /> <br /> [[File:Beagle_Analyzer_Front.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]<br /> <br /> In the front of the analyzer there are the target host and target device ports. <br /> They act as a passthrough to connect the target device to the host computer. <br /> <br /> [[File:Beagle Back.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]<br /> <br /> <br /> == Requirements ==<br /> <br /> To be able to monitor the USB traffic you will need a software that captures and displays USB, USB Type-C Power Delivery, I2C, SPI, eSPI and CAN bus data through the Beagle. To download it from the Totalphase website you will need to create an account. This does not come with any subscription or cost factor.<br /> You can [https://www.totalphase.com/products/data-center/?___ Download] the Data Center Software for following architectures:<br /> <br /> * Windows<br /> * Linux<br /> * MacOS<br /> <br /> If you are using a Windows or a Linux host, it is also important to download the appropriate drivers since without them Windows will not recognize the analyzer:<br /> <br /> * Windows [https://www.totalphase.com/products/usb-drivers-windows/ (here)]<br /> * Linux [https://www.totalphase.com/products/usb-drivers-linux/ (here)]<br /> <br /> MacOS do not require any driver.<br /> For more details like, key features, technical specifications or software requirements follow this [https://www.totalphase.com/products/beagle-usb12/ link].<br /> <br /> == Description ==<br /> <br /> With the type B USB cable connect the target host port at the front of the analyzer with your PCs USB port type A. <br /> The analyzis port at the backside of the analyzer is connected with another type B USB connector to your PCs USB port type A.<br /> Lastly you can then plug in your target device into the USB port type A of the analyzer. <br /> <br /> <br /> === Hands-On ===<br /> <br /> To capture traffic, click in the top toolbar at “Analyzer” and then on “Connect to Analyzer”. Confirm that the correct device is selected and click “OK”. <br /> <br /> [[File:Connect to Analyzer.png|800px|thumb|none|]]<br /> <br /> You can then connect the USB target device (for example a mouse) to the analyzer. After clicking on the play-button, we should then see all the packet data in real-time.<br /> <br /> [[File:Data Center Capture 1.png|800px|thumb|none|]]<br /> <br /> We can see that some interesting parameters like speed, timestamp, endpoint address and the actual data were captured. The captured data has been decoded into human readable messages.<br /> At the beginning we can see the handshake between the computer and the connected device. <br /> We can double-click on any packet to see the low-level data and the corresponding details, which are shown in hexadecimal and ASCII. A mouse click is symbolized by a field named “Btns=[1]”.<br /> <br /> [[File:Data Center Capture 2.png|800px|thumb|none|]]<br /> <br /> It should be now possible to click on the bottom of the Navigator at “LiveFilter” to filter for those events. This should be possible by entering “btns=[1]” in the text field. Apply the filter and all “click”-mouse events are shown. This should be possible for every kind of patterns, endpoint addresses, and more. <br /> <br /> [[File:Data Center Capture 3.png|800px|thumb|none|]]<br /> <br /> By turning off scrolling and disabling the filter, we can see all the data that occurred before and after the events. <br /> You can also connect a USB hub to the analyzer and plug in multiple USB devices. All devices with their assigned addresses will be shown under the navigator in the Data Center software.<br /> <br /> [[File:Data Center Capture 4.png|800px|thumb|none|]]<br /> <br /> You can also find a lot of already captured examples under “Help”, “Examples”:<br /> <br /> [[File:Data Center Example Captures.png|800px|thumb|none|]]<br /> <br /> The protocol analyzer can therefore be very helpful for debugging errors or for forensic analysis, for example.<br /> <br /> == Used Hardware ==<br /> <br /> [[Beagle USB 12 Protocol Analyzer]]<br /> <br /> <br /> == References ==<br /> <br /> * https://www.totalphase.com</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Beagle_USB_12_Protocol_Analyzer:_Test&diff=10452 2022-12-12T16:31:33Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> The Beagle USB 12 Protocol Analyzer is a nice tool to setup it quick and ease and allows engineers to debug problems quickly. You can capture, display and filter high-, full- and low-speed USB traffic in real time. <br /> <br /> [[File:Beagle_Analyzer_Front.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]<br /> <br /> In the front of the analyzer there are the target host and target device ports. <br /> They act as a passthrough to connect the target device to the host computer. <br /> <br /> [[File:Beagle Back.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]<br /> <br /> <br /> == Requirements ==<br /> <br /> To be able to monitor the USB traffic you will need a software that captures and displays USB, USB Type-C Power Delivery, I2C, SPI, eSPI and CAN bus data through the Beagle. To download it from the Totalphase website you will need to create an account. This does not come with any subscription or cost factor.<br /> You can [https://www.totalphase.com/products/data-center/?___ Download] the Data Center Software for following architectures:<br /> <br /> * Windows<br /> * Linux<br /> * MacOS<br /> <br /> If you are using a Windows or a Linux host, it is also important to download the appropriate drivers since without them Windows will not recognize the analyzer:<br /> <br /> * Windows [https://www.totalphase.com/products/usb-drivers-windows/ (here)]<br /> * Linux [https://www.totalphase.com/products/usb-drivers-linux/ (here)]<br /> <br /> MacOS do not require any driver.<br /> For more details like, key features, technical specifications or software requirements follow this [https://www.totalphase.com/products/beagle-usb12/ link].<br /> <br /> == Description ==<br /> <br /> With the type B USB cable connect the target host port at the front of the analyzer with your PCs USB port type A. <br /> The analyzis port at the backside of the analyzer is connected with another type B USB connector to your PCs USB port type A.<br /> Lastly you can then plug in your target device into the USB port type A of the analyzer. <br /> <br /> <br /> === Hands-On ===<br /> <br /> To capture traffic, click in the top toolbar at “Analyzer” and then on “Connect to Analyzer”. Confirm that the correct device is selected and click “OK”. <br /> <br /> [[File:Connect to Analyzer.png|800px|thumb|none|]]<br /> <br /> You can then connect the USB target device (for example a mouse) to the analyzer. After clicking on the play-button, we should then see all the packet data in real-time.<br /> <br /> [[File:Data Center Capture 1.png|800px|thumb|none|]]<br /> <br /> We can see that some interesting parameters like speed, timestamp, endpoint address and the actual data were captured. The captured data has been decoded into human readable messages.<br /> At the beginning we can see the handshake between the computer and the connected device. <br /> We can double-click on any packet to see the low-level data and the corresponding details, which are shown in hexadecimal and ASCII. A mouse click is symbolized by a field named “Btns=[1]”.<br /> <br /> [[File:Data Center Capture 2.png|800px|thumb|none|]]<br /> <br /> It should be now possible to click on the bottom of the Navigator at “LiveFilter” to filter for those events. This should be possible by entering “btns=[1]” in the text field. Apply the filter and all “click”-mouse events are shown. This should be possible for every kind of patterns, endpoint addresses, and more. <br /> <br /> [[File:Data Center Capture 3.png|800px|thumb|none|]]<br /> <br /> By turning off scrolling and disabling the filter, we can see all the data that occurred before and after the events. <br /> You can also connect a USB hub to the analyzer and plug in multiple USB devices. All devices with their assigned addresses will be shown under the navigator in the Data Center software.<br /> <br /> [[File:Data Center Capture 4.png|800px|thumb|none|]]<br /> <br /> You can also find a lot of already captured examples under “Help”, “Examples”:<br /> <br /> [[File:Data Center Example Captures.png|800px|thumb|none|]]<br /> <br /> The protocol analyzer can therefore be very helpful for debugging errors or for forensic analysis, for example.<br /> <br /> <br /> == References ==<br /> <br /> * https://www.totalphase.com</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Beagle_USB_12_Protocol_Analyzer:_Test&diff=10451 2022-12-12T16:30:40Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> The Beagle USB 12 Protocol Analyzer is a nice tool to setup it quick and ease and allows engineers to debug problems quickly. You can capture, display and filter high-, full- and low-speed USB traffic in real time. <br /> <br /> [[File:Beagle_Analyzer_Front.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]<br /> <br /> In the front of the analyzer there are the target host and target device ports. <br /> They act as a passthrough to connect the target device to the host computer. <br /> <br /> [[File:Beagle Back.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]<br /> <br /> <br /> == Requirements ==<br /> <br /> To be able to monitor the USB traffic you will need a software that captures and displays USB, USB Type-C Power Delivery, I2C, SPI, eSPI and CAN bus data through the Beagle. To download it from the Totalphase website you will need to create an account. This does not come with any subscription or cost factor.<br /> You can [https://www.totalphase.com/products/data-center/?___ Download] the Data Center Software for following architectures:<br /> <br /> * Windows<br /> * Linux<br /> * MacOS<br /> <br /> If you are using a Windows or a Linux host, it is also important to download the appropriate drivers since without them Windows will not recognize the analyzer:<br /> <br /> * Windows [https://www.totalphase.com/products/usb-drivers-windows/ (here)]<br /> * Linux [https://www.totalphase.com/products/usb-drivers-linux/ (here)]<br /> <br /> MacOS do not require any driver.<br /> For more details like, key features, technical specifications or software requirements follow this [https://www.totalphase.com/products/beagle-usb12/ link].<br /> <br /> <br /> == Description ==<br /> <br /> With the type B USB cable connect the target host port at the front of the analyzer with your PCs USB port type A. <br /> The analyzis port at the backside of the analyzer is connected with another type B USB connector to your PCs USB port type A.<br /> Lastly you can then plug in your target device into the USB port type A of the analyzer. <br /> <br /> === Hardware ===<br /> <br /> * Non-intrusively monitor I2C up to 4 MHz<br /> * Non-intrusively monitor SPI up to 24 MHz†<br /> * Non-intrusively monitor MDIO up to 2.5 MHz (Clause 22 and Clause 45)‡<br /> * Real-Time Data Capture and Display - Watch I2C, and SPI packets as they occur on the bus.<br /> * Bit-level timing down to 20 ns resolution.<br /> * Fully Windows, Linux, and Mac OS X compatible<br /> * Includes full function monitoring tools<br /> * Low Cost<br /> <br /> === Hands-On ===<br /> <br /> To capture traffic, click in the top toolbar at “Analyzer” and then on “Connect to Analyzer”. Confirm that the correct device is selected and click “OK”. <br /> <br /> [[File:Connect to Analyzer.png|800px|thumb|none|]]<br /> <br /> You can then connect the USB target device (for example a mouse) to the analyzer. After clicking on the play-button, we should then see all the packet data in real-time.<br /> <br /> [[File:Data Center Capture 1.png|800px|thumb|none|]]<br /> <br /> We can see that some interesting parameters like speed, timestamp, endpoint address and the actual data were captured. The captured data has been decoded into human readable messages.<br /> At the beginning we can see the handshake between the computer and the connected device. <br /> We can double-click on any packet to see the low-level data and the corresponding details, which are shown in hexadecimal and ASCII. A mouse click is symbolized by a field named “Btns=[1]”.<br /> <br /> [[File:Data Center Capture 2.png|800px|thumb|none|]]<br /> <br /> It should be now possible to click on the bottom of the Navigator at “LiveFilter” to filter for those events. This should be possible by entering “btns=[1]” in the text field. Apply the filter and all “click”-mouse events are shown. This should be possible for every kind of patterns, endpoint addresses, and more. <br /> <br /> [[File:Data Center Capture 3.png|800px|thumb|none|]]<br /> <br /> By turning off scrolling and disabling the filter, we can see all the data that occurred before and after the events. <br /> You can also connect a USB hub to the analyzer and plug in multiple USB devices. All devices with their assigned addresses will be shown under the navigator in the Data Center software.<br /> <br /> [[File:Data Center Capture 4.png|800px|thumb|none|]]<br /> <br /> You can also find a lot of already captured examples under “Help”, “Examples”:<br /> <br /> [[File:Data Center Example Captures.png|800px|thumb|none|]]<br /> <br /> The protocol analyzer can therefore be very helpful for debugging errors or for forensic analysis, for example.<br /> <br /> <br /> == References ==<br /> <br /> * https://www.totalphase.com</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Evil_Portal_with_Wifi_Pineapple_Nano&diff=10448 2022-12-10T14:28:41Z

<p>FPaschinger: Created page with &quot;== Summary == This documentation will show how easy it is to setup an evil portal, a fake website to receive credentials, with the Wifi Pineapple Nano. This is only for educational purposes and is illegal when used without permission. == Requirements == * Wifi Pineapple Nano and included equipment * SD Card 8gb or above The setup was tested on Kali Linux. In order to complete these steps, you must have followed https://wiki.elvis.science/index.php?title=Pineappl...&quot;</p> <hr /> <div>== Summary == <br /> <br /> This documentation will show how easy it is to setup an evil portal, a fake website to receive credentials, with the Wifi Pineapple Nano. This is only for educational purposes and is illegal when used without permission.<br /> <br /> == Requirements ==<br /> <br /> * Wifi Pineapple Nano and included equipment<br /> * SD Card 8gb or above <br /> <br /> The setup was tested on Kali Linux.<br /> <br /> In order to complete these steps, you must have followed [[https://wiki.elvis.science/index.php?title=Pineapple_Setup]] for preparation.<br /> <br /> == Description ==<br /> <br /> === Step 1 ===<br /> <br /> In order to use the SD Card the right way, it must formated previously. This is done on &quot;Advanced&quot; -&gt; &quot;USB &amp; Storage&quot; drop down arrow in the right corner -&gt; &quot;Format SD&quot;<br /> This will take couple of minutes. When it's done you can go to the next step.<br /> <br /> === Step 2 ===<br /> <br /> Go the &quot;Modules&quot; section, click &quot;Manage Modules&quot; then on &quot;Get Modules from Hak5 Community Repositories&quot; and look for the &quot;Evil Portal&quot; option. Click &quot;Download&quot; and enter the &quot;Download to SD Card&quot; option. <br /> <br /> Now there will be the &quot;Evil Portal&quot; option listed in the Modules section.<br /> <br /> To check if everthing works fine so far: <br /> <br /> * Enter a name for the test portal<br /> * Click &quot;Create New Portal&quot;<br /> * Activate new portal<br /> * Captive Portal Start<br /> * Start On Boot enable<br /> * Reload the page to prevent errors<br /> * Enter 172.16.42.1<br /> <br /> The result will look similar to this:<br /> <br /> <br /> [[File:Pineapple Evil Portal Test Portal.png | 400px]]<br /> <br /> === Step 3 ===<br /> <br /> Next, the pages with the realistic visuals must be downloaded. For this project the Evil Portals from https://github.com/kleo/evilportals.git are used.<br /> In the shell use the command:<br /> <br /> *git clone https://github.com/kleo/evilportals.git<br /> <br /> Then transfer the portals either all of them or just specific ones to the Wifi Pineapple Nano.<br /> <br /> * Enter the folder where the portals are located<br /> * scp -r ''choose-portal'' root@172.16.42.1:/root/portals '''OR WHEN AN ERROR OCCURS''' scp -r -O ''choose-portal'' root@172.16.42.1:/root/portals<br /> <br /> <br /> Now the preferred portal should be copied to the Nano.<br /> <br /> == Step 4 ==<br /> <br /> Enabling the new portals:<br /> <br /> * Go to the Modules section again<br /> * The new Modules are listed in the work bench<br /> * Deactivate or delete the test portal<br /> * Activate the new portal<br /> * Refresh the page<br /> * Enter 172.16.42.1<br /> * Enter the allowed client's MAC addresses in the white list<br /> <br /> The Evil Portal is now ready.<br /> <br /> <br /> [[File:Pineapple Evil Portal Google.png | 600px ]]<br /> <br /> <br /> You can see on the picture that when entering the IP address you will be redirected to the fake Google page. On the Tab the name &quot;Google&quot; appears.<br /> <br /> == Result ==<br /> <br /> To see the entered credentials of the targets, click on &quot;View&quot; of the activated portal. There you will see a list of logs from the users.<br /> <br /> <br /> [[File:Pineapple Evil Portal Logs.png | 400 px]]<br /> <br /> <br /> == References ==<br /> <br /> * https://github.com/kleo/evilportals.git<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=File:Pineapple_Evil_Portal_Logs.png&diff=10447 2022-12-10T14:24:28Z

<p>FPaschinger: Logs of the entered credentials in the evil portal</p> <hr /> <div>== Summary ==<br /> Logs of the entered credentials in the evil portal</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=File:Pineapple_Evil_Portal_Google.png&diff=10446 2022-12-10T14:18:51Z

<p>FPaschinger: Wifi Pineapple Nano Evil Portal Google Example</p> <hr /> <div>== Summary ==<br /> Wifi Pineapple Nano Evil Portal Google Example</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=File:Pineapple_Evil_Portal_Test_Portal.png&diff=10445 2022-12-10T13:55:05Z

<p>FPaschinger: Evil Portal Pineapple Nano Test Site</p> <hr /> <div>== Summary ==<br /> Evil Portal Pineapple Nano Test Site</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Pineapple_Setup&diff=10432 2022-11-17T17:30:09Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> Setup and Firmware upgrade [optional] of Wifi Pineapple Nano <br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> * Operating system: Windows 10<br /> <br /> <br /> == Description ==<br /> <br /> === Basic setup ===<br /> * Connect antennas and USB Y cable, WiFi Pineapple NANO needs a stable USB power supply capable of providing 9W for initial setup. Therefore plug both USB Ports of USB Y cable into the Laptop. After that he blue led should have solid light.<br /> <br /> [[File:Pineapplenanothings.jpg|500px|WiFi Pineapple Nano]]<br /> <br /> <br /> === Provision Linux ===<br /> * Use lusb to verify that pineapple ASIX Electronics is recognized by your laptop<br /> <br /> lsusb<br /> ... <br /> Bus 001 Device 004: ID 0b95:772a ASIX Electronics Corp. AX88772A Fast Ethernet<br /> ...<br /> <br /> * Check networking interface and ip address<br /> <br /> sudo ifconfig<br /> enx00c0ca91b581: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt; mtu 1500<br /> inet 172.16.42.107 netmask 255.255.255.0 broadcast 172.16.42.255<br /> inet6 fe80::d2b0:568c:b39b:4c44 prefixlen 64 scopeid 0x20&lt;link&gt;<br /> ether 00:c0:ca:91:b5:81 txqueuelen 1000 (Ethernet)<br /> RX packets 15 bytes 1589 (1.5 KiB)<br /> RX errors 0 dropped 0 overruns 0 frame 0<br /> TX packets 40 bytes 5589 (5.4 KiB)<br /> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0<br /> <br /> === Setup Windows/Linux ===<br /> * Browse to the determined IP address 172.16.42.1:1471<br /> <br /> The Web interface should appear.<br /> The interface then appearing is the main User Interface (UI) where the user is able to work with the WiFi Pineapple Nano. This UI is further described in: https://wiki.elvis.science/index.php?title=Wifi_Pineapple_Nano<br /> <br /> === Internet connection Linux ===<br /> * Download wp6 script<br /> <br /> wget wifipinapple.com/wp6.sh<br /> ...<br /> 2015-12-22 20:09:43 (4.69 MB/s) - 'wp6.sh' saved [6112]<br /> <br /> * Make it executable <br /> <br /> chmod +x wp6.sh<br /> <br /> * Execute it to set up connection. The predefined settings might work without alteration, if not, the settings are easily changed by answering some questions. <br /> <br /> sudo ./wp6.sh<br /> <br /> === Internet connection Windows ===<br /> * Got to network connections via the change adapter settings. A new ASIX USB Fast Ethernet adapter should have appeared here, which is the pineapple interface.<br /> * In the settings of the interface that is responsible for the Internet connection, in the sharing tab, allow other users to connect through this computer's internet connection. Also use the drop down menu to select the interface of the Pineapple Nano and click OK.<br /> * In the settings of the Pineapple Nano Interface, select the settings of the Internet Protocol Version 4. There you change the IP address to '172.16.42.42' and confirm with OK.<br /> <br /> === User Interface ===<br /> After connecting the Pineapple Nano to your device correctly as can be seen above, a User Interface (UI) opens under the IP address 172.16.42.1:1471<br /> <br /> The User Interface is the main working space for the penetration tester. The UI includes:<br /> * Dashboard - shows the uptime of the device, the clients connected and the SSIDs in the pool<br /> * Recon - scanning the Network<br /> * Clients - List of Clients connected<br /> * Tracking<br /> * Modules - List of downloadable Modules<br /> * Filters - Filtering Clients and connections<br /> * PineAP - Main part of creating a new WiFi where youc an see the SSID pool, add and remove them and start it in order for the SSIDs to be public<br /> * Logging<br /> * Reporting<br /> * Networking<br /> * Configuration<br /> * Advances<br /> * Notes<br /> * Help<br /> <br /> <br /> === Upgrade to newest firmware version 2.7.0 [optional] ===<br /> <br /> * Download newest firmware from https://www.wifipineapple.com/downloads and verify shasum:<br /> <br /> sha256sum upgrade-2.7.0.bin <br /> c69629ef90c715600e09f22ef12732c593f886db3b0ed145f549de551c48f79d upgrade-2.7.0.bin<br /> <br /> * Select file with newest firmware upgrade-2.7.0.bin in the Web interface<br /> ** press reset button<br /> ** wait until firmware upgrade successfully verified appears<br /> * After upgrade connect again to 172.16.42.107:1471 and get into Device Configuration<br /> ** Set root password for ssh and web interface access<br /> ** pwd: &lt;ask for&gt;<br /> * Management AP Setup<br /> ** Management SSID:<br /> ** WPA2 pwd: &lt;ask for&gt;<br /> ** check Hide Management AP<br /> * Open AP Setup<br /> is used for the target to connect to: f.e. **netlab** <br /> <br /> === Troubleshooting ===<br /> Error when trying to start module e.g. tcpdump:<br /> <br /> *Start a ssh connection to the Wifi Pineapple<br /> *Enter the commands<br /> **opkg update<br /> **opkg install libpcap<br /> <br /> No internet connection from the PC when plugging in the WIFI Pineapple on Linux<br /> *Ip route<br /> *Ip route del default via 172.16.42.1<br /> <br /> === Factory reset ===<br /> <br /> *Unplug the WiFi Pineapple completely from all power sources.<br /> *Begin holding the RESET button on the device.<br /> *With the RESET button held, power on the device.<br /> *Continue holding the RESET button for 10 seconds, then release.<br /> *NANO: The blue LED will remain solid<br /> *Connect the host PC to the WiFi Pineapple via the USB Ethernet Port<br /> *NANO: The male USB A plug<br /> *From the host PC, configure a static IP address on the WiFi Pineapple facing Ethernet interface to 192.168.1.2 with netmask 255.255.255.0<br /> *For example, in Linux run ifconfig eth1 192.168.1.2 netmask 255.255.255.0 up (where eth1 is the interface name of the WiFi Pineapple).<br /> *From the host PC, browse to http://192.168.1.1<br /> *Click Choose File and select the factory firmware image downloaded above.<br /> *Click Update Firmware.<br /> *This process will take several minutes. Do not interrupt the power supply while the firmware is updating. Once complete, the WiFi Pineapple will restart.<br /> *Reset the WiFi Pineapple facing USB Ethernet interface back to DHCP or 172.16.42.42 with netmask 255.255.255.0 <br /> <br /> <br /> <br /> == Used Hardware ==<br /> <br /> [[Wifi Pineapple Nano]]<br /> <br /> == Courses ==<br /> <br /> * [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019<br /> <br /> <br /> == References ==<br /> <br /> * https://docs.hak5.org/hc/en-us/articles/360010555313-Setup-Basics<br /> * https://www.youtube.com/watch?v=CrHbEZd4t00<br /> * https://0x00sec.org/t/solved-wifi-pineapple-nano-client-issues/4609<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Pineapple_Setup&diff=10431 2022-11-17T17:26:39Z

<p>FPaschinger: </p> <hr /> <div>== Summary == <br /> <br /> Setup and Firmware upgrade [optional] of Wifi Pineapple Nano <br /> <br /> == Requirements ==<br /> <br /> * Operating system: Ubuntu 18.04 bionic amd64<br /> * Operating system: Windows 10<br /> <br /> <br /> == Description ==<br /> <br /> === Basic setup ===<br /> * Connect antennas and USB Y cable, WiFi Pineapple NANO needs a stable USB power supply capable of providing 9W for initial setup. Therefore plug both USB Ports of USB Y cable into the Laptop. After that he blue led should have solid light.<br /> <br /> [[File:Pineapplenanothings.jpg|500px|WiFi Pineapple Nano]]<br /> <br /> <br /> === Provision Linux ===<br /> * Use lusb to verify that pineapple ASIX Electronics is recognized by your laptop<br /> <br /> lsusb<br /> ... <br /> Bus 001 Device 004: ID 0b95:772a ASIX Electronics Corp. AX88772A Fast Ethernet<br /> ...<br /> <br /> * Check networking interface and ip address<br /> <br /> sudo ifconfig<br /> enx00c0ca91b581: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt; mtu 1500<br /> inet 172.16.42.107 netmask 255.255.255.0 broadcast 172.16.42.255<br /> inet6 fe80::d2b0:568c:b39b:4c44 prefixlen 64 scopeid 0x20&lt;link&gt;<br /> ether 00:c0:ca:91:b5:81 txqueuelen 1000 (Ethernet)<br /> RX packets 15 bytes 1589 (1.5 KiB)<br /> RX errors 0 dropped 0 overruns 0 frame 0<br /> TX packets 40 bytes 5589 (5.4 KiB)<br /> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0<br /> <br /> === Setup Windows/Linux ===<br /> * Browse to the determined IP address 172.16.42.1:1471<br /> <br /> The Web interface should appear.<br /> The interface then appearing is the main User Interface (UI) where the user is able to work with the WiFi Pineapple Nano. This UI is further described in: https://wiki.elvis.science/index.php?title=Wifi_Pineapple_Nano<br /> <br /> === Internet connection Linux ===<br /> * Download wp6 script<br /> <br /> wget wifipinapple.com/wp6.sh<br /> ...<br /> 2015-12-22 20:09:43 (4.69 MB/s) - 'wp6.sh' saved [6112]<br /> <br /> * Make it executable <br /> <br /> chmod +x wp6.sh<br /> <br /> * Execute it to set up connection. The predefined settings might work without alteration, if not, the settings are easily changed by answering some questions. <br /> <br /> sudo ./wp6.sh<br /> <br /> === Internet connection Windows ===<br /> * Got to network connections via the change adapter settings. A new ASIX USB Fast Ethernet adapter should have appeared here, which is the pineapple interface.<br /> * In the settings of the interface that is responsible for the Internet connection, in the sharing tab, allow other users to connect through this computer's internet connection. Also use the drop down menu to select the interface of the Pineapple Nano and click OK.<br /> * In the settings of the Pineapple Nano Interface, select the settings of the Internet Protocol Version 4. There you change the IP address to '172.16.42.42' and confirm with OK.<br /> <br /> === User Interface ===<br /> After connecting the Pineapple Nano to your device correctly as can be seen above, a User Interface (UI) opens under the IP address 172.16.42.1:1471<br /> <br /> The User Interface is the main working space for the penetration tester. The UI includes:<br /> * Dashboard - shows the uptime of the device, the clients connected and the SSIDs in the pool<br /> * Recon - scanning the Network<br /> * Clients - List of Clients connected<br /> * Tracking<br /> * Modules - List of downloadable Modules<br /> * Filters - Filtering Clients and connections<br /> * PineAP - Main part of creating a new WiFi where youc an see the SSID pool, add and remove them and start it in order for the SSIDs to be public<br /> * Logging<br /> * Reporting<br /> * Networking<br /> * Configuration<br /> * Advances<br /> * Notes<br /> * Help<br /> <br /> <br /> === Upgrade to newest firmware version 2.7.0 [optional] ===<br /> <br /> * Download newest firmware from https://www.wifipineapple.com/downloads and verify shasum:<br /> <br /> sha256sum upgrade-2.7.0.bin <br /> c69629ef90c715600e09f22ef12732c593f886db3b0ed145f549de551c48f79d upgrade-2.7.0.bin<br /> <br /> * Select file with newest firmware upgrade-2.7.0.bin in the Web interface<br /> ** press reset button<br /> ** wait until firmware upgrade successfully verified appears<br /> * After upgrade connect again to 172.16.42.107:1471 and get into Device Configuration<br /> ** Set root password for ssh and web interface access<br /> ** pwd: &lt;ask for&gt;<br /> * Management AP Setup<br /> ** Management SSID:<br /> ** WPA2 pwd: &lt;ask for&gt;<br /> ** check Hide Management AP<br /> * Open AP Setup<br /> is used for the target to connect to: f.e. **netlab** <br /> <br /> === Troubleshooting ===<br /> Error when trying to start module e.g. tcpdump:<br /> <br /> *Start a ssh connection to the Wifi Pineapple<br /> *Enter the commands<br /> **opkg update<br /> **opkg install libpcap<br /> <br /> <br /> <br /> == Used Hardware ==<br /> <br /> [[Wifi Pineapple Nano]]<br /> <br /> == Courses ==<br /> <br /> * [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019<br /> <br /> <br /> == References ==<br /> <br /> * https://docs.hak5.org/hc/en-us/articles/360010555313-Setup-Basics<br /> * https://www.youtube.com/watch?v=CrHbEZd4t00<br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10296 2022-07-12T19:03:12Z

<p>FPaschinger: /* Introduction */</p> <hr /> <div>== Introduction ==<br /> <br /> We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the opening process.<br /> The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without needing any keys. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.<br /> One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.<br /> Therefore, we got 2 possibilities:<br /> <br /> ''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''<br /> # The car is sending permanent wake up signals.<br /> # If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.<br /> # If the key and car fits together, an ID check is going to start.<br /> # The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.<br /> '''2. The car sends a LF signal with a car ID. '''<br /> # Periodically a LF signal is transmitted by the car.<br /> # If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.<br /> <br /> == Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig https://zadig.akeo.ie/<br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10294 2022-07-12T19:00:09Z

<p>FPaschinger: /* Introduction */</p> <hr /> <div>== Introduction ==<br /> <br /> We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the opening process.<br /> The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without needing any keys. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.<br /> One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.<br /> Therefore, we got 2 possibilities:<br /> <br /> ''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''<br /> #a. The car is sending permanent wake up signals.<br /> #b. If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.<br /> #c. If the key and car fits together, an ID check is going to start.<br /> #d. The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.<br /> '''2. The car sends a LF signal with a car ID. '''<br /> #a. Periodically a LF signal is transmitted by the car.<br /> #b. If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.<br /> <br /> == Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig https://zadig.akeo.ie/<br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10292 2022-07-12T18:59:28Z

<p>FPaschinger: /* Introduction */</p> <hr /> <div>== Introduction ==<br /> <br /> We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the opening process.<br /> The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without needing any keys. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.<br /> One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.<br /> <br /> #Therefore, we got 2 possibilities:<br /> ''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''<br /> #a. The car is sending permanent wake up signals.<br /> #b. If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.<br /> #c. If the key and car fits together, an ID check is going to start.<br /> #d. The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.<br /> '''2. The car sends a LF signal with a car ID. '''<br /> #a. Periodically a LF signal is transmitted by the car.<br /> #b. If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.<br /> <br /> == Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig https://zadig.akeo.ie/<br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10291 2022-07-12T18:59:13Z

<p>FPaschinger: </p> <hr /> <div>== Introduction ==<br /> <br /> We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the opening process.<br /> The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without needing any keys. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.<br /> One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.<br /> <br /> Therefore, we got 2 possibilities:<br /> ''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''<br /> #a. The car is sending permanent wake up signals.<br /> #b. If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.<br /> #c. If the key and car fits together, an ID check is going to start.<br /> #d. The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.<br /> '''2. The car sends a LF signal with a car ID. '''<br /> #a. Periodically a LF signal is transmitted by the car.<br /> #b. If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open. <br /> <br /> <br /> == Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig https://zadig.akeo.ie/<br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10290 2022-07-12T18:45:44Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig https://zadig.akeo.ie/<br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10289 2022-07-12T18:45:28Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig <br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10288 2022-07-12T18:44:56Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig <br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10286 2022-07-12T18:43:04Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website <br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig <br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10285 2022-07-12T18:42:47Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website <br /> <br /> ''' Step 2 '''<br /> ** Driver Installation on HackRF One<br /> #Download Zadig <br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br />  <br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10284 2022-07-12T18:42:16Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> * Step 1<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> * Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website <br /> <br /> * Step 2<br /> ** Driver Installation on HackRF One<br /> #Download Zadig <br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br />  <br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10283 2022-07-12T18:42:06Z

<p>FPaschinger: /* Pentesting with PandwaRF */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> #Install the application on your Android Phone.<br /> #Open the Device.<br /> #Install the antennas. (Never use a SDR Device without antennas.)<br /> #Connect the PandwaRF via USB-C to your phone.<br /> #Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> #The device should have connected with your application. If not, do it manually in the search tab.<br /> #After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> #At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> #In order to transmit a captured signal, you need to buy a &quot;Kaiju License&quot;. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> * Step 1<br /> <br /> #Set up a laptop with native kali linux <br /> #If you want dual boot on your local machine use these instructions<br /> <br /> ** Dualboot on windows machine <br /> <br /> #You need a USB stick with a minimum of 8gb storage<br /> #Download Kali image from official website<br /> #Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> #On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> #For further information follow the instructions on the official website <br /> <br /> * Step 2<br /> ** Driver Installation on HackRF One<br /> #Download Zadig <br /> #Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br />  <br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> # Choose HackRF<br /> # Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10268 2022-07-12T18:35:57Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> In order to complete these steps, you must have followed [[Some Other Documentation]] before.<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> 1)Install the application on your Android Phone.<br /> 2)Open the Device.<br /> 3)Install the antennas. (Never use a SDR Device without antennas.)<br /> 4)Connect the PandwaRF via USB-C to your phone.<br /> 5)Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> 1)The device should have connected with your application. If not, do it manually in the search tab.<br /> 2)After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> 3)At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> 4)In order to transmit a captured signal, you need to buy a &quot;Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> # Set up a laptop with native kali linux <br /> <br /> # If you want dual boot on your local machine use these instructions<br /> <br /> ''' Dualboot on windows machine '''<br /> <br /> # You need a USB stick with a minimum of 8gb storage<br /> <br /> # Download Kali image from official website<br /> <br /> # Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> <br /> # On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> <br /> # For further information follow the instructions on the official website <br /> <br /> ''' Step 2 '''<br /> * Driver Installation on HackRF One<br /> # Download Zadig <br /> # Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br />  <br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> ** The device settings are listed below:<br /> ## Choose HackRF<br /> ## Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10267 2022-07-12T18:35:10Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> In order to complete these steps, you must have followed [[Some Other Documentation]] before.<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> 1)Install the application on your Android Phone.<br /> 2)Open the Device.<br /> 3)Install the antennas. (Never use a SDR Device without antennas.)<br /> 4)Connect the PandwaRF via USB-C to your phone.<br /> 5)Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> 1)The device should have connected with your application. If not, do it manually in the search tab.<br /> 2)After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> 3)At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> 4)In order to transmit a captured signal, you need to buy a &quot;Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> # Set up a laptop with native kali linux <br /> <br /> # If you want dual boot on your local machine use these instructions<br /> <br /> ''' Dualboot on windows machine '''<br /> <br /> # You need a USB stick with a minimum of 8gb storage<br /> <br /> # Download Kali image from official website<br /> <br /> # Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> <br /> <br /> # On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> <br /> # For further information follow the instructions on the official website <br /> <br /> ''' Step 2 '''<br /> * Driver Installation on HackRF One<br /> # Download Zadig <br /> # Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br />  <br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> ** The device settings are listed below:<br /> ## Choose HackRF<br /> ## Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger https://elvis.hcw.ac.at/wiki/index.php?title=Software-defined_radio_(SDR):_Relay_Attacks&diff=10266 2022-07-12T18:34:48Z

<p>FPaschinger: /* Pentesting with HackRF one */</p> <hr /> <div>== Summary == <br /> <br /> This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements. <br /> <br /> == Requirements ==<br /> <br /> We used 3 different devices for the penetration-testing of a car and a gate. <br /> <br /> ''' Hardware '''<br /> *HackRF-One<br /> *PandwaRF<br /> *Nooelec SDR (No transmission possible)<br /> *Car<br /> *Garage gate<br /> <br /> ''' Software '''<br /> *Computer with native Kali-Linux installed.<br /> *License for PandwaRF.<br /> *Universal Radio Hacker.<br /> *PandwaRF App for Android. (Must be a device with latest Android version installed)<br /> <br /> In order to complete these steps, you must have followed [[Some Other Documentation]] before.<br /> <br /> == Description ==<br /> <br /> === Pentesting with PandwaRF ===<br /> <br /> ''' Step 1 '''<br /> <br /> 1)Install the application on your Android Phone.<br /> 2)Open the Device.<br /> 3)Install the antennas. (Never use a SDR Device without antennas.)<br /> 4)Connect the PandwaRF via USB-C to your phone.<br /> 5)Open the application.<br /> <br /> <br /> ''' Step 2 '''<br /> <br /> 1)The device should have connected with your application. If not, do it manually in the search tab.<br /> 2)After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency. <br /> 3)At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze. <br /> 4)In order to transmit a captured signal, you need to buy a &quot;Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.<br /> <br /> === Pentesting with HackRF one ===<br /> <br /> ''' Step 1 '''<br /> <br /> # Set up a laptop with native kali linux <br /> <br /> # If you want dual boot on your local machine use these instructions<br /> <br /> ''' Dualboot on windows maschine '''<br /> <br /> # You need a USB stick with a minimum of 8gb storage<br /> <br /> # Download Kali image from official website<br /> <br /> # Download e.g. Etcher to flash the image on the USB stick to make it bootable<br /> <br /> <br /> # On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.<br /> <br /> # For further information follow the instructions on the official website <br /> <br /> ''' Step 2 '''<br /> * Driver Installation on HackRF One<br /> # Download Zadig <br /> # Only compatible with Windows <br /> <br /> * Set-up HackRF on Linux<br /> # Sudo apt-get update<br /> # Sudo apt-get -y install hackrf<br /> <br /> Download Universal Radio Hacker on Linux machine<br /> * First method <br /> # Sudo python3 -m pip install –upgrade pip<br /> # Sudo python3 -m pip install urh<br /> * Second method <br /> # Sudo apt -y install urh<br />  <br /> * Third method<br /> # git clone https://github.com/jopohl/urh<br /> # cd urh<br /> # python setup.py install<br /> * Start Universal Radio Hacker with the command “urh”<br /> ** The device settings are listed below:<br /> ## Choose HackRF<br /> ## Enter the frequency<br /> <br /> === Nesdr Smart – receive only ===<br /> <br /> ''' Step 1 '''<br /> <br /> Install the driver with zadig (detailed information in the HackRF One section)<br /> <br /> ''' Step 2 '''<br /> <br /> Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!<br /> <br /> == Used Hardware ==<br /> <br /> * HackRF One<br /> * PandwaRF<br /> * Nooelec SDR<br /> <br /> == Conclusion ==<br /> We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.<br /> <br /> == References ==<br /> <br /> * https://www.youtube.com/watch?v=5CsD8I396wo&amp;t=327s<br /> * https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars<br /> * https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems<br /> * https://www.youtube.com/watch?v=XrRGDQ2IzDE<br /> * https://en.wikipedia.org/wiki/Remote_keyless_system<br /> * https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines<br /> * https://rolling.pandwarf.com/<br /> * https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/<br /> * https://installati.one/ubuntu/20.04/hackrf/<br /> * https://zadig.akeo.ie/<br /> * https://www.kali.org/docs/usb/live-usb-install-with-linux/<br /> * https://www.balena.io/etcher/<br /> * https://www.kali.org/docs/introduction/download-official-kali-linux-images/<br /> <br /> <br /> [[Category:Documentation]]</div>

FPaschinger