Elvis Wiki - User contributions [en]

USB Hacking

2023-02-01T15:39:02Z

NFaustino: /* Quellen */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

[[File:Payloadexample.png|650px]]

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

{| class="wikitable" style="margin:auto"
|-
! OMG Cable !! NinjaUSB
|-
| DuckyScript Payloads || Arduino IDE
|-
| Always simulates keyboard and mouse || Simulates either keyboard or mouse
|-
| Payloads are sent over a WiFi connection or when connecting the cable || Payloads are sent when connecting the cable, in a loop or with a remote
|-
| Does not need to be flashed when the payload changes || Needs to be flashed whenever the payload changes
|}

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/
* https://hackerwarehouse.com/product/usb-ninja-cable/
* http://192.168.4.1/omg.html.gz#
* https://o.mg.lol/setup/
* https://o-mg.github.io/WebFlasher/
* https://shop.hak5.org/products/omg-cable

[[Category:Documentation]]

USB Hacking

2023-02-01T15:38:30Z

NFaustino: /* Differences between the 2 cables */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

[[File:Payloadexample.png|650px]]

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

{| class="wikitable" style="margin:auto"
|-
! OMG Cable !! NinjaUSB
|-
| DuckyScript Payloads || Arduino IDE
|-
| Always simulates keyboard and mouse || Simulates either keyboard or mouse
|-
| Payloads are sent over a WiFi connection or when connecting the cable || Payloads are sent when connecting the cable, in a loop or with a remote
|-
| Does not need to be flashed when the payload changes || Needs to be flashed whenever the payload changes
|}

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/
* http://192.168.4.1/omg.html.gz#
* https://o.mg.lol/setup/
* https://o-mg.github.io/WebFlasher/
* https://shop.hak5.org/products/omg-cable

[[Category:Documentation]]

USB Hacking

2023-01-31T21:07:59Z

NFaustino: /* Quellen */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

[[File:Payloadexample.png|650px]]

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

[[File:DIfferences_Cables.png|500px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/
* http://192.168.4.1/omg.html.gz#
* https://o.mg.lol/setup/
* https://o-mg.github.io/WebFlasher/
* https://shop.hak5.org/products/omg-cable

[[Category:Documentation]]

USB Hacking

2023-01-31T21:07:01Z

NFaustino: /* Demonstration */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

[[File:Payloadexample.png|650px]]

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

[[File:DIfferences_Cables.png|500px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T21:06:27Z

NFaustino: /* Demonstration */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

Payloadexample.png

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

[[File:DIfferences_Cables.png|500px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

File:Payloadexample.png

2023-01-31T21:05:58Z

NFaustino:

USB Hacking

2023-01-31T21:02:23Z

NFaustino: /* Differences between the 2 cables */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

[[File:DIfferences_Cables.png|500px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T21:02:09Z

NFaustino: /* Differences between the 2 cables */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

[[File:DIfferences_Cables.png|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T21:01:40Z

NFaustino:

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Differences between the 2 cables ==

[[File:Differences_Cables.png|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

File:DIfferences Cables.png

2023-01-31T21:00:55Z

NFaustino:

USB Hacking

2023-01-31T19:43:27Z

NFaustino: /* Demonstration */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

To successfully deploy a payload. You need to write a DuckyScript or use the provided examples on the website. After writing a correct DuckyScript you can either save it in a slot to load it at another time, save it to "Boot" so it launches whenever it is connected to a device, or run it. "Run" sends the payload over the WiFi signal to the connected device, and executes it.
The following picture is an example for a DuckyScript Payload that opens "Firefox" and types in "Youtube.com".

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T19:39:48Z

NFaustino: /* O.MG Cable Setup */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer

[[File:OMG_SETUP_1.png|500px]]

=== Step 2 ===

With the provided information from the first step, you can connect to the WiFi Signal it sends out. With the name O.MG, and the Password "12345678"

[[File:WIFI_OMG.png|100px]]

=== Step 3 ===

Now you can connect to the DuckyScript interface with the provided address "192.168.4.1". There you can write the DuckyScript Payloads

[[File:OMG_SETUP_2.png|500px]]

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

Dein OMG Cable Angriff mit der Mail

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T19:36:15Z

NFaustino: /* O.MG Cable Setup */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

You need to flash the cable through the provided Web Flasher, using the OMG Cable Programmer.

=== Step 2 ===

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

Dein OMG Cable Angriff mit der Mail

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

File:WIFI OMG.png

2023-01-31T19:36:01Z

NFaustino:

File:OMG SETUP 2.png

2023-01-31T19:35:53Z

NFaustino:

File:OMG SETUP 1.png

2023-01-31T19:35:43Z

NFaustino:

USB Hacking

2023-01-31T19:32:52Z

NFaustino: /* O.MG Cable */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|200px]]

== O.MG Cable Setup ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

Dein OMG Cable Angriff mit der Mail

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

File:OMG CABLE.jpg

2023-01-31T19:32:24Z

NFaustino:

USB Hacking

2023-01-31T19:32:05Z

NFaustino: /* O.MG Cable */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

[[File:OMG_CABLE.jpg|650px]]

== O.MG Cable Setup ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

Dein OMG Cable Angriff mit der Mail

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T19:30:45Z

NFaustino: /* O.MG Cable */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==

The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

== O.MG Cable Setup ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

Dein OMG Cable Angriff mit der Mail

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

USB Hacking

2023-01-31T19:30:19Z

NFaustino: /* O.MG Cable */

== Introduction ==

USB attacks have become a significant threat to cyber security. To address this, various tools have been developed to aid in penetration testing and security assessments. The USBNinja cable and OMG cable are two such tools that allow for the execution of payloads when connected to a target device by mimicking a Human Interface Device (HID) such as a keyboard or mouse. These tools can be programmed using the Arduino Integrated Development Environment (IDE) which is user-friendly and straightforward. To prevent USB attacks, a combination of preventive measures such as the Malicious Cable Detector, HID protection approaches through software or hardware, and awareness training is recommended.

== O.MG Cable ==
The O.MG Cable is a hacking tool made by the organisation "Hak.5". It has the ability to send DuckyScript Payloads to the connected device. These Payloads are sent over a WiFi Connection. Additionally, there is a feature that enables the Payloads to be executed, whenever the cable is plugged into a device. The O.MG Cable simulates keyboard and mouse inputs.

== O.MG Cable Setup ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

== USBNinja Cable ==
[[File:USB-Ninja.jpg|650px]]

The USBNinja cable is a information security and penetration testing tool that allows the execution of payloads when the USB cable is connected by pretending to be a HID device such as a keyboard or mouse. Programming the cable is done through the Arduino IDE, making it a simple and user-friendly method for using USB Ninja.

== USBNinja Cable Setup ==

=== Step 1 ===

To start with the USB NINJA cable, it is necessary to first access the official website at https://usbninja.com/help/

[[File:USBNinja_1.jpeg|650px]]

=== Step 2 ===

Then, it is essential to strictly follow the steps described on the USBNinja website

[[File:USBNinja_2.jpeg|650px]]

=== Step 3 ===

After downloading the required boot driver and the Arduino IDE, it is imperative to run both as administrator to avoid future conflicts and then proceed with the installation

[[File:USBNinja_3.jpeg|488px]]

[[File:USBNinja_4.jpeg|325px]]

=== Step 4 ===

Next, in the Arduino IDE, go to "Preferences" and add the required link

[[File:USBNinja_5.jpeg|650px]]

=== Step 5 ===

The URL for downloading the required JSON file can be easily found on the USB Ninja website. The link simply specifies the location for the download.

[[File:USBNinja_6.jpeg|650px]]

=== Step 6 ===

Next, we will open the Board Manager within the Arduino IDE and download the required board for the NINJA cable

[[File:USBNinja_7.jpeg|325px]]

[[File:USBNinja_8.jpeg|650px]]

=== Step 7 ===

Finally, we simply select the previously downloaded board for the NINJA cable

[[File:USBNinja_9.jpeg|650px]]

== Demonstration ==

Dein OMG Cable Angriff mit der Mail

== Scenario ==

Imagine a hypothetical scenario: Our USB NINJA cable could pose potential dangers. Suppose someone is at an airport and wants to charge their laptop or smartphone. They find a public charging station with USB ports as well as accessible USB cables that can be connected to their laptop. Without thinking, the person connects the charging cable. As soon as the NINJA cable is connected, a threatening message appears on the screen, manipulating the user and causing them to follow the attacker's instructions. This is a typical attack through social engineering.

[[File:Threat_message.jpeg|650px]]

== Preventive measures ==

Preventive measures against malicious USB cables include the use of a Malicious Cable Detector. This device prevents data transfer through the USB cable while still allowing for charging. The LED on the detector lights up red when data transfer is blocked. There are also two approaches for protecting against HID (Human Interface Device) attacks, a software approach and a hardware approach. The software approach records keyboard activity through software and the hardware approach uses a separate device to record keyboard activity. Awareness training is also an important aspect of protecting against malicious USB cables and HID attacks.

== Quellen ==

* https://usbninja.com/help/

[[Category:Documentation]]

WikiLeaks

2023-01-07T15:12:59Z

NFaustino: /* References */

[[File:Wikileaks_logo.png|200px|thumb|right|WikiLeaks Logo]]

== Summary ==

This documentation is about WikiLeaks, media organization and Web site that functioned as a clearinghouse for unethical, illegal or otherwise privileged information. WikiLeaks was founded in 2006 by Australian computer programmer and activist Julian Assange.

== Awards ==
WikiLeaks, its publisher and its journalists have won many awards, including:

* The Economist New Media Award (2008)
* The Amnesty New Media Award (2009)
* TIME Magazine Person of the Year, People's Choice (highest global vote) (2010)
* The Sam Adams Award for Integrity (2010)
* The National Union of Journalists Journalist of the Year (Hrafnsson) (2011)
* The Sydney Peace Foundation Gold Medal (2011)
* The Martha Gellhorn Prize for Journalism (2011)
* The Blanquerna Award for Best Communicator (2011)
* The Walkley Award for Most Outstanding Contribution to Journalism (2011)
* The Voltaire Award for Free Speech (2011)
* The International Piero Passetti Journalism Prize of the National Union of Italian Journalists (2011)
* The Jose Couso Press Freedom Award (2011)
* The Privacy International Hero of Privacy (2012)
* The Global Exchange Human Rights People's Choice Award (2013)
* The Yoko Ono Lennon Courage Award for the Arts (2013)
* The Brazillian Press Association Human Rights Award (2013)
* The Kazakstan Union of Journalists Top Prize (2014)

As well as nominations for the UN Mandela Prize (2015) and nominations in six consecutive years for the Nobel Peace Prize (2010-2015)

== About ==

''“WikiLeaks is a giant library of the world's most persecuted documents. We give asylum to these documents, we analyze them, we promote them and we obtain more.”'' - Julian Assange, Der Spiegel Interview

=== The founder - Julian Assange ===
[[File:Julian_Assange.jpg|200px|thumb|right|Julian Assange]]

Assange gained his first programming experience on a Commodore 64 computer, and in 1987 he also acquired an Internet hub. He began his hacking activities under the pseudonym “Mendax” (Latin: noble liar). He and two other hackers formed a group called “International Subversives.” This activity led to the Australian Federal Police in 1991 In 1992, Julian Assange was found guilty of 24 counts of illegal hacking and the court ordered him to pay A 2,100 dollar and put him on probation. In 1995, Assange wrote his first free software, called Strobe.

During his hacker activities he became acquainted with his later wife. They moved together in 1989 and had a son. They divorced in 1991. In 1999, after a one-year legal dispute, Assange and her mother, Christine, reached joint custody of the child’s mother.

He has been involved with WikiLeaks since 2006. He claims to have made a living on the internet and is therefore able to work for WikiLeaks without pay. During his work on WikiLeaks, he was arrested, interrogated, censored and sued several times, all to no avail.

=== History ===

WikiLeaks is an international nonprofit organization. It publishes leaked government and other documents on the Internet that exposes an unethical, illegal case or process, while keeping its sources anonymous. The system that enables file uploads is implemented via the Tor anonymization network.
The website was launched in 2006, operated by The Sunshine Press. WikiLeaks claims that its founders were professionals from Chinese dissidents, journalists, mathematicians and start-ups who came to the organization from the United States, Europe, Taiwan, Australia and South Africa. Sweden was originally the site of the founding, and the public face was Australian exhacker Julian Assange.

According to the staff, the database of the site contained 1.2 million documents a year after its launch. The most echoed leaks were the nearly 92,000 military and similar secret documents related to the war in Afghanistan, the “Collateral Murder” video, the nearly 400,000 secret military reports released during the Iraq war, and 250,000 various messages sent by U.S. diplomats. Following the leak of diplomatic messages, the U.S. government launched a drive hunt against WikiLeaks, over and above Visa, Mastercard and PayPal refused to pass on donations to them.

=== Chronology ===

==== 2006 ====

The domain wikileaks.org is registered. The founders of Wikileaks, including Julian Assange, have made it their business to anonymously publish previously secret documents.

==== 2007 ====

Wikileaks is publishing documents for the first time and getting a bit of attention. Among other things, the founders put internal manuals from the US prison camp Guantanamo online. They prove the psychological torture methods used by the military. This year Julian Assange met his biggest supporter and partner, Daniel Domscheit-Berg.

==== 2010 ====

*Wikileaks lands its first big coup: video footage of a US military helicopter attacking civilians in 2007, including two reporters. The skepticism towards Wikileaks is still high.
*US soldier Chelsea Manning is arrested in Iraq. She is alleged to have leaked documents, including the video of the US attack on civilians in 2007, to Wikileaks.
*In cooperation with the British "The Guardian", the US American "New York Times" and the German "Spiegel", Wikileaks is going public with war documents: the "Afghan War Diaries" determine the news.
*Daniel Domscheit-Berg, German spokesman for Wikileaks, leaves the project in a dispute with Assange.
*Assange has been arrested in Sweden on charges of sexual assault and rape. He is wanted by Interpol, later arrested and released on bail. He is then under house arrest.
*The domain wikileaks.org is temporarily unavailable. Companies like Amazon, Paypal, Visa or Mastercard stop working with Wikileaks due to political pressure.
*In the meantime, the Wikileaks pages are "mirrored", so the content is stored as a copy on numerous servers around the world. However, no more documents can be uploaded.

==== 2011 ====

*"Der Freitag" reports a data leak at Wikileaks - for months all unprocessed US dispatches were freely accessible on the Internet, with all of the original senders. A British journalist's book contained the password to decrypt the file. In response, Wikileaks publishes all US cables on September 2nd, unprocessed.
*Wikileaks publishes the so-called SpyFiles and cooperates with the NDR for the first time.

==== 2012 ====

*Millions of emails from the US company Stratfor can be found in "The Global Intelligence Files" on Wikileaks. Partners, including the NDR, are given a preview of the data.
*After the British Supreme Court allowed Assange to be extradited to Sweden, the Wikileaks founder fled to the Ecuadorian embassy in London before being arrested. He applies for political asylum.

==== 2016 ====

*Whistleblower Chelsea Manning has been sentenced to 35 years in prison, among other things, for espionage.
*Wikileaks publishes emails from the account of John Podesta, campaign manager for Democratic presidential candidate Hillary Clinton. Representatives of the Clinton campaign accuse Wikileaks of promoting Russia's President Vladimir Putin. Ecuador then restricts Julian Assange's internet access for a while.
*Internal documents from the NSA committee of inquiry appear on Wikileaks.

==== 2017 ====

*US President Barack Obama pardons Chelsea Manning in one of his final acts.

==== 2018 ====

*It is revealed that the US is planning to bring charges against Julian Assange of treason. The proceedings in Sweden are now suspended.

==== 2019 ====

*Wikileaks publishes over 30000 documents from SAMHERJI and 2 other leaks came out this year
*Chelsea Manning is arrested again for refusing to testify in the Julian Assange trial.
*Julian Assange is arrested in London. Ecuador had previously withdrawn his diplomatic asylum and is allowing British police officers to enter the embassy. Scotland Yard confirms that the US has requested extradition against Assange.

==== 2021 ====

*WikiLeaks publishes "The Intolerance Network" over 17,000 documents from internationally active right wing campaigning organisations HazteOir and CitizenGO.
*"Julian Assange faces a 175 year prison sentence in the United States for publishing documents, including those which exposed wilful, or otherwise reckless, sabotage of climate action during prior climate change summits." - Wikileaks site

== Famous Leaks ==

* '''US Military Equipment in Afghanistan''' - The full equipment register of every US Army managed unit in Afghanistan from psychological operations ("PsyOps") and interrogation units to Kabul headquarters. [[[https://wikileaks.org//wiki/US_Military_Equipment_in_Afghanistan_(2007) US Military Equipment in Afghanistan]]]
* '''Collateral Murder''' - A classified US military video depicting the indiscriminate slaying of over a dozen people in the Iraqi suburb of New Baghdad — including two Reuters news staff. [[[https://collateralmurder.wikileaks.org Collateral Murder]]]
* '''Hillary Clinton Email Archive''' - A searchable archive for over 30 thousand emails & email attachments sent to and from Hillary Clinton's private email server while she was Secretary of State. [[[https://wikileaks.org//clinton-emails/ Hillary Clinton Email Archive]]]
* '''Sony Files''' - 30,287 documents from Sony Pictures Entertainment (SPE) and 173,132 emails to and from more than 2,200 SPE email addresses. [[[https://wikileaks.org//sony/emails/ Sony Files]]]
* '''CIA espionage orders for the 2012 French presidential election''' - All major French political parties were targeted for infiltration by the CIA's human and electronic spies in the seven months leading up to France's 2012 presidential election. [[[https://wikileaks.org//cia-france-elections-2012/ CIA France Elections]]]

== VAULT 7 - CIA Hacking Tools ==

=== Vault 7: CIA Hacking Tools Revealed ===
It is a series of leaks on the U.S. Central Intelligence Agency. Code-named "Vault 7" by WikiLeaks, it is the largest ever publication of confidential documents on the agency. It was leaked on March 7th 2017 and contains a couple million lines of code and about 8761 documents and files. Vault 7 consists of trojans, viruses and malware that infest Iphones, Android devices, Windows devices and Samsung TVs.[[[https://wikileaks.org/ciav7p1/ CIA Hacking Tools]]]

=== Zero Day Exploits ===
Furthermore Vault 7 contains so called "Zero Day" exploits. These are Attacks on completely unknown weaknesses of different devices. This is even more important, because devices like Iphones and Android phones can also be targeted. Zero day exploits have an obvious problem. If the manufacturer of the device does not know about the weakness, it cannot fix it, which can lead to it losing in the global market.

=== Who leaked Vault 7? ===
There are 2 people that are under suspicion when it comes to Vault 7. The founder Julian Assange and an ex-CIA programmer with the name Joshua Schulte. Joshua Schulte has apparently leaked the documents and files that are contained in Vault 7 and because of that is under arrest since 2022.

=== Vault 7 Tools ===
All VAULT7 Tools can be found on the WikiLeaks website. Here is a list of their names and a small description from the WikiLeaks site:
* '''Project Dark Matter''' - contains documentation for several CIA projects that infect Apple Mac Computer firmware
* '''Marble Framework''' - 676 source code files for the CIA's secret anti-forensic Marble Framework
* '''Grasshopper Framework''' - a platform used to build customized malware payloads for Microsoft Windows operating systems
* '''HIVE''' (There is a leak from 2017 called ''VAULT8: Hive'' which is a source code repository related to the CIA Project Hive)
* '''Weeping Angel''' - the User Guide for CIA's "Weeping Angel" tool - an implant designed for Samsung F Series Smart Televisions
* '''Scribbles''' - the documentation and source code for CIA's "Scribbles" project, a document-watermarking preprocessing system
* '''Archimedes''' - a tool used by the CIA to attack a computer inside a Local Area Network
* '''After Midnight and Assassin''' - "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform
* '''Athena''' - remote beacon and loader capabilities on target computers running Microsoft Windows
* '''Pandemic''' - a persistent implant for Microsoft Windows machines that share files in a local network
* '''Cherry Blossom''' - a means of monitoring the Internet activity of and performing software exploits on Targets of interest
* '''Brutal Kangaroo''' - targets closed networks by air gap jumping using thumbdrives
* '''Elsa''' - a geo-location malware for WiFi-enabled devices
* '''Outlaw Country''' - argets computers running the Linux operating system
* '''BothanSpy''' - designed to intercept and exfiltrate SSH credentials
* '''Highrise''' - an Android application designed to provide a redirector function for SMS
* '''UCL/Raytheon''' - documents from the CIA contractor Raytheon Blackbird Technologies for the "UMBRAGE Component Library" project
* '''Imperial''' - documents from the Imperial project of the CIA
* '''Dumbo''' - enabling a way to suspend processes utilizing webcams and corrupt any video recordings
* '''CouchPotato''' - the User Guide for the CoachPotato project of the CIA, a remote tool for collection against RTSP/H.264 video streams
* '''ExpressLane''' - documents from the cyber operations the CIA conducts against liaison services - which includes NSA, DHS and FBI.
* '''Angelfire''' - a persistent framework used to infect Microsoft Windows systems
* '''Protego''' - four secret documents from the Protego project of the CIA, along with 37 related manuals

=== Sonic Screwdriver ===
Sonic Screwdriver is an exploit contained in the project "Dark Matter". It was leaked on the 23rd, March 2017. With this attack the CIA is able to execute code from a connected device while a Mac device is booting. Usually this would need a firmware password, but this gets bypassed. For this exploit you need a Thunderbolt-to-Ethernet Adapter, an external USB-Drive or a CD/DVD-Drive and a Mac computer released between 2011 and 2012.
* '''Setup''' - The first step is to flash the adapter. This is done by booting an ISO file that is saved on a peripheral device and plugging it in combination with the thunderbolt-to-ethernet adapter into a Mac device. This will boot a FreeDos Operating System. There the command "B57UDIAG.exe -ppe x:\ss.rom" needs to be executed and the adapter is flashed. This adapter will look for a specific file path to execute from a USB or CD/DVD-Drive. This file path is "/EFI/BOOT/BOOTX64.efi". This filepath needs to be configured onto the before mentioned USB or CD/DVD-Drive.
* '''Execution''' - Now the thundebolt-to-ethernet adapter and the USB or the CD/DVD-Drive need to be connected to the target Mac device before it boots up. After the requirements are met, the adapter will automatically execute the BOOT64.efi file while the Mac computer boots up.

=== Weeping Angel ===
This attack was leaked on the 21th, april 2017 and is based on the "Extending Tool", that was developed together with the British Secret Service. This targets Samsung F Series Smart TVs. With this attack the built in microphone of the TV can be exploited to listen to conversations in real time or to record conversation and extract them per USB or Wi-Fi Hotspot. Futhermore it can put the TV into a fake off mode, to be even more hidden.
*''' Setup''' - First the Extending tool needs to be installed on a system. This tool consists of 2 folders: "Support" and "TV". The Support folder contains an unencrypted "Settings" file and tools for encryption, like an RSA key generator. The "TV" folder contains another folder named Update. The before mentioned tools need to be made executable first, with the commands "chmod +x encryptSettings" and "chmod +x rsakeygen". Now the RSA key generator needs to be executed with "./rsakeygen", which creates a key pair. This is used to encrypt the recorded conversations. With "nano settings.xml" configurations can be made for this attack. The important thing here is to set the public key so it can encrypt the recorded conversations. Lastly the encryptSettings tool needs to be executed with "./encryptSettings" and the output is a file named "config.xml.cmk". This file needs to be placed into the files.zip which is located in the previously mentioned "Update" folder.
[[File:WEEPING_ANGEL.png|border|500px]] 

* '''Execution''' - Now the whole Update folder needs to be saved into a USB device and connected to the TV. In the Smart Hub of the TV you can use the "More Apps" function to find the application "Update" and download it.

=== Highrise 2.0 ===
This attack was lead on the 13th, July 2017 and targets android devices. It is an application that is able to be installed on android devices with the version Android 4.0 to 4.3. Highrise 2.0 enables the attacker to redirect SMS messages, by creating an SMS Proxy that separates the device and the original receiver. This proxy can receive the outgoing messages of the device and redirect them to another user on the internet. Furthermore this application enabled the attacker to send messages to the receiver on the internet. To keep this attack hidden it hides itself on the android device with the name "TideCheck".
* '''Setup''' - This application can be downloaded from the internet, but the website is not available anymore. There was an older version of this exploit named "Highrise 1.4". If this was installed on the device before, it needs to be terminated. This is done by going into the settings and locating "TideCheck". Now the buttons "Force Stop", "Clear Data", and "Uninstall" need to be pressed in that exact order to uninstall the application. Now that all the requirements are met, Highrise 2.0 can be opened. Firstly it will prompt the attacker with password, which is "inshallah". Now 3 functions are displayed on the screen: "Initialize", "Show Configuration" and "Send Message". Initialize obviusly executes the the attack, which leads to the application being able to run in the background, whenever the android device is active. But before starting it the configurations need to be made. This is done by pressing the show configuration button. There are multiple options, but the 2 most important are the "Checkin Interval" and the "Server URL". For the Checkin Interval it is recommended to use 2-5 minutes and for the Server URL you need to set the receiver you want to redirect the SMS message to. The last function is the "send Message" button, which enables the attacker to send messages to the configured Server URL, for troubleshooting.
[[File:HIGHRISE.png|border|500px]]

== Security ==
* '''Sonic Screwdriver Prevention''' - Apple released a software update, that shuts down this attack on the 23rd, January 2017. With this update Mac devices no longer load optional ROMs while booting up. As the thunderbolt-to-ethernet adapter counts as an optional ROM it is not able to execute its filepath anymore, which leads to the attack being unable to be executed.
* '''Weeping Angel Prevention''' - The Extending tool has some limitations which are also specified in the documentation. First of all the voice recognition feature of the TV needs to be disabled for this exploit to work. So by simply enabling it it can cause troble for this attack. Furthermore it would be benefical for the user to turn of the internet connection to the TV, when it is not necessary.
* '''Highrise 2.0 Prevention''' - This exploit needs to be manually installed on the anroid device and cannot be remotely installed. Knowing this the user can simply uninstall the application, if it is found on the android device by using the method mentioned in the previous chapter "Highrise 2.0". Now the attacker would need to gain physical access to the device again.

== References ==

* WikiLeaks Logo: https://de.wikipedia.org/wiki/WikiLeaks
* https://wikileaks.org/What-is-WikiLeaks.html
* https://wikileaks.org/-News-.html
* https://wikileaks.org/-Leaks-.html
* https://www.britannica.com/topic/WikiLeaks
* https://www.ndr.de/fernsehen/sendungen/zapp/medienpolitik/Wikileaks-eine-Chronologie,wikileaks300.html
* https://support.apple.com/de-at/guide/security/secc80b0cd0c/web
* https://wikileaks.org/vault7/document/SonicScrewdriver_1p0/
* https://wikileaks.org/vault7/document/HighRise-2_0-Users_Guide/
* https://wikileaks.org/vault7/document/EXTENDING_User_Guide/
* https://coed.com/2017/03/08/weeping-angel-cia-hack-protection-guide-how-to-prevent-protect-samsung-tv-info/
* https://www.nytimes.com/2022/07/13/nyregion/cia-engineer-joshua-schulte-theft-convicted.html
* https://wikileaks.org/ciav7p1/

[[Category:Documentation]]

WikiLeaks

2023-01-07T15:09:51Z

NFaustino: /* Highrise 2.0 */

File:HIGHRISE.png

2023-01-07T15:09:09Z

NFaustino: Highrise 2.0 options

== Summary ==
Highrise 2.0 options

WikiLeaks

2023-01-07T15:06:57Z

NFaustino: /* Weeping Angel */

[[File:Wikileaks_logo.png|200px|thumb|right|WikiLeaks Logo]]

== Summary ==

This documentation is about WikiLeaks, media organization and Web site that functioned as a clearinghouse for unethical, illegal or otherwise privileged information. WikiLeaks was founded in 2006 by Australian computer programmer and activist Julian Assange.

== Awards ==
WikiLeaks, its publisher and its journalists have won many awards, including:

* The Economist New Media Award (2008)
* The Amnesty New Media Award (2009)
* TIME Magazine Person of the Year, People's Choice (highest global vote) (2010)
* The Sam Adams Award for Integrity (2010)
* The National Union of Journalists Journalist of the Year (Hrafnsson) (2011)
* The Sydney Peace Foundation Gold Medal (2011)
* The Martha Gellhorn Prize for Journalism (2011)
* The Blanquerna Award for Best Communicator (2011)
* The Walkley Award for Most Outstanding Contribution to Journalism (2011)
* The Voltaire Award for Free Speech (2011)
* The International Piero Passetti Journalism Prize of the National Union of Italian Journalists (2011)
* The Jose Couso Press Freedom Award (2011)
* The Privacy International Hero of Privacy (2012)
* The Global Exchange Human Rights People's Choice Award (2013)
* The Yoko Ono Lennon Courage Award for the Arts (2013)
* The Brazillian Press Association Human Rights Award (2013)
* The Kazakstan Union of Journalists Top Prize (2014)

As well as nominations for the UN Mandela Prize (2015) and nominations in six consecutive years for the Nobel Peace Prize (2010-2015)

== About ==

''“WikiLeaks is a giant library of the world's most persecuted documents. We give asylum to these documents, we analyze them, we promote them and we obtain more.”'' - Julian Assange, Der Spiegel Interview

=== The founder - Julian Assange ===
[[File:Julian_Assange.jpg|200px|thumb|right|Julian Assange]]

Assange gained his first programming experience on a Commodore 64 computer, and in 1987 he also acquired an Internet hub. He began his hacking activities under the pseudonym “Mendax” (Latin: noble liar). He and two other hackers formed a group called “International Subversives.” This activity led to the Australian Federal Police in 1991 In 1992, Julian Assange was found guilty of 24 counts of illegal hacking and the court ordered him to pay A 2,100 dollar and put him on probation. In 1995, Assange wrote his first free software, called Strobe.

During his hacker activities he became acquainted with his later wife. They moved together in 1989 and had a son. They divorced in 1991. In 1999, after a one-year legal dispute, Assange and her mother, Christine, reached joint custody of the child’s mother.

He has been involved with WikiLeaks since 2006. He claims to have made a living on the internet and is therefore able to work for WikiLeaks without pay. During his work on WikiLeaks, he was arrested, interrogated, censored and sued several times, all to no avail.

=== History ===

WikiLeaks is an international nonprofit organization. It publishes leaked government and other documents on the Internet that exposes an unethical, illegal case or process, while keeping its sources anonymous. The system that enables file uploads is implemented via the Tor anonymization network.
The website was launched in 2006, operated by The Sunshine Press. WikiLeaks claims that its founders were professionals from Chinese dissidents, journalists, mathematicians and start-ups who came to the organization from the United States, Europe, Taiwan, Australia and South Africa. Sweden was originally the site of the founding, and the public face was Australian exhacker Julian Assange.

According to the staff, the database of the site contained 1.2 million documents a year after its launch. The most echoed leaks were the nearly 92,000 military and similar secret documents related to the war in Afghanistan, the “Collateral Murder” video, the nearly 400,000 secret military reports released during the Iraq war, and 250,000 various messages sent by U.S. diplomats. Following the leak of diplomatic messages, the U.S. government launched a drive hunt against WikiLeaks, over and above Visa, Mastercard and PayPal refused to pass on donations to them.

=== Chronology ===

==== 2006 ====

The domain wikileaks.org is registered. The founders of Wikileaks, including Julian Assange, have made it their business to anonymously publish previously secret documents.

==== 2007 ====

Wikileaks is publishing documents for the first time and getting a bit of attention. Among other things, the founders put internal manuals from the US prison camp Guantanamo online. They prove the psychological torture methods used by the military. This year Julian Assange met his biggest supporter and partner, Daniel Domscheit-Berg.

==== 2010 ====

*Wikileaks lands its first big coup: video footage of a US military helicopter attacking civilians in 2007, including two reporters. The skepticism towards Wikileaks is still high.
*US soldier Chelsea Manning is arrested in Iraq. She is alleged to have leaked documents, including the video of the US attack on civilians in 2007, to Wikileaks.
*In cooperation with the British "The Guardian", the US American "New York Times" and the German "Spiegel", Wikileaks is going public with war documents: the "Afghan War Diaries" determine the news.
*Daniel Domscheit-Berg, German spokesman for Wikileaks, leaves the project in a dispute with Assange.
*Assange has been arrested in Sweden on charges of sexual assault and rape. He is wanted by Interpol, later arrested and released on bail. He is then under house arrest.
*The domain wikileaks.org is temporarily unavailable. Companies like Amazon, Paypal, Visa or Mastercard stop working with Wikileaks due to political pressure.
*In the meantime, the Wikileaks pages are "mirrored", so the content is stored as a copy on numerous servers around the world. However, no more documents can be uploaded.

==== 2011 ====

*"Der Freitag" reports a data leak at Wikileaks - for months all unprocessed US dispatches were freely accessible on the Internet, with all of the original senders. A British journalist's book contained the password to decrypt the file. In response, Wikileaks publishes all US cables on September 2nd, unprocessed.
*Wikileaks publishes the so-called SpyFiles and cooperates with the NDR for the first time.

==== 2012 ====

*Millions of emails from the US company Stratfor can be found in "The Global Intelligence Files" on Wikileaks. Partners, including the NDR, are given a preview of the data.
*After the British Supreme Court allowed Assange to be extradited to Sweden, the Wikileaks founder fled to the Ecuadorian embassy in London before being arrested. He applies for political asylum.

==== 2016 ====

*Whistleblower Chelsea Manning has been sentenced to 35 years in prison, among other things, for espionage.
*Wikileaks publishes emails from the account of John Podesta, campaign manager for Democratic presidential candidate Hillary Clinton. Representatives of the Clinton campaign accuse Wikileaks of promoting Russia's President Vladimir Putin. Ecuador then restricts Julian Assange's internet access for a while.
*Internal documents from the NSA committee of inquiry appear on Wikileaks.

==== 2017 ====

*US President Barack Obama pardons Chelsea Manning in one of his final acts.

==== 2018 ====

*It is revealed that the US is planning to bring charges against Julian Assange of treason. The proceedings in Sweden are now suspended.

==== 2019 ====

*Wikileaks publishes over 30000 documents from SAMHERJI and 2 other leaks came out this year
*Chelsea Manning is arrested again for refusing to testify in the Julian Assange trial.
*Julian Assange is arrested in London. Ecuador had previously withdrawn his diplomatic asylum and is allowing British police officers to enter the embassy. Scotland Yard confirms that the US has requested extradition against Assange.

==== 2021 ====

*WikiLeaks publishes "The Intolerance Network" over 17,000 documents from internationally active right wing campaigning organisations HazteOir and CitizenGO.
*"Julian Assange faces a 175 year prison sentence in the United States for publishing documents, including those which exposed wilful, or otherwise reckless, sabotage of climate action during prior climate change summits." - Wikileaks site

== Famous Leaks ==

* '''US Military Equipment in Afghanistan''' - The full equipment register of every US Army managed unit in Afghanistan from psychological operations ("PsyOps") and interrogation units to Kabul headquarters. [[[https://wikileaks.org//wiki/US_Military_Equipment_in_Afghanistan_(2007) US Military Equipment in Afghanistan]]]
* '''Collateral Murder''' - A classified US military video depicting the indiscriminate slaying of over a dozen people in the Iraqi suburb of New Baghdad — including two Reuters news staff. [[[https://collateralmurder.wikileaks.org Collateral Murder]]]
* '''Hillary Clinton Email Archive''' - A searchable archive for over 30 thousand emails & email attachments sent to and from Hillary Clinton's private email server while she was Secretary of State. [[[https://wikileaks.org//clinton-emails/ Hillary Clinton Email Archive]]]
* '''Sony Files''' - 30,287 documents from Sony Pictures Entertainment (SPE) and 173,132 emails to and from more than 2,200 SPE email addresses. [[[https://wikileaks.org//sony/emails/ Sony Files]]]
* '''CIA espionage orders for the 2012 French presidential election''' - All major French political parties were targeted for infiltration by the CIA's human and electronic spies in the seven months leading up to France's 2012 presidential election. [[[https://wikileaks.org//cia-france-elections-2012/ CIA France Elections]]]

== VAULT 7 - CIA Hacking Tools ==

=== Vault 7: CIA Hacking Tools Revealed ===
It is a series of leaks on the U.S. Central Intelligence Agency. Code-named "Vault 7" by WikiLeaks, it is the largest ever publication of confidential documents on the agency. It was leaked on March 7th 2017 and contains a couple million lines of code and about 8761 documents and files. Vault 7 consists of trojans, viruses and malware that infest Iphones, Android devices, Windows devices and Samsung TVs.[[[https://wikileaks.org/ciav7p1/ CIA Hacking Tools]]]

=== Zero Day Exploits ===
Furthermore Vault 7 contains so called "Zero Day" exploits. These are Attacks on completely unknown weaknesses of different devices. This is even more important, because devices like Iphones and Android phones can also be targeted. Zero day exploits have an obvious problem. If the manufacturer of the device does not know about the weakness, it cannot fix it, which can lead to it losing in the global market.

=== Who leaked Vault 7? ===
There are 2 people that are under suspicion when it comes to Vault 7. The founder Julian Assange and an ex-CIA programmer with the name Joshua Schulte. Joshua Schulte has apparently leaked the documents and files that are contained in Vault 7 and because of that is under arrest since 2022.

=== Vault 7 Tools ===
All VAULT7 Tools can be found on the WikiLeaks website. Here is a list of their names and a small description from the WikiLeaks site:
* '''Project Dark Matter''' - contains documentation for several CIA projects that infect Apple Mac Computer firmware
* '''Marble Framework''' - 676 source code files for the CIA's secret anti-forensic Marble Framework
* '''Grasshopper Framework''' - a platform used to build customized malware payloads for Microsoft Windows operating systems
* '''HIVE''' (There is a leak from 2017 called ''VAULT8: Hive'' which is a source code repository related to the CIA Project Hive)
* '''Weeping Angel''' - the User Guide for CIA's "Weeping Angel" tool - an implant designed for Samsung F Series Smart Televisions
* '''Scribbles''' - the documentation and source code for CIA's "Scribbles" project, a document-watermarking preprocessing system
* '''Archimedes''' - a tool used by the CIA to attack a computer inside a Local Area Network
* '''After Midnight and Assassin''' - "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform
* '''Athena''' - remote beacon and loader capabilities on target computers running Microsoft Windows
* '''Pandemic''' - a persistent implant for Microsoft Windows machines that share files in a local network
* '''Cherry Blossom''' - a means of monitoring the Internet activity of and performing software exploits on Targets of interest
* '''Brutal Kangaroo''' - targets closed networks by air gap jumping using thumbdrives
* '''Elsa''' - a geo-location malware for WiFi-enabled devices
* '''Outlaw Country''' - argets computers running the Linux operating system
* '''BothanSpy''' - designed to intercept and exfiltrate SSH credentials
* '''Highrise''' - an Android application designed to provide a redirector function for SMS
* '''UCL/Raytheon''' - documents from the CIA contractor Raytheon Blackbird Technologies for the "UMBRAGE Component Library" project
* '''Imperial''' - documents from the Imperial project of the CIA
* '''Dumbo''' - enabling a way to suspend processes utilizing webcams and corrupt any video recordings
* '''CouchPotato''' - the User Guide for the CoachPotato project of the CIA, a remote tool for collection against RTSP/H.264 video streams
* '''ExpressLane''' - documents from the cyber operations the CIA conducts against liaison services - which includes NSA, DHS and FBI.
* '''Angelfire''' - a persistent framework used to infect Microsoft Windows systems
* '''Protego''' - four secret documents from the Protego project of the CIA, along with 37 related manuals

=== Sonic Screwdriver ===
Sonic Screwdriver is an exploit contained in the project "Dark Matter". It was leaked on the 23rd, March 2017. With this attack the CIA is able to execute code from a connected device while a Mac device is booting. Usually this would need a firmware password, but this gets bypassed. For this exploit you need a Thunderbolt-to-Ethernet Adapter, an external USB-Drive or a CD/DVD-Drive and a Mac computer released between 2011 and 2012.
* '''Setup''' - The first step is to flash the adapter. This is done by booting an ISO file that is saved on a peripheral device and plugging it in combination with the thunderbolt-to-ethernet adapter into a Mac device. This will boot a FreeDos Operating System. There the command "B57UDIAG.exe -ppe x:\ss.rom" needs to be executed and the adapter is flashed. This adapter will look for a specific file path to execute from a USB or CD/DVD-Drive. This file path is "/EFI/BOOT/BOOTX64.efi". This filepath needs to be configured onto the before mentioned USB or CD/DVD-Drive.
* '''Execution''' - Now the thundebolt-to-ethernet adapter and the USB or the CD/DVD-Drive need to be connected to the target Mac device before it boots up. After the requirements are met, the adapter will automatically execute the BOOT64.efi file while the Mac computer boots up.

=== Weeping Angel ===
This attack was leaked on the 21th, april 2017 and is based on the "Extending Tool", that was developed together with the British Secret Service. This targets Samsung F Series Smart TVs. With this attack the built in microphone of the TV can be exploited to listen to conversations in real time or to record conversation and extract them per USB or Wi-Fi Hotspot. Futhermore it can put the TV into a fake off mode, to be even more hidden.
*''' Setup''' - First the Extending tool needs to be installed on a system. This tool consists of 2 folders: "Support" and "TV". The Support folder contains an unencrypted "Settings" file and tools for encryption, like an RSA key generator. The "TV" folder contains another folder named Update. The before mentioned tools need to be made executable first, with the commands "chmod +x encryptSettings" and "chmod +x rsakeygen". Now the RSA key generator needs to be executed with "./rsakeygen", which creates a key pair. This is used to encrypt the recorded conversations. With "nano settings.xml" configurations can be made for this attack. The important thing here is to set the public key so it can encrypt the recorded conversations. Lastly the encryptSettings tool needs to be executed with "./encryptSettings" and the output is a file named "config.xml.cmk". This file needs to be placed into the files.zip which is located in the previously mentioned "Update" folder.
[[File:WEEPING_ANGEL.png|border|500px]] 

* '''Execution''' - Now the whole Update folder needs to be saved into a USB device and connected to the TV. In the Smart Hub of the TV you can use the "More Apps" function to find the application "Update" and download it.

=== Highrise 2.0 ===
This attack was lead on the 13th, July 2017 and targets android devices. It is an application that is able to be installed on android devices with the version Android 4.0 to 4.3. Highrise 2.0 enables the attacker to redirect SMS messages, by creating an SMS Proxy that separates the device and the original receiver. This proxy can receive the outgoing messages of the device and redirect them to another user on the internet. Furthermore this application enabled the attacker to send messages to the receiver on the internet. To keep this attack hidden it hides itself on the android device with the name "TideCheck".
* '''Setup''' - This application can be downloaded from the internet, but the website is not available anymore. There was an older version of this exploit named "Highrise 1.4". If this was installed on the device before, it needs to be terminated. This is done by going into the settings and locating "TideCheck". Now the buttons "Force Stop", "Clear Data", and "Uninstall" need to be pressed in that exact order to uninstall the application. Now that all the requirements are met, Highrise 2.0 can be opened. Firstly it will prompt the attacker with password, which is "inshallah". Now 3 functions are displayed on the screen: "Initialize", "Show Configuration" and "Send Message". Initialize obviusly executes the the attack, which leads to the application being able to run in the background, whenever the android device is active. But before starting it the configurations need to be made. This is done by pressing the show configuration button. There are multiple options, but the 2 most important are the "Checkin Interval" and the "Server URL". For the Checkin Interval it is recommended to use 2-5 minutes and for the Server URL you need to set the receiver you want to redirect the SMS message to. The last function is the "send Message" button, which enables the attacker to send messages to the configured Server URL, for troubleshooting.

== Security ==
* '''Sonic Screwdriver Prevention''' - Apple released a software update, that shuts down this attack on the 23rd, January 2017. With this update Mac devices no longer load optional ROMs while booting up. As the thunderbolt-to-ethernet adapter counts as an optional ROM it is not able to execute its filepath anymore, which leads to the attack being unable to be executed.
* '''Weeping Angel Prevention''' - The Extending tool has some limitations which are also specified in the documentation. First of all the voice recognition feature of the TV needs to be disabled for this exploit to work. So by simply enabling it it can cause troble for this attack. Furthermore it would be benefical for the user to turn of the internet connection to the TV, when it is not necessary.
* '''Highrise 2.0 Prevention''' - This exploit needs to be manually installed on the anroid device and cannot be remotely installed. Knowing this the user can simply uninstall the application, if it is found on the android device by using the method mentioned in the previous chapter "Highrise 2.0". Now the attacker would need to gain physical access to the device again.

== References ==

* WikiLeaks Logo: https://de.wikipedia.org/wiki/WikiLeaks
* https://wikileaks.org/What-is-WikiLeaks.html
* https://wikileaks.org/-News-.html
* https://wikileaks.org/-Leaks-.html
* https://www.britannica.com/topic/WikiLeaks
* https://www.ndr.de/fernsehen/sendungen/zapp/medienpolitik/Wikileaks-eine-Chronologie,wikileaks300.html

[[Category:Documentation]]

File:WEEPING ANGEL.png

2023-01-07T15:05:49Z

NFaustino: Weeping Angel commands

== Summary ==
Weeping Angel commands

WikiLeaks

2023-01-07T15:02:28Z

NFaustino: /* VAULT 7 - CIA Hacking Tools */

[[File:Wikileaks_logo.png|200px|thumb|right|WikiLeaks Logo]]

== Summary ==

This documentation is about WikiLeaks, media organization and Web site that functioned as a clearinghouse for unethical, illegal or otherwise privileged information. WikiLeaks was founded in 2006 by Australian computer programmer and activist Julian Assange.

== Awards ==
WikiLeaks, its publisher and its journalists have won many awards, including:

* The Economist New Media Award (2008)
* The Amnesty New Media Award (2009)
* TIME Magazine Person of the Year, People's Choice (highest global vote) (2010)
* The Sam Adams Award for Integrity (2010)
* The National Union of Journalists Journalist of the Year (Hrafnsson) (2011)
* The Sydney Peace Foundation Gold Medal (2011)
* The Martha Gellhorn Prize for Journalism (2011)
* The Blanquerna Award for Best Communicator (2011)
* The Walkley Award for Most Outstanding Contribution to Journalism (2011)
* The Voltaire Award for Free Speech (2011)
* The International Piero Passetti Journalism Prize of the National Union of Italian Journalists (2011)
* The Jose Couso Press Freedom Award (2011)
* The Privacy International Hero of Privacy (2012)
* The Global Exchange Human Rights People's Choice Award (2013)
* The Yoko Ono Lennon Courage Award for the Arts (2013)
* The Brazillian Press Association Human Rights Award (2013)
* The Kazakstan Union of Journalists Top Prize (2014)

As well as nominations for the UN Mandela Prize (2015) and nominations in six consecutive years for the Nobel Peace Prize (2010-2015)

== About ==

''“WikiLeaks is a giant library of the world's most persecuted documents. We give asylum to these documents, we analyze them, we promote them and we obtain more.”'' - Julian Assange, Der Spiegel Interview

=== The founder - Julian Assange ===
[[File:Julian_Assange.jpg|200px|thumb|right|Julian Assange]]

Assange gained his first programming experience on a Commodore 64 computer, and in 1987 he also acquired an Internet hub. He began his hacking activities under the pseudonym “Mendax” (Latin: noble liar). He and two other hackers formed a group called “International Subversives.” This activity led to the Australian Federal Police in 1991 In 1992, Julian Assange was found guilty of 24 counts of illegal hacking and the court ordered him to pay A 2,100 dollar and put him on probation. In 1995, Assange wrote his first free software, called Strobe.

During his hacker activities he became acquainted with his later wife. They moved together in 1989 and had a son. They divorced in 1991. In 1999, after a one-year legal dispute, Assange and her mother, Christine, reached joint custody of the child’s mother.

He has been involved with WikiLeaks since 2006. He claims to have made a living on the internet and is therefore able to work for WikiLeaks without pay. During his work on WikiLeaks, he was arrested, interrogated, censored and sued several times, all to no avail.

=== History ===

WikiLeaks is an international nonprofit organization. It publishes leaked government and other documents on the Internet that exposes an unethical, illegal case or process, while keeping its sources anonymous. The system that enables file uploads is implemented via the Tor anonymization network.
The website was launched in 2006, operated by The Sunshine Press. WikiLeaks claims that its founders were professionals from Chinese dissidents, journalists, mathematicians and start-ups who came to the organization from the United States, Europe, Taiwan, Australia and South Africa. Sweden was originally the site of the founding, and the public face was Australian exhacker Julian Assange.

According to the staff, the database of the site contained 1.2 million documents a year after its launch. The most echoed leaks were the nearly 92,000 military and similar secret documents related to the war in Afghanistan, the “Collateral Murder” video, the nearly 400,000 secret military reports released during the Iraq war, and 250,000 various messages sent by U.S. diplomats. Following the leak of diplomatic messages, the U.S. government launched a drive hunt against WikiLeaks, over and above Visa, Mastercard and PayPal refused to pass on donations to them.

=== Chronology ===

==== 2006 ====

The domain wikileaks.org is registered. The founders of Wikileaks, including Julian Assange, have made it their business to anonymously publish previously secret documents.

==== 2007 ====

Wikileaks is publishing documents for the first time and getting a bit of attention. Among other things, the founders put internal manuals from the US prison camp Guantanamo online. They prove the psychological torture methods used by the military. This year Julian Assange met his biggest supporter and partner, Daniel Domscheit-Berg.

==== 2010 ====

*Wikileaks lands its first big coup: video footage of a US military helicopter attacking civilians in 2007, including two reporters. The skepticism towards Wikileaks is still high.
*US soldier Chelsea Manning is arrested in Iraq. She is alleged to have leaked documents, including the video of the US attack on civilians in 2007, to Wikileaks.
*In cooperation with the British "The Guardian", the US American "New York Times" and the German "Spiegel", Wikileaks is going public with war documents: the "Afghan War Diaries" determine the news.
*Daniel Domscheit-Berg, German spokesman for Wikileaks, leaves the project in a dispute with Assange.
*Assange has been arrested in Sweden on charges of sexual assault and rape. He is wanted by Interpol, later arrested and released on bail. He is then under house arrest.
*The domain wikileaks.org is temporarily unavailable. Companies like Amazon, Paypal, Visa or Mastercard stop working with Wikileaks due to political pressure.
*In the meantime, the Wikileaks pages are "mirrored", so the content is stored as a copy on numerous servers around the world. However, no more documents can be uploaded.

==== 2011 ====

*"Der Freitag" reports a data leak at Wikileaks - for months all unprocessed US dispatches were freely accessible on the Internet, with all of the original senders. A British journalist's book contained the password to decrypt the file. In response, Wikileaks publishes all US cables on September 2nd, unprocessed.
*Wikileaks publishes the so-called SpyFiles and cooperates with the NDR for the first time.

==== 2012 ====

*Millions of emails from the US company Stratfor can be found in "The Global Intelligence Files" on Wikileaks. Partners, including the NDR, are given a preview of the data.
*After the British Supreme Court allowed Assange to be extradited to Sweden, the Wikileaks founder fled to the Ecuadorian embassy in London before being arrested. He applies for political asylum.

==== 2016 ====

*Whistleblower Chelsea Manning has been sentenced to 35 years in prison, among other things, for espionage.
*Wikileaks publishes emails from the account of John Podesta, campaign manager for Democratic presidential candidate Hillary Clinton. Representatives of the Clinton campaign accuse Wikileaks of promoting Russia's President Vladimir Putin. Ecuador then restricts Julian Assange's internet access for a while.
*Internal documents from the NSA committee of inquiry appear on Wikileaks.

==== 2017 ====

*US President Barack Obama pardons Chelsea Manning in one of his final acts.

==== 2018 ====

*It is revealed that the US is planning to bring charges against Julian Assange of treason. The proceedings in Sweden are now suspended.

==== 2019 ====

*Wikileaks publishes over 30000 documents from SAMHERJI and 2 other leaks came out this year
*Chelsea Manning is arrested again for refusing to testify in the Julian Assange trial.
*Julian Assange is arrested in London. Ecuador had previously withdrawn his diplomatic asylum and is allowing British police officers to enter the embassy. Scotland Yard confirms that the US has requested extradition against Assange.

==== 2021 ====

*WikiLeaks publishes "The Intolerance Network" over 17,000 documents from internationally active right wing campaigning organisations HazteOir and CitizenGO.
*"Julian Assange faces a 175 year prison sentence in the United States for publishing documents, including those which exposed wilful, or otherwise reckless, sabotage of climate action during prior climate change summits." - Wikileaks site

== Famous Leaks ==

* '''US Military Equipment in Afghanistan''' - The full equipment register of every US Army managed unit in Afghanistan from psychological operations ("PsyOps") and interrogation units to Kabul headquarters. [[[https://wikileaks.org//wiki/US_Military_Equipment_in_Afghanistan_(2007) US Military Equipment in Afghanistan]]]
* '''Collateral Murder''' - A classified US military video depicting the indiscriminate slaying of over a dozen people in the Iraqi suburb of New Baghdad — including two Reuters news staff. [[[https://collateralmurder.wikileaks.org Collateral Murder]]]
* '''Hillary Clinton Email Archive''' - A searchable archive for over 30 thousand emails & email attachments sent to and from Hillary Clinton's private email server while she was Secretary of State. [[[https://wikileaks.org//clinton-emails/ Hillary Clinton Email Archive]]]
* '''Sony Files''' - 30,287 documents from Sony Pictures Entertainment (SPE) and 173,132 emails to and from more than 2,200 SPE email addresses. [[[https://wikileaks.org//sony/emails/ Sony Files]]]
* '''CIA espionage orders for the 2012 French presidential election''' - All major French political parties were targeted for infiltration by the CIA's human and electronic spies in the seven months leading up to France's 2012 presidential election. [[[https://wikileaks.org//cia-france-elections-2012/ CIA France Elections]]]

== VAULT 7 - CIA Hacking Tools ==

=== Vault 7: CIA Hacking Tools Revealed ===
It is a series of leaks on the U.S. Central Intelligence Agency. Code-named "Vault 7" by WikiLeaks, it is the largest ever publication of confidential documents on the agency. It was leaked on March 7th 2017 and contains a couple million lines of code and about 8761 documents and files. Vault 7 consists of trojans, viruses and malware that infest Iphones, Android devices, Windows devices and Samsung TVs.[[[https://wikileaks.org/ciav7p1/ CIA Hacking Tools]]]

=== Zero Day Exploits ===
Furthermore Vault 7 contains so called "Zero Day" exploits. These are Attacks on completely unknown weaknesses of different devices. This is even more important, because devices like Iphones and Android phones can also be targeted. Zero day exploits have an obvious problem. If the manufacturer of the device does not know about the weakness, it cannot fix it, which can lead to it losing in the global market.

=== Who leaked Vault 7? ===
There are 2 people that are under suspicion when it comes to Vault 7. The founder Julian Assange and an ex-CIA programmer with the name Joshua Schulte. Joshua Schulte has apparently leaked the documents and files that are contained in Vault 7 and because of that is under arrest since 2022.

=== Vault 7 Tools ===
All VAULT7 Tools can be found on the WikiLeaks website. Here is a list of their names and a small description from the WikiLeaks site:
* '''Project Dark Matter''' - contains documentation for several CIA projects that infect Apple Mac Computer firmware
* '''Marble Framework''' - 676 source code files for the CIA's secret anti-forensic Marble Framework
* '''Grasshopper Framework''' - a platform used to build customized malware payloads for Microsoft Windows operating systems
* '''HIVE''' (There is a leak from 2017 called ''VAULT8: Hive'' which is a source code repository related to the CIA Project Hive)
* '''Weeping Angel''' - the User Guide for CIA's "Weeping Angel" tool - an implant designed for Samsung F Series Smart Televisions
* '''Scribbles''' - the documentation and source code for CIA's "Scribbles" project, a document-watermarking preprocessing system
* '''Archimedes''' - a tool used by the CIA to attack a computer inside a Local Area Network
* '''After Midnight and Assassin''' - "AfterMidnight" and "Assassin", two CIA malware frameworks for the Microsoft Windows platform
* '''Athena''' - remote beacon and loader capabilities on target computers running Microsoft Windows
* '''Pandemic''' - a persistent implant for Microsoft Windows machines that share files in a local network
* '''Cherry Blossom''' - a means of monitoring the Internet activity of and performing software exploits on Targets of interest
* '''Brutal Kangaroo''' - targets closed networks by air gap jumping using thumbdrives
* '''Elsa''' - a geo-location malware for WiFi-enabled devices
* '''Outlaw Country''' - argets computers running the Linux operating system
* '''BothanSpy''' - designed to intercept and exfiltrate SSH credentials
* '''Highrise''' - an Android application designed to provide a redirector function for SMS
* '''UCL/Raytheon''' - documents from the CIA contractor Raytheon Blackbird Technologies for the "UMBRAGE Component Library" project
* '''Imperial''' - documents from the Imperial project of the CIA
* '''Dumbo''' - enabling a way to suspend processes utilizing webcams and corrupt any video recordings
* '''CouchPotato''' - the User Guide for the CoachPotato project of the CIA, a remote tool for collection against RTSP/H.264 video streams
* '''ExpressLane''' - documents from the cyber operations the CIA conducts against liaison services - which includes NSA, DHS and FBI.
* '''Angelfire''' - a persistent framework used to infect Microsoft Windows systems
* '''Protego''' - four secret documents from the Protego project of the CIA, along with 37 related manuals

=== Sonic Screwdriver ===
Sonic Screwdriver is an exploit contained in the project "Dark Matter". It was leaked on the 23rd, March 2017. With this attack the CIA is able to execute code from a connected device while a Mac device is booting. Usually this would need a firmware password, but this gets bypassed. For this exploit you need a Thunderbolt-to-Ethernet Adapter, an external USB-Drive or a CD/DVD-Drive and a Mac computer released between 2011 and 2012.
* '''Setup''' - The first step is to flash the adapter. This is done by booting an ISO file that is saved on a peripheral device and plugging it in combination with the thunderbolt-to-ethernet adapter into a Mac device. This will boot a FreeDos Operating System. There the command "B57UDIAG.exe -ppe x:\ss.rom" needs to be executed and the adapter is flashed. This adapter will look for a specific file path to execute from a USB or CD/DVD-Drive. This file path is "/EFI/BOOT/BOOTX64.efi". This filepath needs to be configured onto the before mentioned USB or CD/DVD-Drive.
* '''Execution''' - Now the thundebolt-to-ethernet adapter and the USB or the CD/DVD-Drive need to be connected to the target Mac device before it boots up. After the requirements are met, the adapter will automatically execute the BOOT64.efi file while the Mac computer boots up.

=== Weeping Angel ===
This attack was leaked on the 21th, april 2017 and is based on the "Extending Tool", that was developed together with the British Secret Service. This targets Samsung F Series Smart TVs. With this attack the built in microphone of the TV can be exploited to listen to conversations in real time or to record conversation and extract them per USB or Wi-Fi Hotspot. Futhermore it can put the TV into a fake off mode, to be even more hidden.
*''' Setup''' - First the Extending tool needs to be installed on a system. This tool consists of 2 folders: "Support" and "TV". The Support folder contains an unencrypted "Settings" file and tools for encryption, like an RSA key generator. The "TV" folder contains another folder named Update. The before mentioned tools need to be made executable first, with the commands "chmod +x encryptSettings" and "chmod +x rsakeygen". Now the RSA key generator needs to be executed with "./rsakeygen", which creates a key pair. This is used to encrypt the recorded conversations. With "nano settings.xml" configurations can be made for this attack. The important thing here is to set the public key so it can encrypt the recorded conversations. Lastly the encryptSettings tool needs to be executed with "./encryptSettings" and the output is a file named "config.xml.cmk". This file needs to be placed into the files.zip which is located in the previously mentioned "Update" folder.
* '''Execution''' - Now the whole Update folder needs to be saved into a USB device and connected to the TV. In the Smart Hub of the TV you can use the "More Apps" function to find the application "Update" and download it.

=== Highrise 2.0 ===
This attack was lead on the 13th, July 2017 and targets android devices. It is an application that is able to be installed on android devices with the version Android 4.0 to 4.3. Highrise 2.0 enables the attacker to redirect SMS messages, by creating an SMS Proxy that separates the device and the original receiver. This proxy can receive the outgoing messages of the device and redirect them to another user on the internet. Furthermore this application enabled the attacker to send messages to the receiver on the internet. To keep this attack hidden it hides itself on the android device with the name "TideCheck".
* '''Setup''' - This application can be downloaded from the internet, but the website is not available anymore. There was an older version of this exploit named "Highrise 1.4". If this was installed on the device before, it needs to be terminated. This is done by going into the settings and locating "TideCheck". Now the buttons "Force Stop", "Clear Data", and "Uninstall" need to be pressed in that exact order to uninstall the application. Now that all the requirements are met, Highrise 2.0 can be opened. Firstly it will prompt the attacker with password, which is "inshallah". Now 3 functions are displayed on the screen: "Initialize", "Show Configuration" and "Send Message". Initialize obviusly executes the the attack, which leads to the application being able to run in the background, whenever the android device is active. But before starting it the configurations need to be made. This is done by pressing the show configuration button. There are multiple options, but the 2 most important are the "Checkin Interval" and the "Server URL". For the Checkin Interval it is recommended to use 2-5 minutes and for the Server URL you need to set the receiver you want to redirect the SMS message to. The last function is the "send Message" button, which enables the attacker to send messages to the configured Server URL, for troubleshooting.

== Security ==
* '''Sonic Screwdriver Prevention''' - Apple released a software update, that shuts down this attack on the 23rd, January 2017. With this update Mac devices no longer load optional ROMs while booting up. As the thunderbolt-to-ethernet adapter counts as an optional ROM it is not able to execute its filepath anymore, which leads to the attack being unable to be executed.
* '''Weeping Angel Prevention''' - The Extending tool has some limitations which are also specified in the documentation. First of all the voice recognition feature of the TV needs to be disabled for this exploit to work. So by simply enabling it it can cause troble for this attack. Furthermore it would be benefical for the user to turn of the internet connection to the TV, when it is not necessary.
* '''Highrise 2.0 Prevention''' - This exploit needs to be manually installed on the anroid device and cannot be remotely installed. Knowing this the user can simply uninstall the application, if it is found on the android device by using the method mentioned in the previous chapter "Highrise 2.0". Now the attacker would need to gain physical access to the device again.

== References ==

* WikiLeaks Logo: https://de.wikipedia.org/wiki/WikiLeaks
* https://wikileaks.org/What-is-WikiLeaks.html
* https://wikileaks.org/-News-.html
* https://wikileaks.org/-Leaks-.html
* https://www.britannica.com/topic/WikiLeaks
* https://www.ndr.de/fernsehen/sendungen/zapp/medienpolitik/Wikileaks-eine-Chronologie,wikileaks300.html

[[Category:Documentation]]

IP Cameras Pentesting Report

2022-07-14T12:20:00Z

NFaustino: /* Exploitation */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==
First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.
After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.
[[File:HTTP.jpg]] 
Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool. 
[[File:Base64.jpg]] 

Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

Risk:
The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

Countermeasure:
The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.
Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com
*https://www.invicti.com/blog/web-security/http-security-headers/
*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
*https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications
*https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera

[[Category:Pentesting]]

File:Base64.jpg

2022-07-14T12:19:34Z

NFaustino: NFaustino uploaded a new version of File:Base64.jpg

IP Cameras Pentesting Report

2022-07-14T12:18:07Z

NFaustino: /* Exploitation */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==
First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.
After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.
[[File:HTTP.jpg]] 
Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.
[[File:Base64.jpg]] 

Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

Risk:
The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

Countermeasure:
The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.
Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com
*https://www.invicti.com/blog/web-security/http-security-headers/
*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
*https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications
*https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera

[[Category:Pentesting]]

File:Base64.jpg

2022-07-14T12:17:28Z

NFaustino:

IP Cameras Pentesting Report

2022-07-14T12:16:40Z

NFaustino: /* Exploitation */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==
First of all, to exploit the vunerability we have discovered for the TP-LINK camera, you have to be in the same network as the target machine.
After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user.
[[File:HTTP.jpg]] 
Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.

Now with all the data we have collected as the attacker, you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observe the victim any time. Furthermore, you have the access to all the other additional functions that the camera provides.

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

Risk:
The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

Countermeasure:
The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.
Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com
*https://www.invicti.com/blog/web-security/http-security-headers/
*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
*https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications
*https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera

[[Category:Pentesting]]

File:HTTP.jpg

2022-07-14T12:15:13Z

NFaustino:

IP Cameras Pentesting Report

2022-07-13T19:13:07Z

NFaustino: /* Exploitation */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==
First of all, to exploit the vunerability we have discovered for the TP_Link camera, you have to be in the same network as the target machine.
After, we found out the correct IP address of the target device, we basically did the man in the middle attack and arp spoofing. We as the attacker claimed to be the gateway for the target machine and the same the other way around. After that, we captured the data with Wireshark, between the two components. For this to work you have to capture in the same moment as the login process of the user. Because of the HTTP vulnerabilty which the TP-LINK camera has we could see on the post request, which was on the port 80,the login credentials. On the one hand, the username was transmitted in plaintext , but on the other hand the password was sent encoded in Base64. Encoding without encrypting does not ensure you security so we were able to easily decode the password by an online tool.

Now wit all the data we have as the attacker you basically have full acess to the camera. Meaning, you can easily change the password and lock the users account. Secondly, with the acces to livestream of the camera you can observer the victime any time. Furthermore, you have the access to all the other additional functions that the camera provides.

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

Risk:
The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

Countermeasure:
The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.
Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com
*https://www.invicti.com/blog/web-security/http-security-headers/
*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
*https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications
*https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera

[[Category:Pentesting]]

IP Cameras Pentesting Report

2022-07-13T18:54:16Z

NFaustino: /* References */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

Risk:
The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

Countermeasure:
The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.
Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com
*https://www.invicti.com/blog/web-security/http-security-headers/
*https://www.brafton.com/blog/distribution/how-to-convert-http-to-https-a-quick-guide/
*https://www.bedienungsanleitu.ng/tp-link/tl-nc250/anleitung?p=51
*https://support.blinkforhome.com/en_US/before-you-begin/blink-technical-specifications
*https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera

[[Category:Pentesting]]

IP Cameras Pentesting Report

2022-07-13T18:53:10Z

NFaustino: /* Conclusion, Report and recommended Countermeasures */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

Risk:
The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera, namely Port 80 and 8080 with the versions lighttpd 1.4.32 and Streamd.A42BB014AF19. Which could not be exploited with Metasploit. The actual problem which was stated before was the transmission of data through HTTP. The port 80 communicates the login information of the user to the browser via HTTP, which leads to it being easily readable if captured. The simplicity of executing an arpspoof (if the attacker has access to the local network) leads to this exploit being a major security flaw.

Countermeasure:
The easiest solution would be to migrate from HTTP to HTTPS which leads to the user information not being in plaintext. For this you need to aquire an SSL certificate and install it. Afterwards you need to ensure that everything routes to that HTTPS link not to the previous HTTP link, done by redirecting every request to the HTTPS link.
Another solution would be to add HTTP security headers, namely HTTP Strict Transport Security (HSTS) which enforces the use of HTTPS connections if available instead ot plain text HTTP ones.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Pentesting]]

IP Cameras Pentesting Report

2022-07-13T18:29:54Z

NFaustino: /* Conclusion, Report and recommended Countermeasures */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

The usage of the scan tools mentioned in the article led to no open ports for the ABUS and Blink-mini camera but showed 2 open ports for the TP-Liink camera

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Pentesting]]

IP Cameras Pentesting Report

2022-07-13T18:28:12Z

NFaustino: /* Conclusion, Report and recommended Countermeasures */

== Summary ==

This Article is a comprehensive descirption of a pentesting process regarding three IP Cameras ABUS PPIC32020, Blink-Mini and TP-Link NC200. In the further course of this Report the Methology of the Information Gathering Process will be pointed out, afterwards the gathered information will be analysed. With the analysis of the gathered information vulnerabilities will be pointed out. We will form attack vectors, exploit this vulnerabilites and recommend countermesaures for the vendors to make their systems more secure.

== Requirements ==

In order to perform the Exploits the following tools were needed.

* Operating System:
** Kali Linux 2022.2
* Tools:
** [https://nmap.org/man/de/index.html NMAP]
** [https://www.wireshark.org/ Wireshark]
** [https://linuxhint.com/arp_spoofing_using_man_in_the_middle_attack/ Mount a Man in the Middle Attack (MitM)]
* Cameras:
** [https://www.abus.com/at/Sicherheit-Zuhause/Videoueberwachung/Ueberwachungskameras/WLAN-Netzwerkkameras/WLAN-Schwenk-Neige-Kameras/ABUS-Smart-Security-World-WLAN-Innen-Schwenk-Neige-Kamera ABUS PPIC32020]
** [https://www.amazon.de/wir-prasentieren-blink-mini-eine-kompakte-intelligente-plug-in-uberwachungskamera-fur-den-innenbereich-mit-1080p-hd-video-und-bewegungserkennung-die-mit-alexa-funktioniert/dp/B07X37DT9M Blink Mini]

== Description ==

In this chapter, we will demonstrate how we were able to extract information about the target devices, form attack vectors and exploit them afterwards.

=== Methodology ===

==== Step 1: NMAP ====

We used NMAP to gather as much information as possible about the target systems. This includes IP Addresses, open Ports, Operating Systems, Services and many more. This part is crucial to gain a better understanding of how the camera works and is neccessary to perform sophisticated attacks to extract information or gain access.

Nmap (Network Mapper) is a network scanner created by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich).[4] Nmap is used to discover hosts and services on a computer network by sending packets and analyzing the responses.[5]

Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection. These features are extensible by scripts that provide more advanced service detection,[6] vulnerability detection,[6] and other features. Nmap can adapt to network conditions including latency and congestion during a scan. [https://en.wikipedia.org/wiki/Nmap [1]]

To gather information about the target systems we used the following commands:

nmap -sP [Network Address/Subnetmask] Network Scan --> To discover the IP addresses of the target system inside the LAN
nmap -sS -F [IP Address] TCP-SYN-Port-Scan (Host-Fast-Scan) --> Discovers open ports on target system
nmap -sV [IP Address] Service Scan --> To discover the services listening on the open ports
nmap -O [IP Address] Operating System Scan --> Guesses the Operating System running on target host (Based on OS Fingerprints)
nmap -Pn -sV --script vuln [IP Address] Discovers possible vulnerabilities based on already known exploits for the specific service

==== Step 2: Man in the Middle (MitM) ====

In order to get a better understanding of how the architecture of the service provided by the IP Cameras works, we mounted a Man in the Middle Attack to gain information about how and where the camera connects to and how it deliveres their service to the endpoints (in our case the ABUS Camera used a [https://mobil.abus.com/de/Service/Service-Mediathek/ABUS-Apps Smartphone App] to connect and configure the camera and the two other used Web Services). To mount the MitM attack we utilized ARP Spoofing which can easily be done with the arpspoof command.

arpspoof -i [Your network interface] -t [Target IP] [The IP you pretend to be]

In order to be able to completely execute the MitM attack, you need to enable IP forwarding otherwise the packets would be sent to you but would never arrive at their destination. To do this, enter the following command:

sysctl -w net.ipv4.ip_forward=1

If the attack was mounted correctly, you should be able to capture the traffic between the two endpoints you mounted the attack (e.g. with Wireshark).

In our case, we mounted two MitM attacks, the first one between the camera and the gateway, the second one between the smartphone or endpoint and the gateway to understand fully where and how the service connects to to provide its capabilities.

==== Step 3: Reverse DNS Lookup & Geo Locator ====

When viewing the captured traffic we stumbled over a lot of remote IP Addresses where the communication takes place. Therefore, we wanted to know the Domain of the Webservice the Camera is communicating with. To achieve this, we used the following, free to use, tools:

* [https://mxtoolbox.com/ReverseLookup.aspx Reverse DNS Lookup]
* [https://www.iplocation.net/ Geo Locator of IP Addresses]

==== Step 4: Look through the, open source, firmware of the cameras (if available) ====

To finish our research we searched for any open and available firmware packages of any of the given cameras provided by the manifacturer.

Firmware:

* [https://support.abus-sc.com/knowledge-base/aktuelle-firmware-software-apps-und-hilfs-programme/ ABUS PPIC32020]
* [https://www.tp-link.com/at/support/download/nc200/#Firmware TP-Link NC200]
* Blink Mini (no open and accessible firmware found)

=== Gathered Information ===

==== NMAP ====

First of all, it is important to state that the ABUS Camera used two IP interfaces for their connection to the different services therefore two IP addresses needed to be investigated. Why and how this camera uses and needs two addresses will be discussed afterwards.

{| class="wikitable" style="margin:auto"
|+ NMAP Information
|-
! NMAP Command !! ABUS PPIC32020 !! TP-Link NC200 !! Blink Mini
|-
| Port Scan || [[File:ABUS_Port1.png]] [[File:ABUS_Port2.png]] We can see that all ports on both IP Addresses are closed. || [[File:TP_Service.png]] We can see that two ports (http and http-proxy) are open with the services lighttpd running. This indicates that the Camera hosts a web service. || [[File:Blink_OS_Port.png]] We can see that no ports are open and accessible.
|-
| OS Scan || [[File:ABUS_OS1.png]] [[File:ABUS_OS2.png]] No OS Detection available since there are to many OS fingerprints. Same result with aggressive OS Guess. || [[File:TP_OS.png]] OS Details: [https://openwrt.org/releases/8.09/notes-8.09 OpenWrt Kamikaze 8.09] || [[File:Blink_OS_Port.png]] No definite OS Guess, some suggestions.
|-
| Vulnerability Scan || [[File:ABUS_Vuln1.png]] [[File:ABUS_Vuln2.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]. || [[File:TP_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002] || [[File:Blink_Vuln.png]] Only output: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002 CVE-2011-1002]
|}

==== Man in the Middle, Reverse DNS Query and Geo Location ====

* ABUS PPIC32020
** Smartphone App connects to:
*** 142.251.39.74
**** Domain: bud02s39-in-f10.1e100.net.
**** Located in: Budapest, Ungarn
*** 35.169.53.92
**** Domain: ec2-35-169-53-92.compute-1.amazonaws.com.
**** Located in: Dallas, Texas, United States
*** 44.195.176.7
**** Domain: ec2-44-195-176-7.compute-1.amazonaws.com.
**** Located in: Ashburn, Virginia, United States
** Camera connects to:
*** 176.34.104.236
**** Domain: ec2-176-34-104-236.eu-west-1.compute.amazonaws.com
**** Located in: Dublin, Leinster, Ireland
*** 239.255.255.250
**** Multicast Address used by SSDP

==== Behaviour of ABUS PPIC32020 ====

* Smartphone located inside Network:
[[File:InsideNetwork.jpg]] 
If the smartphone with the app is located inside the network and wants to connect to the camera, the main data stream stays inside the LAN.
* Smartphone located outside Network:
[[File:OutsideNetwork.jpg]] 
If the smartphone with the app is located outside the network and wants to connect to the camera, the main data stream gets hosted to an AWS Cloud Server where the App fetches the data.

== Exploitation ==

== Conclusion, Report and recommended Countermeasures ==

The combined number of cameras tested are 3, all with their own functionalities.

ABUS PPIC32020:
Uses an App that is downloadable on any phone, to control it. The user has the ability to move the camera to adjust the image that is seen. It provides the user with a Full HD 1080p resolution and addtionally it has night vision and it can also activate automatically via motion detection. It has an integrated microphone and speakers. The camera uses a number of protocols, namely: TCP/IP, UDP, SMTP, NTP, DHCP, ARP. Furthermore to encrypt the transmitted data it uses AES 128bit Encryption with WPA/WPA2-PSK. As it is an IP-camera it connects to your local internet and has 2 ways of delivering data to the user, which are further elaborated in the "Behaviour of ABUS PPIC32020" section of this article.

TP-LINK NC250:
Uses an App or the web browser to connect to the camera and to control it. It provides the user with an HD 720p resolution and comes with night vision capabilities. The camera uses protocols such as TCP and UDP to transport data. To encrypt the travelling data it uses WEP and WPA-PSK/WPA2-PSK. It also connects to your local internet and creates a local web server where it fetches the data needed. This sent via HTTP which leads to some issues addressed later in this article.

Blink-Mini:
Uses an App that is also downloadable on any phone to control and get access to its functionalities. In the app the user can adjust the settings of many functions and access the live feed. The camera provides the user with a Full HD 1080p resolution with added motion detection, which captures the next 30 seconds after it was triggered. The camera is also equipped with an integrated microphone and speakers, which allows the user to talk through the camera or with the camera. It uses a number of protocols namely TCP, UDP, ARP, TLS to name a few. It uses AES encryption with WPA2-PSK to ensure the safety of the data.

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Pentesting]]

IP Cameras Pentesting Report

2022-07-13T18:07:31Z

NFaustino: /* Conclusion, Report and recommended Countermeasures */

IP Cameras Pentesting Report

2022-07-13T18:07:13Z

NFaustino: /* Conclusion, Report and recommended Countermeasures */

IP Cameras Pentesting Report

2022-07-13T18:00:56Z

NFaustino: /* Exploitation */

IP Cameras Pentesting Report

2022-07-13T18:00:41Z

NFaustino: /* Exploitation */