22
How Hackers Won the Zombie Apocalypse Quahogcon - Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010

How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

  • Upload
    others

  • View
    4

  • Download
    0

Embed Size (px)

Citation preview

Page 1: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

How Hackers Won the Zombie Apocalypse

Quahogcon - Providence, RI - April 23-25 2010

Dennis BrownQuahogConJuly 2010

Page 2: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Introduction● What is Quahogcon

● New regional con in Rhode Island● Focusing on Infosec and Maker Culture

● Who am I?● Dennis Brown – Quahogcon Organizer

– DC401 – Rhode Island Defcon Group– Day Job - Security Researcher for Tenable Network

Security

Quahogcon - Providence, RI - April 23-25 2010

Page 3: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Badge Hardware● Ultimate goal was to have a hackable badge

● Functional and usable post-con● Our desired result was to include

● Wireless connectivity● A compelling “game” in the firmware● Open source development environment● Easy to write custom firmware for

● We got 3 out of 4!

Quahogcon - Providence, RI - April 23-25 2010

Page 4: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

The Badge● Based off of RedWire LLC's RedBee Econotag

● Freescale MC13224v ARM7 Microcontroller● Zigbee!● 36 GPIO Headers● USB connector – easy to flash

● Added 2 AAA batteries and 7 LEDs● Low cost (~$30 per badge)

Quahogcon - Providence, RI - April 23-25 2010

Page 5: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

End Product

● Interface Components● 2 Buttons + Reset● 5 Red LEDs on left● RGY LEDs on right

Quahogcon - Providence, RI - April 23-25 2010

Page 6: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Badge Features● Easy to code for

● Sorta● Custom firmware

● Kismet client – Zigbee sniffer● Killerbee firmware – Zigbee packet injector● Contiki support – Full system environment

Quahogcon - Providence, RI - April 23-25 2010

Page 7: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Con Firmware● Wanted an interactive “game” for attendees

● Ways to affect other attendees● Ways to hack other attendees badges

● Multiple design ideas● Landed on a Zombies vs. Humans concept

● Chosen 3 weeks before the con● Note: More time is a good idea!

Quahogcon - Providence, RI - April 23-25 2010

Page 8: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Zombies versus Humans!● Humans kill Zombies!

● Multiple attack modes● Zombies kill Humans!

● Charge-up attacks● Speakers and Vendors were Clerics!

● Healed Humans, reclaimed Zombies● Security “Mussel” could attack anyone

● Not very powerful (so they'd get to work!)

Quahogcon - Providence, RI - April 23-25 2010

Page 9: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

How It Worked● Live demo!

● Attacks did 1-5 damage● Humans had 500 health, Zombies 300● Dead Humans became Zombies● Dead Zombies became incapacitted

– Could come back to life● Clerics healed up to 20 health

● Uh, oops!

Quahogcon - Providence, RI - April 23-25 2010

Page 10: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

How It Worked (2)● God mode!

● Only 2 badges flashed in this mode● Designed to be a “prize” for attendees● Allowed user to turn badges into any mode

– Except God mode

Quahogcon - Providence, RI - April 23-25 2010

Page 11: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Predictions● “Encryption” would be cracked

● Intentionally bad!● XOR, no checksum

● Packet replay attacks● Hardware Hacks

● Auto-attacks● The Unknown!

Quahogcon - Providence, RI - April 23-25 2010

Page 12: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

The Invasion Begins!● Badges distributed 5PM Apr. 23

● 65% Human, 30% Zombie● First wave: Predictable

● Human dominance, not completely interested● Zombies attacked, tried to get a foothold

● Saturday Apr 24, everything changed!

Quahogcon - Providence, RI - April 23-25 2010

Page 13: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Badge Hacks● Some predicted, some not● Unsuccessful Attacks

● Hardware Hacks– 555 Timer to automate attacks– Predicted!– Stopped in firmware, rate limit on attacks– Still automated attacks, simplified gameplay

Quahogcon - Providence, RI - April 23-25 2010

Page 14: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Moderately Successful Attacks● Fuzzing

● Not entirely predicted● Graph goes here● Modified code samples to create/replay packets● Successful at making badges “freak out”● More successful at Denial of Service

– Overloaded badges, essentially halted the game● Very confusing!

Quahogcon - Providence, RI - April 23-25 2010

Page 15: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Very Successful Attacks● Packet Replay

● No Checksum on packets● Could replay “known good” packets● No rate limiting

– Successful autoattack!● God Mode was obtained this way, but not fully

– More work was needed to crack it!

Quahogcon - Providence, RI - April 23-25 2010

Page 16: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Very Successful Attacks● Cracking Encryption

● Very simple XOR “encryption” for Zigbee packets– XX XX XX XX XX XX XX– First byte = key– Second Byte = Packet Type (XORed by key)– Third Byte = Action “Strength” (XORed by key)– Other Bytes = Junk

Quahogcon - Providence, RI - April 23-25 2010

Page 17: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Very Successful Attacks● Brute Forcing

● Post-encryption cracking● Discovering the protocol

– Graph of valid commands● Obvious attempts

– Examples – so close!● Grand Prize – Cracking God Mode!

● Only a few people managed this

Quahogcon - Providence, RI - April 23-25 2010

Page 18: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Spoiler Alert!● Quahogcon 2011 Badge

● Preliminary Design – Arduino based● More to come!

Quahogcon - Providence, RI - April 23-25 2010

Page 19: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Lessons Learned● Denial of Service Attacks Suck!

● Game outages were no fun● Will need to take steps against fuzzing next year

● XOR Encryption was ALMOST good enough!● Remained uncracked for about 18 hours!

● More potential hardware hacks needed● No successful hardware hacks affected the game

● People still had fun with the hardware regardless!

Quahogcon - Providence, RI - April 23-25 2010

Page 20: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Conclusion● Wireless Badges means Maximum Fun!● Messing with other peoples badges is More

Fun!● Having great badges is affordable!

Quahogcon - Providence, RI - April 23-25 2010

Page 21: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Special Thanks● John 'Ducksauz' Duksta – Badge Hardware● Dragorn – Firmware Concept and GPIO Code● Redwire LLC – Econotag Design● m33p – Playtesting● Con Attendees – Making it all happen!

Quahogcon - Providence, RI - April 23-25 2010

Page 22: How Hackers Won the Zombie Apocalypse · Zombie Apocalypse Quahogcon- Providence, RI - April 23-25 2010 Dennis Brown QuahogCon July 2010. Introduction What is Quahogcon New regional

Q&A

Quahogcon - Providence, RI - April 23-25 2010