>>We have another short talk and then one more long one and Andrew here is clearly going to do another live demo so wave the rubber chicken in the air and say the incantations so that nothing breaks and he'll talk to us about this rad little Verizon unit he has here.  Give him a big Party Track welcome.
(Applause)
	>> Thank you very much, My name is Andrew Hunt and I'm currently a graduate student at George Mason University and also work at Pac. Tel.  So shout out to my peeps here.  Thank you.  Standard disclosure, what I'm doing here is my own personal work, not necessarily the views of my employer.  But, it's fun stuff so let's talk more about it.  
	So the moCA alliance was formed by a bunch of large companies that got together and said we have all this great copper in people's houses that we have installed about 30 years of cable, and they wanted to find a way to use this as they were moving into the age of the triple play, being able to deliver video, voice, and data over this network.  Copper carries electrons a long way because it's shielded and it's got to a pretty nice insulation there.  
	They developed a PHY and max specifications so that they would be able to do that, so that they would be able to process package to basically turn your coaxial bus in your house into a network.  The key point of this is they wanted to deliver guaranteed bandwidth because this is what video requires.  So that's pretty much what MoCA looks like, it's in your house, it's coaxial cable, everyone knows what it is.  This is what it looks like a little bit.  They use, at the PHY level they are using signaling division --  frequency, divisional multiplexing.  I found this graphic on Wikipedia but it actually works really well, for what they are doing with MoCA and dividing it into two channels.  There's a WAN channel and a LAN channel, two operate at two different frequencies but standard.
	They use this to be able to talk with the router and also to have the router talk to other devices on the coax.  On top of that, they overlay a, well, thank you! -- 
(Laughter)
 So.
	>> Woo-hoo!
(Cheers and applause)
	>> Somebody has done the research, this is pretty good shit.  
	 The Mac layer basically over these channels are dividing it up by time so they can create variable length frames which means that they can encapsulate things in them and that could be video which has very big frames and also Ethernet packets, Ethernet frames, they will encapsulate as well.  Running at the standard 100 megabits per second PHY they can guarantee a sustained rate of 54.6  5 megabits per second.  Consider what your typical Ethernet looks like and collisions are going that's actually very good for 100 megabit rate.  They're everywhere.  Everywhere you see a DVR setup box, everywhere you see these routers here, they are using MoCA.  Which means that it is a great exposure.  It's everywhere.  
	You'll typically see these enter the home through something call wall works on the outside of your house.  This is the one outside of my house that's opened up but there are different ones.  You might have a smaller one if you have a cable provider that's bringing it in.  It won't have this big optical network terminator but basically just a splitter that splits off to the rest of your house.  That's a good point of entry.  
	On the inside you have this router so every cable company gives you some kind of a router to parse up these streams and packetize them.  Read the packets they are sending to you and push it out over the network.  They typically have a SBI firewall to divide the inside from the outside as is standard network security practice.  
	They also have on the left side of this little picture -- uh-oh -- on the left side of this little picture they've got the coax binder there, the plug but it actually carries two MoCA nodes, called network connected -- we'll talk about that later.  They also provide a MoCA-Ethernet bridge on both of those nodes that basically allows them to encapsulate the frames onto the coax.  So, they now turned your nice coax bus in your house into a large Ethernet system.  
	This supports your digital Video recorder so your DVR requires time, you have to be able to schedule shows and find out when everything is.  That's the prime function of having Ethernet on that, to be able to tell when to record your functions.  
	So, yes, sir?
(Laughter)
	>> May I borrow podium for a second.
	>> All right.
	>> If you are a new speaker, raise your hand.  Awesome!
[Cheers and applause]
Are you familiar with this tradition?  
	>> No, I'm not.
	>> Really?  Do you drink?  
	>> Yes, I do.
	>> He brought his own.
	>> You just -- you provide it for me.
	>> Every new speaker at DEF CON, see, they know this, how do you not know this, every new speaker does a shot onstage.
	>> Okay.
	>> How about love for our new speaker?  
(Applause)
	>> Great.  Congratulations, quick shoutout from the guys at Whiskey Pirates that gave me this.  Pretty awesome.  I see we have a pirate in the audience.
	>> Tell him how you got it.
	>> He chained him to a radiator and had their way with him.
(Laughter)
	>> Some kind of pirate.
(Laughter)
	>> Thank you.  
	>> Okay, so what just happened here, let's go back one slide.  What this is doing, this is action tech is bridging your Ethernet and coaxial bus which means if you have a coaxial splitter as most of you do somewhere around the house that splitter is carrying not only the WAN traffic that is supposed to be going out to the biosfeed but also carrying your LAN traffic on a different channel.  If you notice on the left you have a MoCA LAN, Ethernet LAN and wireless LAN.  The action tech router bridges those together and most of the do.  That just makes it easier to manage the notes on the device so you can see everything, nice big happy broadcast network.  Same domain.  
	It's great!  Except, oops.  You can take over all three networks by plugging into that splitter.  If that splitters happens to be outside your house, as this gadget diagram depicts, but is also similar to the Cox, Comcast and Verizon default installation guides for field technicians, they want it on the outside of the house because it's easy to maintain and install.  
	So now that we know the LAN is exposed, just walk in and plug in.  All we need are a couple items, things we usually locate here at the utility point of presence so all I have to do is walk around some houses and look for the utility pole, on the outside of your house look for the electrics box.  Yes.
	>> Drink!
	>> Yay!  
(Pause)
(Applause)
	>> All right.  So you'll need a couple items and you'll be able to go on this fishing adventure.  A MoCA Ethernet bridge.  Mine is net gear MCAB 1001 and then you'll need some RG6 coax cable and a greater than one GHz splitter line, line splitter.  Plug that in, I had to color invert this picture because it was almost impossible to see if you were just taking a picture.  I had to invert it to see that x-ray image.  It's hard to see when it has cover.  Which is great for us!  
	The action tech LAN does not also engage any of the encryption features provided by the MoCA protocol.  It does have a --  I believe it's 40-bit key DEZ that is a pre-shared key but you can code into it.  It is used on the WAN side of the connection that has the key that Verizon knows but it's not on the LAN side.  It's open, clear, hey, works with everything because it's consumer-friendly.  
	So basically what happens you had a MoCA device on the outside of the house, it connects to your action tech router, your action tech router says hey and lets you on the Ethernet.  Pretty awesome.  
	So as y'all have seen this since 2001, typical Ethernet line of attack, this is your normal traffic flow but I really don't want you to go that way, I want you to come to me first and I'm going to do unholy things to your traffic.  
	So I think we have belabored this point.  What could possibly go wrong?  We all know what can go wrong.  We have known about it for a decade.  
	Yeah, whatever.  Take the device, take it over and get the more persistent presence.  One of my co-workers actually brought up to me and says but I'm protected.  I have this MoCA filter.  So MoCA filters are great, they physically block the MoCA ranges in the bandwidth.  What they are designed for is blocking these signals between one house and another.  So you can't block it within your own house otherwise your DVR won't work.  So it has to be located on the egress of the splitter that they are using to provide the cable signal to your house.  That's usually on the outside of the house.  But even if it's not it's usually not in a place where you could divide the inside of the house from the outside of your house because if there's any cable exposed that is carrying your internal connection all you have to do is splice it and you're done.  
	So, great idea but it's not going to work for this particular purpose.  
	So, the idea here is to be able to build a disposable attack unit.   So yeah, we can walk up but yeah, someone is going to find that lap top.  So we built a disposable attack unit that is small, that can hide under a bush and lasts forever, and allow you to walk away and go do your evil.  To illustrate this, you have some requirements.  You have to have some point of -- some way of providing power.  You have to be able to physically insert or demonstrate with that is and you have to have some type of compute device to execute these attacks.  Once it's installed you have to be able to access it and then commit some type of attack, redirection and manipulation.  
	The objectives of this is do no harm so first of all, I'm really just here to demonstrate the problem, but you know I'm sure people out there could take it to the enth degree.  Want to use some standard tools.  We do not want to expose ourselves by showing everyone our latest and greatest coating techniques and be profiled and arrested.  We want to use common stuff that everybody has.  Needs to be updateable so we can a few change things, or add new tools.  Needs to be disposable, so we don't care if we lose it.  That basically means it has to be cheap and has to be small and not too powerful, because if it is too powerful it will burn up all our battery before we have even gotten home.  So, some ingredients I just recently purchased these gorilla 16 800 milla amp batteries, got two of them on woot.  Thank you woot.  Smaller than a paperback book, I used two of these because I have two because I have two different draws on my units.  MoCA draws one amp and the raspberry unit draws half an amp and that's a little more than this can put out on one battery so I need  two batteries. 
	I also used the raspberry pie, Model B.  Has an ARM 11 processor.  It's a little bit slow but doesn't consume too much power, can last 18 hours on this battery and it's cheap, so if somebody finds it go buy another one, buy 10.    
	So Kali Linux has a distribution that works amazingly well with raspberry pie and the ARM distribution, thank you, guys, for that contribution to this field.  It's awesome.  Has all the necessary tools you need pearl python and also squid Apache and mini PUMP.  Let's talk about that later.  
	It also supports the universal plug and play IGDE protocol which is available on the action tech firewall and then you'll also need the Ethernet bridge.  I bring this picture up, I don't know if you can see it down there but the original MCAB mockup that I did before I modified it had a -plug that you had to plug into an AC adapter in order to provide power.  Looking at the back it was 5 volt, one amp which means that it is within the USB specification for power draw.  So, a little hardware hacking later and soldering up and you have a USB power cable for the MCAB.  I recommend it because then you can provide it direct off battery.  I was originally trying to do this work with the APCUPS.  Only lasted about six hours and it beeped a lot.  I didn't think that would be very good for hiding it from attackers, outside of someone's home if they were looking for the freaky beeping.  Also this nasty habit of shutting things down before I was done with it, I'd get about halfway through the battery and say oh my God I'm out of power and shut it off. 
These batteries are a real God send.  They came out in the last couple years, they are really great.  There is no loss of conversion from DC to AC to DC, there is just direct power which means they lasts longer.  
	So on each of these devices MCAD adapter I've got about 14 hours of up time so that's about how long you've got to commit whatever you are going to do.  
	For those who can't see it on stage, this is what it looks like, a bunch of rubber bands and duct tape.  But, it's dark, you can spray paint it and hide it under a bush and no one will see it.  Word about universal plug-and-play, I know this is kind of beleaguered by GRC and other sources but it enables, it's a PMP protocol that enables Gateway manipulation, the action tech supports this.  Basically it allows, everything talks to everything and says hey I'm an iPhone, hey I'm a printer, let's talk, right.  Downside is also hey I'm a router, you want a firewall port opened, let me do that for you.   
	So I borrowed an idea from Joshua Wright, his scripts for doing image high jinks with the I Love My Neighbors distribution.  I borrowed those from him, did modification and some batch scripting and now we have a nice little device that will go and punch holes in firewalls from the inside.  
	Mini PMP is basically what we use here, PMPCA, tell it to forward 22 to myself and send a nice little report to my e-mail address and tell me what my internal and external IP and port are.  This might be a little hard to read for you guys but basically you will turn on your engine.  You are going redirect web streams and then to you'll manipulate that stream.  So, let's see if it actually works.  

(Pause)
All right.  Nope.  
(Pause)
All right.  There is my MoCA device there.  63...  Aww, it doesn't like my key.
(Pause)
(Laughter)
	>> You want me to get through this demo or you want me to drink?  
	>> Drink!
	(Laughter)
	>> While this is loading up, I'll take a drink.  Okay, that's on and now we have to do one more thing.  What that's doing is going through its sequence.  I owe you a drink.
(Cheers and applause)
The sequence it was doing, it's just going through and doing the normal networking stuff, it's also engaging over the MoCA network which is then going to poison the action tech router.  If you want to play along, get laptops out and want to connect.  The access point password is testing 123 testing 123 SSID is testing.  So, go ahead and play with me.  I don't see any takers!  
{{(Pause)
We are getting to the end here.  It's going through the set up sequences.  It's going to engage the squid engine and web server, it basically provides the redirects and squid proxy is going to redirect to pearl which is going to do the re-writing of the sequence to provide the re-directs. Okay.  So let's get through.  While that's going on I can go ahead and show you this.  So you enumerate the redirects, it's not there yet, that one has failed.  Oh, there it is.  So you can see there are all kinds of redirects from things like Microsoft, they've got all kinds of protocol in there that they contracted to get on the action tech.  But you can see here this is my PP and C this is my port forward for my SSH to my router.  So that can be reached through the Internet and then want to go for it, give it a go!  All right.  There we go, somebody is on here and they are getting redirected around and if we try it, so we can stop them... 
(Pause)
Look at that!  It went somewhere else.  Can't see it.  There we go.  So anyway, not too exciting but the entire point of this demonstration is to show the MoCA network is exposed to the outside of your house, anyone can walk up with no keys, can walk up and take over your network and do whatever unholy thing they want to do with you.  So I just have a couple wrap-up slides and then we're out.
(Applause)
So basically some results from this research, the arm 11 is single core, low power drive, but it's also kind of pokey.  If you actually do use this, don't try to do any image processing it will show itself very quickly but it's great for injects, redirects, and things like display.  So tested it with my network at home, it has  about a dozen devices on it, works just fine.  So it's cheap.  It's disposable.  It's quick delivery.  Walk up to a house and install this in less than 2 minutes walk back to your car and drive away and you have all afternoon to do what you're going to do.  Allows you to find a more permanent back door.  So what do we need to do about this?  You need to talk to your ISP, tell them you want them to allow their devices to support better encryption, since the DVR tends to break when you turn on encryption on that local LAN.  The ID do not want IGD, you want disable turned off whatever because you can't turn it off. 
It's a Daemon and you can't disable it.  You want them to stop bridging all your networks together on the same domain and actually have it route so you can do something with it instead of having it just lave everywhere.  
	Customer should demand this, you guys should demand this.  Ongoing work on this, we want detect these MoCA injections, people installing these devices, we want to be able to alert on insertion, but something  better, you could it and see the poisoning that's going on here but you can't see the MoCA side of it.  You want to be able to see that.  We're currently working with a gentleman named Steven Barani, he is a fellow grad student of mine and we're working on a product called Slim and then integrating that into another raspberry unit that will face off with this one called counter pie and hopefully able we'll be able to demonstrate that soon.  Thank you.
(Applause)