How to pen-test off the grid…and in the middle of the Pacific

foreign

all right cool so take two um so i'm server dave we're talking about pen testing off the grid and the middle pacific it's just some of my experiences um living in hawaii um on my father's farm with literally no running water sewage um electricity any of those things and how it really applies to us like if you're doing penetration testing or any type of testing at all like how do you actually do this uh with very limited resources like i mentioned before 14 year old dave can tell you a little bit about who i am i'm not big on bios

what are we doing we're recording okay my name is gatekeeper it's my alias name an anarchist i don't know if you can hear that but my alias is gatekeeper when i was 14 and i'm an anarchist so a little bit about me this is actually building explosives in my mom's basement so

um so just talk about a little bit how i came to live off the grid um what my lab setup really kind of looked like and then tools and techniques i used for making sure our testing my testing was accurate and then also talk a little bit about how to be sustainable from living in a foreign living and working from a foreign country so i got some pictures and it was a real working farm uh my dad's farm in hawaii oh god i can't see anything

so picture time because i didn't really want to do an actual technical talk so you can look at pictures instead um so hawaii is very a unique uh place to live we grew a lot of different things amazingly you find in the restaurants which you can't get on the mainland are being shipped from the mainland over to hawaii becomes a really good crop beets in this particular case we grew beets for restaurants they use it in coloring for different ice creams and they use it to pretty much across the island now that it's been introduced to hawaii tomatoes do not grow in hawaii for the most part unless they're that size there's a specific insect so you're

looking at 5.99 for tomatoes per pound in hawaii so that was actually a good crop to have and we had this in a an enclosure that would keep that insect out mangoes i would make mango chutney and and put it in jars and we'd go sell it at the market lots of different herbs and veg herbs and things like that that you pretty much could throw anything out in the ground in hawaii and it'll grow aquaponics i got aquaponics set up and running to do lettuce it's much easier to do lettuce and things like that in an aquaponics setup really fast we're looking at um that's probably only a day's maybe a day and a half worth growth and you can

have a harvest every week before farmers market hunting what most people don't realize is hawaii is a is a sport hunting ground there's introduced wild pigs and and deer and things like that so you can actually hunt all those things especially up on the farm that was the view from the deck that's pearl harbor and honolulu in the background there so that was the view from from the farm and that's the view of the road going up so the farmhouse is right here where where the cursor is and that is all national forest behind there on the waianae range so you're pretty much able to hike and camp and do whatever you need to back there

it's an amazing place to to live that was the that's the farmhouse and the interesting part about living on this farm was these rocks were pretty much everywhere and you see there's nothing built next to them that's because they have hawaiian hieroglyphs this area was actually part of the damani pineapple plantation and they found these hawaiian hieroglyphs on these rocks and the hawaiian historical society basically if you find that on your property you're not able to do anything within a quarter mile and then you have to allow people to be able to come up and study those those ruins and then a lot of peacocks everywhere i don't know if you've ever heard peacocks before

they're pretty annoying um and then chickens there's chickens everywhere on the islands um one part of the farm uh they do [ __ ] fighting i mean obviously that's illegal but you'd have anywhere from a thousand to fifteen hundred uh boosters and hands that you can imagine that noise up there but sometimes working conditions would be nicer uh go to waikiki beach and i'm using a similar hot spot there to do some testing that day i just didn't feel like being at the farm and anything's portable pretty much in hawaii fishing was the order of the day um so we'll get into my schedule a little bit later on but um if you like ahi tuna um

get down to the beach about one or two o'clock in the afternoon uh and dive and and you can actually have you know fresh fish every single night so that's just a few pictures anyway show and tell

so basically my lab was very simple there um honda eu generators if you ever think of wanting to work in a condition off the grid and you wanted something pretty quiet where you could still have business meetings it's a very quiet generator very efficient and a ups to back everything up now in hawaii up until just recently had one of the best implementations of wimax so i was actually able to get about seven meg now that doesn't sound like a lot but compared to most other internet connections on the island that was very uh was very quick so i had a directional yagi antenna with a high output modem using clear communications now sprint bought clear

communications and because people were using all the data they shut them down so they're forcing people to get landline connections which means i'd have to go to using something like t-mobile now i had an on-premise ex esx server and part of one of the projects i was working on was actually testing doing some qa testing on hardware where i was using virtual machines to pass things back and forth so that would only be used for lab and testing purposes not really anything over the wire and this laptop basically which um 32 gig memory and you know you can pretty much do everything uh inside the box itself so you can imagine that testing via wi-max and i know actually from

satellite services like hughes and direct tv that you're not going to you're going to have crazy amounts of latency you want to talk about an interpreter shell that just will not function whatsoever try doing it with something without latency especially over a satellite type of communication so for me the the most important tool was using virtual private servers or eps's and there's some pricings there digitalocean is one i use more more often than not it's like five dollars a month you can spin things up and down pretty quickly and handle most tasks and we'll just walk through like looking at how digital ocean kind of looks how you can create things and and destroy things it's really really

fast uh lino's ten dollars a month they give you um they give you twice as much as what digital lotion i use digital ocean because it's more cost effective there and you pretty much get what you need to get done there and then heavier lifting so say you're doing an engagement you're doing anything running responder things that you're pulling hashes off the wire any kind of brute forcing or if you're running something like scappy for fuzzing amazon aws you can actually scale that pretty pretty large but your cost also scales with that as well so not all vpss are the same so the different types of things i did out there would be white box engagements or

engagements where i had the customers they'd give me the entire layout of their network or their website or their mobile application for testing but one thing that is important if you're doing black box testing or you're doing a red team engagement is being able to test the effectiveness of their defensive side or their blue team against these things so with digitalocean it's very easy to set up a box create a snapshot of that box and then deploy it from places all around the world so you can come from multiple different ips and then if you you know they start looking at digital ocean ip space you can switch over to lino pretty quickly and it gives you a lot more options to

obfuscate your traffic um now sometimes you're going to have to do a testing that requires you know low latency when you're doing web testing especially when you're talking about automated scanning and enumeration so you can actually implement with the digital ocean and lino which are fully headless um command line only services uh get kde with the vm vnc connection working now i say kind of working it's basically only used really i only used it for automated scanning where i could press a button and let it go and come back and pick up results because you imagine a vnc connection over that speed is pretty slow and then use the sox proxy so ssh into your vps solution and you can come you

can pretty much come from anywhere in the world from ip space um and i didn't know how technical to make this talk so the screen command if anyone's ever familiar with the screen command if you're on a like a putty session or ssh session you can use screen uh to basically drop your your console and it'll continue running in the background and i'll i'll just show that real quick as well so let's just pop in here and see how well this goes because i can have them to kind of look sideways because my laptop's not functioning the way i'd like it to so this is the command console for um for digitalocean and it's very very easy to use

create a droplet here and you can see some of the pricing there and you could really scale upwards um depending on your needs there and they do charge per hour which is nice so like if you had to spin something up for a couple hours and then destroy it it allows you to do that and i'll i'll reiterate that importance of that when i show you another tool that i use multiple different regions you can select from and then whatever type of linux that you're really familiar with i'm a debian person myself so using debian was pretty easy

now is anyone familiar with armitage from it's in the cali distro um anyone familiar with cobalt strike cobalt strike is uh the the granddaddy of armitage and raphael mudge just redesigned it was re-released at derby con version 3.0 the problem with armitage the fact that it wraps end map around it or interpreter or metasploit around it all those different things we have a problem with a the wassemer kind of agreement that just was if i'm not pronouncing that correctly i'm not sure but it's basically um these types of tools cannot be exported to other countries so rafael basically took all that functionality out rewrote how a cobalt strike works so god that's going to be impossible to

read

so i just want to fire that up and just show you briefly um

god

all right so i'm going to call strike directory and then i'll just run the screen command um

okay so that basically sets it up so that i can drop out of this putty connection or ssh and that team server will still be up and running it's very similar way armitage works as far as a team server and armitage works just fine i just happen to have and pay for a copy of cobalt strike because it's much more for much more advanced spread teaming exercises so i'll launch

i can't even see

so this is why you don't do live demos by the way

yes that is a legitimate password so if anyone wants to hook up with their cobalt strike server feel free um the beauty about using vps is to do these types of things is that really quickly you can set them up and destroy them and there's a secure scrub feature with lino as well as digital ocean so if you're using this for actual engagements you're able to do the do the job destroy the data or retrieve the data that you need and destroy it really quickly one note is to make sure you disclose that you're going to be using a third party cloud service before you take on any of these projects a lot of companies

don't want you using something out of another country all right so that's spun up there we go is digital ocean ever expressed any interest in wanting to be notified about running engagements the question is is digitalocean ever wanted to be notified about engagements yes i generally notify them if something's coming from an ip for the most part they won't say anything until someone comes back to them and says you know there's this malicious attack coming from the ip space um and the one thing about digital ocean too is that if you have like 20 boxes they give you a limit if you call them up and say hey i'm doing penetration testing they're like all

right we'll give you a hundred more the capability to do a hundred more boxes so they don't really check a lot of that stuff there's no form or anything yep yeah an email the same with linode and demon vps amazon demon vps similar pricing to uh digitalocean um as far as how that runs i'm just i've been using digitalocean and the snapshot feature is really um really good so cobalt strike the the cool thing about cobalt strike is so in and using digital ocean is i can set up 20 different ips or 20 different boxes with the same snapshot run cobox strike team server and it has a feature called a beacon the beacon is malleable so that it can

here oh here we go thank you sir i read my mind so it's malleable so that when you're doing anything that's testing really the blue team's capability for detection um it can send out at random intervals small pieces of data so you might have a half meg go to singapore another half may go somewhere in new york um so you're really hammering down unfortunately the blue team where i work now says it's completely unfair because there's no way we could possibly detect it and i'm like sorry i'm a red teamer i don't know how to fix that for you all right um if anyone wants to pull up a little bit on kill-out strike i don't want to

say that i did anything to help out with that other than bother much when there's issues i really enjoy using the tool i think it's underutilized in a lot of bigger organizations so if anyone wants to talk about that or armitage afterwards i actually have i've done classes on that for a long time i could talk about it forever but we'll keep it we'll keep it light

okay so some of the other implications for living off the grid and in another nation hawaii is another country um whether or not they call themselves a state i lived in texas as well and you can't tell them that they're part of the united states it's the republic of texas but in texas they allow lots of guns and they'll shoot you or in hawaii it's pretty impossible to even get a you can't there's no such thing as concealed carry it takes about eight days to actually get your gun registered they're pretty conservative or liberal about their their gun laws another factor that you really have to take in uh and this goes for any nation

is the time zone difference and it's 10 hours behind uh greenwich mean time so like if you're wanting to start work on the east coast time you have something to present um getting up at two o'clock to get the generator up internet stable if you have an esx server that you need to get running so that you can make it eight o'clock uh meeting um it's pretty tough and it's interesting that many people start their work days like this in hawaii it's it's very common for people to live by the sun my sister gets up at 3 30 she starts working at five um done pretty early so the cool thing about that is that

once i'm done around noon i could have the rest of the day to go beach surf or dive or or whatever something like that um yeah so you're finished work around noon which is really nice but generally speaking a lot of people are in bed by eight which is kind of different from anything here on the mainland so how does this apply to us right like i live in charlotte now for a big i work for a big organization there where do you want to work like i work in a cube farm like part of the time i still actually have to work off of that because where i'm at i'm supposed to be attacking the outside of the

network but i'm sitting inside so my boss will be here later and you can ask him why we're still inside he'll be given the last presentation in this room he doesn't know either um so where do you want to where do you want to be i imagine myself in another foreign country um hawaii is very expensive very difficult place to live at times and i was thinking like i've got a cousin that runs his entire um animation studio out of the dominican republic and i mean his house is paid for like 800 a month and he's got like a live-in person that does all the cooking for them and like everything else like that sounds like a lot better to me so just

depending on where you want to work you can take some of these things away and i mean anyone that's doing any pen testing and red teaming really can tell you more about using vps's to kind of host those things because you don't want uh you don't want your ip at home attacking the internet like you know oops i mask in the internet and now i don't have internet because they've shut me down type things that's a true story uh anyone familiar with soldier fortran the guy that's mainframe 767. he tells that story in his talk i work with him now and basically he was on the internet for like four days after clearing out some legal things after

mass scanning the entire internet so so why i move back i mean obviously i'm not in hawaii anymore it's hard work i mean it's manual labor um not only doing your normal day-to-day life what you would think is pretty simple you get up and go to the bathroom in the morning you have lights you have running water like we had porta johns and composting toilets you wanted to take a shower you went and got rain catchment water heated it up um so it was very much you know a difficult thing and basically i was lazy really i mean i've missed all the first world problems everyone has like you know all the power's out now i can't

finish playing fallout 4 this afternoon or something like that but i had opportunity to join a red team so that was the main thing and i you know i actually started trying to generate a buzz about the security community and we actually got b-sides hawaii approved to get rolling problem is there's no security community in hawaii issa is about it and the people that i know there um jim anako he's a big owasp guy he works i forget where he works now okay yeah because because jeremiah grossman's out there too he works for white hat yeah there's so the people that are out there that do security they have to travel to get away from

there i met a guy a couple weeks ago and he's like yeah i live we're just trading stories about i'm like what do you do for work he's like i travel like why live in hawaii it's so far out there i mean if you have to travel all the time um and we looked at living off the you know getting off of the farm uh moving into an apartment but it does really consume your time the cost of living is exponential out there like just the studio apartment we were looking at that was probably about five miles from the beach was something like 3 500 a lot of people work two jobs and they live with their entire family like it's

not uncommon for an entire family like multiple generations to be living in the same house in hawaii and i always would say like i mean i came back here because i had this opportunity but you can't eat paradise i just didn't have any money really just doing this remote stuff at least not enough to really enjoy myself out in hawaii so i asked my wife and i was you know getting this talk set up with the pros and cons for her where it was amazing to have access to the ocean and mountains at the same time and it's literally year-long activities uh and one of the downfalls of year-long activities of being outside with no cl

hardly any clothes on is that you have to keep a nice body which obviously have let go um after after leaving there so there's all kinds of stuff to do around very much an outdoors place um some of the cons any time you had to get anywhere the traffic was it's the second worst in the in the us behind um la one accident can can block things my mom actually had one of the army guys took a crane down the road he knocked down one of the supports on one of the bridges it took her 14 hours to get 20 miles around that there's just no other roads to get around there so traffic can be a

nightmare a single accident can ruin your entire evening so like getting onto the other side it should take an hour sometimes it'll take three and you have all these military people around on the island too so you have a lot of foreign drivers that aren't used to what we call island island time over there where everyone's driving really slow 45 miles an hour the military's not used to driving that speed so rush hour ended up uh being a nightmare and i mentioned the prices before us we found a single lemon one time we were just we were wanting to make mexican like if you like mexican food you're not gonna find it in hawaii unless you want canned or something like

that but like a single lemon was two dollars i was like what so uh pretty bad and the last one there cane spiders i was trying to find a picture of that but on the on the outhouse the cane spider is about this big um and if you're in the fields where the sugarcane's growing they can be like this big if you drive in kauai they'll jump across the road in front of your car and so we were living on a farmhouse without really any kind of you know it wasn't sealed or anything like that and we didn't have any ac or anything so you'd wake up with cane spiders on your bed or something like

that my wife did not was not too happy about it i wasn't either but um yeah so this is my wife's notes on that and i mentioned before um trying to start a consulting business um the issa meetings um actually i mentioned giving a talk off of a nexus device the guy from i don't know i think he got a trip to hawaii to speak at the issa meeting he didn't show up at the issa meeting and the guy's like anyone have a talk that they can give and i'm like sure here's how to break microsoft great planes via sql and everyone's like i had no idea that that was even a thing because all the talks there about vendor

talks and things like that and you know they work remote there's a ton of travel to have to deal with so visiting hawaii i totally recommend visiting hawaii and i'm talking mainly about oahu well oahu is the business center of hawaii unless you want to be surrounded by japanese and filipino tourists don't stay in waikiki there's some better places i could go into that um and i understand that there is a rich proud culture alive and well in hawaii the nation the royal nation of hawaii just took over the kapiolani palace like a couple months ago they'll go and try and do a coup every so often and the police are like i'll let them go live in

the palace for a couple days and we'll go kick them back out again it's pretty it's it's almost comical not to them but to everyone watching the news i learned a few phrases in pidgin uh hawaiian pigeon is a mix of all kinds of different languages together spoken on a daily basis japanese and filipino a few phrases there will get you past all the different tourists a lot of filipino people there especially on the side of the island i was and my dad loves to have people come visit him at the farm and he'll he is one of the few native hawaiian speakers left knows all the history and stuff so if you want like the actual hawaiian

experience he's he loves to do it he was a tour guide for many years that's basically all i have thanks i appreciate it if anyone has any questions i got a question sure what was your monthly expenditure for having to do all like wi-fi hotspots things like that when you're trying to run a business uh so what was my monthly expenditure for doing all those different types of things so a lot of times i bill back to clients the ymax stuff was right around 100 a month vps usually ran around 200 a month so it wasn't super expensive to to run all that stuff and i to this day i still use the same techniques because of you know

being able to obfuscate where i come from so i continue to use those things in my day-to-day job yes my question is about max how many of them channels do max i have no idea to be honest with you wymax like the implementation um kind of died out hawaii was the last like hold out for wimax and it's kind of it's kind of gone away so yeah i'm not sure um all i know is that the majority of the people i knew they wouldn't get like time warner because it was like twice as expensive and they would all use wimax i think that's why sprint when they came in the bottom they're like nope we're

gonna throttle everyone back down you guys are using too much internet whereas the internet goes right through like oahu it comes in pearl harbor side and it goes out through the north shore like okay we're right on the pipeline also that's why nsa's big facilities are in uh wahiwa as well as honolulu like all the data goes right straight through there for for asia any other questions all right mahalo and aloha thank you very much

you