A DIY Hardware Packet Sniffer

Transcription

1 A DIY Hardware Packet Sniffer Affordable Penetration Testing for the Individual Veronica Swanson: University of California, Irvine CyberSecurity for the Next Generation North American Round, New York 15 th 17 th November, 2012 PAGE 1

2 Why DIY? System security is important, and penetration testing can be essential to ascertaining and improving the level of security of your system. But what about the cost? Large-scale penetration tests from security firms can be costly, and even commercial penetration testing devices can be expensive for the individual. Creating your own device is less expensive and offers potential for customization. PAGE 2

3 The Hardware Packet Sniffer The HPS was designed to be a simple, small, concealable, DIY packet sniffer Simply plug the HPS into an open Ethernet port and it will receive packets of data being sent on the network and transmit them to a given MAC and IP address. It s Cheap! Other penetration testing devices can be much more expensive. Total development costs came to $ PAGE 3

4 The Hardware Atmel ATMEGA328P Functions as the host controller Interfaces with the ethernet controller via SPI mikroeth Board Microchip ENC28J60 Ethernet Controller Interfaces with a network using an ethernet cable Sends and receives packets based on programmed MAC and IP addresses PAGE 4

5 ENC28J60 Ethernet Controller By setting the Ethernet controller in promiscuous mode, the HPS can capture and store packets of data from the network that it is plugged into regardless of what MAC address the packets were intended for. Once configured for Full-duplex mode, the Ethernet controller can simultaneously receive and transmit acquired data over Ethernet. By programming a destination MAC and IP address into the Ethernet controller, the HPS can then send the data it collects to a specified device. PAGE 5

6 Ethernet Memory Organization The memory in the Ethernet controller is static RAM, and is organized into three sections: Control Registers - provide access to the on-chip Ethernet controller logic through the SPI interface. Separated into four banks of memory containing three types of registers ETH Registers MAC (Medium Access Control) Registers MII (Media Independent Interface) Registers Ethernet Buffers - an eight Kbyte memory split into a receive buffer and a transmit buffer where the data received and the data to be transmitted are stored. Physical Registers - used for configuration and control of the physical device. Can only be accessed through MII registers. PAGE 6

7 The Atmega328p Microcontroller The microcontroller is the host controller used to program and operate the Ethernet controller over SPI. Before the Atmega328p can be used as the host controller, the device needs to be configured for Master SPI mode. This is simply done by setting the directions of the SPI pins appropriately as shown. Pin Name Pin Number SPI Master Direction MOSI (Master Out Slave In) PB3 Output MISO (Master In Slave Out) PB4 Input SCK (Serial Clock) PB5 Output SS (Slave Select) PB2 Output PAGE 7

8 SPI Interface SPI is a data transfer protocol which allows a Master device to communicate with peripheral Slave devices. Data is shifted in bytes from the Master to the Slave, and from the Slave to the Master one bit at a time. The Ethernet controller is designed to respond to a set of seven SPI instructions. Each instruction is 1 byte long followed by 1 byte of data if applicable. The first 3 bits contain an opcode, and the following 5 bits are an argument. PAGE 8

9 SPI Ethernet Controller Instructions Instruction Name Opcode Argument Data Read Control Register a a a a a n/a Read Buffer Memory n/a Write Control Register a a a a a d d d d d d d d Write Buffer memory d d d d d d d d Bit Field Set a a a a a d d d d d d d d Bit Field Clear a a a a a d d d d d d d d System Command (Soft Reset) n/a PAGE 9

10 The Software The software is composed of the three layers: Sniffing Application - appropriately executes the receive and transmit functions. Ethernet Firmware configuring Sniffing Application the Ethernet controller, as well as the receive and transmit functions. Ethernet Firmware SPI Instructions - code initializing the Atmega328p to operate in master mode for SPI and the SPI Ethernet controller instructions. SPI Instructions PAGE 10

11 Handling the Acquired Data Once the HPS is in place and switched on, it will begin transmitting data to the designated destination MAC and IP address. To view and capture the data, a network protocol analyzer such as Wireshark, must be used. Implementing capture filters for source IP or MAC address can isolate the target packets. PAGE 11

12 Sample Wireshark Capture PAGE 12

13 Building the Board The device is wired according to the displayed circuit diagram. It is critical that the master and slave pins be wired correctly for the SPI protocols to function properly PAGE 13

14 Building the Board Part Price mikroeth Board $24.00 AA 1.5V Battery $0.40 Bodhilabs AA Battery Holder with 3.3V Regulator $10.95 ATMEGA328P-PU Microcontroller $2.24 Perf Board $3.52 Short Ethernet Cable $ P Socket $0.17 Slide Switch $0.86 Total Price: $43.99 PAGE 14

15 Summary The HPS is a simple, do it yourself packet sniffer for penetration testing. The device is easy to fabricate Less expensive than other penetration testing devices offered on the market. PAGE 15

16 Thank You Veronica Swanson: University of California, Irvine CyberSecurity for the Next Generation North American Round, New York 15 th 17 th November, 2012 PAGE 16