The following is an excerpt from the book Hacking and Penetration Testing with Low Power Devices written by Philip Postra and published by Syngress. This section from chapter one discusses "The Deck" -- a custom Linux distribution that allows pen testers to use low-power ARM-based systems.
The Deck, the custom Linux distribution described in this book, breaks the traditional model by providing penetration testers with an operating system that runs on lowpower ARM-based systems developed by the nonprofit BeagleBoard.org Foundation (these will be described more fully in the next chapter, but see http://beagleboard.org/Getting%20Started if you just cannot wait till then). This permits devices running The Deck to be easily hidden and opens up the possibility of running off of battery power. At the time of this writing, The Deck contained over 1600 packages, making it extremely useful for penetration testing. The Deck is extremely flexible and is equally adept at being used as a traditional desktop, dropbox, or remote hacking drone.
What's in a name?
If you are a reader of science fiction, you may already have a suspicion where the name The Deck comes from. The Deck can refer to the custom Linux distribution described in this book or to a device running The Deck operating system. In the 1984 science fiction classic Neuromancer by William Gibson, cyber-cowboys using computer terminals attached to the Internet are said to "punch deck." Gibson described a future where advanced devices (decks) are used to access the Internet. In my mind, the Beagles and similar small, low-power, inexpensive devices represent the future of penetration testing. Naming the system The Deck is a tribute to Gibson. Additionally, the Beagle- Bone is roughly the size of a deck of cards.
Devices running the Deck
All of the devices shown in Figure 1.1 are running The Deck. At the time of this writing, The Deck runs on three devices in the Beagle family: the BeagleBoardxM, BeagleBone, and BeagleBone Black edition. These boards will be described more fully in the next chapter. You can also find out more about them at the Beagle- Board Web site (http://beagleboard.org). For now, we will describe them as lowpower boards based on ARM Cortex-A8 processors running at up to 1 GHz. Despite providing desktop-like performance, these devices require a fraction of the power of an Intel-based or AMD-based system. Even when driving a 7 in. touchscreen (such as this one: http://elinux.org/Beagleboard:BeagleBone_LCD7) and external wireless adapter, a 10 W (2 A at 5 V) power adapter is more than sufficient. Compare this with triple- and quadruple-digit wattages found in laptop and desktop systems.
Penetration testing tools
The Deck contains a large number of penetration testing tools. The intention is to have every tool you would likely need available without the trouble of downloading additional packages. Installing new packages to a hacking drone during a penetration test ranges from difficult to impossible. Some desktop-oriented penetration testing Linux distributions suffer from having many old packages that are no longer in common use. Each package included in The Deck was evaluated before inclusion. Anything deemed redundant to a new package was left out. Some of the more frequently used tools are introduced here.
Wireless networking has become extremely prevalent. As a result, many penetration tests start with the need to crack a wireless network. The aircrack-ng suite is included in The Deck for this purpose. The airodump-ng utility is used for basic packet captures and analysis. Captured packets can then be fed to aircrack-ng in order to crack network encryption. Screenshots of airodump-ng and aircrack-ng are provided in Figures 1.2 and 1.3, respectively. More details on using the aircrack-ng suite will be provided in future chapters.
Even in cases where a client is not using wireless networking, the aircrack-ng suite can be useful for detecting and possibly cracking any rogue access points on the client's network. A very easy to use point-and-click wireless cracking tool known as Fern WiFi Cracker is also included with The Deck. A screenshot showing a successful crack with Fern is shown in Figure 1.4. Those newer to penetration testing might find Fern easier to use. Due to their interactive nature, neither aircrack-ng nor Fern is suitable for use in a hacking drone. For this reason, the Scapy Python tool (http://www.secdev.org/projects/scapy/) is included in The Deck.
Regardless of whether they are from wired or wireless networks, network packets are potentially interesting to the penetration tester. The Deck includes Wireshark (http://www.wireshark.org/) for capturing and analyzing captured packets. Nmap (http://nmap.org/), a standard network mapping tool, is also provided for identifying services and hosts on a target network. A collection of vulnerability scanners and a powerful exploitation framework known as Metasploit (http://www.metasploit.com/) are also bundled in the standard version of The Deck. Some of these tools are presented in Figure 1.5.
Hacking and Penetration Testing with Low Power Devices
Author: Philip Polstra
At checkout, use discount code PBTY15 for 25% off
Metasploit is a very popular tool maintained by Rapid 7 (http://www.rapid7.com/). Numerous books, training classes, and videos covering Metasploit have been created. Offensive Security has published an online book Metasploit Unleashed (http://www.offensive-security.com/metasploit-unleashed/Main_Page), which is freely available (although a donation to Hackers for Charity is encouraged). Metasploit is billed as a framework and features a large number of vulnerabilities, which may be exploited to deliver one of several hundred available payloads. Metasploit may be run in scripts, as an interactive console, or with a Web interface. Complete coverage of Metasploit is well beyond the scope of this book. Readers who are unfamiliar with Metasploit are encouraged to learn more about this amazing tool.
Cracking user passwords is frequently a component in penetration tests. The Deck includes a collection of online password crackers, offline password crackers, and password lists. One of the online cracking tools, Hydra (https://www.thc.org/thchydra/) is presented in Figure 1.6. Numerous additional tools are included in The Deck, not the least of which is a collection of Python libraries. Some of these packages will be highlighted in case studies later in this book.
Modes of operation
One of the strengths of The Deck is that a device running The Deck is capable of operating as a traditional graphical user interface (GUI) desktop system, dropbox, or hacking drone. No software changes are required to switch between modes of operation. This adds a great deal of flexibility to a penetration test. You can literally show up at a penetration test with a dozen devices running The Deck and select power and other options (such as wireless adapters and 802.15.4 modems) on the spot. No need to bring separate devices for use as penetration testing workstations, dropboxes, and drones, some of which might never be used in the engagement.
The Deck as a desktop system
The Deck debuted at the 44CON security conference in London in September 2012. It originally ran only on the BeagleBoard-xM. Two configurations were demonstrated. The first configuration was a desktop system with external monitor, keyboard, and mouse. A portable system with a 7 in. touchscreen and compact presenter keyboard/mouse was also presented. At 44CON, I made the statement that these devices could easily fit in a child's lunchbox. When I saw a Buzz Lightyear lunchbox on sale after returning home, the penetration testing lunchbox was born. Buzz Lightyear was chosen because using this lunchbox, you can hack someone to infinity and beyond. Both of these devices are shown in Figure 1.7.
Read an excerpt
Download the PDF of chapter one to learn more!
Several desktop configurations of The Deck have been created since its debut in September 2012. A system with a 7 in. touchscreen, Alfa wireless adapter (the whammy bar was replaced with a 5 dB antenna), and RFID reader was installed inside a video game guitar. This system, dubbed the haxtar, looks like a toy and is easily dismissed as nonthreatening. In reality, this is a powerful portable penetration testing system that even has a strap so you can use it while standing. A wireless presenter keyboard/ mouse combination is used for input. There is enough free space inside the haxtar to add 802.15.4 and Bluetooth as well. The haxtar appears in Figure 1.7.
In April 2013, the BeagleBoard organization released a new board, the BeagleBone Black edition (BBB). This new system has approximately the same processing power as the BeagleBoard-xM (BB-xM) at less than a third of the price. Unlike the original BeagleBone, the BeagleBone Black featured HDMI output making it suitable for use as a desktop system. Like the BeagleBoard-xM, both versions of the BeagleBone can be directly connected to a touchscreen. The original BeagleBone is not recommended for use as a desktop as it is not as powerful as the BeagleBoard-xM or BeagleBone Black. A desktop system based on the BeagleBone Black is shown in Figure 1.7.
From whence cometh The Deck
I have been asked on multiple occasions where the idea for The Deck originated. Prior to developing The Deck, I had done considerable work in the field of USB mass storage forensics. In conjunction with this work, I had the privilege of presenting a microcontroller-based pocket USB mass storage forensic duplicator at the very first 44CON in London in September 2011. One of the limitations of the microcontrollers I was using was that they did not support high-speed USB. This meant that the devices I developed were perfectly fine for duplicating USB flash drives, but much too slow to be used for larger storage media such as external hard drives. I wanted to recreate my USB forensics work with support for high-speed USB.
As luck would have it, I exhibited several of my microcontroller-based devices at Maker Faire Detroit in summer 2011. I just happened to have a booth right next to Jason Kridner from the Beagle-Board organization. The BeagleBoard-xM had been recently released and Jason was doing some impressive demonstrations over the two days of the show. I had never heard of the BeagleBoard before, but immediately saw lots of potential in this little board. I filed the BeagleBoard away in the back of my mind as something to use for a future projects.
When I decided to extend my USB work to support high-speed USB, the BeagleBoard-xM was a natural choice. As I started working with the BeagleBoard-xM, I quickly realized that to use the board solely for creating a forensic duplicator would be a real waste of some nice hardware. I decided to create a penetration testing device. Before I knew it, I found myself creating my own Linux distribution. I became so engrossed in creating a device for penetration testing that I almost forgot about the forensics functionality. The forensic functionality is provided in a module known as the 4Deck, which was released simultaneously with The Deck 1.0 in September 2012.
About the author:
Dr. Philip Polstra (known to his friends as Dr. Phil) is an internationally recognized hardware hacker. His work has been presented at numerous conferences around the globe including repeat performances at DEFCON, BlackHat, 44CON, GrrCON, MakerFaire, ForenSecure, and other top conferences. Dr. Polstra is a well-known expert on USB forensics and has published several articles on this topic. Dr. Polstra has developed degree programs in digital forensics and ethical hacking while serving as a professor and Hacker in Residence at a private university in the Midwestern United States. He currently teaches computer science and digital forensics at Bloomsburg University of Pennsylvania. In addition to teaching, he provides training and performs penetration tests on a consulting basis. When not working, he has been known to fly, build aircraft, and tinker with electronics. His latest happenings can be found on his blog: http://polstra.org. You can also follow him at @ppolstra on Twitter.