Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

Video RSA: The Pwn Pad is an Android Tablet-Based Penetration Tester (Video) 46

Posted by Roblimo from the use-this-device-for-good-and-never-for-evil dept.
Video no longer available.
Last year Pwnie Express showed us their Stealthy Pen Test Unit that plugged directly into a 115 VAC wall outlet. This year at RSA they're proudly displaying their Pwn Pad, which is a highly-modified (and rooted) Nexus 7 tablet "which provides professionals an unprecedented ease of use in evaluating wired and wireless networks." They list its core features as Android OS 4.2 and Ubuntu 12.04; large screen, powerful battery; OSS-based pentester toolkit; and long range wireless packet injection. If you can't see the video (or want to read along) the transcript is below.

Oliver: Hi. My name is Oliver Wies, ‘Awk’ at Pwnie Express. I am a developer for different mobile pentesting platforms. This is the Pwn Pad, and I am going to give you a little demonstration and talk about it.

Tim: Please. Can you talk about the hardware first? What is it that you are holding?

Oliver: So this is a Google Nexus 7 tablet. It is running Android Jellybean 4.2.1. And then with a recompiled kernel to support packet injection and the Bluetooth stuff. And then underneath is a Ubuntu CH root environment with all the different security and hacker tools installed.

Tim: Now talk about what are some of those tools? What do you have installed?

Oliver: So, we have a wide range of cutting edge wireless tools installed on here, as well as the standard network tools. So, the wireless side, we’ve got the Aircrack-ng Suite, there’s Kismet Newcore, that also works with the Ubertooth. There’s Wi-Fi, which is frontend to Aircrack-ng for automation. There is Hostapd which is another that can be used for an Evil AP. There is the FreeRADIUS WPE stuff, Asleap, EAPeak. So there is a lot of capabilities of doing enterprise level wireless pentests. And then there is also some Bluetooth tools as well, Bluelog, Bluebugger, some basic, the Bluez Utils suite, and then the Ubertooth tools as well. And then on the network side, we’ve got Tshark, Tcpdump, SSLstrip, Dsniff, Ettercap-ng, the Social Engineering Toolkit, Metasploit, Easy Creds, and an OpenVAS vulnerability scanner.

Tim: Now the software under here is [Intensity]. It is open source, it’s well known, so talk about how it is different from somebody picking up a Nexus 7, like what it does take to make all these things work on this hardware?

Oliver: Well, a few months that is for sure. Basically, installing an Ubuntu CH root environment is pretty trivial these days on an Android device, granted you have enough space and you have rooted your device, so you have root access. But once you do that, in order to get these kind of devices working with it that you packet injection, you have to recompile the Android kernel to support those modes.

Tim: Why did you have to put on the Ubuntu environment at all?

Oliver: Because a lot of the standard tools won’t just run in Android. Android is Unix-based. But it doesn’t have a lot of the libraries and a lot of the tools that a full Ubuntu Linux has which is why we chose that.

Tim: And what kind of work went into actually making the tools work, once you had those big pieces on?

Oliver: Yeah, there are a lot of tools that are pretty standard in the Ubuntu repositories that you could apt get install but there are a lot of the latest cutting edge ones like Kismet and Ettercap-ng that you have to compile from source. Also some of the other wireless tools like MDK3. We put the latest version of Aircrack on there as well. A lot of the really cutting edge tools you just can’t find in the Ubuntu repositories, especially for ARM because this is ARM processors. So I ended up compiling them directly on the device itself.

Tim: Now we are at a security show and I presume you have been running this here at the show.

Oliver: Most of the time, yeah, we’ve been doing quite a bit of demos, just showing that things will connect, AT&T, Wi-Fi specifically, things will just connect to that automatically, and it is very easy to just show, I’m going to show you right here, that even though this isn’t doing anything evil except allowing people to connect, it will show that basically a lot of devices are just going to automatically connect to an open network when they see it. And it is also using Airbase, which is pretty aggressive. So you can start to see things connect.

Tim: So even at a show like this people are not as security conscious as maybe they should be?

Oliver: Even at a show like this. Yeah, you think that at a security show people would be conscious about turning their wireless off, but it’s not the case. Convenience, the convenience factor is always going to win in the end.

Tim: Now is this an outgrowth of the Pwnie Plug? The earlier product, the plug that was here last year? And that is still available?

Oliver: Yes. That is correct.

Tim: So how does this differ in what capabilities it offers?

Oliver: Well, this is really good for doing a wireless assessment; it looks really sleek, it is really easy to use, a lot of the tools that would take the time to sit down at the laptop and set them up, they are already pretty configured. You basically plug the adapter in and hit the icon and it goes. So you can very quickly assess the security of a wireless environment, you can see what a Bluetooth environment looks like, you can even attack the wired side, but it basically just takes a lot of the well-known tools that require a set up and make them easy and quick to use, and the shell as well, and of course, the plug doesn’t have a nice screen and a quad core processor.

Tim: Or a battery?

Oliver: Or the battery, yeah.

Tim: So you could I guess leave this and book shop for a while, and come back?

Oliver: Yeah, one of the tools is the reverse SSH shell, so you could leave this somewhere and have it connect to an SSH server somewhere else over the 3G network and then get into it, and start hacking wireless from there, so you just enter in your address in the port and then it will connect back and you can leave it.

Tim: So what does this cost? And what goes into that? For instance, I see you’ve got a different wireless card on here, can you talk in detail about what’s the wireless that you’ve got attached to the back there?

Oliver: Yeah, so this is a TP-link adapter. This is a unique card in that it supports a packet injection, monitor mode and wireless promiscuous mode, which lets you do sidejacking.

Tim: And how is it attached to the device?

Oliver: So this is just a standard OTG USB cable. One of the really nice things about Android devices is there is a lot of support for USB, so you can practically plug in any USB device and access it through Android. So flash drives, keyboards, mice, and now adapters with the kernel work that we’ve done. So this is like a long range wireless card. It also comes with a small Bluetooth adapter. It also comes with an USB Ethernet adapter, so that you could plug it into the wire. And the price on the product it also comes with this nice case with the Velcro. And the price point on it is $800 for the whole kit, but if you have a Nexus 7 the software will be available on our website to download, and you can get the adapter separately.

Tim: And the kernel work you’ve done, that all goes back upstream?

Oliver: Yeah, basically, we provide it to the community; all our stuff is open source so it is available.

Tim: And if someone didn’t want this, who are you competitors? I mean, you’ve got an open source portable thing?

Oliver: Yeah, I mean this is really the first time we have seen an Android device doing packet injection publicly that we know of. So it is hopefully the first of many, but it is kind of definitely a new thing.

Tim: And what kind of reaction have you gotten from people?

Oliver: People are psyched. People are really excited about it. The Pwn Phone was great, definitely a different piece, it was already running Linux, had an internal card that supported packet injection and monitor mode and this is kind of a whole new realm. So it’s really coming together.

Tim: And as a developer, where are you based, and how distributed is the company right now?

Oliver: We are based out of Vermont, and we started out as three people, and now we are about fifteen, and we are planning to continue expanding, and we will probably start popping up all over the place.

Tim: What should we look for next?

Oliver: Well, I think there will probably be another phone on the horizon soon. I mean this is our first tablet, but expect to see another phone soon.

This discussion has been archived. No new comments can be posted.

RSA: The Pwn Pad is an Android Tablet-Based Penetration Tester (Video) More

RSA: The Pwn Pad is an Android Tablet-Based Penetration Tester (Video)

Comments Filter:

  • Pwn Pad Passes Perl Philter Phor (Score:2, Insightful)

    by Anonymous Coward

    Duplicates [slashdot.org]

  • Nice Tablet (Score:3, Insightful)

    by jackb_guppy ( 204733 ) on Thursday February 28, 2013 @04:09PM (#43039163)

    I good see the hardware/software is flexable - even in these days of walled gardens.

    My wife just got me a TP adapter, so I now have a net project to look forward too.

    • Agreed. Potentially any Android device could be used. Can't wait to see the looks I get when I start wandering around my city with my Android phone with an TP link adapted connected to the OTG adapter and a Pringles tin taped to my head!

  • If you can't see the video (or want to read along) the transcript is below.

    Where? If I may ask? Are we engaged in some kind of mediocrity?

  • Sooo... (Score:2, Informative)

    by Anonymous Coward

    It's an $800 sub-par tablet with a bunch of free software installed that any "pwner" worth his/her salt should know how to get on their own. Meh.

    • My thoughts exactly. You could have this exact hardware setup for a third of the price and roll your own software. If you forego the Nexus and (and ability to install a working Ubuntu dist) swap that with one of the cheap Chinese made tablets (many have full size USB ports already!) then you'd be in the sub $150USD range.

    • It's an $800 sub-par tablet

      My Nexus 7 cost £200 (~$300). And I've yet to find anything it can't do (within reason).

  • I was hoping it was some sort of low cost, easy to use, material hardness tester attachment :(
  • All of this has existed for some time. Unless you don't know have the knowledge to do this, or the ability to follow a guide, this is really just an overpriced MID from China.

    Hak5 covered the USB dongle + sniffing, etc part of it. The rest is just compiling the tools which are free and possibly cranking out an Android gui for a few of them.

    • Re:Not Really Revolutionary (Score:5, Insightful)

      by Lunix Nutcase ( 1092239 ) on Thursday February 28, 2013 @04:37PM (#43039469)

      They don't claim it's revolutionary. Also the integration and pre-configuration is very important to many people who would be interested in such a product. Much more so than your dimissive comment would make it seem. Sure, one could buy all the parts separately, recompile the kernel and all the software and put it tall together hemselves. On the other hand, most people's time is not worthless so the price is worth the fact that one can be up and running immediately.

    • Re:Not Really Revolutionary (Score:4, Interesting)

      by DarkTempes ( 822722 ) on Thursday February 28, 2013 @05:01PM (#43039751)
      First of all, this is neat. I've used usb host mode on my HP Touchpad to run a wireless adapter for kismet before just to see if I could.
      But mostly I don't think this is for consumers or enthusiasts .

      Let's say $300 for the most expensive nexus 7 and they're selling this for $800.

      Maybe $100 for all of the other extra hardware (very generous as the wifi adapter is $15-20, etc)

      That means you're paying $400, half of the device, for them to: compile a custom kernel for android (turn on packet injection), install an ubuntu chroot, install most of the packages from apt, and build a couple of them from source.
      They're using an ubuntu chroot so no need for android custom gui apps.

      $400 is a pretty hefty convenience cost but I guess I could see where for business purposes that would make sense for some people.

      • You're pretty much dead on with your numbers:

        32GB Nexus 7 w/ AT&T 3G - $300 [google.com]

        TP-Link TL-WN722N (atheros usb wifi) - $20 [newegg.com]

        Sena UD100 (Bluetooth USB) - $40 [sena.com]

        USB Ethernet adapter - ~$30 (really? Damn!)

        OTG cable (host mode) - $2 [amazon.com]

        I wonder how long it takes them to compile/load all those apps? Would be interesting to break it down and see just how much per hour these guys are charging.

        • Couldn't they make a script where they plug in a new nexus 7 and it roots and images a device based off of the initial working device and they're good to go?

          That leaves 2 months of sunk costs working on the initial setup (what they claim in the video) and handling packaging/billing/shipping/tax.

          • Don't see why not; heck, they can probably use scripts to automate the whole process, I know I would.

    • Re: (Score:2)

      by AHuxley ( 892839 )
      They had to recompile the android kernel, get Ubuntu on, they compiled tools form source to get the newest versions - for ARM.
      So all the person has to do is plug the wireless usb device in, click the icon and then see what the surrounding wireless/wired network is like.
      The other point is the battery, quad core cpu and work done on usb hardware to inject into wireless.
      Its all open source too :) The news is its public for Android.

  • Advice For Doing Interviews (Score:3)

    by CanHasDIY ( 1672858 ) on Thursday February 28, 2013 @04:34PM (#43039433) Homepage Journal

    Tim: Now is this an outgrowth of the Pwnie Plug? The earlier product, the plug that was here last year? And that is still available?

    Oliver: Yes. That is correct.

    Tim: So what does this cost? And what goes into that? For instance, I see you’ve got a different wireless card on here, can you talk in detail about what’s the wireless that you’ve got attached to the back there?

    Oliver: Yeah, so this is a TP-link adapter. This is a unique card in that it supports a packet injection, monitor mode and wireless promiscuous mode, which lets you do sidejacking.

    Word of advice: try letting the interviewee answer the current fucking question before you ask another one.

    I, personally, would like to know what the cost will be, but thanks to Timmy's piss-poor interviewing skills, I'll have to seek the information elsewhere.

    • And the price point on it is $800 for the whole kit,

      Straight from the transcript...

      • And the price point on it is $800 for the whole kit,

        Straight from the transcript...

        Yea, I see that now; 3, 4 questions further down.

        Timmy should have given him an opportunity to answer before moving to a new line of questioning; Journalism 101.

        • No, it was in the response to the question from right after what you quoted.

          • No, it was in the response to the question from right after what you quoted.

            Right:

            And what goes into that?

            There's 1...

            For instance, I see you’ve got a different wireless card on here, can you talk in detail about what’s the wireless that you’ve got attached to the back there?

            #2...

            And how is it attached to the device?

            aaaand 3.

            • No. The end part of what you quoted was the response:

              Oliver: Yeah, so this is a TP-link adapter. This is a unique card in that it supports a packet injection, monitor mode and wireless promiscuous mode, which lets you do sidejacking.

              Right below that is the question and answer from where I quoted:

              Tim: And how is it attached to the device?

              Oliver: So this is just a standard OTG USB cable. One of the really nice things about Android devices is there is a lot of support for USB, so you can practically plug in any USB device and access it through Android. So flash drives, keyboards, mice, and now adapters with the kernel work that we’ve done. So this is like a long range wireless card. It also comes with a small Bluetooth adapter. It also comes with an USB Ethernet adapter, so that you could plug it into the wire. And the price on the product it also comes with this nice case with the Velcro. And the price point on it is $800 for the whole kit, but if you have a Nexus 7 the software will be available on our website to download, and you can get the adapter separately.

              So, as I said it's the very next response after what you quoted. Not 3 to 4 questions further down.

  • RSA has always been one of my favorite hip-hop artists.

  • Hey baby, wanna experience my pwn pad together with me tonight?

  • These days kids can buy these expensive products and it allows them to easily hack into systems they don't understand. If they really would like to hack it would be better for them to learn how to code and write their own software. This allows them to learn responsibility for hacking and their actions instead of "piggybacking" off of pre-made programs and one button software.
  • Quick, be an idiot and pay $800 for a $50 - $200 tablet instead of downloading backtrack and using it in a cheap notebook or even your old notebook you dont use anymore...

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close