Presenting. Uh, correct me if I'm wrong. Lynnwood and beef.
I don't know if I spot that I said that, Rick. OK, take it
away.
Thanks. Let's go ahead and.
Share my screen.
OK, so the first part is gonna be recorded because it did like
half and half. And then the second part we'll do live and go
from there.
Can you guys hear that? Sorry. Should ask first.
Ohh no. You know what?
Unshare your screen and then when you click share.
There will be a little thing on top that says include computer
sound. Click on that.
On that drop menu comes out.
Got you. Let's see.
Hi everyone. My name is Alejandro Bautista, and today
I'll be covering topics of Linode and how to use the beef
tool and Linux.
So this presentation will be split into 2 portions, 1 being
the setup of the Linode server and the second the live attack.
So the objectives of this presentation are launching Web
attack against a targets browser with the implementation of the
two called beef and then we'll use Linode to launch our.
Cloud platform in order to deploy the tool.
But first I wanted to cover what Leonard is right. Linode helps
simplify cloud infrastructures.
With Linux virtual machines to deploy, develop and scale
applications.
In this case it will help support a Linux server to
deploy.
Beef onto other hoes.
Uh, just to highlight the set up, the Linode server first,
we're going to navigate to Linode, com and then once inside
we click create Linode and then create Linode.
Next, we want to go to marketplace. It has different
applications in there, but in this instance, we're gonna
select beef.
Simply clicking the option.
And then we'll go to the next slide.
OK. So on this portion we need to select the the little
options. For example creating a beef password, select an e-mail
that we're going to use and create creating a pseudo
username. In addition, we're gonna create a sudo password.
We're gonna need that later as soon as we launch.
The beef tour right through the Linux terminal.
OK, so we need to change a couple more settings.
One being the region we want to select the closest region to
you.
In this case, I selected Fremont, CA.
From there, it's like the the.
Shared CPU option and then within there you're gonna select
the plan. In this case I selected the Lenovo 2 gigabyte
plan. It's only $10.00 a month.
In order to launch their services from there, we want to
establish a Linode label. You can create whatever your name
you're going to use, and then you're going to add a password
to the label that you created. I kept all the passwords the same
just so it won't cause confusion later on when I do launch the
server.
Another thing too, on the next slide I added a.
Video from a network check to kind of explain the process of
the setup of the server.
OK, step one, let's get our Linux server set up. So if you
haven't already, head out to landon.com/network Chuck and
either set up a new account or get signed in, and once you're
there, let's click on create at the top left and click on Linode
because we're creating a Linode now from here things kind of get
stupid easy. We're going to go to the marketplace tab right
here. That's going to do all the work for us. Check it out and
we're going to search for beef and it's right here using the
marketplace beef will just come preinstalled on a server that we
launch. We don't have to worry about it. So select that and
then we'll Scroll down just a bit to add some settings for
some config here. We'll have our beef.
Options in. The first thing we'll do is set U our beef
account user password. I don't know why I said like that. OK,
just put in something for yourself and then just below
that put in an e-mail address. This can be any e-mail address.
And really, I'm not sure it's used for this installation. It's
just required so you have to put something in there. Anyways,
let's continue. OK, next. And this is just good practice. Best
practice. We'll create a limited pseudo user to be created for
the Linode. So just create whatever user account and then
create a password for that user. Everything else is optional but
just pointing out here real quick. Linda help you set up a
domain for this so you can go a little bit crazy but anyways
it'll do some cool stuff.
By default, so don't worry about that. So let's go down and do a
few more things. First, our region where we gonna put this
thing, put it somewhere close to you. I'm in Dallas. Next we'll
select our Linode plan. I like my shared CPU because they're
cheaper and I'll choose the cheapest option. The node one GB
5 bucks a month. So even if you're not getting this a free,
that's as much as going to be charged for this month. And then
we're almost done. We have to label our box real quick. I'll
name mine attack beef and then a password from our root user. And
that is pretty much it. We'll go and click on create Linode and
that's going to bake and we're going to say, OK, step one.
OK, so before we begin our life attack, I just wanted to
highlight this last point. Regarding the server setup.
Once you hit create, it's gonna hang on provisioning for five to
10 minutes. Then you'll see it turn green, as shown on the
screenshot on the right. That's when you'll know that the
service operational.
From there you go grab the egg.
Everything IP addresses and then use that Kelly terms, which I'll
show next live.
OK. So those are some of the references that I got the
information from. Then I'll just uh.
Go in here.
So this is a server that.
I created it from using those steps, so we just go ahead and
power it on.
Give it like a minute and then it should boot on. Then I'll be
able to launch a.
The Kelly Vienna had set up.
Because you can log in here.
OK, so now that it's running, are you open up two VM's just so
I can test the the attack on?
So the left one is going to be the Jelly Bean that it's set up,
and then the right it's gonna be the windows VM. So what I did, I
created 2 emails to.
Create like a scenario of a phishing attack. So on the left
I created a template.
With the with the link and I'll show you here shortly.
But first, we're gonna.
Go in here.
Is the route that was, uh populated in the server?
We're going to copy this.
Then we go back to.
Our Kelly Vivian.
We're going to sign in, so we're going to use that password that
we created earlier.
OK, so now that we're in, which just run the cat command, so it
can't.
OK. So we're gonna grab this link here and just open it.
It should take us right to our beef page.
No, the username you can change, but I left it as beef and then
the password. You can use the same password password we use to
create.
Within that Linode.
OK.
Alright.
So it's important to like read through this because sometimes
when you hook a browser.
These will be on and off, meaning the browser that you
heard some of the commands, you won't be able to run if they're
shaded off. If they're green, then should be able to use them
on the target.
And then the the links here. So we're gonna copy this link here
that advanced version.
And in theory, right, like when you create the the template for
the phishing attack.
Uh, this link here actually was the link from from here. I what
I did was I right clicked it.
Change the the format of the link to resemble a real link, so
when it goes to the person that you're attacking.
Let's see.
They won't know the difference, right? Because you.
Because they they look at it at first glance.
Then they click the link.
OK, then you should have control there. The browser now, right?
You'll see a populated over here.
OK.
By simply clicking the link, you'll have all the information
on the target computer.
Shown here you can also see the logs of when if they log on and
log off.
A command you can run commands as well. Jose show here.
Let's see which one they want to use this one.
And which is it execute?
And should populate on the sound.
It didn't pick it up.
Ah, there you go. See on the right hand.
Right hand side. You'll see the.
The alert that we sent from the attacker attack VM to the target
VM.
Let's see. We can run other commands as well.
Social engineering attacks. We can send a Google fish attack to
the target.
Up there we go.
So it does. It in turn gives a the target a fake website where
they.
Think that they're logging in and what it does is it tricks
them.
Then on this side you just click the last command that you said
to the target and you can see the the username and the
password that I entered right? Like it picks up the credentials
from.
Just simply clicking that link that they got it initially.
Let's see.
Other things we can use like a redirect link.
Or even ping sweeps. We could do that as well through the.
The framework here.
Let's see.
Then it will redirect the browser whatever you send it
target to.
That's pretty much the the concept I had. It was just more
so setting up the server to get the big tool going. That way I
can hook a browser to see if I can was able to do that and
that's pretty much it. I'm not sure if anybody has any
questions.
Yes, uh. Let's see.
Uh, sorry, I guess nobody has questions. I guess that's that's
it for me.
Good stuff.
Pretty cool stuff. I like how you can just take it over and
then it sends alerts out to the browser saying you've been
hacked.
I the crazy thing is in the process of like setting up the
two fake emails and when I sent the original link to myself, I
I'm not sure if I picked up somebody that was looking at my
network, but like they clicked the link and somehow I got
control there.
They're they're browser in in turn.
I was trying to hack myself, but instead I hacked you.
Yeah, that was that was trying to figure that part out. So I'm
not sure if it was like a glitch or something.
But yeah, that's pretty much it.
Cool stuff.
Alright, well up next we have a Noah Hansen with OPN sense
firewall.
Yeah, somebody get my screen shared here.
Go and see my screen.
Yep. Just remember, if you get a share, any kind of videos or
Internet share with sound or with audio on it.
Yep, we are good. Alright. My presentation is on open sense.
Firewall.
Uh, so opensense I'm sure a lot of people have heard of PF
sense. It's just an open source. Next Gen. Firewall is created by
the same company that made pfsense. There was just a group
of people within that company that kind of had different a
different creative direction that they wanted to go with open
sense. So they split off and made this.
I figured instead of just telling you a bunch of facts
about it, I would show you how to set it up in a VM so you can
play with it on your own. Next Gen. firewalls are kind of
becoming the new thing, so they're good to have on your
resume. If you're looking to get into it.
The UM system admin or SoC analyst, or really any part of
it. So.
So the first part, we're just going to head over to the open
sent site to get our ISO file.
So it has a system architecture here. They're only doing AMD 64
right now. Hopefully they'll update it to add some more later
down the road.
And then they have a description of all of the different ways you
can download the image for VMS are gonna use the DVD option to
get the ISO.
And for mere location, this sometimes defaults to weird
places like the Netherlands. You just want to make sure that
you're picking the closest server to you.
And I already have it downloaded so you don't have to sit and
watch me do it.
And to install it, I found that it works better on VirtualBox. I
personally prefer prefer VMware, but it can have some weird
issues with it.
So we're just going to create a new one.
While it opened sense master class.
And for the type we want to pick BD.
And 64 bit.
A memory the website is going to tell you one gig of RAM. Minimum
runs really terribly anything under 4. Once you start adding
all of the plugins and extra capabilities to it. So I was due
4.
And virtual hard disk is fine.
VDI is fine.
And dynamically allocated spine I like to go up to 32 gigs for
this as well because some of the updates and stuff can take up a
lot of space.
And ress create.
And here.
Since we're doing a firewall, we're going want Internet
access, but we also want separate adapters for our land
interfaces. So if you had to host network manager, we just
want to make sure we have at least one host only Ethernet
adapter and next Gen. firewalls can do DHCP. So I just unable
that there.
And in the settings of the VM that you created, go to network.
I also will set 1 to the bridge adapter with your host machine.
This is going to give us the Internet access for your Wan
interface and on a separate adapter I do the host only for
the LAN.
And it's also a good idea to just hit advanced and kind of
take note of the Mac address.
Of the adapters, so I'm just going to pull up.
Yes.
A copy of the Mac address down for the bridge adapter and just
mark that as my Wan.
And I copy my host only adapter from Alan.
And last but not least, we have to hit settings and go to
storage and that ISO file that we downloaded we wanna enter.
Insert that into our optical disk drive.
There's my ISO.
And we could press OK and start it up.
So basically the difference between the next Gen. firewall
and a regular firewall. It's just next Gen. has extra
capabilities. You can add plugins, you can do IDs, IPS,
DHCP, antivirus and things like that and you can manage Vlans
and stuff within it as well.
So just give this a second to start U.
And this is kind of the same as like a a computer with the
Windows CD that you install the operating system on. So we're
just booting from the disk right now, so we're going to work on
getting it configured so that we can boot it from the actual VM
itself without having to have that ISO inserted.
So this is asking for a configuration import that we
don't have a configuration yet because this is new, so we can
just leave it blank and press enter.
And this is going to move on to interface assignments.
And for now we can skip lags. We can skip Vlans. You can set that
up in the GUI or in in the command line later on. And this
is where it comes in handy to mark the Mac addresses,
especially if you're doing more than just one land interface, it
can be kind of confusing just looking at the.
The numbers here, so I just see that my Wan interface ended in
8414.
And I just matched that up. It looks like that's EM0. So for
the Wan interface, we're going to assign that to Emma 0.
And for the LAN interface EM1.
And this is asking if we want to add any extra interfaces and we
can just leave that blank for now.
And proceed.
So this happens pretty quick. It's just turning on all the
interfaces and making sure everything's assigned correctly.
All right.
And now to get it installed on the VM itself, we have to use
the installer login basically. So the default username is
installer.
And the default password, it's just open sense.
And this is going to bring up the installer and we can
continue with the default keymap. That's fine.
UFC is fine and then this is where we want to make sure we're
selecting the the hard disk that we created with our VM instead
of the.
Optical drive.
And it's going to ask you one more time for sure. You want to
do that, that's fine.
And this is a really quick install as well.
We use these in.
Well, I've used these I guess in my job for sandbox environment,
because you can start it up in Azure and AWS and GCP as well.
So we'll spin up like an open sense VM and then attach it to
some copies of a SQL database or web application to do some
testing and see how the firewall rules are affecting everything
and to see what logs we're coming up with.
Once it's finished installing, you should change your password.
Please change your default credentials for today. I'm not
going to, I'm just going to press complete install for time.
And it's going to automatically reboot.
So once this actually shuts down, what I do is just go into
my devices again and take out the.
The ISO file, just to make sure that it's not booting from it
anymore.
And I do another reset after I do that.
Just to make sure that we're not configuring and spending a bunch
of time on a disk file that resets every time you shut the
machine down.
Alright, so we're all good. We are booted from the hard drive
now and we can connect to it. The web GUI with the LAN
interface.
So let me just get a web browser open.
Let's do.
Right. And it's 192.168 dot 1.1.
And we haven't set up any certificates or anything on the
firewall side, so you just have to press advanced and proceed.
And the default credentials for your admin account is grit and
open sense.
Whoops.
And here we go. So this is probably more familiar for
anybody that has any firewall experience. It's a pretty
typical.
Webgui.
But we have a dashboard here and that we can see some information
system info services that are running.
Gateway information interface information and you can also add
in other widgets. So I personally like having CPU usage
since it's a VM and I like having my firewall log.
I'll put system log in there and then once I add other plugins
and stuff you can add widgets for those as well.
And these are all customizable. You can drag things around so
you have things.
You like them? Anybody that works in cybersecurity knows how
powerful your dashboards are, so it's good to have it set up for
what you like.
And here they make it really easy for you to change your
default credentials, so there's no reason not to.
We go down to system.
One of the other first places you're going to go is this
firmware tab.
And under status is going to show you which version you're
on, since it's an open source platform, it's updating all of
the time, so you want to make sure that you're always staying
up to date. The documentation changes pretty frequently as
well, so you just want to make sure that you're up to date, so
the documentation makes sense. It matches.
And under plugins. Here's all the extra stuff that you can add
on. I'm not going to have all the options here because I
haven't updated this instance of it yet.
Uh, you can see things like.
Different themes that you can add. So I have a dark mode on
the main one that I use.
Umm there's intrusion prevention intrusion detection plugins that
you can download. There is antivirus like clam AV.
Or there's another IPS system called cercada that's kind of
popular.
Not sure where that's at right now.
And all of these plugins that you install, especially if it's
something that you can interact with, will likely go down to the
services tab here.
And you'll just see an extra.
An extra tab open for whatever plugins that you've installed.
But moving on through the list interfaces you have your LAN
interface, so you can change things here. I usually turn IPV
6 off because nobody likes IPV 6.
You can see the assignments that you have, so this is another
spot that you can double check the Mac address on your adapter
to make sure that you have it set up correctly.
They're overview is diagnostics and then under firewall. This is
arguably probably where you spend most of your time.
You can set up aliases, so if you have, you know in production
system you have 100 hosts. You can just create aliases that
represent groups of those hosts instead of having to type in all
the individual IPS all the time when you're creating rules, so
that's really nice.
You can configure Nat.
I have a different rules, so floating rules, LAN rules, Wan
rules.
You can do traffic shaping. You have all your log files here as
well and you can configure these to go to an external log server
as well if you'd like.
How you can configure a VPN?
And DHCP is here as well, so you can change the.
The pool that you'd like to assign to hosts.
Set up default DNS servers.
And all of that gets stuff intrusion detection. This one
is.
Kind of a higher learning curve. There's a lot of confusing
things in the intrusion detection piece of open sense,
but it's really powerful and it's fun to see how it actually
acts with production applications.
And you can change your network time. So if you want a different
NTP server, you can do all that here. So there's a lot of stuff
here. I encourage everybody that's interested in it just to
download it and play with it. There's too much to do and, you
know, even an hour master class so.
Yeah, there you go.
We'll stuff good job.
Good, good.
Alright.
Up next, we have a Jonathan White DNA Center made by Cisco.
What's going on? You guys hear me?
Yep, I can hear you.
Awesome. Thanks for.
Right, it's started on this man. Everyone's presentation has been
No problem.
really good so far.
Open the. Keep it up to standard.
You see the presentation.
Yep. Uh. And just like I was telling everybody else, make
sure if you have any audio or anything like that, just to
share with sound.
OK, got it.
Alright, it's all yours.
Awesome. So let me.
Up. Alright, sweet. OK, so today I'll be.
Umm. Going over the DNA center, this device is really cool. It
was created by Cisco not too long ago. Really great device.
It's very Cisco proprietary so there's a downfall but overall
great device.
So so far for our agenda today, we'll be talking about the DNA
center. What is it? Why am I presenting this single device to
everyone's going over the placement of the device as a
cyber security perspective.
We're going over the business benefits. I like to just display
that because not all businesses wants to pay thousands of
dollars to one device. So I think it's important us in it to
kind of say, hey, this is what's important to the business.
We're also gonna be going over the network operations, how the
DNA center works.
Through normal networking, day-to-day tests next is about
wireless dining center works with wireless really helps it
out again with everything else. We are also going over security
concepts.
As well, with the DNA center.
So UM overview of the DNA center. This thing is a
proprietary device. So it's really only gonna.
Be able to go with Cisco components.
Uh, I'll get to that in a minute that there's there's a lot of
slides that go over that first thing is a powerful management
system. So the system's able to manage all devices into one. So
your Cisco routers, your switches, your ice, your
umbrella, all can be managed within one device. So it's
really just a streamlined way to display all your information
within one. This has AI and machine learning support. So
what this is gonna do is make recommendations on the things we
talked about in the agenda. Just be like your Wi-Fi.
Network. But we'll get into that machine learning what I mean by
that is a baseline. So for the network, it'll set a baseline of
how the network should create, and then after that any
anomalies will happen. Then it'll say, hey, there's a
problem again. Kind of what I explained already streamlined,
complex network operations and did overall just optimizes the
IT infrastructure.
So we're going to be getting into the DNA center placement,
pay attention more towards the left diagram as you can see, the
DNA center is more towards the top, right. If you guys don't
see it, you guys see my cursor, I hope it's gonna be right here.
So this is usually this placement is usually gonna be
with your ice, which is the Cisco policy management or I'm
sorry, sorry. Security policy management.
For Cisco, your Active Directory DNS reduced P is the DNA center
is gonna be right where those guys are because this device is
able to access all the devices on the network. So it is quite
critical we secure that.
So we're going to go on to the next slide.
Again, we're going to go over the just the business benefits.
Again, I kind of already talked about this already. It doesn't
lot of network optimization, this is gonna streamline a lot
of tasks that a lot of employees will spend probably like 45
minutes to an hour doing. I'll get to that and then network
section.
It has optimal and user support, so it really helps the end user
with bandwidth issues. Wi-Fi issues can help get into that
and it also has powerful AI integration. This lowers the how
employees think because DNA center will recommend different
things that on different situations. So it's really
awesome. Really cool.
And this picture right here is one of the AI recommendations.
It's basically showing you the health of.
Application or a network? It just basically goes overall like
what could be better for the network? What could be better?
So we're going to move over to the network operations, uh, this
is gonna be.
All the networking DNA center has, so your routers, you're
switches, your core switches. We'll all be plugged in. All
that data be connected to the DNA center. Now the DNA center
will pop up this diagram. This is within DNA center. It'll pop
up with maybe clients. So phones, routers and switches.
It'll all come out that on this diagram you don't have to go
into like Visio and create a diagram as my previous job I was
a network engineer and this is what we did.
A lot of the time just to just to have that, but it's nice to
just simply just plug something in and just have it right there.
It has automation discovery, So what this means is.
It's a packets will be sent out via the DNA center saying, hey,
is there any of the Cisco devices that wants to connect?
And once the Cisco, let's say I a catalyst 6500 comes in and
plugs in, then DNA center will see that put it on the diagram.
It's got policy driven configuration, so if you have an
access control list you want to put in like a a configuration
for some reason for all the core switches routers.
You can put that within one single click when one single
command. That's it. That's all you have to do. Don't have to
log into every single switch when you're working on a more
heavier IT infrastructure where you have lots of routers and
switches, it really streamlines that process.
As compliance up to date, so basically it ensures all your
components or up to date no matter what it'll say like it'll
say on the DNR center. Hey, we noticed that your routers are
out of date. Please update it. I also have a third party
ecosystem integration that's like your Splunk as integrated
Splunk. With this we already talked about this visibility
health, it has health into your architecture and making sure
that there is no problems within your network.
A great example of this would be.
Uh, throttle down, so there may be an issue with the switch that
might need to just be restarted, but it could be slowing users
down. Your DNA center will come up and say, hey, this switch
might be acting up. Can we please do something with this?
Basically, it'll give you a list of stuff to do, goes on to my
next thing faster troubleshooting. That's one of
the things it has this diagram.
Guided workflows. Exactly what I kind of just mentioned. DNA
Center has a guided workflow that will help assist you if
something may go down if.
Something else may happen on the UH network, just overall. Again,
AI OPS machine learning algorithms. This basically is
setting a baseline for your whole network of what should we
going through and whatnot and if there's any issues or anomalies
or anomalies, it'll pop up and say, hey, this is weird.
So great awesome tool for the UH network. No networking team, so
we're gonna move on to the wireless section. I really love
this design. This is one of the DNA center uses. Cisco creates a
proprietary device called the Wireless LAN controller that
runs all the apps that device connects to the DNA center.
It does cost a lot to make this move, but it is super helpful. I
worked with the wireless LAN controller a lot as a as a
network engineer and let me tell you it's better to see
everything on diagrams. Stuff like I'm showing you on the
pictures, then it is just reading words and debugging and
just doing all that. Just numbers game. I'd rather just
look at it straight from here. It's all streamlined.
Or we're gonna be going over a performance. And what I mean by
AP is access points. So just Wi-Fi in general, the Wi-Fi
devices, AP Monitoring API, so Wi-Fi signals, they have a
problem nowadays because there's more and more why app is getting
put up in businesses, schools. I also used to work and help out
schools for it. And So what a lot of schools have is they have
access points in every single classroom.
And they don't care where they put them, they'll put them in
the very corner of the room. They'll put them in the very
middle of the room, which is great. So there's just a lots of
errors on that part and.
Just going over this diagram is showing the performance is
exactly what we need because AP's they they have this thing
where they need to be on channels and if two AP is that
are right next to each other on the same channel, they'll both
transmit each other and cause a lot of errors and those errors
will make their utilization go up. So they'll be at 100% for
just no reason. So no clients in that certain classroom.
Will will not be able to do or perform their work, so instead
they gotta be on different channels and this is also what I
mean by actionable insights. Top lift right here.
There could be insights on your on your Wi-Fi saying hey, the
intent is saying, hey, this is the issue. What can we do to
solve this in a kind of show you again performance you got your
summary right there of.
What you have now, I wanted to go on the bottom left screen
too.
Uh, the potentially poor client experienced this is what I mean
about the the topics are already talked about with end user
experience. This is super important in my opinion. It's
just saying hey, this client may be having issues because what
happens is at my job we used to have to always constantly ask
the IT staff. Hey is your clients having issues and it was
a constant daily task that we had to do.
Now with this involved, it's gonna really help that users
support so we don't have to keep asking it. It gets annoying when
we have to keep asking them this. All right, let's move on.
I don't want to run on time here. We're gonna go over to
Wi-Fi again, but this time, we're gonna look at the heat
maps. Heat maps are basically.
Wi-Fi transmissions on that's went on to a map. The DNA Center
does this automatically.
As you can see, the little green areas.
Where the green on the left hand side, the wireless 2D map that
those are gonna be. Your AP's that what makes this really nice
is that you can decide what placements you should be doing
and now DNA center is also doing is also creating wireless 3D
maps. So you can map out your whole classroom, your school
district or business.
Within the DNA center and then now you can make a smart
adjustments instead of wasting money on multiple AP or slowing
down clients with just this map alone is an awesome thing. I
really. I also created diagrams for this to help clients get
better service and it was a pain.
So next we're going to move into one of our last things is going
to be the DNA security. I took a look on this. There is some
options with DNA security, again with ICE, we're able to profile
all the endpoint users. We're able to set a baseline saying,
hey, this user connects to the web, this user needs it for a
shared drive for example.
And if the user does something that's very like a weird
behavior, then DNA center will bring it up and saying, hey,
this is kind of weird. Let's let's investigate this.
This also has Cisco or integrated Cisco Securities.
This is gonna be stuff like here umbrella. It's also a another
one the compliance that's gonna be like making sure your devices
are up to date for security reasons and you vulnerabilities
that may be happening.
UM. And with that being said.
We reached the end this. Anyone have any questions for me?
Yeah, I have a couple.
Yeah. What's up, Robert?
I just wanted to double check the uh, the map that you showed
like 2 slides ago that's automatically.
Is that automatically drawn or did you or did you know
Whomever's managing the network have to tell it where these
access points are and what the rooms look like?
So that's the thing that I'm I'm I I was trying to research this.
As as will Robert.
I don't, so I don't have access to the data center or as I'd I'd
Umm.
look into it more. I've been researching this and it.
It does is job, it kind of maps out because it can detect
barriers and whatnot, but I don't. I don't think it does. I
think you're gonna have to create the diagram yourself of
like, what your foundation is everything, but it'll still
create the heat map of everything. So really, you can
just create the whole diagram based on where the placement of
Yeah.
the apps are. And this kind of build from there.
So building on that does are the is there any way to automate
some of the kind of mundane tasks such as you were
mentioning the the apps being on the same channel? If you're
telling it or it knows that the two are right next to each
other, will it automate the task of switching channels to OK,
Yes, Sir.
cool, so it optimizes itself.
So this this is actually the DNA center is actually not do that.
It does not automate that the remember what I said on the
OK.
wireless LAN controller that that's that operates all the
access points, that's the one that you can set it to
automatically do that. But sometimes there might be bugs in
the system where you have to statically assign it a channel
but more than likely it's gonna automatically assign saying hey
you need to move to this channel. So if there's two apps
right next to each other.
Ones that one ones at 11. So the the the how the channels work,
I'm, I'm sorry I didn't explain this is it's one through 11,
right one through 11 and they want to be as far away as
possible. So one app could be at 11, one app can be at one if
another app comes in that one's gonna be at 6. It just starts
creating this chaos of.
Of every AP fighting for a channel that has the best.
Utilization and that's where that, that that's why the this
heat map is so, so important like I wish I had this instead
of driving 2 hours to a client to run scans everywhere, you
know.
Yeah, yeah, I'm sure it helps people decide whether they're
So.
gonna go on the directional or or bidirectional, whatever sort
of interest for them as well. OK, that's cool.
Exactly. Yes, Sir. Yeah.
So any more questions for me?
No, OK, that is my presentation. Thank you guys for listening and
here's my references. It's all from Cisco. So thank you guys.
Cool stuff. Good job.
Umm.
Up next we got Rob C DE Baca ransomware.
Hello everybody.
Wow, everybody went so in depth with theirs. I hope everybody's
still.
A week after mine, alright.
And here we go. You guys should be able to the presentation now.
Correct.
Yep, we can see it.
Yep.
Outstanding.
So, uh, rather than scaring the heck out of everybody with a
live demo of what random we're looks like, I wanna take a step
back and let people know what we can do to prevent it and what we
can do after the fact. If our mitigation doesn't work.
Right.
So let's start off with what exactly ransomware is.
So we're going to be going over what ransomware is, what kind of
types of ransomware. There are some recent examples of them,
mitigation and incident response and thus recovery. If all else
fails.
So First off, ransomware is a type of malicious software. It's
designed to block access to a computer system essentially
until sum of money is is paid, right. This usually involves
encrypting data definitely without consent and without the
provision of the necessary keys to decrypt that data.
It's going to involve communication with the victim's
instructions on how much to pay and how to complete the
transaction, right? A lot of these transactions are not going
to want like a paper trail, so cryptocurrency or like gift
cards is a fairly.
Fairly common foreign currency.
So these types of transactions.
May also involve other malware as to include screen capture,
camera hijacking key loggers.
Data leaks. They can gain access to your data, so any any number
of things can really come up and and cause issues and can be
bundled along with the malware while the main component of it
is ransomware.
So the there's different types, right? But basically break down
to two and then most of them are kind of a a combination of those
two. So the first type is a locker, right? This is, this is
the type of ransomware that's going to lock down
functionality. It's can prevent.
Uh prevents you from leaving either single window or it'll
lock down like just portions of your operating system that can
make it harder to remove the malware to begin with, or it can
make it so it's nearly impossible to use your device
for anything other than directions on how to pay them.
Right.
There's also uh crypto right? This type encrypts the victims
personal data and attempts to ransom it back to them, so
that's gonna be, I mean, everybody's heard of believe,
wanna cry.
Yeah. What are they'll they'll encrypt your own data, not
giving you the key until you pay them the money, right?
Umm. And then like I said, most of them kind of include both of
these.
Uh. And so they'll encrypt your data so you don't have access to
it and they'll block other parts of your operating system,
preventing you from removing where they installed the malware
there.
Some recent examples of this is gonna be Ryuk.
We don't encrypting the data. This malware also blocked access
to Windows recovery right? So even if you were, you know,
diligent about backups and you backed up on your own device,
this particular type of malware would prevent you from being
able to restore your data unless you head backed it up externally
on a separate device, right?
Jigsaw this one was semi entertaining to read about so
it.
Yeah, had some imagery from the movie, saw that character
Jigsaw, right. And it's the name. But in order to reduce the
time to action for the victim, increase their likelihood to pay
and pay quickly, the malware would start deleting data on its
schedule. So as as the hours start ticking by, more and more
of your data as getting removed.
So that's a I can get kind of scary there. And then there's
also gain crab this malware made claims of hacking the victims
webcam and having unsavory footage, it would reveal to the
Internet if the attackers demands were not met.
Uh.
This one also had it in the in the screen that it was showing
to its victims. It was an image of them on their own webcam,
showing that the malware at least had access to the webcam
after the fact, and thus, you know.
Implying that it had access to the webcam prior as well.
Umm, we've heard kind of what it does and what can happen. Right?
Let's go over. You know how to prevent it.
The number one vector for this is going to be the end user,
right?
Umm, so most of these prevention steps are gonna be hinged around
the end user not installing it in the 1st place, right? So
there's a rule of least privilege, you know, in a
professional environment you want to reduce user access to
only what is necessary to do their job.
Umm.
You also want to back up all mission critical data. That data
should be backed up externally to separate devices, right? So.
Backup for each.
Uh, yeah. For each endpoint, and then each server should have
separate backup repository as well.
Of course, uh keeping your anti malware up to date.
Umm and installed and turned on right?
Umm this can be. This can obviously be used personally as
well, but our professional environment you'll wanna use a
variety of different anti-malware technologies,
things that are gonna scour packets as they're incoming,
sandbox things that look questionable, look for
anomalies, and of course signature based as well. Right?
And then.
Uh, training right? The main vector for installing malware is
user error, so you want to train all of your employees and all
the people in your household don't click suspicious links.
For me, I I have to tell my parents and grandparents a
couple times a week. Don't click that. Don't respond to that
text.
But you know it, it gets old, but you gotta keep reminding
people because not everybody's in this field with us.
And so.
What do you do if you, you know, when somebody inevitably clicks
on that link and then calls you, right?
So the first thing you wanna do is you want you want to identify
the threat, right? You want to ensure that you know exactly
what it is.
Umm, where it came from and a lot of times they'll tell you
where it ended up on the system, whether it's in your if it's in
your root files or you know if it's in your system 32 files
spanning what OS you're on.
What have you wanna? You wanna know where it is?
And when it got there, if possible, right the time of the
incident is gonna be really important. For what? If you are
diligent with your backups, right?
If it's not super critical information that you've, you
know, made or created in the past, you know since your last
backup, you can just restore as long as you know when it was
installed, restored to the nearest clean backup.
Umm. And then work from there, especially in a professional
environment where time is money. You wanna go to the nearest
clean clean backup or clean install, right?
And then you wanna find that file. If you can in the
subsequent.
Uh archives or backups and clean it out of there, and then you
may be able to even get a more recent recovery snapshot to
recover too. Doing it that way.
Type.
You're going to want to execute that recovery once you've
identified the closest point to which you can.
Once again, this isn't a this is kind of focused towards a
professional environment.
Umm, the longer you wait to get yourself up and running, the
more money the organization is going to lose. So you want to
get up and running as fast as possible.
And then you want to do a thorough analysis. Uh, you want
to provide assurance that the recovery that you did, but that
you did.
Uh restore you doesn't include that malware. You wanna help
eliminate. You also want to analyze where it came from, how
it got in, and help eliminate that threat vector, right? If
that was a downloaded that was a download link, you really need
to focus more on training your employees, right?
If it was, you know, a floppy drive or somebody who's using.
You know unapproved cloud services, anything of that
nature you wanna you wanna enforce? You wanna be able to
set the rules to enforce what you need to do to prevent this
from happening again.
Umm.
And that's the end of my presentation. Is anybody have
any questions about that?
Hearing none, I'll pass it back to you, Jordan.
Sweet. Good job, good job.
Thank you.
Alright up. Ohh no problem, no problem. Up next we got a Jimmy
Monreal for IT business application. Internet of Things.
Hey, good evening, everybody. I'm just gonna share my screen.
And you see it.
I don't see anything yet.
OK, one second.
Oh, there we go. You're ready to go.
Just make sure you do click share with audio. I'll talk.
Alright, there's no audio on the video.
All right.
OK.
There you go.
Popular everybody still awake?
I know it's kind of late and thank you for hanging in there
with us.
Good evening everybody. My name is Jimmy and today my master
class presentation will be on the Internet of Things business
applications.
So I'm going to start with what is IT?
The Internet of Things, or IoT, is a network of technologies
that have sensors, operating systems and other technologies
and is able to communicate. It is beyond smartphones, computers
and tablets.
The spectrum of IoT devices is wide and diverse. They range
from autonomous vehicles to wearables to rat sensors.
Examples in your home may be the nest thermostat, smart speakers,
your wearables such as Apple watches.
Lt. devices are estimated to hit 14.4 billion in 2023, and the
projected 27 billion by 2025. As of 2022, the average US
household has 22 connected IoT devices.
So how did it work?
It starts with the sensors. The sensors send data to a gateway
over a low power lower network that works in building outside
and even in parking garages.
The gateway then transmits over the network or Ethernet,
depending on the gateway.
This gateway then sends data to the server.
Here in management can access the information, identify
trends, see historical alerts and process reports, all from
sensors that are virtually anywhere through a web-based
portal.
As a standard, another six main categories of IT wireless tech.
1st is low power wide area networks.
Which provide more long range communication on small, cheap
batteries that last years they into support large scale IT
networks over more significant sites. Next cellular such as
3G-4G and 5G which are phone networks needed for calls,
Internet access, video streaming and multiple applications.
However, they're expensive to run and very power intensive.
3rd is Ziggy.
Which is mesh protocols. Uh, which are and other mesh
protocols that are short range wireless and low power standard
using censored data nodes. These boost high data rates but isn't
as power efficient as low power wide area networks.
4th Bluetooth.
Bluetooth technology is short range communication and which
enables data exchange across multiple nodes.
A low power version was invented for small consumer IoT
applications.
5th Wi-Fi not as common in the IT space due to problems with
scalability, coverage and power, loose and finally six is RFID
known as radio frequency identification. Radio waves
which transmit data from A tag to your reader at a short
distance. They're usually used for logistics and retail.
But what are the impacts of IoT?
As it stands, relying on manual monitoring can be costly to a
business, has potential for human error, and may not alert
management to issues in time to avoid costly falling or damage.
I'll T solutions can impact uh. Metrics such as inventory loss,
equipment damage, costly downtime, operational
operational inefficiencies, safety hazards, regulatory fines
and reputation damage.
Let's talk about business applications.
I want to start with the energy sector for IT and I thought this
was really neat.
But I'm gonna start with a hot mess fact.
Which one pound of concrete the production of 1 pound of
concrete emits .93 pounds of CO2 emission.
Which is incredibly not sustainable, especially given
you know the climate that we've heard, the environmental
restrictions that we should be implementing moving forward in
California, a renewable energy company knows he login using
mirrors in the Mojave Desert that are embedded with IoT
sensors and machine learning capabilities to optimize solar
panel placement.
The levels of heat generated from their systems have reached
heights of 1800 degrees. The resulting high energy
concentration could be a massive shift for heavy industrial
processes.
And would replace their current high carbon footprint process
with a far more sustainable form in solar.
This can help replace heavily polluting fuels and by making it
possible to capture missions that are separate part of the
process of making something.
Next is agriculture.
Be application of OT and agriculture is as simple as
watering crops. Ality sensors can automize watering systems
whenever solar levels dropped. The way the system works is in
four easy steps, 1 sensors and actuators monitor solar levels.
2 the changes are communicated using MQTT or HTTP communication
protocols to the IoT Gateway. 3 The Gateway receives and sends
information to the cloud using Wi-Fi before. Once the drop and
moisture is communicated.
The sprinkler system turned on.
The info stored on the cloud can be used for analysis, which is
probably the largest benefit time the time that the timing of
the activation, the rate at which moisture drops and the
amount of water used can all be monitored and analyzed.
A sensor that this is an example of a great sensor that can be
used. It is pretty much an all in one solution. It offers
monitoring of CO2 levels, temperature and humidity. Total
volatile organic compounds, motion detection, barometric,
barometric. Can't talk tonight. Pressure and light sensors as
well.
Sorry this things not changing.
There we go now to retail.
In retail.
The applications are numerous. I picked the four that stood out
to me the most. They're interesting and this is going
back to that rap trap. Rat traps. Sensors can help
eliminate the expenses of having to hire someone and monitor.
It's a game. It's sure he is.
It's pretty funny, indoor tampering, so this will be able
to monitor price, list, equipment, jewelry, stuff like
that, stuff that shouldn't be moved. I will be pretty much
monitored 24/7. There's also a door monitoring which helps in
retail, for analytics. So they be able to attract the foot
traffic footsteps that are of the client bases that are coming
in going out.
Uh, you could set it up to capture anytime someone walks
in. The door is open, you can set it for you know, 10 minute
intervals at a time as well and stuff like that. And finally,
perimeter monitoring for security purposes, obviously.
In the event that there's a break in or if there is an
accident that happens, you'll be alerted to instantaneously.
Temperature monitoring is another example of the
application of perita pharmacies, restaurants,
convenience stores, grocery stores all have a need to ensure
items are stored at the right temperatures. In some cases, it
may be regulatory requirement to ensure food or other perishables
are kept at the right temperature.
In all cases, inventory can be a total expensive loss of
temperature or not maintained.
And worse.
If it's not discovered, the temperatures are not maintained
and the items are Slater sold. That could result in a public
health issue, lawsuit, reputation, damage or worse
deaths.
The next sector or vertical is gonna be hospitality.
I want to start with two facts. Over 14% of sexual harassment
charges filed in the past decade occurred in the accommodation or
food room service industries. More than 25% occurred in
industries dominated by service sector workers.
It's an unfortunate step, but something that I IT can
definitely help with.
In the example I have here is a push emergency system. It's a
one but one click, but what this does is workers can carry a
lanyard and press a button if they need to. The designator
responders get an immediate alert and location of the
employee. The system tracks the employee if they're on the move.
This works anywhere within range of the gateway. In building
outside, even in parking garage.
But due to the nature of the system, the solution is
something that has to be professional installed by
vendor.
And this is an example of how it works. So similar to what I
described earlier, where the sensors send the data to the
gateway, the gateway transmits to the network and from the gate
or using the gateway and then it is sent to the server. The main
difference is the implementation of Bluetooth nodes which will be
able to provide a more accurate second by second location of the
wherever the saying is coming the signal is coming from.
Another aspect for hospitality is indoor air quality.
And everybody knows where I'm going with this, but we just got
out of a pandemic and I wanna leave with this fact. Most
people spend about 90% of their in their time indoors where
balloons can be twice to five times and occasionally 100 times
higher than outdoor levels.
And to relate to the application indoor air quality inside
schools and workplaces impacts not only comfort but also
health.
Symptoms such as headache, fatigue, trouble concentrating
and illness may accompany poor air quality due to improper
ventilation, lack of temperature control and extreme pie or
extremely low humidity.
What about IT and manufacturing?
We're currently in industry 4.0.
But her to understand and appreciate what industry 4.0 is,
let's start from the beginning. The first industrial Revolution
came about with the creation of the steam engine in 1784.
Industry 2.0 came in the late 1800s thanks to the introduction
of the assembly line and electrical energy. But in fact,
Henry Ford is credited with the creation of the now famous
assembly line, the same one that we use from automotive
production to McDonald's Assembly, one for their burgers.
With third iteration came with the implementation of computers,
electricity and other technology that help automate
manufacturing.
Industry 4.0 refers to you or current era, which utilizes
automation, computers and electronics on another level.
In this iteration I OT machine learning and big data elevate
the ecosystems entry in which they are implemented.
And the numbers don't lie. There has been a significant impact in
this industry.
I'm namely the reduction of costs.
Obviously, operational efficiencies being improved and
with safety seeing a significant boost at 23% year over year.
Next is logistics.
From 2020 to 2021, U.S. business businesses, transportation costs
have risen 22%. It's only 1.85 trillion in the same period. The
cost of storing inventory increased 26%.
Now.
As the world shrinks and ask, you know, everything's being
transported.
How do you localize everything? How do you locate or track your
packages, your inventory?
Well I IT provide provides a solution in the form of acid
tracking.
This is an example of a acid tracking sensor.
It is fully autonomous, so you don't have to connect. You know
to Wi-Fi or you know, like anything hardwired essentially
provide secure, accurate location of the environment
environment and as well as physical conditions of the
device.
The impact obviously for logistics is huge. It prevents
asset loss, theft or damage using on demand access to real
time location, environment and physical condition data. You're
able to track your assets virtually anywhere so you can
maximize utilization and minimize downtime. The solution
integrates smoothly into your operations, which is an easy to
use web and mobile based app and self installation with self
installation options.
Now these solutions sound pretty awesome, but there are concerns.
A few of the main concerns uh, at a high level?
Are going to be visibility.
Is it just like super bright, like the entire world's flash
banging you?
Alright, mic, check IT. Security challenges, visibility, security
Uh, we.
integration, open source vulnerabilities, and then STATA
volume port testing unpatched vulnerabilities, vulnerable API
and weak passwords.
Jimmy, we can't hear you anymore.
Uh, man, I'm heating myself.
Included was that last slide.
It's OK. We all do it.
Alright, so that last slide, you didn't hear anything or since 1?
Just the the 2nd to last one.
Man, that was the funny one. Let me go.
I will go back and do it.
Alright, so this one alright, so trouble brewing in 2015, trouble
That one, yeah.
began to brew for users of a smart kettle in London.
It had virtually no security in place, leaving unsuspected tea
lovers vulnerable. The hacker claims he could sit outside of
victims place with a directional antenna pointed at their house,
knocked the kettle off their axis point, make it connect to
themselves, didn't take commands, and the kettle would
disclose the victims Wi-Fi password.
So this is an A great example of uh, you know, just rushing to
production and not in, not fully testing or.
Identifying the proper security protocols that need to be in
place.
So how do we address this?
It is important to be as meticulous as possible when it
comes to managing IT security. The strategy must be consistent,
must consist of a variety of tactics and tools, while
simultaneously factor in relational systems such as
networks.
It can be broken down to three general keys for a good robust
security solution, one learn use solutions in place that provide
clarity of the network to assess the risk profiles for each group
of biotic devices. Provide education for all stakeholders
along with best practices.
Two to protect, create, implement and force and
reevaluate IT security policies.
3 segment implement segmentation for IoT systems based on the
risk profile.
And that concludes my presentation.
Cool stuff, man.
Thank you.
Alright, last but not least, we have Cassidy Sanchez with
ethical hacking with wire shark.
I Cassidy, are you muted by chance?
Oh, sorry.
I didn't realize you had a prerecorded presentation, OK?
Cassie, just make sure that you when you shared your screen,
make sure you click on where it says share. There'll be a
dropped down. Say include computer sound. Make sure you
click on that too just in case. I don't know if you're sound
starts right away on the video, but I just wanna make sure.
There we go. Perfect.
Hello everyone. My name is Cassidy Sanchez and today I will
be talking to you about the ethical hacking with Wireshark.
I do want to apologize. I am sick.
Umm and I have a lot of stuff running on here, so if there's
any delays and the feedback, I do apologize beforehand.
OK, so to get started for my project I wanted to simulate how
Wireshark is used to sniff out weaknesses in the system.
Uh companies use water shark to help protect their network and
to help troubleshoot issues. However, it can be used for
malicious intent.
So during this demonstration I will show you how war shark can
tap into a voiceover call.
And other ways it can be used.
Hope you enjoy.
So first I wanted to go over the applications I used.
To put this presentation together.
I use the wire shark, zoiper. Avoid the mess virtual machine
and GNS 3.
OK, so virtual machine you go and pull this up.
That's my virtual machine. Virtual machines are a.
Computing resource of software instead of a physical computer
running hardware, it's a virtual machine of a virtualization of a
computer.
With all the functions of physical computer and it
implements hardware and software. As you can see, I'm
running Oracle virtual machine box with the buntu Linux 22.10
version.
All this stuff is free, easy to download. If you've definitely
done it before.
They'll be links at the end.
Of the presentation.
Of where I got this.
OK, next.
It's like for five Zippers, 3 it's a SIP protocol. It is a
soft phone. Anybody who's ever worked remotely, probably very
familiar with the soft phone, and it uses the voice over
Internet Protocol. So void is where you can call someone over
the Internet if you've ever used WhatsApp or messenger.
You've you've used white before.
So yeah, substance for this season terminating
communications and it's a networking protocol that enables
the voice.
OK to enable my.
Sniper.
Me. Go ahead and pull this up over here. Forgot to show you
guys.
I'm hitting the wrong buttons over here.
This is my phone. Obviously it works. This is Super 5.
Don't worry, these phone numbers have probably already been.
If they're not already blurred out, if I wasn't able to do
that, then they've already been deactivated. So if you call them
now, nothing will will happen. That's why. Prerecorded.
OK. So moving on The Voice from S, it's not free. Very cheap
though. I think the total how many times I had to call myself
to practice prior calls me about maybe $20, which it was OK. It
was cool to mess with it and figure it out. I've never tried
to call myself before Maria shirt and all that. Still kind
of fairly new to me, but.
Let's go. Hacking has always interested me, so that's why I
decided to do my project on it.
Uh, so with them asked me go ahead and bring this over here.
OK, this is what it looks like. You can create subaccounts. This
is where I went to.
Umm.
Create multiple phones so I could have one on my virtual
machine and.
Have one actually on my computer itself as well.
OK.
Over here, if we go to advanced you can see it's uses the SIP
protocol.
Uh, it is not encrypted.
So I can go ahead and minimize this.
OK. Like I said, it's a cloud based VoIP provider. Security
features covered it.
OK.
OK. And where? Shirt. So wire shirt is used to the genus 3,
but for this presentation, for the sake of lack. And then and
my sanity, I will just be doing it through the regular
application.
So this is Wireshark here. So why let this load? Why give you
a little bit more information about it?
So we're shirt can be used in genus 3, but it's also an
application. Like I said, it's a real time network packet
analyzer.
Worship can capture and view suspicious data in your network
and can help troubleshoot network issues. Even though
we're shark can be used for malicious intent, is still very
useful for cybersecurity.
OK, whenever you first open Wireshark, we're going to see
here.
Ohh my virtual machines are running. I have to wait for that
to load while this is loading up, I'll go ahead and display.
My virtual network that I have here.
Because you have the virtual networks.
OK. We'll go ahead and go into here and I'll just play this
other one first then.
OK, so as you can see it opened it wireshark's running.
And this first box here is called the packet list.
Where packets are coming in, everything that's going to my
network is coming in. You can see it right here. You can
refresh it, stop it.
Restart it to choose a different one. Uh, different network path.
No, such as Wi-Fi or whatever my laptop is.
Set up through hardware right now.
You can see the source IP address, what time they come in,
the destination IP address, what protocols it's using, the length
and information about it.
These packets.
OK, you have the filter here. I can filter the protocols to see
see if I wanna see something more specific like HTTP.
It stop it typing HTTP.
OK, so for this let me go ahead and say say I want to see slides
that are being used on my network. Say I over here, you
know, if you click on one and you look, it's not really gonna
show you the name of these websites or anything. It's just
gonna show you IP addresses and for average highest, we're not
going to look at this. So I'm going to open up my Internet.
If it decides to ever open.
Sorry, this is what we're talking about.
It's over here. When I look this up real quick.
So let's look up something like.
So that's probably not gonna come up. That's insecure, right?
So we got some Cisco and misspelled it. Obviously it's
not secure. It's up, it's on my network.
We're going to stop this packet filter.
Are going to go up here and we're going to search for HTTP
because obviously we know HTTPS secure. One HP isn't the host
we're gonna look for this. So we see some suspicious stuff in
here, right? So let's call this HTTP.
We're gonna look.
Again, it doesn't show us the name of this website, but we
know it's probably not secure so.
It's going to this statistics.
GDPR.
Low distributor.
And now we can see exactly what website I went to.
Right there.
So that's how you checked back fossil connected to Ubuntu.
Some other stuff in here.
OK, so that's how you check that out.
It does show.
Sorry.
Ohh, seems annoying.
OK, so a little bit more about wire shark.
This one is that called the packet bytes.
Uh, share quick. It's the detailed and this is the
detailed packet. You click these, it'll highlight what
exactly if you see down here, it's highlighting more. This is
the hexadecimal and it just displays more in detail what
exactly we're looking for in here just in case not really
used that often.
OK, so let me.
Go back here.
And.
Did I completely skip over a whole?
It's down because it was causing major like if I open it again,
it's just extremely slow. So we're gonna keep that off. I've
already have my Wireshark open and running between the two and
my switch to capture the web call.
So we're not going to stop that. This is just like more visual
representation of.
What's going on?
So I've already learned my buntus together. If you look and
back into my VirtualBox right here.
How I did that was.
I wouldn't here went to settings, took a lot of
research.
But I had specific adapters to connect these two together, fill
in the IP addresses so whenever.
You put any virtual machine on here, including the the GNS 3.
Oracle or any VirtualBox or machine configures it to the
same IP address. So I had to go in here and change these.
You know, went in there and obviously I went in there,
changed on and by giving them their separate networks,
creating a virtual network infrastructure, it allowed me to
do that.
OK.
So let's go on to this wiretap real quick.
So let me go ahead and bring over my phones. This is the one
on my computer.
This is my virtual machine.
OK. And you can see these two are different, like I said,
these numbers do not work. Please do not call me.
OK.
They're different casters, they exploit, so I'm going to do is
I'm gonna call my phone. Let's go ahead and pull up Wireshark
through here and start this capturing first. I forget.
Take off this filter.
OK, so make the call and I'm just going to apologize for the
feedback. Go ahead and call.
If it picks up sometimes, I might have to do it two or three
times.
Sometimes if it doesn't call it when I have to call the other
one.
So let's try this.
Calling this.
Unless I called myself.
The other one I called myself.
There we go.
Clicking the times they got it. OK, so I'm going to answer you.
You can hear the feedback feedback and I'm talking to
myself, talking to myself and bully. Wanna good?
Of course, it's going to break up, break up because it's on
one.
Alright, goodbye.
Alright, so that calls over.
So we can get these out of the way now.
That was another $0.05.
OK, let's get this back up here real quick. I'm going to stop
it.
And what I'm gonna do is I'm gonna look for.
Real time protocols.
OK.
See, there's a few.
Here.
So we could see.
A lot of stuff going on here, so let's we're going to do is we're
going to decode it first.
That's RDP.
Sorry RTP.
Click one.
Now let's see if there was any telephone calls.
Here.
Had except the folder, so you can see we tried to call
multiple times and it didn't work the first time, but then
that's why I wanted to make it long so we can see both
indication calls at least skip one.
It's playing.
OK.
I don't know. It's horrible.
We might try the phone call again. Let's see what this one
says.
There we go. That's better.
You can hear the feedback.
And I'm talking to myself.
I'm calling on a good.
Ah.
Is going to break up.
Someone.
OK, so that's good.
Then we get here love better. So we shouldn't have to make
another call. So what's going on here?
Now remember, Wireshark is an application monitoring my
network Wireshark.
Does this by recording each wavelength, so right here if you
look.
You see this G 7-11 does G 711 is what we call a codec for
encoding an analog voice, so an analog voice is a waveform. So
when I speak, the G7 picks up on wave sounds and records them by
binary forms. One is the zeros codec. That's the purpose of the
decoder. When I went in and decode it, that makes sense to
the buyer narrator, RTP breakdown.
Right.
So now.
So we can hear.
And see the exact cause between both ends or more than one at a
time. We're going to go back to the telephony real quick.
And this time, we're going to go down to real time protocol play
the streams.
And now we have the strings here and if I click all of these and
I play.
We have all three streams.
OK.
You can hear the feedback.
And I'm talking to myself.
I wanna go.
And obviously that was a better call you would have heard each
line. So it what it's doing here is.
Each call has its own stream. If I call you, my voice going to
you is one way and then you coming to me talking to me is
another way. So that's why there's so many in here. And if
we just click one, you'll be able to hear it a lot easier.
A lot better.
OK.
How was it that one?
This one.
So you pretty much can hear them individually.
You can hear the feedback.
And I'm talking to myself.
You probably wanna go.
Ah.
Because it's going to break up.
Someone.
OK.
So that's that.
Now, what about if I call my personal phone with an
unencrypted soft phone?
My personal phone is on the Wi-Fi, however it is encrypted
and using an active form service provider. Let's see if Wireshark
can listen in to this phone call.
So we're going to start a new segment.
I'm gonna go down here.
I'm going to bring over my soft foam.
I'm going to blur out my phone number so no one calls me.
I'm gonna call my cell phone.
Hello. Hello, this is my so my.
In a lot of feedback.
So I'm hang up.
No.
OK, so now that that's done, I'm gonna move this out of the way.
I will stop this filter.
We have a lot of tact and knowledgement sequence numbers.
Trying to figure out what's going on.
So for this.
Let's go ahead and.
See the most recent RTP packet.
You're going to decode them.
Although it should already be done, we'll go ahead and do it.
Let's do one of these. Go to telephony now, and now we're
just going to go down to the streets.
And remember, this is a new.
I closed out on the other one so.
The new stream.
Hello. Hello.
And then this is my.
I.
So let's try these a little bit better. Let's see if we can.
It's.
So though it it did record but.
You to myself voice and.
A lot of frequency, a lot of waves coming in for it. It was,
it was kind of bad to hear it. But you know, you get the
concept. You can still, even though as long as one sided
unencrypted.
You can anyone can listen in on these calls and see.
Where they're coming from and exactly definitely would be good
for any investigations listening in on calls and more short has
many other uses such as decrypting passwords and
usernames ethically of course, so I hope you all enjoyed. Thank
you. Bye.
Hello everyone. My name is Cassidy.
We'll stuff good job.
All right. Well, I think that concludes our master class.
Wanna thank everybody for their presentations. Everybody didn't.
Excellent job.
Make sure you guys don't forget to clock out.
And I don't have anything else unless we Marjorie or Marcia
have anything.
Very good. Well, nobody else has anything else, no questions.
I think we are going to call it a night.
Every night, everyone.