AirBnBeware:short-term rentals, long-term pwnage

Presented by Jeremy Galloway

High-level takeaways

High-level takeaways
Short-term rentals have become so popular that
their attack surface can no longer be ignored
Exposure to unsecured networks increases risk
Home networking hardware is worth targeting
The biggest threats are simple, not sophisticatedMost risk is mitigated when physical access to
network hardware is restricted

High-level takeaways
Short-term rentals have become so popular that
their attack surface can no longer be ignored
Exposure to unsecured networks increases risk
Home networking hardware is worth targeting
The biggest threats are simple, not sophisticatedMost risk is mitigated when physical access to
network hardware is restricted

High-level takeaways
Short-term rentals have become so popular that
their attack surface can no longer be ignored
Exposure to unsecured networks increases risk
Home networking hardware is worth targeting
The biggest threats are simple, not sophisticatedMost risk is mitigated when physical access to
network hardware is restricted

High-level takeaways
Short-term rentals have become so popular that
their attack surface can no longer be ignored
Exposure to unsecured networks increases risk
Home networking hardware is worth targeting
The biggest threats are simple, not sophisticatedMost risk is mitigated when physical access to
network hardware is restricted

High-level takeaways
Short-term rentals have become so popular that
their attack surface can no longer be ignored
Exposure to unsecured networks increases risk
Home networking hardware is worth targeting
The biggest threats are simple, not sophisticatedMost risk is mitigated when physical access to
network hardware is restricted

High-level takeaways
Short-term rentals have become so popular that
their attack surface can no longer be ignored
Exposure to unsecured networks increases risk
Home networking hardware is worth targeting
The biggest threats are simple, not sophisticatedMost risk is mitigated when physical access to
network hardware is restricted

When things go Bump in the Network[Origins of this talk]Short-term rental market

Story timeBrave New WorldThe Sharing Economy

Brave New WorldThe Sharing Economy

Brave New WorldThe Sharing Economy

PwC nailed it

AirBnB: Up, Up, and Away!

The number of people that have used ashort-term rental has doubled in less thanfour years

Let’s check those numbers again

Market Size in Billions (2015)

Short-term rentals shown in greenListings Targets everywhereListings Targets everywhere
Global Comparison:
350,000 Gas stations
187,000 Hotels
35,000 McDonalds
34,000 Subways
23,000 Starbucks
15,000 Burger Kings
11,500 Wal-Marts

Listings Targets everywhereRevenue of AirBnB in New York Cityfrom 2010 to 2018 (millions)Financial forecasting with Weezytl;drNot every headline inspires confidenceCorporate ReadyCorporate ReadyCorporate Ready

TravelApproved!

😻

Corporate ReadyBiz-dashboard-pane-of-glass-2.0

Aggressive Loss-Leader Promos

Short-term rental biz be like

When was the last time
you personallyupdated your router’s security?

Getting into the attacker mindset
SSID: AirBnBeware
Wireless Security: OpenAdmin Pass: blankGetting into the attacker mindsetev
HafunecinyPlaJ

Google: dlink emulator

Google: dlink emulator

Scale of Trust0Untrusted (yolo)

100

Somewhat trusted

Mostly trusted😎

Scale of Trust😎

Your personal home network

0Untrusted (yolo)

100

Somewhat trusted

Mostly trusted🤔

Scale of TrustA university network

0Untrusted (yolo)🤔
100

Somewhat trusted

Mostly trusted

Scale of Trust😰💣 💩 🔫 😱
🔥🔥☠😭☠
Rando hotel kiosk

0

Untrusted (yolo)

100

Somewhat trusted

Mostly trusted

Scale of Trust
AirBnB rental network

0100

BewareSomewhat trusted

Mostly trusted

The internet

ISPHome network

Local clients: laptops, desktops, phones

Countermeasures
Anti-virus
EMET (anti-exploitation)
End-point agent (telemetry)
Local security policies
Code signing

The internet

ISP

Home network

Local clients: laptops, desktops, phones

Countermeasures
CertificatesFirewalls
Bug bounties
HSTS / HPKP
Input filtering + validation

The internet

ISP

Home network

Local clients: laptops, desktops, phones

Countermeasures
Password protected admin panel
Lack of physical accessCountermeasures
Password protected admin panel
Lack of physical accessExposure to unsecured networks

Exposure was derived using
established formulas for afinite geometric series

Think twice before having an
unprotected ‘one network stand’Scale of Trust
AirBnB rental network

0100

BewareSomewhat trusted

Mostly trusted

SoHo routers: A worthy target

Carna Botnet ~420K Clients 2012
“The vast majority of all unprotected devices are
consumer routers or set-top boxes…”

OSX.RSPlug.A Trojan 2007

Operation Ghost ClickDNSChanger ~4M clients
2007-2011 ~$14M profit

CERT Polska 2013
DNS changing malware
MitM Polish online banking users

Real-World CSRF attack hijacks DNS Server
configuration of TP-Link routers

document.writeln('<style type="text/css">@import url(http://admin:admin@192.168.1.1/userRpm/LanDhcpServerRpm.htm?
dhcpserver=1&ip1=192.168.1.100&ip2=192.168.1.199&Lease=120&gateway=0.0.0.0&domain=&dnsserver=106.187.36.85&dnsserver2=8.8.8.8&Save=%B1%A3+%B4%E6);</style>')d‘TheMoon’ worm 2014

“The router situation is as touchy as a gasoline
spill in an enclosed shopping mall.”-Dan GeerBlackMoon (WPAD) April 2016
“the malware now uses a proxy auto-config (PAC)
file…we can see a list of website hashes that themalware monitors for credentials phishing”

“Crippling HTTPS with unholy PAC” + “badWPAD”
Blackhat 2016
“Toxic Proxies - Bypassing HTTPS and VPNs toPwn Your Online Identity”
DEF CON 24 (2016)

Abuse of Customer Premise Equipment
BHUSA 2014

Abuse of Customer Premise Equipment
BHUSA 2014

Physical. Access. Changes. Everything.

Average Paperclip Threat,
The new APTEase of Attack:I am APT and so can you!

Protected by lulz

Protected by lulz

R.I.P Your network security

R.I.P Your network security

What’s old is new again

What’s old is new again

Home routers: Security not included

Home routers: Security not included
routerpwn.com

Home routers: Security not included

Home routers: Security not includedIf a bored teenager can hack yournetwork, you’re in trouble

Anarchaos, aged 18, DEFCON 2004

If a bored teenager can hack yournetwork, you’re in trouble

c0mrade, aged 15, NASA hacks, 1999

If a bored teenager can hack yournetwork, you’re in trouble

Jake (not shown), aged 14, Call of Duty 2, 2011

Scale of Trust
AirBnB rental network

0100

BewareSomewhat trusted

Mostly trustedAttacks

Attacks:

Potential impacts of a compromised network“…exposure of sensitive information,
modification of trusted data,and injection of data.”
US-CERT
Securing End-to-End Communications

Attacks
Remote Administration

Attacks
Remote Administration

OPSEC++

Attacks
Just listen and wait

Attacks
Just listen and wait

Attacks
Download router config toextract credentials

Attacks
Download router config to extract
credentials
ISP
ADSL
L2TP
PPTP
PPPOE
DDNS
WEP/WPA
LoginAttacks
Malice Level: Troll
Website blocking

Attacks
Malice Level: Troll
Parental Controls

AttacksMalice Level: Troll
Reducing speed

Attacks
Expose hosts on the DMZ(outside of the router/firewall)Attacks
Reducing security

Attacks
Control network timeAttacks
Firmware modification
Skill Level: Advanced

Attacks
Remote Administration (advanced)

Attacks
Remote Administration (advanced)
via TR-069

Attacks
MitM via route hopAttacks
MitM via route hopAttacks
MitM via route hopAttacks
Owning DNSWhen the attacker gains control of DNS

Owning DNS: Attacks

HTTP/S downgrade
Sniff plain-text creds (passive)
Pharming (FakeDNS)WPAD abuse
Hash capture (http_ntlm)
BEEF hooks
Browser Autopwn2
Evilgrade (malicious updates)
BDFProxy (MitM binary patching)Owning DNS: Attacks“If an attacker registers a domain to answer leaked WPAD
queries and configures a valid proxy, there is potential toconduct man-in-the-middle (MitM) attacks across theinternet.”

Owning DNS: Attacks

So many great options! How to choose?

Owning DNS: Attacks

No 0day
Almost zero exploit code (!autopwn2)
Pre-built tools
Little infrastructure needed (AWS free)
Attacks are cross-platform
Attacks are easy to perpetrate
Attacks can be passive + automatedAttacks can be difficult to detect
Logs of attacks can be easily wipedOwning DNS: Attacks
A very simple demonstration

Owning DNS: Attacks
Captive portal NTLM hash captureOwning DNS: Attacks
Captive portal NTLM hash captureWide range of attack styles,
can vary from:
Nuanced to Direct
Subtle to Aggressive
Opportunistic to Persistent
Generic to Personalized
Simple to SophisticatedPassive to Invasive
Annoying to Devastating

Attacker types

Bored teenTech savvy miscreantTrollsGrey hat
Full blown black hat
Hacktivist
Evil property owner
Motivated criminal
Opportunistic criminal

Semi-targeted attacks
Conferences
Tradeshows
Sporting events
Specific locales (DC Beltway, Silicon Valley)
Holiday destinations
High end rentals for high end targets
Near military bases
Near corporate offices
How would you target?

Attacks
Owning DNSHow ICANN secures your DNS
Locked cages, seismic sensors, smartcards,cameras, EMF blocking, safes, iris scanning

How you secure your DNS
Kittens, wishful thinking, lulzHow you secure your DNS
Security?

Protecting yourself

Mitigations for renters (technical)
Hardcode DNS in all devices

Mitigations for renters (technical)
Hardcode DNS in all devices

Mitigations for renters (technical)
Ensure ‘Automatic proxy setup’ is disabledMitigations for renters (technical)
Ensure no unknown proxy is in use

Mitigations for renters (technical)
Trusted Free VPN

Mitigations for renters (technical)
Trusted Free VPN (w/limits)

Mitigations for renters (technical)
Corporate VPN***

Ensure WPAD/Proxy settings are correct
Corp VPNs typically use split-tunneling, which
may leave large amounts of traffic unprotectedMitigations for renters (technical)
Use mobile apps off WiFi

Mitigations for renters (technical)
Tether to 4G/LTEMitigations for renters (technical)
Never use plain-text auth
HTTP
FTP
Telnet
POP3
SMTP
LDAP
VNC

Mitigations for renters (technical)

2FA/MFA everything you care about
https://twofactorauth.org

Mitigations for renters (behavioral)
Watch Mr. Robot

Mitigations for renters (behavioral)
Be skeptical and aware when travellingMitigations for renters (behavioral)
Demand HSTS + HPKP from providersMitigations for owners
Remove physical access to hardware
Lock in a closet or secure roomMitigations for owners
Remove physical access to hardware

Lock in a closet or secure room (like R. Kelly)Mitigations for owners
Remove physical access to hardware
Lock in an electronics enclosureMitigations for owners
Remove physical access to hardware
Lock in an electronics enclosureMitigations for owners
Remove physical access to hardware
Don’t offer internet access (gasp!)

Mitigations for owners
Never share your personal WiFi connection

Mitigations for owners
Backup and restore router settingsroutinelyMitigations for owners
Add an ‘Online Safety’ section to yourGuest Welcome Guide

This is not going away any time soonThis is not going away any time soon
RFP discloses SQL injection in 1998
‘Year of the Breach’ 2011 - ?

This is not going away any time soon
There is no patch, update, or easy fix

Conclusion & Takeaways
Be skeptical and stay aware when traveling,whether or not you stay at a rental
If the network is untrusted, use a VPN or 4G/LTE mobile network
Be cautious of ‘one network stands’‘Average Paperclip Threats’ (APTs) are simple, but potentiallydevastating
Remove physical access to hardware if you 💜 security

Homework
Ask security pros and hackers at BH and DEF
CON if they would use an AirBnB network
without a VPN.

Ask how they secure their own devices whenusing random, unknown, or untrusted networks.

Thank you for your time!

🙅👻🍕Cheers 🍻👯😊

JeremyNGalloway at gmail
EcstaticSec.tumblr.com

Bibliography
s1 https://www.airbnb.com/
s2 Jenny 2.0 Brian Wood http://www.brianwood.com/
s3 http://www.reactiongifs.com/homers13-14 http://www.forbes.com/pictures/eeji45emgkh/airbnb/
s17-19 http://www.nusinstitute.org/assets/resources/pageResources/NUSIPR_Short_Term_Rentals.pdf
s21 gaming.unlv.edu/reports.html
s21 https://www.statista.com/markets/
s22 http://www.wsj.com/articles/airbnb-plans-dual-stock-sales-to-push-off-ipo-1467226873
s24-29 https://www.airbnb.com/
s30-32 http://www.wsj.com/articles/airbnb-raises-over-100-million-as-it-touts-strong-growth-1448049815 http://www.reuters.com/article/us-airbnb-growth-idUSKCN0RS2QK20150928 http://www.wsj.com/articles/airbnb-raises-1-5-billion-in-one-of-largest-privateplacements-1435363506
s33 http://www.statista.com/statistics/483752/new-york-city-airbnb-revenue/s35 http://therealdeal.com/la/2016/06/29/airbnb-might-increase-chances-of-identity-theft-report/ http://www.reactiongifs.com/aryas36-42 https://www.airbnb.com/
s44 http://screencrush.com/442/files/2016/04/time-travel.jpeg
s45-48 http://support.dlink.com/CMS_FTP/CMS_DAF/Product/Pictures/DIR-655/DIR-655_front20131010123406.png
s54-59 https://www.draw.io/
s62-64 https://www.dred.com/uk/sexual-exposure-calculator/
s65 https://kinmoku.itch.io/one-night-stands67-68 http://internetcensus2012.bitbucket.org/paper.html
s69 archive.org https://www.intego.com/
s70 fbi.gov snapchat.com
s71 http://www.dcwg.org/
s72-73 https://www.cert.pl/en/news/single/large-scale-dns-redirection-on-home-routers-for-financial-theft/s75-76 https://www.blackhat.com/us-14/briefings.html
s77 https://3.bp.blogspot.com/-c2REuOaCLRQ/VzMTPlqZyoI/AAAAAAABCJ8/Or7menk9Q-gQziFqLReLKOzxpJ4cpaTngCLcB/s1600/cat-sleeping-on-router.jpg
s78 http://www.productwiki.com/upload/images/macgyver_multitool.jpg
s79 http://www.howtogeek.com/56612/turn-your-home-router-into-a-super-powered-router-with-dd-wrt/
s81 www.downloads.netgear.com
s83 https://www.reddit.com/r/gifs/comments/4ccybs/nuke/s84-85 https://i.ytimg.com/vi/2Qep4ZclTGQ/maxresdefault.jpg
s86 https://www.sohopelesslybroken.com/
s87 routerpwn.com
s88-89 https://community.rapid7.com
s90 https://www.youtube.com/watch?v=UeZjWdg_Qn8
s91 https://www.wired.com/images_blogs/threatlevel/2009/07/jonathanjames.jpg
s92 https://tctechcrunch2011.files.wordpress.com/2011/05/jake2.jpg
s94 https://en.wikipedia.org/wiki/Super_Punch-Out!!
s95 https://www.us-cert.gov/ncas/alerts/TA15-120A
s96-120 http://support.dlink.com/CMS_FTP/CMS_DAF/Product/Pictures/DIR-655/
s101 http://www.nirsoft.net/utils/router_password_recovery.html
s110 http://www.qacafe.com/wp-content/uploads/architecture_of_tr-069.png
s115 https://www.tumblr.com/blog_auth/channing-your-tatums117 https://media2.giphy.com/media/kuLuAVBxOsQyk/200_s.gif
s118 https://media2.giphy.com/media/3o6MbjHbqDwRnHyKhG/200_s.gif
s122 http://vignette2.wikia.nocookie.net/supersmashbrosfanon/images/7/77/Pikachu.png/revision/latest?cb=20131028234047 Pokemon GO IOS
s123 http://s8.favim.com/orig/72/adorable-animal-animals-black-and-white-Favim.com-693274.jpg http://www.yoyowall.com/wallpaper/tigers-grin.html
s124 https://pbs.twimg.com/media/CnLBOWsXEAAOFgc.jpg
s125 http://www.clipartbest.com/cliparts/9c4/eRq/9c4eRqa0i.png
s127 https://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-webs128 https://github.com/jbenet/go-netcatnat
s129 http://i.imgur.com/XkU4Ajf.png
s130-131 OSXdaily.com
s132 http://www.netresec.com/?page=Blog&month=2012-07&post=WPAD-Man-in-the-Middle
s134-135 https://tunnelbear.com
s137 http://www.androidheadlines.com/wp-content/uploads/2015/10/Screen-Shot-2015-10-14-at-1.30.21-PM.png
s139 https://i.ytimg.com/vi/bOmwWEzqX7M/hqdefault.jpg
s140 https://twofactorauth.org/
s141 http://geek.com.mx/wp-content/uploads/2016/05/MR.-ROBOT-7-1000x600.jpg
s142 http://www.graffhead.com/uploaded_images/awareVidb_large.jpg
s143 https://timkadlec.com/images/hsts-vulnerability.svg
s145 https://www.amazon.com/ESPi-EC-1-Outdoor-Enclosure-PVC/dp/B015BNH2L0/ref=sr_1_13?ie=UTF8&qid=1469223103&sr=8-13&keywords=enclosure+electronics146 https://www.amazon.ca/Orbit-57095-Outdoor-Waterproof-Sprinkler/dp/B000VYGMF2
s148 http://userscontent2.emaze.com/images/c646b62c-500f-4aa3-9b08-15fb10b93ce7/28ec5f80-cb4d-486d-b792-b41606be8d30.jpg
s150 http://www.seeknewtravel.com/wp-content/uploads/2013/06/CoconutAirbnbWelcome-1024x1024.jpg
s151-152 http://www.phrack.org/
s153 http://vignette2.wikia.nocookie.net/rickandmorty/images/1/1e/Rick_and_morty_icon.png/revision/latest?cb=20150805041642
s155 https://pixabay.com/static/uploads/photo/2014/04/03/11/08/pencil-311818_960_720.png
s156 http://cache.soometa.com/image/160205_www.wordsoverpixels.com
s157 https://s3media.247sports.com/Uploads/Assets/318/805/805318.gif http://hannibalisatthegate.com/wp-content/uploads/2016/04/beyonceLossII.png
S76 https://blog.fortinet.com/2016/04/23/over-100-000-south-korean-users-affected-by-blackmoon-campaign