Well, good afternoon.
Thank you all for being here.
We are going to see from the workshop the call of death.
I imagine that many of you will be very curious about the reason for this title.
That comes at the end.
Let's start.
Well, we have a small index with the seven points that we are going to explain.
First, what is this about?
I'm going to spoil a little bit.
I'm going to bore you a little.
What is the workshop about?
I'm going to explain the voice IP.
For those of you who don't know what the term is, get familiar with what we are going to see, since we are going to use it throughout the process.
We will talk a little bit about IoT devices.
In this case, we are going to use a NanoPi.
An RPi device.
And we are also going to use Arduino.
We are going to see both systems.
Then, we are going to mount a telephone control unit.
We are going to use Asterix.
And we are going to install it on the RPi.
Then, we are going to see a little bit about how it works, script commands, configuration, and how we are going to play with this telephone control unit.
In order to be able to execute a series of commands and things that we are going to see later.
Then, in point 6, we already have the death call.
We are going to do the proof of concept, so that you can see how it works.
And finally, we are going to see some tips and countermeasures, to know how to protect ourselves from this type of attack.
Let's start.
This is an initialization workshop, as you well know, so we are not going to go too deep into the technical issue.
We are going to go over it a little bit, so that those of you who have a lot of knowledge, like a few, can follow the workshop.
Any system created can be given a function beyond what it has been designed for, which is, in essence, the spirit of the hacker.
To take technology further, to jump the established barriers, to expand knowledge and improve the future.
Basically, it is the definition that I have of what it is to be a hacker.
You have a very long text here.
A hacker is a restless mind that expresses the technologies and means it has around it, whatever they are, to create new paths, to use new technologies that are superior to the current ones, or simply to solve problems that no one has ever done before.
A hacker can know about programming, design, networks, systems, electronics, physics, chemistry, psychology.
You can be a hacker, whatever your field.
Being a hacker is the most, and the best thing is that you can be anyone.
I really compare the term hacker to what is closest in the real world to what would be a superhero.
We know that superheroes have superpowers, they are not real.
Well, the closest thing in the real world would be a hacker.
Now comes when I bore you a little bit.
A little theory.
Let's start with voice IP.
What is voice IP?
The name says it, right?
Voice over IP, over the internet protocol.
It's the acronym for voice over internet protocol.
And this basically simply means that all the technology we currently have, through which communications work, data, what is the conventional voice of all life, has been converted so that it can be used through the data line itself.
Analog lines have been around all life.
As you can see, this phone we have here, with a pair of copper wires.
This does not transmit data.
Until the modems were invented.
Through this, we are going to control an entire telephone station.
Can we use analog devices?
The answer is yes.
Within the voice IP, if we go back to the previous slide, basically, to be able to use it, you need either an IP phone, dedicated exclusively to this, or an IP phone by software.
You can have a physical IP phone, or you can have a program, an application installed on your computer or smartphone that uses the service.
For example, WhatsApp calls or WhatsApp video calls are voice IP.
Old devices.
Any analog device.
There you have several examples of phones.
The dome of all life, which surely almost all of you will have at home, or you will have seen it at some point.
A fairly old phone.
And the one at the bottom of everything is the one we have here, right now.
It's this one you can see.
All these devices can continue to be used thanks to a few devices that make the conversion from analog to digital.
And from digital to analog.
You can do it both ways.
This has a series of ports.
It has an Ethernet port, which is the one that connects to the Internet, or to the network itself.
And then it has the FXO or FXS connections, which are those for converting a phone to digital, or a line to digital.
A conventional line, one of all life, could also be converted to the digital format of voice IP to configure it in a central and be able to use it digitally.
Now we are going to see a little bit about IoT devices.
No Pi computers.
The Pi devices, which is how we all know them, are single or single board computers, as you can find in any description you can find on the Internet, you will always find that paragraph that we have here.
Initially, the Raspberry Pi project, which were the ones who started this type of devices, basically created it for teaching, so that a cheap device could be used to teach computer science and programming in schools, colleges and so on.
But it turns out that this has spread a lot, especially in the hacking world, with maker projects, robotics jobs, that is, it has gone beyond what was initially created, the device.
What has happened?
That in addition to Raspberry, hundreds of thousands of manufacturers have come out.
Each one has invented its own version.
We have OrangPi, we have NanoPi, we have BananaPi, that is, if you look for the term, you will find a lot.
Each one has its own characteristics, they change designs, they change type of processor, they change RAM memory speeds and so on.
I have chosen a model of NanoPi, NanoPi Neo2, which is basically the one you have down here.
The NanoPi board is the one you have above, which you can see.
And the device is a little bigger than a nut, you can see it here.
Basically, it is an aluminum case with a lot of power.
Keep in mind that the device, even if it is so small, has 1 GB of RAM memory, of DR3.
And what is the Cernet socket is 1 GB.
That is, for all these experiments and these little things that we are going to do, the device is more than enough.
It has enough power.
Here we have the scheme of this NanoPi board.
Keep in mind that all these boards have a lot of connections, which are the ones we can use in our projects.
You will see that it has a card reader, it has a series of GPIO inputs and outputs, which are the ones we use to send or receive information to the device.
In those GPIO pins that we are talking about, for example, what is the case that we are seeing, you will see that it has a display where you can visualize and execute different things.
And it also has three buttons.
Both the image of that display and the utility and operation of those buttons, we program them through those GPIO pins.
Just as here I am using the display and the buttons, in those GPIO pins you could connect anything.
We could connect, I don't know, we could use, if we see it here, an example of use, we could directly connect a LED.
And through this little script that you can see, we could turn on and off that LED.
Or we could connect a relay, or we could connect it to a home system, and directly from the device itself, with a little programming, we could turn on and off the lights that have passed here.
We could connect any device, a camera for example.
There are many projects that what they do is directly in these GPIO pins, they connect a little camera, and they use it for artificial intelligence systems, facial recognition.
With this you can do many projects.
Well, if any of you know about programming, you know how to program, you will see that this script is super, super simple.
That is, directly above we do VLED.py, we open the V editor to be able to write the script, and you will see that it has very few lines.
We simply import the recognition libraries of the board itself, which are the RPI.GPIO.
We make an import of the time module, and then we create a variable, where we establish the number of pins that we are going to use.
If you can see below, on the left, you will see that we need, for example, to control that LED, we need three pins.
What is the power supply, which would be pin V, which we are going to get from the GPIO4 pin.
G, which is the mass, the negative of that power supply, which would be pin 6.
And pin 7 is where we are going to send the command to turn on or off the LED, that is, basically the switch.
And what is in the programming, we simply create a loop where we are waiting for the command.
We do a waiting time.
Well, here really the commands are programmed in the script later.
Here we are simply making a loop, in which, with a waiting time of one second, the LED turns on and off.
This would be, basically, the programming of a switch.
Once we run it, it turns on and off, and it is like this, continuously, until we cancel the script.
Well, below, if you know programming, you already know what it is.
We simply add it once we have created and saved the script, we add the execution permissions, and then, below, we run it with dot bar.
All right.
Orusbox.
I imagine that many of you have come to the workshop as a result of the publications we have made about Orusbox.
Orusbox is simply this little device in AnoPy, in which we have implemented the tools that come with Kali Linux, and we have created a small pocket device that can be used for pen testing.
Okay?
There you see a little detail of the explanation, which is what we have in the slide.
Apart from these tools, which, obviously, with any Linux system, you could access by SSH and work with it, we have implemented, directly in the device, the functionalities in what would be the control of the buttons.
Just as we could, for example, have programmed a mp3 device, and of the three buttons, one would be the play, pause, and go from song to volume up and down.
In this case, we have made a programming, through which we can choose if we want to do a network scan, the type of scan, if it is simple, if it is fast, if it is deep.
We can make a TCP DAM, through which we can collect all the traffic packages from the network to which we are connected.
We have an export, through the USB ports.
Through the menu, we can choose to make an export to the disk of all the information that is being collected.
For example, if we connect an external disk.
And there in the photo, as you can see, there is a small example of how I have used it at some point.
It is a battery, a power bank, to which the NanoPi device is connected.
A mobile phone with SSH access, connected directly to the NanoPi itself.
And the device on the left is a Wi-Fi repeater.
It really is a hard disk, a USB memory.
What happens is that it includes a Wi-Fi server.
So, it does Wi-Fi service.
Both the RPi and the mobile phone are connected.
They would be interconnected.
And once that is done, you could start working.
Scanning networks, or the work you need to do in the pentesting that you have been commissioned.
It is a very hidden way, for example, if you do not want or do not need somewhere, or they should not know that you are doing that, for example, the workers of a company, and you want to go unnoticed.
Well, you put all the junk in your pocket, and you would be working with your mobile phone.
Who would suspect that you are doing a scan, for example, or you are analyzing the network of work of that company, to see what vulnerabilities they may have, and then make a report for the company itself, taking into account, for example, what the workers are doing at that moment.
Because who is going to suspect, even if they know it is you, the one they have hired to do that job, if they just see you reading or working with your mobile, no one is going to think, until they sit down on the computer, it does not start.
So, I'm going to see Facebook, I'm going to see my private email.
In this way, it is a great option to be able to do this, even if the company knows that it is you who is going to do the job, you avoid changing their behavior the moment you start working.
On this occasion, as I have written below, what we are going to do is use the Aorus Voice itself, or the NanoPi itself, as a telephone station.
The explanation we are going to see now, when we install the Asterix system, the telephone station, we are going to do it directly on the device itself.
So that you can see that it even has enough power to manage a complete voice system in a company.
An Asterix system could perfectly manage, I don't know, all the voice calls that could be managed in a common company, with workstations, commercial services, technical services, with IVRs, with voice buttons...
We can configure everything.
A device like this would be more than enough.
We don't need to install any proprietary or millionaire system, since this device is super cheap, and the Asterix system is completely free and free.
Now we are going to see a little bit about Arduino.
As we have mentioned at the beginning, since it is an initialization workshop, and what it really is about, is that we see many points, for those of you who have doubts about whether this is mine, whether I will like it or not, we are going to touch many,
many sticks, within the subject of computer science and electronics.
Actually, everything we have deployed, we would not need the Arduino at all.
It could be done directly only with the RPI cart, as you have seen before, through the GPIO ports.
But we are going to give it an extra.
So we are going to see a little bit about the operation of Arduino.
What is an Arduino board?
Basically, an Arduino board is a board that has a programmable microcontroller, through which we can basically program whatever we want.
As you can see, it is free hardware, it incorporates a reprogrammable microcontroller, it has a series of pins with which we can establish connections between the microcontroller and the different sensors and actuators, whatever we want, in a very simple way,
to be able to test new designs, create new projects, without the need to initially invest in expensive prototypes or custom boards.
Keep in mind that until the Arduino market came out, any project involved an important economic outlay, because any project you had to do, of course, you had to order a series of boards or build them yourself.
There was nothing prepared in such a way that, with this device and a protoboard, I can immediately test the functions, I can update the scripts of the programming until I get the one I really need, I can do a thousand tests, and once I have the one I want,
I can move the designs, the prototypes to the factory, to make the production in series of what I want.
Basically, with Arduino, what we get is this.
An impressive cost savings.
For example, we are talking at the business level.
At the home level, to put it in a way, with these little devices, you can create anything you want.
There are people, the famous makers, who do witchcraft, because I imagine that on the internet and on YouTube you will see many videos of little things and projects they usually do.
They can do anything.
Basically, they do magic with this gadget.
There are many types of Arduino boards.
You have Arduino Uno, Leonardo, Mega, Lillipad, Pro, Mini.
The BT, which has, for example, included Bluetooth.
A little while ago, a new one came out, which also includes Wi-Fi.
Basically, the difference between all these boards is the number of ports, analog or digital, they have.
The memory capacity of the microcontroller itself.
Depending on the memory they have, you can make larger or smaller projects.
And the format and size.
Basically, the functionality is the same in all of them.
The only difference is the performance and the format.
How do we program Arduino?
With Arduino IDE.
There is nothing easier.
Arduino IDE is basically an application through which we can choose the type of Arduino board we have, and we can directly write and program the code.
Once the programming of that code is done, we have an option to directly upload that program that we have made directly to the device's memory, the Arduino memory.
And once it is uploaded, the board would already be programmed, and we could use it to work.
It is also free and available for all platforms.
In fact, a new version came out a little while ago.
Uploading code to the Arduino board.
Right now, what we are going to present in the workshop, what you are going to see, with the Arduino board, we are simply going to do one thing.
Controlling a single pin, pin 13, which is the one we are using here in the connection.
What we are going to do, through what is the serial connection, because all Arduino devices have a serial connection, through which you can establish a communication between the computer and the device.
Only what we are going to do is a small boat, where the Arduino is simply going to be waiting for the communication through the serial port.
And it is simply going to wait for two things.
It is going to be waiting to receive a 1 or a 2.
When it receives the 1, what we are going to do is activate the power of pin 13.
We are going to put it in I, right?
We are going to allow the passage of current.
And when it is in 2, we will do the opposite, we will turn it off.
Basically, it is a switch, which will receive the order to turn it on or off through the serial port.
With this, for example, we could do, if we connected it to the home lighting system, we would automatically have a controllable switch from the computer.
Or even, if we do it through a web interface, we could control it from the mobile phone.
You have seen that the programming is super simple too.
With what is the serial connection, it stays waiting, and that's it.
And the loop stays there, waiting to receive one thing or another.
Playing with relays.
We are also going to use a relay.
Because this way we see more electronic devices.
Because what I like is electronics.
That's why we have so many things here.
A relay is basically the same.
It is a switch.
Only it separates what is the part of the order to turn it on or off, from what is the power or the device that turns it on and off.
One of the great advantages of a relay is that, through a system of very low power, such as the Arduino, and with 3.3 volts or 5 volts, as would be the case of the one I am using, I can turn on and off that switch.
And to that relay, what I can have connected is anything.
I can have it connected, for example, with a 12-volt battery and a light bulb.
Or I can have a device connected to 220 up to 10 amps, for example, that would withstand the relay that we are using.
And we are now going to mount the Asterix power plant.
What is Asterix?
Well, many of you already know, I have mentioned it at the beginning.
Asterix is a free software program developed by Digio.
It is a North American company that provides the functionalities of a telephone power plant to a PC.
In other words, any computer, whatever type it is, we would convert it into a telephone system, with all the benefits you can imagine.
When I say all, I mean all.
Well, one of the strengths of the Asterix software is that it also allows the unification of VoIP, GSM and PSTN technologies.
In other words, all analog and digital technologies that exist right now, even via cable or air, it unifies them in a single device.
Asterix is now widespread in corporate and business environments, since it is a very low-cost solution with great benefits.
Basically, in any Asterix installation that can be run in any company, the import of the entire installation is the configuration that the technical staff will carry out.
Since what is hardware and software, it really doesn't need anything.
Installation and configuration.
Come on, if you have a laptop, you can start now.
If you have an internet connection, you can start testing it.
Well, we can do it in several ways.
Let's see, the most common one that is usually used is to download the repositories of the manufacturer's own website.
There you have the address, asterix.org.downloads.
From that address, you can see all the versions available, since right now there are several simultaneous versions of Asterix.
There is one that has, so to speak, many novelties or tests, which is the one that is not in production.
There is an intermediate LTS with long support, which is the one that companies usually use.
And there are all the previous or old versions that have been appearing over time.
The option is to download it, unzip it, install it, and you would already have it in the system.
Then, depending on the type of Linux you have, well, Asterix is developed for Linux, you can do an update, install Asterix, or zoom, install Asterix.
Depending, for example, if you are using Debian or CentOS.
What happens and why I do not prefer to use this option?
Because you cannot choose what is going to be installed.
The system is going to put what is in the repository of the Linux system that you have installed.
Maybe you want to install a version 16, and in the repository it has version 13, and it installs version 13.
And there are things that change or that you are not going to have.
With that difference in versions.
So, I always recommend downloading the edition website directly.
Important files and routes.
Asterix has a thousand configurations.
With a thousand types of links.
But basically, what we are not going to be interested in are these files that you are going to see there.
All configuration files are in the etc/.asterix folder.
We have the zip.conf or the pjzip.conf.
Depending on the version, we can work with zip or pjzip.
Pjzip is basically an evolution of the zip protocol.
But it does the same.
It is where we can configure the extensions, the trunks and the lines.
If in a company I have ten positions with ten phones, I would configure those ten phones in that file.
In the zip.conf or in the pjzip.conf.
If I also have two phone numbers or two lines hired with a telephone and IP provider, I would also introduce the configuration in that same file.
Then we have the extensions.conf, which is where the markup plan is configured.
What is commonly called in the world of Asterix, Dial Plan.
That is the heart of Asterix.
What is the heart of Asterix, in the extensions.conf, is where we are going to do everything in detail about what our control unit is going to do.
Or how we are going to want our control unit to work.
Later we will see the examples of the configuration files.
Then we have the features.conf.
Here are a series of additional parameters that can be used in the control unit.
Like parking, waiting time, the music that we are going to have waiting, and these things.
Then we have the manager.conf, which is where we configure users and permissions with access to the AMI.
Later we will see what the AMI is.
This is very important.
For me it is the most important thing we are going to do within Asterix.
And then we have a series of folders.
The voices and sounds that sound in the control unit, we have them in bar, lib, asterix, souls.
By default they come in English, but there are a lot of places where they can be downloaded in Spanish or any other language.
With which we could have the control unit in the language we want.
Then we have in the usrlib, asterix, modules, libraries, applications and modules that we are going to need.
By default it has a lot.
And then bar, bar, log, asterix is where all the logs that the control unit generates are going to be saved.
Be it calls made, problems or errors produced, everything.
Absolutely everything is going to be in that folder.
The .conf file.
Basically the .conf file consists of a general part, where we are going to introduce the configurations that are going to be used by the rest of all the extensions that we are going to configure.
And then we have there, as you can see, an extension section, where we put first what is going to be common to all the extensions.
And then we are going to configure extension to extension.
For example, I base myself on the range of numbers 1000, I can have the extension 1001, 1002, 1003.
You can really configure the numbering as you want, it doesn't have to be this one in particular.
And then each user will have an ID card, which can be a number or a name.
1001 is Jesus, 1002 is Alejandro, 1003 is Daniel and so on.
The secret is the password of that user.
And since we are in a cybersecurity event, I wanted to use the most famous password of all, 1, 2, 3, 4.
This is the one you should never use.
extensions.conf file.
The one I told you about before, which is the heart of the centralization.
Here we also always have a general section.
We are not going to go into detail about all the lines and all the little things, because this is a world and you are probably going to get bored.
If you want information, you can always look for asterisks on the internet.
And it has tutorials and manuals to bore you.
Basically, for example, here we are going to configure the default, which is what we are going to do when the centralization receives a call.
In the default, as you can see at the beginning, it does an answer.
Then there is an extend, which makes a markup of the IP line.
In this case, in the previous section, I have configured the lines 1001, 1002, 1003.
Here I have missed a zero.
I have put bar 101, so it would have to be 1001.
And after answering, the call would hang.
In the outgoing, we have configured two blocks.
The extensions block, which is the one that manages the calls, for example, between extensions within the company itself.
And the services block, which is where we can have a series of phones, so to speak, or numbers, with a series of services.
For example, they could be, well, you will see that I have prepared a hello world here.
If we call the number 1123 from the phone, a voice will answer us saying hello world.
We have the hour service.
If we call the number 403, a voice will automatically answer us saying, well, hey, so and so, so and so, there they are.
It would give you both the date and the time.
And then we have the execution.
Here you can program whatever you want.
Even, for example, if you have an internet service where you can see the time it is doing in the locality, you can create a menu that accesses that web page, an application in Python, for example, that accesses the web.
And based on the codes you send it or type on the phone, it will tell you the current state of the time or the roads, the location you tell it based on the numbering you choose, for example.
Here you can do whatever you want.
And in the execution of commands and scripts with the IVR menu, which is the one we have prepared, the one we are going to see in the proof of concept.
In principle, we have prepared a phone number that many will already know.
When we call that phone number, the system hangs up, runs a voice menu, the typical one, welcome to this, and press 1 for this, press 2 for the other.
When we have heard that menu, we have a little waiting time to write or type on the phone keyboard the corresponding option that we want to execute.
In a company, the typical thing would be to press 1 to talk to the commercial department, press 2 to talk to the technical service, press 3 for X.
In our case, the configuration we have made, if we press the 1 key, we activate the Arduino output, if we press the 2, we deactivate the Arduino output, with which we could be turning on and off the relay that we have connected to the Arduino.
What have we achieved with this?
That through a telephone network, anywhere, remotely, thousands of kilometers away, I can call by phone and turn on and off the company's lights, for example.
Or turn on and off the alarm.
A very good feature.
Without the need for the internet.
I don't even need the internet.
I just call my company by phone and by pressing 1 or 2 on the menu, I turn on and off the lights or activate or deactivate the alarm, for example.
And I can be anywhere.
I just need to have a conventional telephone connection, as I have mentioned.
I wouldn't even need the internet.
In option 3, we run Scriptorani.
We'll see that later.
In option 4, we run an Nmap on the network.
Even remotely, we can start doing things.
Without the need for a computer, I can make an Nmap on a remote network, and see which devices are up and which ports are open.
And the result of that Nmap, I can send it, for example, to copypaste.
With a small parameter, through the web browser, I can find that result.
It would be one of the options that we could do.
There is another option, execution by agi.
And the last option, as you can see, here we are running the self-destruct command.
Eliminating tests.
Basically, with this device, we could have it connected anywhere.
It can be used for both good and bad.
In the case of bad use, imagine a device of this style, programmed this way, with a compromised IP phone, stolen from somewhere, configured in the central itself.
And this part, you can connect it or hide it in any company, within its network.
Or, if you don't have internal access to the network, imagine that you can connect it wirelessly.
You connect to the network by Wi-Fi and the hidden device, in an external part, that has been connected to the Wi-Fi of that company.
You don't even have to have physical access within the company.
The point is that you are connected to its network.
Imagine that, in this way, in a very remote way, and without having to have internet connection, you can do, for example, a pentesting, according to what you program in the device.
After having carried out all those options of operation, of work, whatever you want to call it, within the network itself, you could run the self-destruction command.
For example, if the device by USB has a USB killer connected, in that command you could activate the USB killer.
So, you would free the device.
There would be nothing to investigate or find out what this device has done.
This type of attack, for example, hiding a device of this style, is as if you had not seen it on television.
A couple of years ago or so, one of the servers of NASA had an attack, a NASA laboratory, where, in a rack of connections, they hid, among all the cables of the network connections, they hid a Raspberry Pi, which was taking all the traffic and all the communications and sending them to no one knows where.
This would basically be the same.
Only with a great advantage.
By using an analog telephone system and with self-destruction, there would be nothing to analyze because it is not using any internet connection.
A connection through the internet, at the end of the day, can be tracked.
It may cost more, it may cost less, depending on whether you use a VPN or the network.
But at the end of the day, it can always be tracked.
Imagine someone who executes an attack of this style, in a lost place in Australia, in the middle of the desert, in which there is simply a telephone booth.
And there is no internet connection in any way, no Wi-Fi, no cable.
And it turns out that a company suffers a cyber attack.
That company that has received that cyber attack, automatically, if they do any type of investigation, the only thing they could find, is that they have received an attack from within the company itself.
That is, the person who has received, or who has really carried out the attack in a telephone way, will never be found or tracked.
Imagine that instead of a USB killer, there is an explosive device.
It would be another way through which terrorist attacks could occur, for example.
This is a type of attack in which, I think, basically, it has not been thought of, to unify these two types of technology.
As we have said, it can be used for good, but it can be quite dangerous.
We have the Command Line Interface.
In what is the Asterix centralization, we have a console through which we can execute, visualize everything that the centralization is doing.
Whenever we make modifications in the data, from that command line, we can restart the centralization, we can upload the services, stop them, we can visualize the lines that are configured, and the state of them.
Basically, in the daily plan, we are going to see everything that the centralization is doing in real time.
Later, in the proof of concept, we will see the example of how it works, and the output it reports.
And we are going to start playing with the centralization.
How can we interact with an Asterix centralization?
The first of them, and the most common, is to work with AGI, the Asterix Gateway Interface.
We have a series of libraries and frameworks that we can use.
There are some in Java, there are some in Python, there are some for PHP, for .NET.
Basically, what the Asterix Gateway Interface allows us is to be able to interact, from other programming languages, with the central itself.
It should be borne in mind that the work through AGI is a little limited, so to speak, since we depend on the user permissions of the centralization itself.
Normally, what is an Asterix telephone centralization does not have ROT permissions, obviously.
Otherwise, it would be a very serious security failure.
Therefore, even if we use AGI, if we tell it to do a type of execution, which requires ROT permissions, since Asterix is not ROT, it will obviously not work.
So, this is a way through which we can work, but to be able to do what we want, we would have to get more into the device configuration.
We would have to change the folder and user permissions, the files, the configuration...
It is more complicated.
So, in this case, for what we want to do, it is not worth it.
We discard it.
It would be worth it, but it would involve much more configuration.
So, in this case, out.
What would the execution be like?
If we create, for example, automate-metasploit.py, from the dial plan itself, which we have seen before, it would be the telephone number, and in parentheses, within the function agi, we would enter the name of the script.
And the system, which is the central one, if we gave that option in the telephone number, it would execute that script.
We go back to the same thing.
If I have permissions, it will execute it.
If I don't have permissions, it won't do anything.
Then we have command and script execution, with the system function.
Basically, in the dial plan, it is the same.
It would be to put system, and in parentheses, the command.
What command?
The one we would write in the line of linux commands, for example.
There is also another series of additional functionalities, through which we can interact with data that the central can be generating.
Here in the example, in the second one, well, the first one simply recharges the Asterix service.
In the second example, what we are doing with the system command, is $CALERID and $DATETIME.
What we are doing is collecting the identification of the call, and the date and time of the call, for example, that has just entered, and redirecting it to the serial port.
Let's imagine that in the serial port I have a display.
What I am doing is that it presents the information by text that it may be receiving.
Well, every time someone calls, automatically, I would receive, or see on the screen, the phone number of the person who is calling, and the date and time.
Basically, a call identifier.
Well, there are other series of options.
You can also run the whole route.
Of course, in the system command, if you want to run any script, of any kind, programmed by yourself, you are forced to enter the entire route directly.
For example, here in the example we have .home, .user, .documents, .scripts, .something like that, and all hacked, .py.
Let's go back to the same thing.
We depend on the execution permissions of the Asterix service.
If we run something for which we need to be wrote, it will not do it directly, unless we have previously modified the installation of Asterix.
It could be done, but it is more complicated.
We come to the me.
Asterix Manager Interface.
This is the one I like and the one we are going to use.
Basically, what the Manager Interface allows us to do is to connect a client to an Asterix instance to run commands or read events on TCP and IP.
Basically, what we do is we make a TCP connection to the telephone network, and depending on the permissions we have, because as you can see in the configuration file, the manager.conf, we can establish, well, also user and password, 1, 2, 3, 4.
This is my favorite.
We can choose which IP addresses have permission or do not have permission to connect.
Obviously, that must always be configured, yes or yes, as a security measure.
We can choose which port we are going to communicate through.
And then we have a series of reading and writing permissions.
Well, we can see in those permissions that there are a lot, right?
Well, that permission would allow us to make telephone calls.
The Dial Plan would allow us to modify or access the visualization of the Dial Plan.
The CDR would allow us to visualize the history of all the calls made.
DTMF would allow us to collect or receive the markup tone that people execute when using a call.
That's why I've marked it in red, because that's exactly what we're going to need.
And only the reading one, because we're not going to write it.
We're not going to get involved in the STERI system.
We're just going to read.
When someone telecalls a series of numbers, I need to see those numbers.
Well, we're just going to do it that way in the connection.
How would we check if we've configured the connection correctly for me?
With Telnet.
We simply do a Telnet, the IP address that has the central.
Localhost, because normally when you do the tests, you work directly on the machine you're configuring.
And the port, 5038.
When you run it, if the configuration is correct, the Telnet response would be the one you're seeing there.
Tracking, trying to connect to the corresponding address, and then that text would come out.
Connected to the address, escape character, asterisk manager bar, and the asterisk manager version.
Here, for example, is 5.0, which is the last one.
Death call.
We're going to do the proof of concept.
We're going to make the call.
Well, wait a minute, because before making the call, I didn't remember this slide.
We have to know how we're going to link everything.
How the phone is going to know, through the AMI, what it has to do.
It's very simple.
We've created a little script in Python.
In which, simply, what we're going to do.
First, we connect to the AMI service.
You'll see that we're specifying the IP address.
The port.
We make a socket connection.
These are specific commands of Python itself, to be able to make the connection.
And we send, through that port, the parameters to be able to connect.
They are very specific parameters.
To be able to connect to the AMI, it would be the text you're seeing.
Action, two points, space, login.
You have to make two intros.
Username, the username.
Here we have called it Arduino.
The intro, with a car return.
Sorry, express, an intro.
Username, the username.
Another intro, secret, with the password.
And then, two intros.
In that second intro, is when the shipment is made.
At the time we make the shipment, the machine would receive the request.
If it is correct, we connect to it.
If it is incorrect, it would return us the incorrect user, incorrect password.
Or that there is no communication, or any other type of error message.
At the same time, in the same script, as in the top part, we connect to the central, with AMI.
In the bottom part, what we do is connect to the Arduino, through a serial port.
As we have explained.
The connection is super simple.
Simply, serial.serial.
And inside the function, we tell it which port we are going to connect to.
And the speed, the same.
Here it would be the dv-tti-usb0.
Because in this case, I have connected the Arduino to the device by USB.
It would be an emulation of the COM port.
This would be, for example, the equivalent in Windows, with 1, with 2.
In Windows, that is, in Linux, they are called this way.
dv-tti, followed by the numbering of the port.
In this case, it is the usb0.
And the speed, 9600.
There we could configure the one we want, depending on how we have configured the speed in Arduino.
In this case, we have not changed it.
By default, it is 9600.
We leave it at 9600 bits per second.
We wait a little while.
And then we start a loop.
In that loop, simply, what do we do?
Once I have the connection made with the AMI, and I have the serial connection made with the Arduino, the only thing I have left is to wait and see what happens.
Only what we are going to do in the loop, is basically, based on what I receive from the AMI's own communication, I'm going to do a search.
Because what is the AMI is going to be throwing information at us non-stop, with everything that happens in the central.
To reduce it, as I mentioned before, we have configured it so that it only receives the information from TMF.
With which it would only receive the marked tones.
Everything else, in this case, does not interest me.
If, for example, you imagine that instead of this, you want to carry out a program that manages the calls of a company, which, in real time, would like to see which users are on the phone, which users are not at that moment communicating, which are absent,
the call time that each of them has, with whom they are talking...
You can make a panel completely with the AMI system.
What is the AMI theme is super powerful, because it allows you, with the theme of programming, to do a lot of things.
We, for example, in the company I work for, we have configured it that way.
We have a panel through which we manage all the calls of the clients.
That gives an impressive power, because as soon as a client calls you, automatically, if you have a call ID, it will automatically show you all the information of that client.
With which, when you hang up, you already have everything prepared.
You do not have to wait for that user to be identified, that I then have to look for it, that I have to access to see what it has, that it does not have to be spoken to.
It would be a way to automate it and receive directly, as soon as you hang up the call, all the history of that user, for example.
Or in the case of a hospital, for example, imagine a program in a hospital with an Asterix machine.
If that hospital has the phone numbers of all its users, in the case of a private clinic, automatically, the moment that person calls, if that phone number matches the one in the phone list of the machine, the person who hangs up would automatically have on the screen all the medical history of that person,
of that patient.
With which, the response times would be optimized a lot.
I already know if that person suffers from a certain disease or a certain problem.
I already know what protocols I have to follow if that person makes an emergency call.
With which, maybe those little minutes of difference between having to look for who it is, if it is a client, if it is not a client, if I send the ambulance, if not, if I have it all at once, there may be the difference between whether that person is alive or dead,
for example.
It is one of the good things that automation has.
Well, in what is the part of the script, I start talking about these things and I get confused.
One of the good things that this script has, as you are seeing, in automation, we are simply going to base ourselves, as I said before, on the numbers.
And I am going to be in a loop waiting to receive what number I have.
We make an end of the answer, looking for, for example, digit 2.1.
If it is greater than 0, that is, if in that answer I find that phrase, digit 1, I already know that someone has marked a 1.
What do I have to do?
Turn off the coffee maker.
If I have a coffee maker connected to the relay, I give the 1 to the coffee maker, I unplug it, I turn it off.
If I receive a 2, I turn it on.
These are the commands 1 and 2 that we have seen in the previous Arduino script, which are the ones that turn on and off the relay, through the communication of the serial port.
In the case that it receives a 3, whatever.
Here you can even introduce execution commands.
If I receive a 3, I run another script in Python or whatever.
Or I play a movie.
You can do whatever you want, or run a direct command.
And we could start making the call.
We are finally here.
The call of death.
Let's see.
Information note.
I have made an internal configuration.
I have made a simulation of Centralita.
And what is the phone number that I have configured, so that it is a known number, especially, for example, for the people at the event, we have used the phone number of INCIBE.
Phone number 987-877-189.
That's the phone number I'm going to call.
Obviously, no one from INCIBE is going to hang up.
A speech is going to come out, which I have recorded myself.
I don't know if the microphone will be able to reach...
although the sound, of course, through the phone is very low.
A speech will be heard in which I say, Welcome to CyberCAD.
I pressed 1 to turn on the relay.
I pressed 2 to turn it off.
I pressed 3 for this.
I pressed 4 to make an nmap in the network.
I pressed 5 to run the script X.
I pressed 6 for self-destruction.
These are the different steps we are following.
We could configure whatever we want.
The call is made in a previously programmed closed network.
And no external call is made.
The phone number of INCIBE has only been used as an example.
And its network has not suffered any damage during the implementation of this workshop.
We have moved on.
We are going to make the call.
We unhook.
And we are going to call.
We would hear the menu.
If we press 2, it turns on.
If we press 1, it turns off.
We are going to move on to another section.
Let's get out of here for a moment.
We are going to switch screens.
We come here.
Very well.
Here I have prepared what I told you before.
I have prepared two connection screens so that you can see the execution in a visual way.
On the right side, we have the Asterix key.
This is where we see everything the control unit does in real time.
On the right side, you will see that there is an AIMS web.
Someone has hung up that call.
There is a playback with the recording.
Asterix, sounds, recording.
I have changed the route there.
Recording is an mp3 file.
In this case, I have converted it to format, because I do not have the mp3 codec installed in the central one.
So, I have made a conversion to ULAU, which is the one used by default.
Asterix, unless we specify a different one.
With any Linux operating system, you can also make these conversions of sound files.
Then, you will see that after the playback, of the execution of the message.
Let's see, let's see, let's see, let's see.
We have the connection.
And let's see the reception of the numbers.
Then it does a waitstand and hangs up.
If we go to the left side.
Well, depending on how you are, it will be my left or my right.
Depending on whether I turn or not.
You will see that what is the top part of everything that is being received.
It is the information that the central is sending us through the AMI.
Although we have closed it only to the TMF tones.
Really, yes, it is going to send us the TMF tones.
But along with that, it sends us a lot more information.
It specifies the type of channel that is being executed.
The call identifier.
In this case, the 1000 appears because it is an internal extension.
We are not making an external call.
Otherwise, the phone number of the person who has called would appear.
The context to which the type of language has been introduced.
It is in English, I have not changed the language to Spanish.
The only thing that is in Spanish is the speech that I have recorded.
The phone number appears, which is the one we have called.
Then we have some identifiers through which the calls are linked.
And then we have the one that interests us.
The digit option.
You see that it says digit 1.
In this case, digit 1 is to turn off the lights.
It is received order.
Well, we have turned on 2.
I don't know if you have seen it.
The LED board has been turned on.
And with 1 we have turned it off.
Received order, turn off lights.
Now we are going to repeat everything in real time so that you can see how the information is passing.
Let's see if we put it in some way that you can see it better.
Keep in mind that instead of a LED display, as is the case, imagine that here you can have connected whatever you want.
When I say whatever you want, it is whatever you want.
It will depend on the programming that you have done.
I hope it always works well.
Battery life, we are doing well.
Although I am doing the whole workshop without connecting the laptop to the network because I don't have free shots.
Yes, let's see.
We have plenty of battery.
We are going to prepare this.
We are going to repeat the call.
And now look at both screens.
What is going to appear on the right is everything that is creating the click.
And on the left is the one that is going to be receiving, which is the script itself that we have made.
It is the one that is going to be receiving the commands or the information that we have prepared.
Let's see.
For example, we hit 2.
Here I hear the keyboard.
We turn on and off the LEDs.
If we hit 4, we run an Nmap.
You are seeing it there on the screen.
The result would go where we have sent it.
And if we run command 6, we would activate self-destruction.
It is what I have told you before.
In that command, after having done everything we wanted in the network, so that the control unit is connected, imagine that instead of an RPE, we commit a real Asterix control unit, already working in a company.
We would save a step.
The activation of self-destruction, we would destroy the device, so that later it could not be analyzed or tracked, for example.
Then, when the forensics come, they would have nothing to analyze.
It depends on what kind of self-destruction you would like to use.
Tips and countermeasures.
When everything is possible.
We know that in the world of computer science we can do whatever we want.
Because whenever something or a new system is invented, there will be someone who will turn it around or use it in a way that should not be used.
What are all these things for?
So that the manufacturers or developers of these systems and devices themselves, know what other ways people can use their systems.
And they can apply security measures to avoid it.
Vigilance and control in a virtual and physical way.
What is virtual, basically, is what we are most concerned about.
We control communications.
We install WAF, we install firewalls.
We put antivirus.
We monitor networks.
We have that part more than clear.
Monitoring protocols and ports used in the network.
Through which, for example, if in a network in which I am managing, I know that I do not use a series of protocols, and in the analysis I am doing of network traffic, those protocols appear that I know I am not using, I would have to stop them, cut them,
turn off all the alarms and see what is happening.
There are many systems that do this.
But you always have to remember it.
Monitoring traffic and blocking what is allowed.
Listing authorized devices.
MAC addresses, IP addresses.
We have to check at all times what is connected to the network.
We should not allow an unauthorized connection at any time.
In what way?
Always taking into account MAC addresses, IPs and others.
With which I know which devices are mine.
And if one appears that has not been recognized, directly block it or simply do not allow it to connect.
For example, this is basic.
Prevent the use of DHCP whenever possible.
And use honeypots.
Physically protect unauthorized network connections from switches, hubs or routers.
What happened to NASA?
They had free, completely accessible to everyone, a rack with a thousand cables.
And anyone can come and plug in whatever they want.
Right here, for example, in the corridors, and anywhere, I have seen hundreds of network connections.
I can hide the device connected to any of them.
And I would be working with the network of the Palace of Congress.
All those shots, for example, I don't know if they are controlling it here or not.
I guess so.
In the rack where all those shots are concentrated, those that I know should not be used, or at the moment they are not being used, should be disconnected directly from the rack.
And the IT staff should connect them only when that shot is really going to be used.
A network shot at the entrance to the corridors to access the services, I think that should not work.
Instead, if I connect the computer, I have access to a network.
The rack should be disconnected.
Access to the racks themselves.
The best way, physical protection, not only to the place where they are, but the racks themselves have to have their doors with a key.
Do not put the key above, below or glued to the glass, which I have seen in many places.
In a well-protected rack, the accesses, but then you get to the rack, and the little key that opens the door is glued to the lock.
That should not be done.
This is the point we are talking about.
Create isolated networks for guests or between departments.
A very bad habit, this, for example, in many restaurants, you can see it.
They have a Wi-Fi network, I have internet, I put the key and everyone connects to the Wi-Fi.
And it turns out that in that same Wi-Fi, I have my TPV equipment, through which I am making charges to the customers with the card, through the bank, which is connected to the same network.
I use the systems to take orders and table notes, and I have all the customers connecting to the internet in a free way, to the same network where I work.
Mixing work with what hundreds of strangers can do, who are passing by, I don't see it logical or normal.
That happens every day.
I was going to say, you can check it.
You don't check it, it's a crime.
The ideal in these cases is always to have those networks separated.
A work network, independent, and then, on the other hand, a specific network, exclusive to the customers.
And if we don't have it for infrastructure or economy, you can always create different IP ranges, at least to create a little separation in that respect.
Now I'm talking in a home plan, not a professional plan.
That's why there are other devices that can do it.
Well, one very important thing.
The cybersecurity budget is not an expense.
It is a necessary investment.
What happens with the cybersecurity budget?
People only remember it when they have already received an attack.
That's not the point.
I remember investing money in repairing computers, or in having my information saved when I already had a ransomware.
The normal thing is that I make an investment in advance, to avoid having that ransomware.
You have to keep in mind that cybersecurity, just like in the company, we are going to implement the best technology, or we are going to spend the best we can, at any price, to prevent us from being robbed.
We set alarms, we put good screens, locks, everything to prevent our company from being compromised.
If our company works with the Internet, if I close all the doors, but I don't close the Internet window, the criminals are going to enter through there.
The criminals simply look for where they can enter.
If I can't enter through the door, I enter through the Internet.
What company today does not work with email, does not have a website, does not have an online store?
Basically none.
Just as you protect your physical store, you have to protect your online store.
Therefore, the cybersecurity budget would be mandatory for me.
It would be the first thing to take into account.
Just as I take into account what label I am going to put on the door, I have to decide how much I am going to spend on cybersecurity.
Why?
Because I know that sooner or later they are going to attack me.
I am going to receive an attack.
What I don't know is when, but you are going to receive it.
It will be today, tomorrow or in ten years.
But at some point, you will fall.
Through an email, through a phishing, an employee who is angry and wants to sabotage the company.
There are a thousand ways to receive this type of attack.
You have to be prepared.
If you need it, hire the best and put a hacker in your life.
And that's it, we're done.
Thank you very much for being here.
If you have any questions about what I have explained...
Thank you.
Hello.
Good afternoon.
I wanted to ask you something.
First, it was a very nice talk, very entertaining.
And second, I have seen that when you are typing, you only receive one number.
What if, for example, you wanted to enter the IP for Nmap?
Programming.
You would have to make a nested loop of so much logic for that.
Exactly.
Keep in mind that programming is your imagination.
Programming has no limits.
It's about thinking about how you want to program it.
How would I put an IP?
This little gadget, for example.
I can change the IP.
I connect from the computer, it has a web interface.
I can configure it, change the data, the user who connects, and all these things.
Through the web interface.
What if I don't have a computer?
I have already configured the device in my house or in the workshop.
A company takes it to me and it is a different IP range.
For example.
And they don't let me change the IP.
No, no, no.
Give me a computer to change the IP for a moment.
No, no, no.
You can't touch anything here.
You have to plug it in and make it work.
We are not going to let you touch the network.
Because you are a bad bug, aren't you?
You have come here to put this and that's it.
And this device, if we call the pillow four times over the phone, we access the voice configuration menu.
LinkSys.
Which gives you a series of options.
One of them is that first you can hear what IP address it has configured.
You give that option and it tells you the IP address.
192.168.1.100.
I have the option to change it.
I give the option to change.
And it tells you.
The current IP address is such.
Introduce the new one.
192.168.1.100.
Instead of a point, asterisk would be used.
Asterisk would be the point of the IP.
And so on.
And when I finish it, I give it to the pillow.
Which would take it as an intro.
I have already changed the IP address of the device.
From this.
Okay?
Just as we do it here.
We could do it in the Asterix center.
It is to think about how you want to do it.
And program it.
There is no limit.
It depends on the imagination.
Or how well the programming is given to you.
Perfect.
Thank you very much.
Any more?
Any more questions?
Well, nothing.
Ah, look.
There is one.
Yes.
It also gives the possibility that someone is listening to the calls.
They can click on you or something.
And they can send you the sounds that you are sending.
Manning DeMiddle with Asterix?
Yes, also.
It could also be done.
I have not studied that specific point.
So I could not give you a very...
I know I could.
What I could not explain to you is how.
This comes from the origins of hacking.
When there was the blue box.
The blue box.
Thank you.
Any more questions?
Well, nothing.
This has been all.
Thank you very much.
A round of applause.
Thank you very much for your time.