
So, I got a VivoKey Spark. No, not a VivoKey Flex. This is a new product from VivoKey, that is currently 100% unreleased.

The Spark is similar to the Flex One from VivoKey, but this one, instead of being a flat flexible strip, is in a small glass tube just like every other RFID implant. It's small, compact, and feature rich. 

First, let's talk about what VivoKey is trying to accomplish. While all of their marketing is practically non-existent on just about anything they're doing, going so far as to have a one page website with no feature or technical information. However we can still work out some things from what is available. 

The VivoKey is...

- RFID-based implantable technology
- Runs on NFC frequency and protocol.
- Aims to be a device capable of

- PGP/GPG storage
- 2FA storage
- Payment applications

- Tap to pay
- Wallets
- Addresses

- Access control
- Any other RFID/NFC-based technology implementations

VivoKey is a product that's still in it's very early stages, all things considered. The [VivoKey Flex recently just entered beta](https://dangerousthings.com/shop/vivokey-flex-one/). The VivoKey Spark has not even been announced yet (it is expected to be announced at BDYHAX in the 15th of December). Very little is known about this product, and all information is coming from secondary sources. It is reported that the Spark has less overall storage space, due to its physically small size, but unknown how much of a disparity in storage there will be.

I acquired the Spark through [@c00p3r](https://twitter.com/c00p3r_7), who runs the Dangerous Minds podcast and is a good friend of DC801. Cooper acquired the Sparks early, directly from Amal @ Dangerous Things. It turns out that neither Amal or Cooper have gotten these implanted. Looks like I am the very first person to have a VivoKey Spark doin' things in their body.

> Oooo, what&#39;s this? 😁[@DangerousThings](https://twitter.com/DangerousThings?ref_src=twsrc%5Etfw)[@c00p3r_7](https://twitter.com/c00p3r_7?ref_src=twsrc%5Etfw)[@dmindspodcast](https://twitter.com/dmindspodcast?ref_src=twsrc%5Etfw)[pic.twitter.com/UhtW7mDKZb](https://t.co/UhtW7mDKZb)
> &mdash; Pips (@Pips801) [December 10, 2018](https://twitter.com/Pips801/status/1072276390173532162?ref_src=twsrc%5Etfw)

![](2018/12/image.jpg)

On opening, there is a card that tells you to STOP! and not continue until you visit [vivokey.com/spark](http://vivokey.com/spark). Sadly, the page does not exist (yet). Once I got it, I immediately drove over to a local piercing studio and got it installed. 

Below is the installation video of the VivoKey Flex.You don't have to watch it, but if you're curious about the process, it's a quick video.

A description of the video: Hand is sanitized and the needle comes pre-loaded with the glass tag alredy. the needle is pushed through the skin, and the plunger is pressed while removing the needle and leaving the tag behind. In the video, the tag actually was slightly stuck to the needle on removal, so  the needle/tag was pushed back in to make sure it stayed.

Once installed, it was time to scan. The major exciting feature is Fidesmo and their application development stack. However, scanning the tag with the Fidesmo app did not work at all. It appears this does not directly register as a Fidesmo/Fidesmo-capable chip.

If you scan it with an NFC app, it reveals this information about the tag.

![](2018/12/image-1.jpg)

The tag appears to be emulating a standard NFC tag with enough storage to store a URL on it in the standard NFC URL format. The url is unique per chip. However, when I visit the URL, it forwards me to [https://www.vivokey.com/claim-my-spark](https://www.vivokey.com/claim-my-spark), which just says "coming soon". 

It appears that the chip used in the VivoKeys has the ability to emulate/virtualize NFC partitions on it. This one virtualized a standard ISO 15693 tag with a size just big enough to store the registration URL (49/49 Bytes).

I assume that this is the page where you register the Spark, and probably download an app or something that allows you to actually interact with the device.

Now that a member of DC801 has a VivoKey Spark, we can finally start hacking on it and writing applications for it. All of our research, development, and hacking will be cataloged right here on the 801Labs Research site. Click subscribe below to be kept up to date! 🙌


Biohacking: New VivoKey Spark Implant


My family does an annual LAN Party and one of the biggest complaints we have is that Steam takes ages to download for everyone. 

This year things are going to be different. I want to follow in the footsteps of SaltLAN and setup some caching. As this progressed, I spiced things up with my own flare and thought I would share.

The primary guide I followed was:
[https://github.com/SaltLAN/Configuration/blob/master/SETUP.md](https://github.com/SaltLAN/Configuration/blob/master/SETUP.md)
done by [@Pips801](https://twitter.com/pips801). 

### Step 1 - Get a Server

I have a server I use for various projects and environments. 
SuperMicro E300-8D
You can read about a similar setup on a fellow 801Labs member's blog at:
[https://securedumby.science/view-post/dumbyland_beginning_](https://securedumby.science/view-post/dumbyland_beginning_)

### Step 2 - Install a VM

I am installing a Ubuntu 18.04 VM onto this server. The primary trick with the VM is that I setup 2 hard drives so that I can utilize the BLAZING FAST NVMe drive I have in this server for the caching. After this LAN party, I'm going to delete/shrink the cache drive since it won't be needed later and I want to keep the NVMe space available for other projects. I'll keep the OS & Dockers on the mSata drive, powered off, for future use.

![](2018/11/image-4.jpg "VM Configuration")

Follow the normal Ubuntu install setup.

Update Ubuntu:

    sudo apt update
    sudo apt dist-upgrade -y
    sudo reboot
    

Enable SSH:

    sudo systemctl enable ssh
    sudo systemcts start ssh
    

### Step 3 - Setup Docker

This should be pretty easy. Follow the official instructions:
[https://docs.docker.com/install/linux/docker-ce/ubuntu/](https://docs.docker.com/install/linux/docker-ce/ubuntu/)

### Step 4 - Install Portainer.io

Follow the official instructions:
[https://portainer.io/install.html](https://portainer.io/install.html)

I deviated from the official Portainer guide by not creating a portainer data container, and rather mounting to the filesystem. I did this so I can backup the settings easily.

    sudo mkdir /opt/appdata/
    docker run -d -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v /opt/appdata/portainer:/data --restart unless-stopped --name portainer portainer/portainer
    

![](2018/11/image-5.jpg)

Bam! Now you should be able to access Portainer

### Step 5 - Format & Automount Cache Drive

I followed this guide to format my 700GBs of NVMe storage for cache
[https://www.digitalocean.com/community/tutorials/how-to-partition-and-format-storage-devices-in-linux](https://www.digitalocean.com/community/tutorials/how-to-partition-and-format-storage-devices-in-linux)

    sudo parted /dev/sdb mklabel gpt
    sudo parted -a opt /dev/sdb mkpart primary ext4 0% 100%
    sudo mkfs.ext4 -L cache /dev/sdb1
    

Don't forget to add the drive to `/etc/fstab` so that it will auto-mount. I have mine mounting to `/cache` in the root of the system.

### Step 5 - Setup Network for Containers

We want to give each container a unique IP address on the network, so we need to create a unique IP address for each container so that can happen.

Since Ubuntu 18.04 uses netplan instead of `/etc/network/interfaces` , let's try that out. 

Create a `lanparty.yaml` file with your IPs.

    network:
        ethernets:
            ens160:
                addresses:
                    [10.0.0.2/24, 10.42.0.3/24, 10.42.0.4/24, 10.42.0.5/24]
                gateway4: 10.0.0.1
                nameservers:
                        addresses:
                                - 10.0.0.1
        version: 2
    

Then you'll need to restart netplan for the new IPs: `sudo netplan apply`

### Step 6 - Install the Various Containers

We're going to create a container for each service we want to cache. SaltLAN shows this is what it would look like if we were to create the commands manually:
ServiceCommandSteam`sudo docker run --name steam-cache -p 10.0.0.2:80:80 -d steamcache/steamcache`Battle.net`sudo docker run --name blizzard-cache -p 10.0.0.3:80:80 -d steamcache/generic`Origin`sudo docker run --name origin-cache -p 10.0.0.4:80:80 -d steamcache/generic`Uplay`sudo docker run --name uplay-cache -p 10.0.0.5:80:80 -d steamcache/generic`Riot`sudo docker run --name riot-cache -p 10.0.0.6:80:80 -d steamcache/generic`Frontier`sudo docker run --name frontier-cache -p 10.0.0.7:80:80 -d steamcache/generic`Windows`sudo docker run --name windows-cache -p 10.0.0.8:80:80 -d steamcache/generic`Twitch`sudo docker run --name twitch-cache -p 10.0.0.9:80:80 -d steamcache/twitch`
Again, since we're going to put our own twist on it, these will be different. Specifically we're going to add a mountpath inside the container to point to our NVMe drive AND we're going to do it all using Portainer's GUI.

Containers -> + Add Container

Then fill in the Settings. I'll show screenshots for a Steam Cache:

![](2018/11/Screenshot_2018-11-19-18.52.56_wehvoV.jpg "Main Steam Container Settings")

![](2018/11/image-8.jpg "Steam Volume Mount Paths")

![](2018/11/image-10.jpg "Steam Restart Policy")

Once all those are done, you can go ahead and deploy the container.

Create containers for each of the different services.

You'll want to read the [steamcache/generic](https://github.com/steamcache/generic) guide. If you're using SNIProxy or SteamDNS (you should use both), you'll set the port mapping just to something like `443:443`, without any IPs. That'll make it so that it is mapped to *all* IPs.

Also, There are environmental variables you need to set to configure things for your environment.

The only one I'll show is the SteamDNS env variables:

![](2018/11/image-13.jpg "SteamDNS ENV Variables")

Beyond that, you can handle it. Here's what mine looked like completed:

![](2018/11/image-12.jpg "All Caching Containers")

### Step 7 - Set your router DNS

This step is the last step before things start taking effect. You need to go to your router and change your DNS server to a local one. This was *not* as common a feature as I hoped it would be. This may require you to get a nice router and setup OpenWRT or something similar onto it to get that running. Good luck on this one.

### Step 8 - Analytics & Maintenance

There are a lot of tools that you can setup for this. I didn't really care about it.
All I did was tweak the script [from SaltLAN](https://github.com/SaltLAN/Configuration/blob/master/scripts/saltlan) and make it fit my environment. You can find that [here](https://gist.github.com/miketweaver/9f8e60db3ee5cbe7dd0cde6b88184956). 

## Enjoy!

I hope you have enjoyed this guide. I had a lot of fun at my LAN Party and a lot of games were had!

The cache worked very well for use. We saved over 1TB of data transferred, which would have killed our Comcast Data Cap. We did run into issues where we were limited by the 1GBs cap and the Samba Share would only *really* push to one person at a time, so I'll look at ways of improving this.

In the future I hope to look at stuff such as [Linux ZFS ARC](https://pthree.org/2012/12/07/zfs-administration-part-iv-the-adjustable-replacement-cache/) and setting up 10G networking.

with ❤️️ 
-- [bashNinja](https://twitter.com/_bashNinja)


An easier SaltLAN


So say there's a Chinese silicon vendor which designs and sells a chip that does a lot of really fancy stuff. You're super interested because said fancy bits can be had for the low low price of a few hundred pennies. Awesome, you might say, lets buy them! But there's an issue. Documentation. Silicon vendors, Chinese or otherwise, have a nasty habit of making it nearly impossible to find proper documentation for a specific product; whether it's poorly documented, NDA'd, or in some cases simply nonexistent.

![](2018/11/take_my_money.png)

So what can you do? You could find someone who sells a product based on the chip you want to use, but if it's extensible and has a lot of features you may not be able to find something you can easily shoehorn into your design. You could try contacting them to see if the offer of buying a zillion of their chips can coax them into releasing precious bits of documentation, but there are generally engineering fees associated with this. You could offer to sign an NDA, but generally they don't let someone off the street sign one, and that precludes you from open sourcing your awesome new project.

Once you've tried knocking on those doors, there's basically not much else you can do to get proper documentation. In your hypothetical situation, let's assume there is one or more existing products which are, of course, not open source based on this fancy hotness you're so interested in. For argument's sake, lets assume that this chip is not something trivially placed on a simple 2 layer board. It's QFN, BGA, quite possibly with some RF goodness. Since, aside passive component values, reverse engineering a 2 layer board can pretty easily be done with just high quality images.

Meet the Genesys Logic [GL3224](http://www.genesyslogic.com/en/product_view.php?show=53). Less than [200 pennies](https://lcsc.com/product-detail/USB_GENESYS_GL3224-OIY04_GL3224-OIY04_C157357.html) in single quantity! It's a fancy USB 3.0 eMMC/SD MMC controller with a bunch of really cool features. Genesys Logic themselves offer up a sick single-page (as per usual) short touting all of its features. A bit of Google fu reveals a 25 page datasheet and a few existing products based on this chip. One product [in particular](https://jiffyshop.com.au/SBC/odroid-c1/160-usb30-emmc-module-writer.html) caught my eye. Searches on Amazon etc for GL3224 turned up a lot of products, mostly polished ones with nice injection mold plastic cases that were a bit too pricey. At the time of this writing, the [Hardkernel store](https://www.hardkernel.com/main/products/prdt_info.php?g_code=G152105300286) that I bought these for $10 404's, but you can still get these boards fairly cheaply.

![](2018/11/odroid_emmc-1.jpg)

So you buy a couple of these, they're on the slow boat from China. What's the first step? Is there anything we can do while we wait? Of course! The top and bottom layers are exposed (albeit on black soldermask which is pretty but a pain to RE), and you can begin like so many 2 layer RE's have in the past. By staring and squinting at a series of potato quality pictures of the board, highlighting traces, colorizing layers, overlaying things, and trying to get a rough idea of what's going on. From the datasheet we have the pinout and other general information about the chip that will help us, and we have the pinout of the eMMC connector because it's one of the ODROID standardized ones.

![](2018/11/odroid_emmc.jpg)

Excitement! There was a sketchy padded envelope in the mail today. Where do we go next? You're going to need some hot air reworking tools and a relatively high DPI scanner. [The one that I bought](https://www.amazon.com/gp/product/B00SQ6CCSS) is capable of doing 9600 DPI (which is absolutely insane), but you can probably get away with anything above ~600 DPI. Start by removing all of the tall components, large capacitors, connectors, etc. The taller the components, the more out of focus the images you take will be, most scanners have a fixed focal point.

![](2018/11/emmc_crystal.jpg "4800 DPI scans are crazy")

![](2018/11/img010_small.jpg)

Once you have some quality scans of the board, start carefully removing components one by one. If there are reference designators on the board, use them to identify each component as you remove it, measure it, and record the value. Keeping a meticulous record will help when you go to design your version. Once you've pulled all the parts off and cataloged them, use a soldering iron, some leaded solder, and a bunch of flux to clean all of the excess solder. Take as many scans as you want, once you start sanding there's no turning back.

    C1        1.19uF         R1        32.7Ω
    C2        114nF          R2        9.82kΩ
    C3        106nF          R3        0.2Ω
    C4        106nF          R6        1.001MΩ
    C5        114nF          R7        683Ω
    C6        106nF          R8        10.06kΩ
    C7        1.16uF         R9        0.6Ω
    C10       1.18uF         R10       463.5Ω
    C14       2.27uF
    C15       2.24uF
    C16       ?pF
    C17       ?PF
    C18       115nF
    C19       108nF
    C20       108nF
    


![](2018/11/img011_small.jpg)

For the sanding, I used a combination of 200 and 600 grit wet dry sand paper. You can get this at any local hardware store. Taking off the soldermask will be extremely quick, especially on this board where you can literally see through the soldermask. Wet a small piece of the 600 grid sand paper and start sanding

![](2018/11/img013_small.jpg "Top Copper Layer")

You can see that the contrast on the bare copper compared to the PCB core material is much higher compared to when everything is covered with soldermask. Next, we switch to the 200 grit to sand through the much thicker layer of copper and core material so that we can expose the inner layer.

![](2018/11/img015_small.jpg "Core material")

Be sure to apply even pressure while sanding, if you don't you can end up with edges of the board that sand clear through the inner copper layer like I did. It's going to take a while, and make a gigantic mess. My desk is still a sickly shade of green because of this project.

![](2018/11/img016_small.jpg "Inner Copper Layer 2")

Again, I need to stress that even pressure is extremely important, you can see I even started to wear away parts of that power rail. Once you get to this point, with a 4 layer board, you're done. Switch to the other side, rinse, and repeat. Once you have exposed layer 3 (which in this case was frustratingly only solid ground pour), take all of your scans and composite them. Set each layer to a pure color by dumping the saturation and tweaking with the layer opacity until you get something you can understand. In this case, I chose red for the top layer, green for layer 2, and blue for the bottom layer. The result is pretty good, but if you really put some work into it you can get really great images.

![](2018/11/img013_composite_small.jpg "Composited image with 3 copper layers")

Now that the RE work is done, it's time to do your schematic and layout work. The WIP repository can be found [here](https://github.com/dvdfreitag/USB3-eMMC), and the Eagle library for my GL3224 part can be found [here](https://github.com/dvdfreitag/eagle_libraries). Keen observers will notice that the connector and pinout for the eMMC that I chose is identical to the one that the Nintendo Switch uses. This board is meant to be a high speed NAND backup and restore utility for the Switch.

![](2018/11/emmc_re.jpg)



Reverse engineering a 4 layer PCB, the slow and destructive way


I got another email. This one was interesting, the email was the standard "we had a rat on your computer that we used to take dirty pictures of you,  give us money or we will  send it to all your contacts". 

This is the email that I received.

![](2018/10/image-17.png "The scam email")

It's a fairly standard "give us money or we send dirty photos we took to your contacts" kind of scam email, but this one actually does something that I have not seen previously. The scammers establish "credibility" by actually telling you what your password is. The scammers purchased a dumped site database (that assumedly did not hash or salt passwords), correlated the email address in the DB, and sent out an email.

This scam is incredibly effective when you consider that a vast majority of people use the same password for every account. 

This scam also does something unique; they spoofed the sender of this email  to be me. 

    Delivered-To: hello@[redacted]
    Received-SPF: none (zoho.com: 171.99.132.162 is neither permitted nor denied by domain of [redacted]) client-ip=171.99.132.162; envelope-from=hello@[redacted]; helo=171-99-132-162.static.asianet.co.th;
    Authentication-Results: mx.zohomail.com;
        spf=none (zoho.com: 171.99.132.162 is neither permitted nor denied by domain of [redacted])  smtp.mailfrom=hello@[redacted]
    Received: from 171-99-132-162.static.asianet.co.th (171-99-132-162.static.asianet.co.th [171.99.132.162]) by mx.zohomail.com
        with SMTP id [redacted]; Mon, 29 Oct 2018 19:47:47 -0700 (PDT)

This was an interesting way of finding out that my mail server has incorrectly configured SPF records. This establishes ~darknet spooky hacker credibility~ by sending an email as you. 

I am going to take a shot in the dark that they try several different techniques to do this. The first, is just standard SPF record spoofing to send the message. Since the boilerplate message contains `Please don't try to contact me or find me, it is impossible, since I sent you an email from your email account.`, I am going to assume that sending mail as the recipient is part of the scam in general. 

I also have another theory, that when they send the mail, if SPF records prevent spoofing, that they then try to authenticate with the target mail server to craft the email using the harvested credentials. This would also prove to the scammers if the harvested credentials were valid. This is a technique that has been seen in the wild in previous phishing campaigns, talked about [here](https://research.801labs.org/phishing-campaign-research/).

Digging a little deeper and looking at the email headers above, the IP that sent the email is `171.99.132.162`. This IP appears to be a standard telecom IP address, belonging to a Broadband ISP located out of Bangkok, Thailand. 

![](2018/11/image.png)

Riskiq also only has two carrier-assigned DNS records for this IP address

![](2018/11/image-1.jpg)

It appears that this IP is for sure a private (possibly residential IP). Is this IP the actual IP of the scammer? I hope they they wouldn't be so dumb, but who knows. Lets poke at it on [Shodan](https://www.shodan.io). 

![](2018/11/image-2.png)

The only running service on this host is a web server. Ohhh boy, that's great. Since there was no DNS record for a TLD pointing towards this IP, it's safe to assume that it is a residential/business host that opened up a web server for something, or the scammer is running this from their home IP and has a web server running. Lets see whats on it. 

![](2018/11/image-3.jpg)

It appears this IP address is hosting a Hikvision camera control panel. Cameras are the number one compromised host for botnets or malicious activity on the internet. It's easy to assume that the person hosting this publicly accessible camera control panel left it with default passwords, and somebody logged in and compromised one of the cameras, adding it to a botnet. 

Aside from trying to log in (illegal) there's nothing more I can do for this research. :(


Phishing/Scam campaign research (ep. 2)


Hiding data in new and interesting places has always been a fun objective for anyone who likes creating and solving challenges. One of the interesting secret hiding places for data I like to use is server headers. 

I found out that you can override server headers live in-page with PHP's `header()` function. Combine this with some ascii art, and in the header of a server response you can now show people super hidden ascii art.

![](2018/10/image-15.png)

Here's the code to make it happen. Replace the `$subject` with new ascii art. 

    <?php
    $i = 0;
    $subject= "
    #    ,-''''-.
    #   (.  ,.   L        ___...__
    #   /7} ,-`  `'-==''``        ''._
    #  //{                           '`.
    #  \_,X ,                         : )
    #      7                          ;`
    #      :                  ,       /
    #       \_,                \     ;
    #         Y   L_    __..--':`.    L
    #         |  /| ````       ;  y  J
    #         [ j J            / / L ;
    #         | |Y \          /_J  | |
    #         L_J/_)         /_)   L_J
    #        /_)                   /_)";
    $header_name= "blackmagic-";
    foreach(preg_split("/((\r?\n)|(\r\n?))/", $subject) as $line){
    
        $pre = "";
        if($i<10)
            $pre = "00";
        elseif ($i<100)
            $pre = "0";
    
    
    
        header( "{$header_name}{$pre}{$i}: {$line}");
        $i++;
    
    }
    ?>
    
    


ASCII art in hidden places


An email came in that an end user thought was suspicious. The end user passed it up to one of our team members, who then passed it up to me.

![](2018/10/image.jpg "Initial phishing email")

To start off, this email is just dumb. The sender never bothered to copy legitimate Microsoft email formatting, and the wording is just strange. It doesn’t inspire even the most inexperienced users to “***rectify password expiration***”. Just for fun, let’s look at the url.
 
![](2018/10/image-2.jpg "Suspicious url")

`hxxp://piba.org.br` isn’t a known phishing site, it goes to a Portuguese church website. The site doesn’t matter, what does matter is it looks like the script is being ran through a compromised WordPress site, since it’s going through a `/wp-content/` uploads folder. It appears that somebody could upload a script to the WordPress site that acts as a pass-through to further obfuscate and prevent the campaign from being detected.

Once you click the link that passes through WordPress, you end up at a not-so-convincing office 365 login page.

![](2018/10/image-3.jpg "Bad credential harvesting page")

The email address in the link autofills the email box for your account. Let’s point out some interesting things about this scam site though. 

- the copyright on the bottom of the page has the **wrong year**.
- The site doesn't fill the entire page.
- The buttons and links don't work

 Why don’t they work? Because they’re **images**.
 
![](2018/10/image-4.jpg "Everything is a background image, instead of HTML/CSS")

Let’s look at the url and domain. `hxxp://fwclub.co.za/` is a winemaker’s club. It also doesn’t appear to be running any special framework either that would be exploitable.

![](2018/10/image-5.jpg "No interesting services detected")

There are quite a few open ports as well on this server, four of them are CPanel. It’s possible that the person running this phishing campaign got access to the site’s CPanel and piggybacked off their normal traffic.

Back to the original url, `hxxp://fwclub.co.za/includes/Office1/Login.php`. If we try one directory up, `/Office1/`, it redirects back to this script. So, lets go up another directory to `/includes/`.

![](2018/10/image-6.jpg "All the scripts!")

Hmm, looks like directory listing is turned on, and… there’s a recent backup of their phishing campaign. Let’s look at this backup.

![](2018/10/image-7.jpg)

Yup, that’s the source code to the credential dumping code. A day later, the domain is shut down in one form or another :(
 
![](2018/10/image-8.jpg)

Sophos also flagged the site, finally.

![](2018/10/image-9.jpg)

Well, we’ve still got their source code, so let’s take a look. 

`blocker.php` is a very interesting file.

![](2018/10/image-10.jpg)

The code uses a function I’ve never actually seen in PHP before, `gethostbyaddr()`, which attempts to lookup the incoming IP address to a hostname and possibly an identifier, like as Google or AWS, as well as the host names for a few other malware and phishing scanners.

It also has a list of banned IP addresses, ranges from Google, Cogent, Digital Ocean, ISC, EQNET, INSC, Amazon, Softlayer, EIG, NTT America, MX Logic, British Telecom, Nianet, Elisa, GigeNET, University Of Minnesota(?), NetVision, NET1 Plus, Unified Webhosting, MULTACOM, China Unicom, Dassault Systèmes, Hurricane Electric, CoreSpace, SITA, Orange S.A, Cyber Wurx, CYBERCON, Zayo Bandwidth, Savvis, QTS, Kasetsart University in Thailand(?), Chungnam National University in South Korea(?), RCC, USAA, Comverse, Omnico Hosting, AT&T, Marlink, Airstream, The Department of Defense Network Information Center, and DataPipe. Whew, that was a long list. 

The major group of IP ranges are hosting providers that have a large amount of traffic for VPN/Proxy services. It would make sense that the Phisher’s target audience falls outside of hosting companies, it falls to individual users and companies. The second interesting group of IPs are for a few Universities, none in the list make any sense though. Only one of them has a recognized Cybersecurity course. It appears that MXLogic is also on the list, probably to avoid enterprise email filtering detection for companies that use it. I also found it a little interesting that they blocked the DoD as well.

The last bit of code simply checks if the useragent falls under msnbot, google bot, yahoo bot, etc. They also have a robots.txt that does the same thing.

Once it has checked the incoming request, the index.php file sets the header (URL) to something along the lines of  `login.php?websrc=<random numbers>&dispatched=<random numbers>&id=<random numbers>&email=<compromised email>`. It’s interesting that the phishing author attempted to make the URL look more legitimate and lengthy, as many official emails are.
 
![](2018/10/image-11.jpg)

Once it goes to the Login.php page, it loads the two images and two text boxes that are supposed to look like, and auto fills the email address, to make it look more “authentic”.

On the form submit, it hits `logon.php` (not login). Here’s where something interesting happens. The first thing the script does, is gets the visitors country from geoplugin.net. The second thing it does, is craft a basic email and loads in the submitted username, password, ip, browser, date, and geoip lookup. It then sets the TO: field of this email to ipconfigura@gmail.com, the subject to `“Office365 | <country> | <username>”`  and lastly sets the FROM: field to `“John De Fisher <new@cpanel.com>”`.

![](2018/10/image-12.jpg)

After it crafts this email, it then runs a function called `check()` from inside a PHPMailer directory from the script `smtp.php`, and passes the submitted username and password. Let’s look at this script then.

![](2018/10/image-13.jpg)

This `check()` function is incredibly clever. It connects to the office365 SMTP server, authenticates with the server using the submitted credentials, sets the FROM field to the email `hbergamini@truehomesusa.com`. This is interesting, `truehomesusa.com` doesn’t seem to be flagged and is a legitimate website, they even run on office 365. I take an educated guess and figure that this domain has not fully set up the correct MX records to protect their domain from email spoofing, allowing this test email to not be noticed by most people and not appear in anybody’s inbox. Clever. It then checks to see if the email sent. If it could send, it means that the submitted credentials successfully authenticated with Microsoft and are correct. 

This is something I don’t see that often. It’s commonplace for campaigns to accept and send off any credentials it gets, but this one is checking the validity of the credentials. It also allows the phishing author to provide a “Password not recognized” message, to skeptical users who input a wrong password the first time to see if it works or not.
 
![](2018/10/image-14.jpg)

Aaand that's the analysis of this phishing campaign.


Phishing/Scam campaign research


### Fingerprint readers are silly

DISCLAIMER: I used to work for a physical security company architecting access control and surveillance solutions. 

One job I was tasked with was getting a fingerprint-based reader tested and operational for demoing our new level of hardware support for more secure facilities, 2 factor physical access control; something you are (fingerprint) and something you know or have. (pin/card)

We were given these readers to test. The readers had a TON of wiring on the back of them. The two important things that the reader pinouts contained was

1. Weigand 2-pair access control wire
2. POE-enabled RJ45 port   

The way that these readers work with existing access control systems **completely invalidates** the security benefits of using a fingerprint-based authentication system. Let me explain the architecture and design of this system.

First, you must enrol fingerprints on the reader. You essentially scan a fingerprint a handful of times, give it a name, and assign it a badge. Wait, a badge? Yes. The reader contains a **local** database of every fingerprint in it's system, as well as a **card **associated to this fingerprint. When a fingerprint authenticates and is validated to the local database on the reader, the reader takes the card associated with that fingerprint and relays it over Wiegand wiring to an access control box. This reader is essentially functioning the exact same as a normal fingerprint-less card reader.

![](2018/10/Untitled-Diagram.png "Finger is read, authenticated against a print DB, then the card associated is passed over to the access control system")

The fingerprint reader on the back end/access control provides the exact same level of authentication as a standard card-based system. If the reader is configured to pass through card reads (passthrough mode for 2nd factor, or for card or fingerprint setups) the fingerprints are **completely useless**.

---

# Potential attack 1: network permeter comprimise

This edge device has an ethernet port. 

Which means it has an ethernet cable, which is going to have to tie into an internal access control network to allow it to talk to the provisioning server. Most people put their ICS on the same network. Cameras, access controls, gate controls, HVAC, etc. From the exterior of the building, you now have hardline access to an internal control network. 

If this network has any kind of network security (for instance, MAC address filtering), you can pull the MAC of the fingerprint reader directly from a sticker located next to the ethernet port. Spoof that MAC and you have access.

---

# Potential attack 2: device fingerprint datastore compromise

The database containing **fingerprint** data is stored non-centrally, and every reader has a copy. The enrolment process is

1. Scan fingerprint on central server
2. Associate card, name, etc to fingerprint
3. Push new user profile to all readers on the network
4. Reader receives profile, adds it to internal datastore

If you compromise the edge device (reader), you can potentially access this database through their control software, or directly through chip-off forensics. This datastore is going to not just contain fingerprint data, of which I would consider **incredibly valuable and sensitive information**, it would also contain all associated cards for every user profile. 

Unless a mass card revocation is initiated, you now also have a datastore of every functioning, authenticating, door-opening card in the system. Additionally, you may have full names, positions, teams, pictures, etc for every user.

---

# Potential attack 3: Weigand man-in-the-middle

This isn't specifically a fingerprint reader specific attack, but it is just as effective. You can purchase a device that clamps onto the Weigand data wires and can Man-in-the-middle cards over the wire. With this, you can 

- offload all cards as they get sent to the access control system
- in-line replace/denial of service on all/selected cards (lock someone out of the building)
- Replay a functioning card without having to have a card cloner/spoofer

Devices like the [ESPKey](https://redteamtools.com/espkey) are cheap ($99) and usable with bluetooth or wifi.

![](2018/10/ugdTOpe.jpg "ESPKey in-line man-in-the-middle")


801 Labs Research Portal

Research, How-To's, Stories, & More