USA 2002

### Overview In this Black Hat presentation titled "DC Phone Home" (also termed "180° hacking"), Aaron Higbee and Chris Davis demonstrate how conventional enterprise security focuses heavily on perimeter defense—creating an architecture with a "hard crunchy outside and a soft chewy center"—while neglecting outbound egress filtering. The speakers argue that perimeter firewalls and traditional network intrusion detection systems (NIDS) are ineffective against attacks initiated from inside the trusted boundary. To exploit this asymmetry, they present methods and custom hardware/software platforms that automatically discover local network settings, enumerate allowed outbound egress traffic, and phone home to establish an encrypted inbound tunnel back to an external attacker system ("the Mothership").

### Key Topics - **Inversion of Perimeter Assumptions:** Organizations enforce strict ingress filtering but allow extensive outbound communications (e.g., HTTP, HTTPS, DNS, SMTP, ICMP) because users need external internet access. Attackers who gain brief physical access or leverage social engineering bypass perimeter controls entirely without generating inbound attack signatures. - **Egress Enumeration and Phoning Home:** Once a device is introduced inside the perimeter, it acquires an internal address via DHCP, probes common external ports (such as Google on ports 80 and 443, EarthLink on port 25, DNS on UDP port 53, and ICMP), and records available outbound communication channels. - **Proxy Discovery and Traversal:** When direct outbound connections are blocked, the device runs an automated script ("Proxy Finder") to locate local proxies via DNS zone transfers, reverse lookups, and keyword grep searches (e.g., `proxy`, `squid`, `gate`). It then initiates encapsulated VPN tunnels using HTTP/proxy tunneling, SSH, and PPP through the proxy's `CONNECT` method. - **Drop-and-Go Platforms:** The authors implemented their phoning-home framework across three low-cost or ubiquitous platforms: 1. *Sega Dreamcast:* An inexpensive consumer gaming console modified with a Linux distribution, custom cross-compiled kernel, and broadband adapter. 2. *Compaq iPAQ:* A small handheld device running Familiar Linux, strongARM CPU, and optional PCMCIA adapters (supporting wireless cards like Orinoco). 3. *x86 Bootable CD:* Based on a 20 MB trinux ISO image equipped with networking, tunneling, and mapping tools.

### Technical Details - **Tunneling Stacks:** Depending on available egress protocols identified in `dc.info.txt`, the devices attempt several tunneling mechanisms: - VTun over allowed TCP ports (e.g., port 25 or 80) utilizing kernel `tun`/`tap` drivers. - CiPE over UDP port 53. - ICMP tunneling for networks permitting echo requests. - Multi-layer encapsulation through proxies using `proxy-tunnel` or `httptunnel`, wrapping SSH and PPP to create a full virtual network interface. - **Network Routing:** The architecture establishes virtual networks (demonstrated with subnets such as 10.0.3.0 and 10.1.1.0) using double NAT/masquerading on both ends of the tunnel, providing the external attacker bi-directional routed access into the victim's internal subnet without running complex dynamic routing protocols. - **Tooling Included:** The toolkit leverages tools such as Nmap, Netcat, SSH, PPP, VTun, CiPE, S-Tunnel, HTTP-Tunnel, Proxy Tunnel, and Felix's F-Scanner / Dsniff for credential and authentication capture.

### Takeaways - **Shift from Prevention to Egress Constriction:** Absolute prevention of internal access is unrealistic. Defenses must focus on constricting outbound traffic to rigidly defined and monitored interfaces. - **Mandatory Egress Proxies and Inspection:** Organizations should route all outbound traffic through strict application-layer and protocol-analyzing proxies rather than raw egress paths, and employ switch port security (MAC address controls) to prevent unauthorized devices from connecting. - **Internal Data Protection:** Security investments must pivot toward protecting sensitive internal data directly rather than relying exclusively on boundary firewalls and perimeter NIDS.