https://community.rapid7.com/community/metasploit/blog/2017/03/21/metasploits-rf-transceiver-capabilities

物联网兴起

我们花费大量时间来监控我们的企业网络，并使用许多工具来检测异常的行为。我们不断地扫描漏洞、公布测试。然而，我们经常不能认识到自己网络，和家庭中的小型（有时是大型）物联网（IoT）设备。令人震惊的是，考虑到它们的普遍性 – 这些设备并不是容易被测试的。

RF：(无线射频识别(RadioFrequency))一般指无线射频

虽然很困难，在技术上，可以通过其以太网侧的连接来发现和识别这其中的部分IoT设备。但这不能让我们全面了解这些设备对消费者或企业带来的风险。当仅评估以太网连接的设备时，您可能会错过对企业安全造成重大影响的无线系统。无线网络通常会控制警报系统、监控、门禁、机房HVAC控制等诸多领域。

这给我们带来了一个非常关键的问题：如何真正确定这些设备的风险？

从最基础开始：

• 这些连接的设备能做什么？
• 这些设备的作用范围是多少？
• 设备是否具有无线功能？

传统上，我们经常对802.11无线网络执行周期扫描，以确保接入点是否安全，网络流量是否过大。我们可以监控并创建堆叠的AP以防止他们某一个挂掉或者被附近电磁干扰。当然，如果你问：其它频率的无线频段呢？而这恰恰是我们要研究的领域和方向。

也许您由于其他原因使用非802.11标准以外的其他无线电频。遥控车库门？RFID读卡器、无线安全系统、Zigbee控制灯或HVAC系统等。

这些设备的频率范围是多少？它们是否加密受保护？当受到干扰时会发生什么？在封闭或开放的状态下是否失败？

无法有效地回答这些问题，是我们发布Metasploit硬件桥射频(RF)收发器的真正原因，也说明为什么我们认为这将是安全研究人员和渗透测试人员了解其实际攻击面的关键工具。

现在，安全团队将能够对公司的安全状况进行更真实的评估。能够测试物理安全控制，并更好地了解物联网及其他设备的安全性。

以安全研究的名义进行的大部分活动可能是有争议的或难以理解的。 但RF测试肯定是正确的，随着我们看到越来越多的技术利用RF通信，研究领域变得越来越多和越普遍。

对安全测试领域开发的任何技术最常见的批评是：容易被攻击者利用。安全圈有个常见的反应：如果已经被攻击者利用，那我们唯有了解黑客在做什么、有效地模拟攻击方法，并展示攻击潜在的影响，才能采取必要的措施来阻止他们。

这是Metasploit背后的逻辑，以及驱动了Rapid7大规模的漏洞研究工作。这也是RF 收发器出现的原因。我们坚信，RF测试是漏洞测试非常重要的的一部分(虽然目前仍被忽视)，随着物联网生态系统的发展，射频测试的重要性将会持续增加。

我们有这样一个案例，2016年，Rapid7的Jay Radcliffe公布了强生公司Animas OneTouch Ping胰岛素泵的多个漏洞。

https://v.qq.com/iframe/player.html?vid=h0387fb90nt&width=986&height=739.5&auto=0攻击演示过程

普通的泵具有血糖仪，其通过专有无线管理协议中的无线电频作为遥控器。泵和遥控器之间的通信以明文而非加密的形式传输。这为攻击者创造了机会，使用适当的技术手段和资源来欺骗短距离遥控器将触发未经授权的胰岛素注射。

虽然Jay认为攻击者利用这些漏洞的可能性比较低，但可能会严重伤害使用该技术的患者。幸运的是，Jay及时发现了这个问题，并给强生公司提出建议，通知病患者使其减轻风险。 如若没有RF测试，这些漏洞可能一直存在，患者将无法做出选择来保护自己。

Status-1
REMOTE: 00 00 00 04 A3 5A 92 B2 4C 00 0E 0F .....Z..L...
REMOTE: 00 00 00 04 A3 5A 92 B2 4C 00 0E 0F .....Z..L...
PUMP: 00 00 FF 00 1A D1 81 81 ........
REMOTE: 20 00 0E 00 BF DB CC 6F ......o
PUMP: 03 00 F1 04 16 B9 B9 87 2C 01 00 00 ........,...
REMOTE: 03 00 F8 00 31 FD C9 EE ....1...
PUMP: 03 00 07 04 88 76 DA DD 2C 01 00 00 .....v..,...
REMOTE: 03 00 12 00 F0 30 0E FC .....0..
PUMP: 20 00 ED 12 E7 BC 93 43 01 01 27 05 26 02 8F 00 ......C..'.&...
PUMP: 57 45 45 4B 44 41 59 00 00 00 WEEKDAY...
PUMP: 05 00 EA 00 D5 8F 84 B3

样本数据包

工作原理

在解释其工作原理之前，需做一个简单申明： Rapid7不销售RF测试所需的硬件。您可以在任何地方获得。比如：Hacker Warehouse，Hak5，淘宝，京东，亚马逊或任何无线设备的电子商店。

使用射频(RF)收发器，安全专家能够制作并监控不同的RF数据包，以正确识别和访问公司内除以太网以外的无线网络系统。

第一个RF收发器版本支持TI cc11xx低功耗Sub-1GHz射频收发器。 RF收发器可以调整设备来识别和调制解码信号。甚至可以创建短时间的干扰来识别故障状态。该版本还提供了与TI cc11xx芯片组流行的RfCat python框架兼容的完整API。如果您现有的程序使用RfCat，您可以轻易的将它们移植到Metasploit中。此版本附带两个后置模块：基于暴力破解的振幅调制(rfpwnon) 和 通用发射器(transmitter)。

如何使用RF Transceiver

使用新的RF 收发器需要购买像Rard Stick One这样兼容RfCat的设备。 然后下载最新的RfCat驱动程序，在这些驱动程序中，会有一个rfcat_msfrelay。这是RfCat中Metasploit Framework的中继服务器，运行在附属的RfCat兼容设备系统上。

您可以连接硬件桥：

$./msfconsole -q
msf > use auxiliary/client/hwbridge/connect
msf auxiliary(connect) > run

[*] Attempting to connect to 127.0.0.1...
[*] Hardware bridge interface session 1 opened (127.0.0.1 -> 127.0.0.1) at 2017-02-16 20:04:57 -0600
[+] HWBridge session established
[*] HW Specialty: {"rftransceiver"=>true} Capabilities: {"cc11xx"=>true}
[!] NOTICE: You are about to leave the matrix. All actions performed on this hardware bridge
[!] could have real world consequences. Use this module in a controlled testing
[!] environment and with equipment you are authorized to perform testing on.
[*] Auxiliary module execution completed
msf auxiliary(connect) > sessions

Active sessions
===============

Id Type Information Connection
-- ---- ----------- ----------
1 hwbridge cmd/hardware rftransceiver 127.0.0.1 -> 127.0.0.1 (127.0.0.1)

msf auxiliary(connect) > sessions -i 1
[*] Starting interaction with 1...

hwbridge > status
[*] Operational: Yes
[*] Device: YARDSTICKONE
[*] FW Version: 450
[*] HW Version: 0348

要了解有关RF Transceiver的更多信息，在这里下载最新的Metasploit：

https://www.rapid7.com/products/metasploit/download/community

The rise of the Internet of Things

We spend a lot of time monitoring our corporate networks. We have many tools to detect strange behaviors. We scan for vulnerabilities. We measure our exposure constantly. However, we often fail to recognize the small (and sometimes big) Internet of Things (IoT) devices that are all around our network, employees, and employees’ homes. Somewhat alarmingly – considering their pervasiveness — these devices aren’t always the easiest to test.

Though often difficult, it is technically possible to find and identify some of these IoT devices via their Ethernet side connection. But that doesn’t always give us a full picture of the risk these devices present to consumers or organizations. When assessing only Ethernet connected devices you can miss the wireless world that can have a major impact on the security of your organization. Wireless systems often control alarm systems, surveillance monitoring, door access, server room HVAC controls, and many other areas.

Which leaves us with one very critical question: how do you really determine the risk of these devices?

Let’s start with the basics:

• What do these connected devices do?
• What is the range of exposure of these devices?
• Does the device have wireless capabilities?

Traditionally, we often perform perimeter scans of our 802.11 wireless networks to ensure our Access Points are secure and the network bleed isn’t too large. We can monitor these Access Points (APs) to create overlap in case one goes down or gets interference from a nearby kitchen microwave.

However, if you’re asking yourself, “but what about the rest of the wireless spectrum?” that’s exactly the position we found ourselves in.

Radio, radio, everywhere

Chances are your company and employees are already using many other radio frequencies (RFs) outside of the standard 802.11 network for various reasons. Perhaps you have a garage door with a wireless opener? Company vehicle key fobs? Not to mention RFID card readers, wireless security systems, Zigbee controlled lights, or HVAC systems.

What are the ranges for these devices? Are they encrypted or protected? What happens when they receive interference? Do they fail in a closed or open state?

The inability to effectively answer these questions (easily or even at all) is the very reason we are releasing the RFTransceiver extension for Metasploit’s Hardware Bridge, and why we think this will be a critical tool for security researchers and penetration testers in understanding the actual attack surface.

Now, security teams will be able to perform a much broader assessment of a company’s true security posture. They will be able to test physical security controls and better understand when foreign IoT and other devices are brought onto the premises.

Sunlight is the best disinfectant

Much of the activity undertaken in the name of security research can be contentious, divisive, or hard to understand. This is certainly true of RF testing, an area of research becoming both more prevalent and increasingly necessary as we see more and more technologies leveraging RF communications.

The most common criticism of any technology created for the purpose of security testing is that bad guys could use it to do bad things. The most common response from the security research community is that the bad guys are already doing bad things, and that it’s only when we understand what they’re doing, can effectively replicate it, and demonstrate the potential impact of attacks, that we can take the necessary steps to stop them. Sunlight is the best disinfectant.

This is the logic behind Metasploit, as well as what drives Rapid7’s extensive vulnerability research efforts. It is also the reasoning behind the RFTransceiver. We strongly believe that RF testing is an incredibly important – though currently often overlooked – component of vulnerability testing. We believe that failing to test the usage of radio frequency in products puts people and organizations at risk. We also believe the importance of RF testing will continue to escalate as the IoT ecosystem further expands.

To provide an example of this kind of testing, in 2016, Rapid7’s Jay Radcliffe disclosed vulnerabilities in Johnson & Johnson’s Animas OneTouch Ping insulin pump. The popular pump has a blood glucose meter that serves as a remote control via radio frequency in a proprietary wireless management protocol. Communications between the pump and the remote control are sent in cleartext, rather than being encrypted. This creates an opportunity for an attacker with the right technical skills and resources, opportunity, and motive to spoof the Meter Remote and trigger unauthorized insulin injections.

While Jay considered the likelihood of an attacker exploiting these vulnerabilities in the wild to be quite low, it could seriously harm a patient using the technology. Fortunately, Jay’s research uncovered the problem and he was able to work with Johnson & Johnson to notify patients and advise them of ways to mitigate the risk. Without RF testing, these vulnerabilities would have continued to go unnoticed, and patients would not have the opportunity to make informed choices to protect themselves.

How it works

Just one quick author’s note before we get into the ‘how-to’ portion. Rapid7 does not sell the hardware required to perform RF testing. The required hardware can be found at any number of places, including Hacker Warehouse, Hak5, or any electronics store that carries software defined radios or RF transmitter hobbyist equipment.

With the RFTransceiver, security pros have the ability to craft and monitor different RF packets to properly identify and access a company’s wireless systems beyond Ethernet accessible technologies.

The first RFTransceiver release supports the TI cc11xx Low-Power Sub-1GHz RF Transceiver. The RFTransceiver extension makes it possible to tune your device to identify and demodulate signals. You can even create short bursts of interference to identify failure states. This release provides a full API that is compatible with the popular RfCat python framework for the TI cc11xx chipsets. If you have existing programs that use RfCat you should be able to port those into Metasploit without much difficulty. This release comes with two post modules: an Amplitude Modulation based brute forcer (rfpwnon) and a generic transmitter (transmitter).

How to use RFTransceiver

Using the new RFTransceiver extension requires the purchase of an RfCat-compatible device like the Yard Stick One. Then download the latest RfCat drivers, included with those drivers you will find rfcat_msfrelay. This is the Metasploit Framework relay server for RfCat. Run this on the system with the RfCat compatible device attached.

Then you can connect with the hardware bridge:

./msfconsole -q

msf > use auxiliary/client/hwbridge/connect

msf auxiliary(connect) > run

[*] Attempting to connect to 127.0.0.1...

[*] Hardware bridge interface session 1 opened (127.0.0.1 -> 127.0.0.1) at 2017-02-16 20:04:57 -0600

[+] HWBridge session established

[*] HW Specialty: {"rftransceiver"=>true}  Capabilities: {"cc11xx"=>true}

[!] NOTICE:  You are about to leave the matrix.  All actions performed on this hardware bridge

[!]          could have real world consequences.  Use this module in a controlled testing

[!]          environment and with equipment you are authorized to perform testing on.

[*] Auxiliary module execution completed

msf auxiliary(connect) > sessions

Active sessions

===============

Id  Type                   Information    Connection

--  ----                   -----------    ----------

1   hwbridge cmd/hardware  rftransceiver  127.0.0.1 -> 127.0.0.1 (127.0.0.1)

msf auxiliary(connect) > sessions -i 1

[*] Starting interaction with 1...

hwbridge > status

[*] Operational: Yes

[*] Device: YARDSTICKONE

[*] FW Version: 450

[*] HW Version: 0348

To learn more about the RFTransceiver, you can download the latest Metasploit here: https://www.rapid7.com/products/metasploit/download/community/