Although I love working with hardware, if I can avoid hardware attacks, I will. The network interfaces on a device are often all we need to compromise it.
There are three different ways we will need to connect to Ethernet devices:
- Receiving an IP address from the device via DHCP
- Setting a manual IP address to communicate with the device
- Offering an IP address to the device via DHCP
DHCP is Dynamic Host Configuration Protocol. For the purposes of this post, it is simply the way that devices connecting to a network are assigned an IP address as they connect.
Basic Setup
We will be using a USB Ethernet adapter which will be passed through to our Ubuntu VM. This is preferable to using a bridged connection to our built-in Ethernet, as it ensures that the host operating system is not going to interfere. It also allows multiple network connections.
I am using an Amazon Basics USB 3.0 Gigabit Ethernet adapter and a switched Sabrent USB hub (both discussed in this post). Switched hubs allow us to power cycle connected devices without unplugging them. Unfortunately, it is very common to have to disconnect and reconnect USB devices for them to work correctly, especially in VMs.
The most common chipsets for USB Ethernet are ASIX AX88179 (USB 3.0 Gigabit), ASIX AX88772A (USB 2.0 100Mbit) and Realtek RTL8152B (USB 3.0 Gigabit). As far as I know, all are supported natively in Windows and Ubuntu without installing any drivers.
USB 3.0 (or 3.1) support needs to be enable for the VM itself. VM->Settings, then navigate to the USB section and ensure it is set correctly. If you leave this on 1.0, the device will partially enumerate but fail to work correctly – I was once losing random part of packets due to this!
The USB device needs to be passed through to the VM. In VMware Workstation, go to VM->Removable Devices->(name of device) -> Connect (Disconnect from Host). You should get some USB sounds to indicate this happening
Type:
dmesg
And you should see the most recent log entries show the device.
Type:
ifconfig
or
ip
And you should also see the adapter.
Notice the name of the adapter: enx0050b6fff820. The last part is the MAC address of the adapter. In some respects, this is annoying – when you need to type the name of the adapter in (remember – copy and paste!). In other respects, it means you can have multiple adatpers plugged in and not get confused.
If at this stage you are having issues, try power cyling the Ethernet adapter.
Lazy Method of Setting up Connections
I’m fundamentally quite lazy. I’ve found that Ubuntu’s built-in network manager handles the networking setups we need, and does it quickly and efficiently. I’m sure some people won’t be happy with this, but this method works and is easy to remember.
Run:
nm-connection-editor
You should be presented with a window showing two network connections – the VM NAT connection and the new USB Ethernet.
Rather frustratingly, they are not named using MAC address here. Generally, the higher numbered one is the most recently plugged in. Here I select “Wired connection 2” and press the settings (cog) button at the bottom.
Confirm that the “Device” is the same as the MAC address of the adapter.
Now click on the “IPv4 Settings” tab. This is where we can choose which of the three options we want.
Receiving an IP address from the device via DHCP
This is the situation if we are connecting to the LAN side of a router, or simply connecting to a network to test.
This is the default “Method” in Ubuntu – “Automatic (DHCP)”. Change or set it to this.
Ensure that there are no “Addresses” listed below – if there are, delete them.
Setting a manual static IP address to communicate with the device
This will often be used when the device under test already has a static IP address. This is common on DVRs and ICS equipment. It is also used when devices enter recovery mode – a lot of routers will take a manual IP of 192.168.x.1, and you need to manually set yourself to 192.168.x.2 or similar to communicate.
Change the “Method” to “Manual”.
Press “Add” next to the addresses. Add the address. The netmask should automatcially populate – generally a 24 subnet will work for IoT. Unless you want to try and route traffic out, leave the gateway blank.
Offering an IP address to the device via DHCP
Most consumer IoT devices will connect out, and assume that they will receive an IP address via DHCP. We want to act as a router for this traffic, allowing us to intercept and tamper with any communications from the device.
Ubuntu can natively do this. Set the “Method” to “Share to other computers”.
Ensure that there are no “Addresses” listed below – if there are, delete them.
That’s it. Your machine will assume the IP address of 10.42.0.1, offer IPs to connecting devices, and route traffic. Simple.
For all methods
Press “Save”. You don’t need to quit out of the list of connections if you don’t want to.
If you have changed from one connection to another, then you will need to drop the connection and bring it back up. There are two ways I do this.
You can simply unplug the network connection, wait 10 seconds, and plug it back in.
Or run:
nmcli device disconnect enx0050b6fff820 nmcli device connect enx0050b6fff820
Remember that not all IoT devices will request a new DHCP lease if the connection drops – some only do this at startup. We will look at working with Wireshark analyse traffic in a later post to diagnose issues.