HandsOnKB

S1x6: eps1.5_br4ve-trave1er.asf

Episode Description: “<mr.rob0t> to save someone elliot cares abt, hes gotta hack vera– badass drug-dealer– out of jail. tyrells “game” gets crazy. angela digs deeper into moms death.”

The title of this episode references the Advanced Systems Format filetype, Microsoft’s digital audio/video container format for streaming digital media, which was created by Microsoft as part of their Media Foundations Framework as the infrastructure for digital media streaming in Windows versions from Vista to Windows 11.

This episode gets even more tense than the last one, with Elliot’s bust of drug dealer Vera backfiring when his brother and men kidnap Shayla. Now Elliot has a limited amount of time to break Vera out of prison or Shayla will be killed.

Elliot Hack’s Isaac’s Phone Via BlueTooth

This really dates the show considering Isaac has a Samsung Galaxy S5 and we’re about to have the S27 come out. It was also a time where BlueTooth was way less secure than it is today. Elliot looks for BlueTooth devices in his vicinity and you can see the date, time, MAC address, clock offset (discrepancy between Elliot’s device and the target), and Class of device.

The Class for BlueTooth devices is a hexadecimal value based on the device’s capabilities (telephony, audio, video, networking, etc.). This site gives you a decent idea of how it works.

In terms of hacks for BT devices back then (2014/2015) Elliot may have used two vulnerabilities for the SwiftKey application which was installed by default on Samsung Galaxy phones at the time: CVE-2015-4641 and CVE-2015-4640

Basically SwiftKey, even if it wasn’t actively being used, would look for language pack updates from their designated server over HTTP connections. These packets could easily be monitored and messed with by an attacker, modifying them to get RCE on Android phones with the privileges of the application. This could allow for eavesdropping on calls, texts, e-mails, and more.

There’s a good chance this is what Elliot did, since he tells Isaac later in the episode that he has all “everything” from their operation.

Darlene Drops USBs Near The Prison, And A Cop Accesses One

This episode’s just full of stupid people being incredibly naive. Darlene drops handfuls of USB drives in the parking lot of the prison and a cop takes one back to his desk and inserts it into his work computer. The fact that she dropped dozens of them near each other is already incredibly suspicious. For a real life attack or pen testing engagement that would be a terrible idea.

The malware Darlene put on the USB drive attempts to trick users by saying they have the chance to get a “Free eTunes Gift Card” if they just complete a survey. Pop ups like this used to be WAY more common online.

While this idiot is busy trying to get his gift card, his computer’s Avast anti-virus catches the attempted connection via Internet Explorer (iexplorer.exe) by Darlene’s malware, with the identifier “JS:ScriptPE inf[Trj]” which probably stands for “JavaScript: Script Portable Executable infection [Trojan].”

Basically Darlene made a malicious JavaScript file formatted into a typical Windows .exe or .dll (which is what PE files are) that would attempt to connect back to a machine either she or Elliot controlled after the cop clicked on an iframe (that was 468×60 pixels) that she snuck into an AdMeld ad.

Writing the file to disk, not obfuscating its contents, and not testing this payload by running it against other AV engines makes this a pretty poor attempt by Darlene. In-memory payloads, packers, and multi-AV engine scanners like VirusCheckmate and NoDistribute were definitely in use. You can read about some of them in this PCMag article from 2018. There’s also an article from last year on another service like this named “Avcheck.net” that was busted by law enforcement.

Elliot’s Hack of the Prison

Desperate to find a way into the prison, Elliot starts researching the use of PLCs in prisons. Considering PLC security today (not to mention 11-12 years ago) this would be pretty easy. The password was probably “admin” or a manufacturer default, so if he could reach those PLCs it would be child’s play from that point on.

Later when they head out to the prison to meet with Vera, he leaves his phone in an office with a signal sniffer running to look for wireless network connections.

Unfortunately the prison runs WPA2, meaning Elliot’s only option would be brute forcing the password to join the network. Luckily Elliot sees that the police cruisers have 4G connections for their dash cams to be sent back to the police department’s servers along with bluetooth keyboards they use to have an easier time typing from the driver’s seat.

All he would have to do is get onto that bluetooth keyboard, access the cell connection somehow and jump to the prison network. Pretty complex in real life but no big deal for fictional hackers.

So Elliot’s plan ends up being having Darlene charm the cop while he secretly uses the cop’s in-cruiser laptop’s bluetooth signal to hack in, then Elliot jumps from the cruiser to the prison network via the car’s 4G connection, accesses the PLCs in the prison to unlock all the cell doors, and lets Vera escape.

Elliot sets himself up in Isaac’s car while Darlene goes to sweet talk the cop. He sets up bluesniff on his laptop hoping to connect to the cop’s laptop while she distracts him.

Elliot can be seen using bluesniff to discover bluetooth devices, hcitool to interact with them on Linux and find the cop’s laptop’s bluetooth signal in discoverable mode, and hciconfig to configure the devices for him to connect to.

Elliot discovers the bluetooth signal from the officer’s laptop and uses that to get in. He connects as a bluetooth keyboard for easy keystroke injection, similar to something like a BadUSB attack.

Then from the cruiser’s laptop Elliot connects to an FTP server he controls to download a PLC exploit executable.

Elliot can then be seen running a fictional Meterpreter payload named “PLCpackage” to gain access to the prison’s programmable logic controllers from the cruiser. It can be assumed that this is being done via the cruiser’s 4G connection to the prison network. Later on that night the prison doors all open, and the power goes out in the entire facility, allowing Vera and dozens of others to escape.

S1x7: eps1.6_v1ew-s0urce.flv

Episode Description: “Eliot desaparecido. Mr. Robot tenta reunir a f-sociedade. O futuro depende disso. Angela se vê cara a cara com um velho inimigo. Extremamente arriscado.”

Translation: “Eliot is missing. Mr. Robot tries to reunite fsociety. The future depends on it. Angela comes face-to-face with an old enemy. Extremely risky.”

The FLV filetype (Flash Video) is for an old video and audio encoding from the Adobe Flash Player. It’s been a long time since Flash was anywhere on the internet, but it used to be extremely prevalent for not just video but games, programs, etc.

Young Elliot Copying Sites By Copying HTML Source Code

While sitting in Gideon’s office, Elliot has a little monologue about how he first learned HTML by going to his favorite websites and viewing their source code, then copying it with small edits to make his own.

I’m a big fan of learning about how web browsers and sites work through browser dev tools and HTML source code, so I was pretty happy to see the show touch on this.

S1x8: eps1.7_wh1ter0se.m4v

Episode Description: All safe is hacked and Elliot is meeting White Rose. Tyrell is interrogated by the police and Elliot remembers who he really is.

Elliot Uses AirDream Thermostats Backdoor to All Steel Mountain Locations

After getting the fsociety crew back together, Elliot reveals to them that from the Raspberry Pi they installed in the Steel Mountain facility he’s expanded to backdoors via the thermostats in ALL Steel Mountain locations because they “all phone home to the same network.”

That means that Elliot’s backdoor on the original thermostat then gave him access to that network, which he used to connect to every other model of that thermostat being used in Steel Mountain’s distributed facilities. That’s a very well executed hack, even though the lead up to getting the physical implant in the building was a complete mess.

Tyrell Wellick Searches the CS30 Server/Honeypot

Still shaken mentally from his murder of his boss’ wife, Tyrell rushes to his office to SSH into the CS30 server and search for any remaining trace of the fsociety hack. He’s initially unable to find the directory where the malware was left until he notices a directory named “fd1nfo” imitating the legitimate “fdinfo” directory.

Tyrell opens it to find fsociety’s directory where the malware was stashed, but he can’t access it.

Elliot Gets Into Gideon’s OSTicket Account to Keep the CS30 Server Up

Elliot needs to get onto Gideon’s phone to get the temporary token to log into his account for their IT support ticketing software (OSTicket) and send a message to keep the CS30 server up and connected so the world-changing hack can take place.

He sends a number of 100 GB MMS files to Gideon’s phone to drain the battery so he leaves it charging in his office, then has fsociety hack the office TVs to play a video calling out Gideon and drawing everyone’s attention as Elliot gets to work.

After a very close call with Gideon checking on him at his desk, Elliot successfully gets into the account and sends the message impersonating his boss, essentially dooming the company in order to strike a blow against Evil Corp.

Final Thoughts

Overall I thought these three episodes had some good content in terms of the plot (with the reveal of Elliot’s mental delusions) but the technical content was more misconduct than actual hacking. Hopefully the later episodes include more interesting black hat stuff.