Omphalos

Two omphalos processes, 2011-07-23

A tool for network enumeration, protection, evaluation, and subjugation. Omphalos makes use of passive and active portscanning, DNS/DHCP/Zeroconf server interrogation, portknock detection, covert channel detection and establishment, ARP scanning, automatic WEP cracking, man-in-the-middling, and a whole host of other tricks. GPS integration? Oh yes. Coordination across multiple interfaces? Of course. Use of Linux's MMAP_RX_SOCKET and MMAP_TX_SOCKET? Wouldn't have it any other way. While designed as an offensive tool, omphalos has proven useful to me for network debugging and troubleshooting, as well as experimentation.

Omphalos is not a "point-and-click" tool so much as "pull the pin" or perhaps "spray the area". Default behavior is to redirect and seize all traffic, attack weak cryptosystems, archive authentication materials, and learn everything that can be learned. Ideally, a tiny microprocessor would be paired with power and a network device, stealthily physically inserted into a network, and left there; omphalos and liburine would then combine to provide complete network dominance. I hope to combine network programming and high-performance computing to create a tool capable of much havoc.

Omphalos: Because one layer is never enough. Code is hosted on GitHub. Bugtracking is hosted on qemfd-bugzilla. There's a mailing list at Google Groups.

Similar Tools

• SSLSNIFF from Thoughtcrime Labs
• ArpON by Andrea Di Pasquale et al
• ettercap by Alberto Ornaghi and Marco Valleri
• Netdiscover by Jaime Peñalba

Countertools

We want to defeat systems like:

• ArpON by Andrea Di Pasquale et al

Versions/Milestones/Releases

Version	Release date	Features
0.98	2011-09-10 (planned)	Detection of network entities at layers 2 and 3. Dynamic handling of devices, routes, neighbors and addresses Full netlink, ethtool, nl80211 and wireless extensions support TTY and ncurses-based UI's ARP- and DNS-based probing
0.99	2011-11-11 (planned)	Routing/iptables configuration capabilities Hostapd and AP-spoofing support Spoofing support at layers 2 and 3 Zeroconf- and WINS-based probing
1.0	2011-12-25 (planned)	Automated selection and execution of previous capabilities GPS support Logging support

General Features

Some planned, some implemented...

• Modes of operation governing automatic behavior, from "Silent" to "Hostile":

Mode	Summary	Operating characteristics
Silent	Take no actions, only watch.	TX ringbuffers/sockets are not automatically created No packets will be issued by omphalos unless requested No automatic modifications to host networking state
Stealthy	Take only the actions of a normally-configured host.	ARP queries will be automatically issued DNS and Zeroconf queries will be issued, but only as the host is configured No automatic modifications to host networking state
Active	Learn what we can, possibly standing out from the crowd.	Make free use of detected information for further recon No automatic modifications to host networking state
Aggressive	Learn things quickly, in ways that will be noticed.	"Active", plus... Periodic and triggered wide-spectrum active scanning Omphalos will freely manipulate host networking state
Forceful	Actively disrupt the network, rerouting traffic through us.	Continuous scanning of the network MitM automatically effected wherever possible DoS will be employed to make MitM more effective Omphalos will freely manipulate host networking state
Hostile	Attempt to make the network unusable.	Same as "Forceful", but don't pass traffic along once MitM'd. Actively employ null routing. DoS employed upon network infrastructure, carrier, and and egress.

• GPS coordination and tagging
• Fully dynamic behavior viz the networking stack. Add and remove cards, routes, addresses...
• Audiovisual plugins (FIXME detail! lots of good ideas here)
• Event/scripting engine
  • Fine-grained MitM packet manipulation, filtering and generation via Parvenu and domain-specific languages
  • Fine-grained, one-click identity theft at any desired layer(s) (assumption of MAC, IP, cookies, etc)
    • Eat your heart out, Firesheep!
• Full integration with POSIX capabilities for fine-grained security (nothing runs as the superuser)
• Covert channel detection at all layers via Zetetic
• Opportunistic, secure remote control via liburine

Network Analysis

• Network analysis and debugging ought be spun out into Dr. Benway

Layer	What's tracked	Notes
Layer 2	From packets: All source hardware addresses seen in packets All destination hardware multicast addresses From netlink: All hardware addresses in the kernel neighbor cache Our hardware addresses Hardware broadcast addresses	Node allocation is backed by a statically-sized WLRU At the point an attacker can overwhelm our WLRU, there's effectively nothing on the network but junk packets. If something's a source, it's being claimed as present here on the network. A destination means nothing, except in the case of multicast. Someone else sending with our MAC address ought be noted, unless we stole their MAC address We can't generally differentiate between two other physical hosts using the same MAC We can't detect a spoofed MAC, but we can send our own ARP probes and at least determine whether the MAC's being serviced
Layer 3

Attack Capabilities

Layer 2

802.3/Ethernet II

• Flood a network with spoofed MAC addresses, in the hope of forcing fail-open behavior to facilitate attacks (see macof from dsniff and Hacking Layer 2: Fun with Ethernet Switches from BlackHat 2002)
• Probe and autodetect CAM sizes and hash functions, allowing for minimal CAM overflows
• Autodetect host ARP timings and replacement policies, allowing for stealthy man-in-the-middling
• Reverse and direct man-in-the-middling (answer all queries for an address, from an address, or both)
• Gratuitous ARP ("enclosure")
• Controlled SNAT of outgoing traffic at layer 2, to create multiple realistic hosts ("Capgras delusions")
• Automated ARP jamming and man-in-the-middling
• Arpwatch-like layer 2 monitoring
• VLAN hopping

802.11

• Passively attack weak cryptosystems (especially WEP), or do so actively if configured
• Channel hopping or locked operation
• Spectrum and noise analysis plugin
• Respond as master to probed networks, on a to-order basis
• Ability to run omphalos in as an AP client via userspace networking atop radiotap (Monitor mode) and WPA/EAPOL support
• "Hole 196" injection

STP

• FIXME

DTP

• FIXME

Layer 3

• ICMP redirects
  • We're closer than the remote server; jam ours in, and let the real one be tossed as duplicate
• A whole world of IPv6 mischief
• Rogue DHCP service
• SNAT for routing enbondaged neighbors
• ...much more

Layer 4

• TCP assassination (via RST) / arbitrary corruption
  • Most TCP implementations will (usually) deliver the first bytes received for a given window
• UDP assassination (via ICMP) / insertion
• Cryptographic downgrade attacks on HTTPS etc

Layer 5

• FireSheep-like session hijacking
• Progressive user identity/demographic discovery aka "maximum creepy" (heuristics on machine name, web pages visited, accounts revealed, mails sent etc)
  • Watch for and aggregate probed wireless networks, DHCP lease renewals, etc
• Rogue DNS service
• File-and-signature association for insecure checksums + csums updated-to-order

Portability

Omphalos currently only runs or indeed builds on fairly recent Linux systems, due to extensive use of advanced capabilities of the Linux networking stack (and the small fact that I don't run anything else). I doubt that I would accept patches to add Windows/MacOSX support, but you're certainly welcome to maintain them yourself. Once the main functionality set is complete (0.98 release), I'll add support for falling back to plain old PF_PACKET sockets without ringbuffers; that ought add support for any UNIX-based OS with a basic rtnetlink implementation.

User Interfaces

• omphalos-tty: line-based console output with readline-based input
• omphalos-ncurses: screen-based terminal output with ncurses-based input
• GTK: I'd like to add a GTK UI, but it's not a major priority
  • If you'd like to contribute freely-licensed, original artwork to this effort, please contact me!
• WxWidgets, QT: Dubious that I'll add one, but I'd take patches.
• Java: nope

Open Bugs

{{#bugzilla:columns=id,priority,status,to,from,component,summary

|status=ASSIGNED
|product=omphalos
|sort=priority,id
|noresultsmessage="No matching bugs found."

}}

---

One of her sisterhood lugged me squealing into life. Creation from nothing. What has she in the bag? A misbirth with a trailing navelcord, hushed in ruddy wool. The cords of all link back, strandentwining cable of all flesh. That is why mystic monks. Will you be as gods? Gaze in your omphalos. -- James Joyce, Ulysses

---