UPnProxyPot: fake the funk, become a blackhat proxy, MITM their TLS, and scrape the wire

Presented at DEF CON 29 (2021), Aug. 7, 2021, 11 a.m. (45 minutes)

UPnP sucks, everybody knows it, especially blackhat proxy operators. UPnProxyPot was developed to MITM these operators to see what they're doing with their IoT proxy networks and campaigns. We'll cover SSDP, UPnP, UPnProxy research/campaigns as well as cover a new Golang based honeypot, so we can all snoop on them together! REFERENCES: http://www.upnp-hacks.org (OG disclosure) https://www.youtube.com/watch?v=FU6qX0-GHRU (DEF CON 19 talk I attended) https://www.akamai.com/us/en/multimedia/documents/white-paper/upnproxy-blackhat-proxies-via-nat-injections-white-paper.pdf (my initial UPnProxy research) https://blogs.akamai.com/sitr/2018/11/upnproxy-eternalsilence.html (additional UPnProxy campaign researcher, also mine)

Presenters:

• Chad Seaman - Lead & Senior Engineer @ Akamai SIRT
  Chad is the SIRT team lead @ Akamai Technologies. He spends his time being an internet dumpster diver and emerging threats researcher focusing on DDoS, malware, botnets, and digital hooliganism in general. https://www.linkedin.com/in/that-chad-seaman/

Links:

• https://defcon.org/html/defcon-29/dc-29-speakers.html#seaman
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Chad Seaman - UPnProxyPot - fake the funk, become a blackhat proxy, MITM their TLS, and scrape the wire.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Chad Seaman - UPnProxyPot - fake the funk, become a blackhat proxy, MITM their TLS, and scrape the wire.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Chad Seaman - UPnProxyPot - fake the funk, become a blackhat proxy, MITM their TLS, and scrape the wire.srt (subtitles)
• https://www.youtube.com/watch?v=mHCGNUsrTf0

Similar Presentations:

• DEF CON 31 (2023) / Legend of Zelda: Use After Free (TASBot glitches the future into OoT)
• May Contain Hackers (MCH2022) / TLA+ in Action
• DEF CON 19 (2011) / UPnP Mapping