SANS Holiday Hack 2015-Part 2

Super Gnome 1

I then used the Shodan search to visit the website of one of the the super gnomes: 52.2.229.189. It showed a logon portal. I used the word “admin” as the username, and the “SittingOnAShelf” password that I found in the /opt/mongodb directory in the gnome.0 file. I was logged in as an admin. There was a menu with Home, Camera, Files, Gnomenet, Settings, and Logout as the selections. I downloaded the files to peruse later. I looked at the Camera section which was an eerie collection of people’s living rooms and bedrooms. I looked at Gnomenet, which seemed to detail problems with the camera feed. For instance, "Took a look at your issue. It looks like the camera feed collector only cares about the name and will merge the feeds. Looks like each pixel is XORed... Its going to be a lot of work to fix this. We are too late in the game to push a new update to all the cameras... stop naming cameras the same name. ~DW" I filed this information away for later.
Then I looked at the settings which would help me find information later. The gnome home page let me know which gnome I had access to. This gnome was Super Gnome 1. When I downloaded his files, I got a pcap. From this point forward, note that I do the same procedure every time I get a pcap. I looked at "Protocol Hierarchy", and then selected “Data” and right-clicked and selected apply a filter. It filtered out TCP traffic. I right-clicked on one of the TCP packets and selected “Follow the TCP stream. There was an e-mail and a base64 encoded image. I used an online tool to decode the base64 encoded image for me: http://www.opinionatedgeek.com/dotnet/tools/base64decode/ I scanned the file that I was given to be sure that it wasn’t infected. Then I used file -i <filename> in the Terminal to see what kind of file it was. As expected, from the content of the e-mail, it was a jpeg file. It was a hand drawn GIYH Architecture.

E-Mail 1

JoJo,
As you know, I hired you because you are the best architect in town for a distributed surveillance system to satisfy our rather unique business requirements. We have less than a year from today to get our final plans in place. Our schedule is aggressive, but realistic.
I've sketched out the overall Gnome in Your Home architecture in the diagram attached below. Please add in protocol details and other technical specifications to complete the architectural plans.
Remember: to achieve our goal, we must have the infrastructure scale to upwards of 2 million Gnomes. Once we solidify the architecture, you'll work with the hardware team to create device specs and we'll start procuring hardware in the February 2015 timeframe.
I've also made significant progress on distribution deals with retailers. Thoughts?

Looking forward to working with you on this project! -C

E-Mail1: PhotoAttachment:GIYHArchitecture