Home
WORK IN PROGRESS
This document describes how to setup and run a demo of irondetect. It demonstrates how irondetect can detect the presence and activity of an unwanted app that performs video and audio streaming on a smartphone.
You need the following in order to run the demo:
- Software
- VirtualBox https://www.virtualbox.org/
- Service VM that hosts irondetect TODO LINK
- Router VM that performs routing and enforcement TODO LINK
- Android IF-MAP Client
- Android Device Analyzer
- Hardware
- Android Smartphone with Android Version >= 4.0.1
- An Wireless Access Point
An overview of the architecture is depicted below.
In terms of VirtualBox configuration you need to make sure that the Smartphone which is connected to the Wireless AP can communicate with the Service VM. In order to do so, ensure the following:
- Service VM and Router VM can communicate via an Internal Network.
- The Router VM has bridged access to the LAN port of the host system.
- Your host LAN is connected to the Wireless AP.
- We suggest to setup a DHCP service on your Wireless AP in order to serve IP addresses to the Smartphones that you connect. Note that the VMs come with preconfigured static IP addresses. However, you can modify the setup as you want.
Components
- irond - the central MAP server
- irondetect - our correlation engine, implemented as MAPC
- ifmapcli - a set of command line tools. We use it in order to mock services like PDP, IDS and Vulnerability Scanner that publish certain metadata to the MAPS
- iptables - features a MAPC that subscribes for events in order to perform some sort of enforcement
Smartphone <-- WLAN --> Access Point <-- LAN --> Host running Virtualbox
- Install the Android IF-MAP Client on your Smartphone
- Import the Service and Router VMs to your VirtualBox
Most of the demo components come preconfigured and are ready to use. However, there is one aspect that you need to configure on your own. In order to distinguish multiple devices, we need some sort of identifier for each smartphone. For the demo, we use the first 4 characters of the SHA-1 hashed IMEI. This identifier must be configured at the TODO
In order to bootstrap the whole demo environment, perform the following steps in order.
- start the Service VM
- start the Router VM
- switch to the Service VM
- start irond (01_irond.sh)
- publish required metadata (02_bootstrap-metadata.sh)
- change to Router VM
- start port forwarding (01_enable-port-forwarding.sh)
- start trustedmapmonitor (02_map-monitor.sh)
- change back to Service VM
- start irondetect (03_irondetect.sh)
- connect the smartphone to the Oberseminar SSID
The following services need to be set up in order to run the demo:
- irond as MAP server
- irondetect as correlation engine
- iptables to perform enforcement decisions
- ESUKOM IF-MAP client collecting smartphone features
- trustedmapmonitor to allow communication between irondetect and iptables
- irond
- iptables
- trustedmapmonitor
- ESUKOM client
- irondetect
- start and demonstrate IP Webcam App (use browser within the Service VM, show video stream- if no stream is visible reload browser page)
- stop IP Webcam App using the back button, do not use the home button to stop it
- start ESUKOM client, establish session with irond running in Service VM (takes some time)
- irondetect should recognize installed Apps with questionable permissions
- put ESUKOM client in the background by pressing the Home button
- start IP Webcam App, do not yet connect to it using a browser
- irondetect should recognize an open port and the camera activation
- connect to the Webcam App using a browser within the Service VM (reload page if no stream becomes visible)
- irondetect should recognize traffic increase and send enforcement instructions to the Router VM, thus finally disconnecting the smartphone (browser should no longer be able to access the camera stream)