From pocket to Pwn: How we hacked a multinational corp for $200 with what's in our pockets

From pocket to Pwn: How we hacked a multinational corp for $200 with what's in our pockets

Speakers: Tim Shipp, CTO and co-founder, Threat Lights

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=o7FI9pGg23s

Overview

In this compelling BSides NYC talk, Tim Shipp, CTO and co-founder of Threat Lights, unveils a highly effective, low-cost attack methodology that successfully compromised a multinational corporation. Titled "From pocket to Pwn: How we hacked a multinational corp for $200 with what's in our pockets," the presentation details a red team engagement where traditional, sophisticated attack vectors proved ineffective against a well-defended target. The core of the strategy involved leveraging readily available, inexpensive hardware to perform a physical proximity attack, bypassing robust endpoint detection and response (EDR) and security operations center (SOC) capabilities by targeting an often-overlooked attack surface: employee-owned mobile devices and company vehicles.

Shipp, a seasoned cybersecurity professional with 20 years of experience in incident response and red teaming, and a serving Major in the British Army Cyber Reserves, demonstrates that ingenuity and a non-standard approach can yield significant results with minimal budget. The talk highlights how attackers can exploit the convergence of Bring Your Own Device (BYOD) policies, common employee behaviors, and the physical environment to establish a persistent foothold within a corporate network. This particular engagement achieved a full network compromise for roughly $90 in hardware, underscoring the critical need for comprehensive security strategies that extend beyond traditional Windows endpoints and incorporate physical and mobile device security.

The significance of this talk lies in its practical demonstration that advanced security defenses are not impenetrable if attackers target the right blind spots. By focusing on mobile devices and non-Windows infrastructure, Shipp illustrates a blueprint for achieving deep network access without triggering conventional alerts. This approach challenges organizations to re-evaluate their threat models, emphasizing the importance of monitoring all connected devices, segmenting networks, and securing physical access points, rather than solely relying on endpoint protection that might not extend to every device an employee uses.

Background

▶ Watch: Legal disclaimer and talk overview (0:00)

The genesis of this unconventional attack stemmed from a recurring challenge faced by Shipp's red team: a particular customer had become exceptionally adept at defending against standard penetration testing techniques. Previous engagements, which included sophisticated spear phishing, smishing, physical dead drops, elaborate social engineering, and the deployment of malicious USB keys, consistently hit a wall. The client's EDR and SOC teams were highly effective, quickly detecting and neutralizing any attempts at exploitation, making it difficult for the red team to achieve meaningful objectives and for the client to see a return on investment from these traditional approaches. The team needed a fresh, "out of the box" strategy.

With a tight two-week deadline and a minimal budget – literally what could be found "in our pockets" or purchased for under $200 – the team opted for a passive targeting approach. They identified developers as a prime target, assuming they might have rooted handsets or be more prone to installing custom software, making them a potential weak link. This assumption was rooted in Shipp's 20 years of experience, where developers were often seen as "the bane of my life" for their tendency to perform "weird stuff on a machine."

Initial reconnaissance revealed several key vulnerabilities within the target organization: a notable lack of corporate BYOD policies, leading to widespread use of personal mobile phones and Bluetooth devices for work; and a fleet of company-provided electric cars, specifically Teslas. This combination sparked the idea: what if they could exploit the interaction between employees' personal devices and their company-issued vehicles? The goal was to bypass the client's strong corporate security practices, which were primarily focused on traditional endpoints, by introducing an attack vector that was completely off their radar. This approach aimed to deliver significant value by demonstrating a novel and previously undetected pathway into their environment.

Key Findings

▶ Watch: Client's strong security forced a novel attack (2:45)

The "From pocket to Pwn" talk revealed several critical findings that challenge conventional cybersecurity wisdom and highlight overlooked attack surfaces:

1. Low-Cost Physical Attacks Bypass Advanced Defenses: The most striking finding was the ability to achieve a deep network compromise for approximately $90 in hardware. This demonstrated that sophisticated EDR and SOC solutions, while effective against traditional cyberattacks, can be completely bypassed by ingenious, low-tech physical attacks that exploit human behavior and device interactions.
2. Mobile Devices as an Unsecured Gateway: Employee-owned mobile devices, especially in BYOD environments without robust Mobile Device Management (MDM) or endpoint monitoring, represent a significant and often unmonitored entry point into corporate networks. The talk proved that compromising a personal phone can provide a persistent, unflagged bridge into sensitive internal infrastructure.
3. Bluetooth Jamming and Masquerading as a Novel Attack Vector: The strategy of using inexpensive hardware to jam a legitimate Bluetooth connection (e.g., a car's infotainment system) and then masquerading as that device to trick a user into connecting to an attacker-controlled device is a highly effective and under-appreciated initial access method. This creates a compelling scenario where users are primed to accept a "fix" for their non-functional device.
4. Android 13/14 Security is Robust, but Not Impenetrable: Modern Android versions have significantly improved security against malicious APK (Android Package Kit) installations and direct exploitation. However, with sufficient effort (which consumed a substantial part of the two-week engagement), it is still possible to craft and deploy a malicious APK, especially when combined with social engineering or user interaction.
5. USB Rubber Ducky Emulation for Initial Payload Delivery: Leveraging the USB Rubber Ducky concept over Bluetooth/Wi-Fi (using a Flipper Zero and custom hardware) proved to be an effective method to rapidly inject commands and initiate payload download/execution on a targeted Android device, circumventing the need for physical USB access.
6. ADB over TCP: The Ultimate Persistent Backdoor: While initial Metasploit shells on Android are often unstable, lack persistence, and are quickly terminated by the OS, achieving root access to enable ADB (Android Debug Bridge) over TCP provided a stable, persistent, and highly privileged remote shell. This critical step allowed for full control, lateral movement, and data exfiltration from the compromised device, acting as a gateway into the corporate network.
7. Non-Windows Environments as Evasion Paths: The talk highlighted that sophisticated attackers are increasingly targeting Linux servers and ESXi hypervisors to avoid detection by Windows-centric EDR solutions. The compromised Android device, once on the corporate Wi-Fi, served as an ideal platform to pivot into these less-monitored environments, allowing for extensive enumeration and lateral movement without triggering alerts until Windows domains were explicitly targeted.
8. Ingenuity Trumps Expense: The overall finding reinforces that budget is not a blocker where ingenuity exists. Non-standard approaches, leveraging readily available tools and creative attack chains, can achieve far greater impact than expensive, complex exploits, especially against targets that have optimized defenses for well-known attack patterns.

Technical Deep Dive

▶ Watch: Targeting developers with rooted handsets, tight timeline (4:00)

The attack methodology presented was a multi-stage process, meticulously designed to bypass advanced corporate security by exploiting physical proximity and mobile device vulnerabilities. The core concept revolved around denying service, masquerading as a legitimate device, and then exploiting the user's mobile phone for onward access.

The initial target was the customer's fleet of company electric cars, specifically Tesla Model 3s. Tesla's public documentation made it easy to identify the location of key components, including Bluetooth modules, which were found under the Tesla badges on both the front and rear of the vehicle. The team leveraged inexpensive hardware to jam these modules. The "car computers" mentioned were generic NRF24 modules, costing approximately $29 each. With an additional $15 worth of hardware, these modules could be configured as Bluetooth jammers, each offering an effective range of roughly 2 meters. Two such devices, strategically placed on the front and back of a target Tesla, cost a total of $95.

To facilitate the masquerade and exploit delivery, a Flipper Zero was used. Equipped with a larger antenna, the Flipper Zero acted as the attacker's device, broadcasting a Bluetooth signal masquerading as the target Tesla. The scenario envisioned a user getting into their car after work, attempting to connect their phone to the car's infotainment system (e.g., for Spotify), and finding the connection blocked by the jammers. At this point, the Flipper Zero would present itself as the "Tesla," prompting the user to connect.

The primary challenge in exploiting the connected Android device (specifically Android 13 and 14) was their robust security posture. These modern OS versions are designed to prevent the installation of malicious APKs and limit ADB (Android Debug Bridge) access to USB connections. The red team spent a significant portion of their two-week window crafting a malicious APK that could bypass Android's defenses without being outright blocked. Traditional Android exploits often rely on ADB over USB, which is impractical for a remote, passive attack.

To overcome the payload delivery challenge, the team employed a modern twist on the classic USB Rubber Ducky. The Flipper Zero's BadUSB functionality allowed it to emulate a USB keyboard, sending rapid keystrokes over the established Bluetooth connection. This enabled the attacker to input commands into the Android device, effectively typing instructions to download and execute the malicious APK. While the demo showed a simplified version, in a real scenario, this could be made transparent to the user with a black screen overlay displaying a Tesla logo.

Upon successful execution of the APK, an initial Metasploit payload was delivered over Bluetooth. However, this shell proved to be highly unstable. Metasploit's Android support is largely outdated, lacking robust features like persistence, and Android's security mechanisms would terminate external APK connections after approximately three minutes. This limited initial access to brief enumeration using tools like Drozer.

To achieve reliable and persistent access, the team aimed for ADB over TCP. This was accomplished by first gaining root access to the device (either pre-existing or through undisclosed privilege escalation techniques). With root privileges, the attacker could modify the device's SELinux policy, setting it to permissive mode (set enforce 0). Subsequently, the Termux application was deployed via ADB. Termux, a Linux terminal emulator for Android, allowed the creation of a remote listener on an arbitrary port (e.g., 55555). This setup facilitated a complete outbound connection from the Android device's ADB to the attacker's Command and Control (C2) server hosted in Google Cloud.

This ADB over TCP connection was the linchpin of the entire operation. It provided full persistence, surviving reboots (though the speaker noted future work would focus on more robust reboot persistence) and working seamlessly over the user's 3G, 5G, or Wi-Fi connection. Critically, when the compromised device connected to the corporate Wi-Fi network, the attacker gained a permanent remote shell directly onto the corporate network, effectively bypassing perimeter defenses.

From this persistent foothold, the team performed extensive post-exploitation activities:

• Network Enumeration: Using Socks proxies established through the ADB shell, the attacker could tunnel tools like NMAP and Bloodhound to scan the internal network, identify domain controllers, and map out the corporate infrastructure.
• Lateral Movement: The compromised phone became a pivot point for moving laterally into less-monitored environments, specifically Linux servers and ESXi hypervisors, which are often overlooked by Windows-centric EDRs.
• Remote Control: The SCRC CPY tool (likely scrcpy) allowed for remote desktop-like control of the Android device's user interface, enabling interaction with apps or pressing buttons if necessary.
• Data Exfiltration & Credential Harvesting: A keylogger was deployed to harvest credentials, WhatsApp chats, and other sensitive information.
• Advanced Tunneling: The ability to create reverse SSH tunnels and Socks proxies allowed the red team to connect their own Kali Linux boxes through the compromised phone, effectively granting them the full capabilities of a dedicated attack machine within the target environment, all from the comfort of their home.

This detailed technical progression highlights the power of combining physical access, social engineering, and clever exploitation of mobile device features to achieve deep and persistent access within a highly secured corporate environment.

Demo / Proof of Concept

▶ Watch: The $30 device for the Bluetooth attack (7:00)

The talk included a compelling recorded demonstration of the attack, acknowledging the inherent unreliability of live demos, especially with physical components. The speaker emphasized that while the demo was deliberately slowed down for clarity, the actual exploit could occur in a matter of seconds, often with minimal user interaction.

The demonstration showcased the following steps:

1. Flipper Zero Setup: The demo began with the Flipper Zero being configured. The speaker navigated its user interface to select the relevant application package and enable its BadUSB functionality, preparing it for rubber ducky emulation.
2. Bluetooth Jamming: Although not explicitly shown in detail, the jamming aspect was implied. The "car computers" (NRF24 modules) would be actively blocking the legitimate Bluetooth signal of the target Tesla.
3. User Interaction Simulation: On the right side of the screen, a phone (representing the victim's device) was shown attempting to pair with its "Pesler" (a legally modified term for Tesla). Due to the jamming, this connection failed.
4. Masquerade and Compromise: The Flipper Zero, acting as the attacker's device, then pushed its own Bluetooth connectivity, masquerading as the Tesla. The user's phone was shown connecting to this malicious device.
5. Payload Delivery: Once connected, a Metasploit payload was swiftly sent to the Android device over Bluetooth. The speaker noted that for the purpose of the demo, the Android device was already rooted. However, in the actual engagement, the team utilized their own undisclosed privilege escalation techniques to gain the necessary root access.
6. User Transparency: The speaker explained that in a real-world scenario, the process would be made as transparent as possible to the user. This included slowing down the on-screen actions and, crucially, overlaying a black screen with a Tesla badge during the exploit execution to minimize suspicion. This ensures that the user perceives a brief connectivity issue followed by a successful connection, unaware of the underlying compromise.

The demo effectively illustrated the initial access phase of the attack, from the user's attempt to connect to their car to the successful delivery of the Metasploit payload. It clearly demonstrated how a user could be subtly manipulated into connecting to an attacker-controlled device, initiating the chain of compromise without overt warnings or complex social engineering. While the demo concluded with the Metasploit shell, the speaker elaborated on the subsequent steps (ADB over TCP, persistence, lateral movement) as detailed in the technical deep dive, which were the ultimate goals of the attack.

Defensive Implications

▶ Watch: Physical placement of low-cost devices on Teslas (7:45)

The "From pocket to Pwn" talk offers critical insights for organizations looking to bolster their security posture against sophisticated, low-cost attacks. The defensive implications span policy, technology, and operational practices:

1. Robust BYOD Policies and Enforcement: The primary defensive implication is the urgent need for comprehensive BYOD (Bring Your Own Device) policies. These policies must clearly define acceptable use, security requirements for personal devices accessing corporate resources, and mandatory monitoring or security software installations. Simply allowing employees to use personal devices without oversight is a critical blind spot.
2. Mobile Device Endpoint Monitoring (MDM/EDR): Organizations must extend their Endpoint Detection and Response (EDR) and monitoring capabilities to include mobile devices. Deploying Mobile Device Management (MDM) solutions or specialized mobile EDR tools is essential. These solutions should monitor for unusual activities such as:

• ADB (Android Debug Bridge) making outbound connections to the internet.
• Android devices connecting to Linux devices over IP in unexpected ways.
• Unauthorized APK installations or modifications to system settings (e.g., SELinux changes).
• Sudden enabling of developer options or debugging features.

The speaker explicitly stated that such activities would be "a very easy indicator for something pretty sketchy going on," yet "nobody's looking."

1. Network Segmentation and VLANning: Implementing strong network segmentation through VLANning is crucial. Mobile devices, whether corporate or personal, should be isolated on a separate VLAN from corporate laptops, servers, and sensitive infrastructure. Upstream controls and firewalls should strictly limit communication between these segments, preventing lateral movement from a compromised mobile device into the core network.
2. Focus on Non-Windows Environments: The talk strongly emphasizes that attackers are increasingly targeting Linux servers and ESXi hypervisors to evade Windows-centric EDRs. Security teams need to bolster their monitoring and detection capabilities for these environments, implementing specialized EDR solutions for Linux and virtualization platforms. Organizations should assume that if attackers gain a foothold, they will pivot to these less-monitored systems.
3. User Awareness and Training: While the attack was designed to be subtle, basic user awareness can still play a role. Employees should be educated about:

• The risks of connecting to unknown or suspicious Bluetooth devices, even if they appear legitimate.
• The importance of verifying device names and MAC addresses if a connection fails.
• The dangers of installing APKs from unknown sources, especially if the device warns about "sketchy" applications.
• The potential for physical compromise in public or semi-public spaces like parking lots.

1. Physical Security Considerations: The attack highlighted the vulnerability of physical assets. While the specific Tesla hack wasn't directly targeting the car's systems, the use of company cars as a vector for mobile device compromise underscores the need to consider physical security in parking areas, including surveillance and policies regarding tampering with company vehicles.
2. Application and Device Configuration Hardening: Organizations should ensure that mobile devices, especially those used by developers, are configured with the highest security settings. This includes disabling developer options by default, preventing unauthorized APK installations, and ensuring that ADB is not easily enabled or exposed. The continuous improvement of Android security (e.g., in Android 15) is a positive trend, but organizations cannot solely rely on default OS protections.
3. Proactive Red Teaming and Purple Teaming: The success of this attack against a well-defended organization underscores the value of purple teaming and unconventional red team engagements. By actively testing novel attack vectors, organizations can uncover blind spots that traditional audits or vulnerability assessments might miss, leading to more robust and comprehensive defenses.

In essence, the talk serves as a stark reminder that security is a holistic challenge. Relying solely on perimeter defenses and Windows endpoint security leaves significant gaps that ingenious attackers, armed with minimal resources, can readily exploit.

Key Takeaways

• Ingenuity Trumps Expense: Highly effective attacks do not require massive budgets or complex, zero-day exploits. Low-cost hardware (e.g., $90) combined with creative methodologies can bypass advanced security controls.
• BYOD is a Critical Blind Spot: Personal mobile devices, especially in BYOD environments lacking robust monitoring or MDM policies, represent a significant and often unmonitored entry point into corporate networks.
• Physical Proximity Attacks Remain Potent: Leveraging physical access to company assets (like parking lots and company cars) to facilitate Bluetooth jamming and device masquerading is a viable and often overlooked initial access vector.
• ADB Over TCP is a Powerful Post-Exploitation Tool: Once initial access is gained and root privileges are established, enabling ADB over TCP provides a stable, persistent, and highly privileged remote shell, turning a compromised mobile device into a full-fledged pivot point within the corporate network.
• Non-Windows Environments Are Attractive Evasion Paths: Attackers are increasingly targeting Linux servers and ESXi hypervisors to avoid detection by Windows-centric EDRs. Organizations must extend robust monitoring and detection capabilities to these environments.
• Comprehensive Monitoring is Essential: Organizations need to move beyond traditional endpoint monitoring and implement solutions that detect unusual activities on mobile devices (e.g., outbound ADB connections) and across all network segments, including non-Windows infrastructure.

About the Speaker(s)

Tim Shipp is the CTO and co-founder of Threat Lights, a company specializing in cybersecurity solutions. With a distinguished career spanning two decades, Tim has extensive experience leading incident response (IR) teams and red teams globally for a diverse range of clients.

Beyond his corporate roles, Tim is a serving Major in the British Army Cyber Reserves, where he contributes his expertise as a Subject Matter Expert (SME) for both red teaming and blue teaming operations for the British Ministry of Defence (MOD). His professional background includes significant cybersecurity roles at prominent organizations such as Asentia, Cyber Reason, Semantic, Airbus, and Talis. Throughout his career, he has personally led approximately 300 breach investigations for Fortune 500 companies, highlighting his deep practical experience in both offensive and defensive cybersecurity.

Tim's engagement with mobile technology dates back to 2007, even before Android officially launched as an operating system. While working for Panasonic, he was involved in reverse-engineering and porting Android ROMs onto Windows Mobile phones and Palm Pilots to enable early application development. This early, hands-on experience in "breaking" devices, famously installing Doom on a brand-new Panasonic IP phone, marked his initial foray into cybersecurity and set the stage for his innovative approach to penetration testing.