Hacking Network APIs

### Overview In this presentation, the creator of Packet Sender demonstrates practical techniques for reverse engineering network APIs, analyzing simulated malware traffic, and diagnosing network degradation. Using Packet Sender alongside Wireshark and hardware such as a Raspberry Pi 400 and a KMAX network emulator, the speaker walks through live demonstrations illustrating how devices communicate over raw TCP and UDP sockets, how to mimic or spoof network services, and the crucial distinction between network latency and throughput.

### Key Topics - **Packet Sender Capabilities**: An overview of the open-source tool Packet Sender, covering GUI and CLI usage, support for TCP, UDP, SSL/TLS, custom delimiters, persistent connections, packet resending, built-in macro strings, smart responses, and UI panel generation. - **Protocol Reverse Engineering**: Analyzing custom IoT protocols by inspecting Wireshark traffic and using Packet Sender to capture, replay, and automate control commands. - **Faking Network Services & Spoofing**: Capturing commands directly by setting Packet Sender to listen on target ports, tricking clients into communicating with a rogue listener, and inspecting simulated outbound malware activity. - **Latency vs. Throughput**: Demonstrating how network degradation affects application behavior using a KMAX device, and why evaluating both latency and throughput is necessary when troubleshooting.

### Technical Details - **Reverse Engineering Pi Player**: - The speaker uses an open-source demo app called "Pi Player" running on a Raspberry Pi 400. To locate the device, Pi Player sends a UDP broadcast to `255.255.255.255` on port 15000 containing the string `find units`. The Pi responds with `server address: <ip>`. - Playback commands (`play`, `next`, `stop`) are transmitted via raw TCP connections to port 15000. - The speaker demonstrates two reverse-engineering workflows: capturing packets with Wireshark to recreate commands in Packet Sender, and configuring Packet Sender to listen on port 15000 while responding with its own IP address (`0.99`) to trick the client application into sending its commands directly to Packet Sender. - Packet Sender's panel generator is used to create a custom graphical dashboard to trigger commands and script sequences (such as `play`, delay 5 seconds, and `stop`). - **Simulated Malware Analysis**: - In an isolated network, an IoT device attempts an ARP request for default gateway `192.168.0.1` to access the Internet. - The host adds an alias IP address for the gateway to observe further traffic. The malware attempts a connection to external IP `138.197.192.84` on port 5123. - The host configures that external IP as another alias address and runs a persistent TCP listener in Packet Sender on port 5123. The captured payload reveals an Nmap scan report containing OS details, host scanning results, and open ports, representing an exfiltration attempt to a command-and-control server. - **Latency vs. Throughput Demonstration**: - Using Python HTTP servers on ports 8000 and 8001 and VLC RTP media streaming on ports 5004 and 5005, network traffic is selectively degraded using a KMAX hardware emulator. - **Rate Limiting (Low Throughput, Low Latency)**: Port 8001 traffic is throttled to 100 kbps while ping latency stays sub-millisecond, causing identical file transfers to take days on one port while completing rapidly on an unshaped port. - **Delay Insertion (High Latency, High Throughput)**: A 5-second delay is applied to one of two identical RTP video streams. Both streams sustain identical throughput, but the delay renders synchronous media unusable. The speaker notes human perception detects audio/video discrepancies at 20 to 50 milliseconds. - **Performance Inefficiency Clarification**: During Q&A, the speaker explains that delays during playback commands occur because Pi Player executes an underlying Linux `system` call to launch an external player and executes a `killall` command to stop playback.

### Takeaways - Combining a flexible packet generator/listener like Packet Sender with Wireshark enables rapid reverse engineering of proprietary network APIs without needing source code. - Setting up local listeners and IP aliases allows analysts to safely capture and decode outbound device behavior in isolated sandbox environments. - Latency and throughput must both be evaluated when assessing network quality; looking at either metric in isolation can completely mask severe performance bottlenecks.