The Idea

So, I’ve seen the Upside-Down-Ternet many times, and I began thinking…How can I leverage this idea on one of my wife’s favorite websites – Pandora.

She listens to Pandora for a good part of the day from our home internet connection… Perfect! I can set up a transparent http proxy, and manipulate requests for Pandora as they come through.

Now, what should I play? This of course. And may more things. And maybe What does the spleen do?

The Implementation

Determining an “attack vector”

I fired up Chrome’s developer tools while listening to a pandora stream, and was quite pleasantly surprised: the audio is transferred over HTTP (correct – no encryption), in MP3 format. (And I discovered a little too late that the Pandora ONE Player will play audio/mp3 streams, while the free pandora player will only play audio/mp4 streams – This is important later on!) How easy this will be! All I’ll need to do is watch for the specially crafted URL requesting resources from http://audio-*.pandora.com/ (and *.p-cdn.com) access and respond accordingly – In this case, with an mp3 pre-staged on my intercepting server.

Base Environment

My “host” in this scenario is a VM running on Hyper-V on my Windows 8.1 Desktop. The VM is running Ubuntu 14 as a guest OS, and has 2 cores with 256 MB ram, and one network adapter.

Phase 1: Configuring Squid3 & iptables

Squid3 is a proxy server that supports something called “transparent mode.” In conjunction with iptables, squid can be a very effective content filter, caching proxy, or the perfect tool to carry out an April fools prank.

In this scenario, we’ll be setting up our linux machine to “Masquerade” as the machines that will be passing traffic to (through) it. In much the same manner as how your existing home router works: You have one public IP address, and all of the requests from computers within your network (using private IP addresses) appear to come from that one public IP. This is called NAT.

Since this linux machine will facilitate the transfer of all traffic from the “victim” machines to the internet, It’s in the perfect location to identify (and manipulate) Pandora requests.

OK, OK, enough theory, let’s get some code

Iptables

Enable ip_forwarding (this is temporary, and will go away after a reboot of the “host” machine)
```
echo 1 &gt; /proc/sys/net/ipv4/ip_forward
```
Configure iptables to pass traffic (Never configure it this way if you’re actually building an edge device. Since all of my devices – both “host” and “victim” machines are on the same physical network, I took some liberties with security)
```
iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
```
Next, we need to tell iptables to “masquerade,” or that is to “NAT” the traffic that comes from the local subnet, and is destined for the internet.
```
iptables -t nat -A POSTROUTING -s 172.16.9.0/24 -j MASQUERADE
```
Great, but what about our prank? Let’s explicitly redirect traffic destined for the IP segment owned by Pandora (you can find this using whois)
```
iptables -t nat -A PREROUTING -d 208.85.40.0/21 -p tcp --dport 80 -j DNAT --to-destination 172.16.9.155:3128
```

Squid3

First, install squid using your favorite packaging tooapt-get install squid3

Configure Squid. I’ve taken the liberty of trimming down the config file as thin as possible for this scenario. 5 lines!

redirect_program /home/administrator/pandora.pl
http_access allow all
http_port 3128 transparent
strip_query_terms off
coredump_dir /var/spool/squid3

Next, we need to write the redirect_program. Having not actually read the Squid3 documentation, and surmising based on operation – This is loaded at the time the Squid3 service is started, and continually runs in the background. Squid3 then passes URLs from clients into the script through the pipeline. The script then passes a URL back to Squid3. In this circumstance, we use some regex to identify all requests for a Pandora song (http://audio.*?pandora\.com and http://.*\.p-cdn\.com)
```
#!/usr/bin/perl
use strict;
$| = 1;
while (&lt;&gt;) {
my @elems = split;
my $url = $elems[0];
if ($url =~ m#^http://audio.*?pandora\.com#i) {
$url = "http://172.16.9.155/test.mp4";
print "$url\n";
}
if ($url =~ m#^http://.*\.p-cdn\.com#i) {
$url = "http://172.16.9.155/test.mp4";
print "$url\n";
}
else{
print "$url\n";
}
}
```
Restart Squid3
```
service squid3 restart
```

Apache2

Since we’re actually replacing the song in Pandora with a “payload” track, we need some way of hosting this audio. Additionally, we need the host to respond with the “payload” track for any and all incoming requests. Queue: Apache mod_rewrite.

Edit the /etc/apache2/sites-enabled/000-default.conf file, and add these three lines. This causes any inbound HTTP requests to return the test.mp4 file (with the correct MIME association, so as not to break “free” Pandora)
```
RewriteEngine on
RewriteRule .* /test.mp4
AddType audio/mp4 .mp4
```
Place the test.mp4 file at /var/www/html

Phase 1.5: Test Proof of Concept

Set a host on the LAN to use the afforementioned box as a default gateway.
Launch Pandora
Validate that only the payload song will play.

Phase 2: Deploy to LAN

I have a standard FiOS router as my default gateway, and the device does not give total control over the DHCP server settings. Of particular interest here is the option routers parameter. This allows the DHCP server to dictate to the clients what IP address they should use as a default gateway. Obviously if this prank is going to affect more than my sandbox, I need the other devices on the LAN to pass all of their traffic through the “host”

Configure isc-dhcp-server

Install isc-dhcp-server using your favorite package manager
```
apt-get install isc-dhcp-server
```
modify the lines below in the /etc/dhcp/dhcpd.conf file. Define some hosts if you’d like to exclude them from the prank. All hosts with a host block will be issued an IP in the deny unknown clients pool: this is not; however, what determines their gateway, but rather the options routers clause in the host block. One very important thing here is to set the lease time rather low. I don’t want this prank to cause some random device to get an IP and hold onto it for the default of 8 days. Bumblebee happens to be my desktop:
```
option domain-name "ccrossan.com";
option domain-name-servers 172.16.9.1,8.8.8.8,8.8.4.4;default-lease-time 100;
max-lease-time 100;

host bumblebee
{
hardware ethernet 00:24:8C:93:7C:EE;
fixed-address 172.16.9.100;
option routers 172.16.9.1;
}subnet 172.16.9.0 netmask 255.255.255.0
{
option routers 172.16.9.155;

pool {
deny unknown clients;
range 172.16.9.100 172.16.9.150;
option routers 172.16.9.1;
}
pool
{
allow unknown clients;
range 172.16.9.200 172.16.9.250;
option routers 172.16.9.155;
}
```
Re-start the DHCP server
Disable DHCP on the FiOS router.
Watch hilarity ensue as users launch Pandora in their browsers only to hear your specially selected track!

Thanks for reading. If you stuck with it this far, you’re a trooper.

Please leave any comments or suggestions you may have below!

Charles' Blog

April Fools Day 2015 – What’s in Pandora’s Box