An Introduction to IoT Penetration Testing @libertyunix - PowerPoint PPT Presentation

An Introduction to IoT Penetration Testing @libertyunix www.kmco.com

The Agenda n IoT Attack Surface l OWASP IoT Top 10 l -1 Ring in IoT n Wireless Topics in IoT n IoT Pen Testing Tools & Examples n Q&A 2

Getting Started in IoT Penetration Testing 3

OWASP IoT Top 10 www.kmco.com 4

OWASP IoT Top 10 1. Weak, Guessable, or Hardcoded Passwords l Hard Code Everything 2. Insecure Network Services l Ecosystem services are vulnerable? 3. Insecure Ecosystem Interfaces l Account Lockout? l Credentials Exposed in Network Traffic 4. Lack of Secure Update Mechanism l More info in the clear & OTA 5

OWASP IoT Top 10 Cont. 5. Insecure or Outdated Components l Supply Chain Risk Management 6. Insufficient Privacy Protection l GDPR for IoT? 7. Insecure Data Transfer & Storage l More info in the clear 6

OWASP IoT Top 10 Cont. 8. Insufficient Security Configurability l Lack of Password Security Options l Security Monitoring & Logging? 9. Insecure Software/Firmware l Encryption Not Used to Fetch Updates l Update File not Encrypted l Update Not Verified before Upload 10. Poor Physical Security l USB l SPI l JTAG 7

-1 Protection Ring in IoT* *Not an Official Term 8

Software Defined Radio & FCC ID 9

Amplitude l Vertical distance between crests 10

Frequency, Cycles, and Hertz l The frequency determines how often a signal is seen l 1 cycle per second = 1 Hertz 11

Modulation 12

Digital Modulation Amplitude Doors, Bells, On Off Keying Shift Lights, Keys Keying(ASK) Frequency Digital Gaussian FSK BLE , ZWave Shift Modulation Keying(FSK) Offset Phase Shift Quadrature Zigbee Keying(PSK) PSK(OQPSK) 13

IoT Networks 14

IEEE 802.15.4 & ZigBee Customer Application API – “the software” Security ZigBee – Network, Security Alliance 32- / 64- / 128-bit encryption & Application Network layers Star / Mesh / Cluster-Tree IEEE 802.15.4 MAC IEEE – “the hardware” 802.15.4 PHY – Physical & Media 868MHz / 915MHz / 2.4GHz Access Control Stack layers Silicon App Source: http://www.zigbee.org/resources/documents/IWAS_presentation_Mar04_Designing_with_802154_and_zigbee.ppt

Z-WAVE 16

Z-WAVE Packet 17

RFID LF - 125-134 kHz RFID HF - 13.56 MHz UHF - 433 MHz & 856-960 MHz 18

Bluetooth Cross Compatibility 19

BLE Application 20

BLE - (Adaptive) Frequency Hopping n When in a data connection, a frequency hopping algorithm is used to cycle through the data channels n Access Addresses to avoid collisions 21

BLE Stack 22

GATT Example 23

IoT Pen Testing Tools & Examples 24

IoT Penetration Testing Physical Cloud & Mobile Wireless 25

IoT Testing Roadmap Example • Technical IoT SME Discovery ID Attack • OWASP Surface IoT Top • Intelligence Technical Gathering Testing • Exploitation Vulnerability • ?? Ranking Reporting 26

IoT Setup Laptop – USE LINUX § Preferably a dual boot or dedicated machine Hardware OS/Software § HackRF § Ubuntu LTS § BladeRF – Most common § Yardstick One § Kali Linux § Atmel RZ RAVEN – apt-get install kali-linux-all § Ubertooth One § Universal Radio Hacker § Proxmark3 Dev Kit § GNU Radio § Arduino Nano § Blue hydra § Every cable and adapter you § Bettercap can think of § KillerBee § PC Repair and Build Kit § Binwalk § Misc § Firmadyne § A patient wife § APKtool 27

Access Control Systems 28

CCTV System n The real time streaming protocol “RTSP” uses port 554 to connect via TCP n Locating cameras: l #nmap –p554 192.168.1.1/24 29

Access Panel Discovery 30

API Interaction 31

API Interaction n There are three major fields analyzed : l EncodedNum, Card Format, and the Access Levels 32

IoT On-Boarding 1. IoT Device Creates Wi-Fi Network 2. PC or Tablet joins open AP 3. IoT device is then registered to connect to the local Wi-Fi 33

Fun with GNU Radio 34

Zigbee “Smart” Home 35

Sniffing BLE 36

Sniffing BLE 37

Exploring Services with Bettercap 38

Extracting Sensitive Data 39

Exploiting BLE 40

Exploiting BLE 41

Binwalk 42

Firmadyne n An automated and scalable system for performing emulation and dynamic analysis of Linux-based embedded firmware n It includes the following components: l Modified kernels (MIPS,ARM) instrumentation of firmware execution l Ability to emulate a hardware NVRAM peripheral l An extractor to extract a filesystem and kernel l A small console application to spawn an additional shell for debugging 43

Firmadyne 44

Hard Coded Passwords www.kmco.com 45

APKTool 46

Locating Keys www.kmco.com 47

Automotive Security 48

Bypassing Rolling Codes 49

Bypassing Rolling Codes www.kmco.com 50

Vapor Trail –Data Exfiltration Tool of Tomorrow 51

52 libertyunix@protonmail.com Q & A www.kmco.com