iot security
play

IOT SECURITY: CONSUMER DEVICES AND THE EXTENDED CORPORATE NETWORK - PowerPoint PPT Presentation

Mar 03, 2024 •357 likes •953 views

IOT SECURITY: CONSUMER DEVICES AND THE EXTENDED CORPORATE NETWORK Get CPE Credits for this Webcast Attendees of this Webcast are eligible for 1 CPE credit Self-report on your organizations website Keep the email invitation as

  1. IOT SECURITY: CONSUMER DEVICES AND THE EXTENDED CORPORATE NETWORK

  2. Get CPE Credits for this Webcast • Attendees of this Webcast are eligible for 1 CPE credit • Self-report on your organization’s website • Keep the email invitation as confirmation for possible future audits • More info: http://bit.ly/R7CPE

  3. Speakers Tod Beardsley Mark Stanislav Michael McNeil Research Manager Senior Security Consultant Global Product Security & Rapid7 Rapid7 Services Officer Philips Healthcare

  4. Hacking IoT Baby Monitors Mark Stanislav, Sr. Security Consultant

  5. What Does an Internet-Connected Monitor Offer? • “Connected” Features (via a Web Site and/or a Mobile Application) • Viewing a live stream locally (the home’s Wi-Fi) or remotely (Internet) • Controlling the camera’s position via pan, tilt, and zoom functionality • Communicating audio through the monitor (i.e. two-way audio) • Playing music or other recorded audio clips (i.e. bring your own lullabies) • Manage device preferences such as the audio volume and “night vision” • Share access and provide privileges to other people (e.g. family, friends) • Access recordings for humidity, temperature, noise, and/or motion alerts • Remote (e.g. SaaS, FTP) and local (e.g. Micro SD) DVR recordings

  6. A Mess of Dependencies and Attack Surface • Many IoT baby monitors leverage third-party services, firmware, and software • Some vendors put a lot of trust in their supply chain without testing security • Implementation errors or failure to comply with best practices also occurs 
 • Complex ecosystems means that there are plenty of ways to screw up: • Mobile applications, cloud services, backend services, web applications, firmware, hardware, network protocols, wireless protocols, & cryptography • It’s difficult for a single IoT vendor to be proficient in security across all of it 
 • The frameworks, protocols, and design patterns of IoT are still very much in flux

  7. SO, HOW DO WE HACK THESE THINGS?

  8. Via Dumping Firmware Pomona SOIC Clip + Bus Pirate flashrom to Dump Flash binwalk to Extract Filesystems

  9. Via Brute Force of Various Means Hash Cracking with cudaHashcat Scouring Google for Useful Details

  10. Via Serial Console (UART) JTagulator 
 U-Boot Configuration (or Bus Pirate, Shikra, etc.) UART Scan & Connect

  11. Via JTAG (e.g. Dumping Memory via GDB) Not a baby monitor … but you get the idea!

  12. Via Mobile Applications Acquire Firmware with dex2jar + JD-GUI for Android View API Calls with mitmproxy (esp. SSL/TLS) Find API End-Points with Clutch + strings for iOS

  13. Via Network Analysis Uncover Network Services with nmap View Protocol Details with wireshark

  14. Via Web Applications Hidden Administrative Web Interface XSS on Camera Cloud Web Service

  15. THE BABY MONITORS

  16. A Variety of Vendors, Styles, Costs, & Features Amazon 
 Two-Way Vendor Model Price Pan Tilt Zoom Wi-Fi Ethernet Rank* / Stars Audio ✓ ✓ ✗ ✗ ✗ ✗ Gynoii GCW-1010 $89.34 #56 / 3.8 ✓ ✓ ✓ ✓ ✓ ✓ iBaby M3S $169.95 #243 / 3.4 ✓ ✓ ✓ ✓ ✓ ✗ iBaby M6 $199.95 #31 / 3.7 ✓ ✗ ✗ ✗ ✓ ✓ Lens LL-BC01W $54.99 #149 / 2.8 ✓ ✓ Philips B120/37 $77.54 #N/A / 2.2 ✗ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✓ ✗ Summer 28630 $199.99 #64 / 3.1 ✓ ✗ ✗ ✓ ✓ ✗ TRENDnet TV-IP743SIC $69.99 #N/A / 3.5 ✗ ✗ ✗ ✓ ✓ ✓ WiFiBaby WFB2015 $259.99 #156 / 3.2 ✓ ✓ ✓ ✓ ✓ ✓ Withings WBP01 $204.60 #101 / 2.9 * Amazon Ranking Based on Category “Baby > Safety > Monitors”, Which Includes Non-IoT Baby Monitors

  17. THE FINDINGS

  18. Withings WBP01 - $204.60

  19. Disabled Doesn’t Quite Mean What it Used To 20 Minutes Later … 
 The Stream Still Works! After a stream exists, “disabling” it via the app doesn’t actually stop it …

  20. 
 
 When Obfuscation Goes Wrong, or, Not at All? At first, this looks like a really poor attempt at an obfuscation method to “hide” the password for this web service account. 
 On further review, however, the mchunk method simply returns at the start of the for loop, yielding the output from the input to be a concatenation of “ff” and the integer passed as a parameter. 
 Was this obfuscation intended to be enabled? Did someone give up on their dream of confusing reverse engineers? The world may never know …

  21. WiFi Baby WFB2015 - $259.99

  22. Nothing Makes Sense to Me Any More Unauthenticated Log With Stream Details Hardcoded SSL Cert … That’s Not Even Used …

  23. UPnP Bugs: Alive and Well in Baby Monitoring UPnP RCE Bugs, CVE-2012-5958 & CVE-2012-5959

  24. Lens Peek-A-View (LL-BC01W) - $54.99

  25. If You Needed Some Free Cloud Storage 


 [redacted] An FTP Account Per Camera, Apparently Used for Configuration Backups

  26. Backdoor Credentials Galore Hidden Web Interface Credentials Cracking the Linux ‘admin’ Password This account has functional ‘root’ privilege due to ugly permissions The Live Stream Passes Credentials in URL over HTTP

  27. Gynoii GCW-1010 - $89.34

  28. Unencrypted Web Services - Local and Cloud Local Administrative API Calls Hidden Device Web Interface Vendor Cloud API Calls Third-Party Streaming Service None of these services or APIs use any encryption and often pass sensitive credentials and keys

  29. TRENDnet TV-IP743SIC - $69.99

  30. 2-for-1 — Unencrypted Web Service + XSS [redacted] Either MITM a User or Just BYOJS to their DOM:)

  31. A Remote Shell Waiting to Happen … Username: root Password: admin Telnet Available, Just Not Default Pro Tip: Remove Remote Access Services, Don’t Just Disable Them!

  32. iBaby M3S - $169.95

  33. Uncovering Backdoor Linux Accounts & Access An nmap Scan Reveals Telnet :) Username: admin Password: admin Password is “Protected” by UNIX Crypt * FYI, there is no ‘root’ on here, only ‘admin’

  34. iBaby M3S - A Historical Look at Software? ✦ U-Boot: 1.1.3, released August 14th, 2005 ✦ OpenSSL: 0.9.8e, released February 23rd, 2007 ✦ Linux Kernel: 2.6.21, released April 26th, 2007 ✦ BusyBox: 1.12.1, released September 28th, 2008 
 ✦ UNIX Crypt: First appeared in 1979, limited to 8-character passwords ✦ Telnet: Developed in 1968 — SSH-1 came out in 1995 …

  35. Encryption! Just Not Great Choices For it :) Encrypted Backups … with a Hardcoded Password? Stream Encryption … with XXTEA?

  36. iBaby M6 - $199.95

  37. Cryptography? Naw, They Are Just Babies … Unencrypted Web Service Login Telnet & Unencrypted HTTP on Device Unencrypted Mobile API Calls

  38. This is the iBaby Cloud Web Site Today … … and What is Now Returned on Login … Login for Camera Owners

  39. But a Few Months Ago, Direct Object Reference! <—Proper Account “Attacker” Account—> No Authorization/Privilege Given to Our “Attacker” Account

  40. Full Access to All Audio & Motion Alert Videos “Attacker” Account—> [redacted] [redacted] [redacted] [redacted] Don’t let the broken images fool you … there’s live data ready to be viewed! View Source -> Find AVI Filename -> Access Static CloudFront URL

  41. Unauthenticated Access to Unencrypted Videos Mobile API Call for Alert Video Retrieval Example AVI Thumbnail File [redacted] [redacted] [redacted] Video Downloads via Amazon CloudFront [redacted] ✦ URLs are not requested via HTTPS ✦ No IAM credentials or signed URLs

  42. … and Some Weirdly Exposed Web Applications? Apparently There’s a Private Wiki. What For? No Clue. … But an Admin Site? Now That’s an Interesting Find!

  43. Philips In.Sight B120/37

  44. Everything Old is New Again … My IZON Research - 2013 My InSight Research - 2015 The question is … Did security issues fixed by one camera manufacturer ever trickle into devices also leveraging the same firmware?

  45. A Quick Look at “Old” Security Issues Still There No SSL on Backend Web Service Insecure Firmware Upgrade Process Multiple Hardcoded Linux Accounts Telnet Enabled by Default (Until Recently) Shout out to Paul Price for his research into the In.Sight M100 which shares a few issues from my old Stem Innovation IZON research and subsequent research into the In.Sight B120. Check out his site detailing this and other research at ifc0nfig.com!

  46. A Few Newer Issues. But Wait, There’s More! :) Backdoor Telnet Enablement Script Username: root Password: b120root Multiple XSS on Web Service Portal Predictable ‘admin’ Web Service Password

  47. Unauthenticated Administrative Camera Access User HTTP Reverse Proxy Camera Internet Clear Text Clear Text Clear Text Home Network Web Service 
 HTTP/80 When a remote end user requests their camera’s stream, an HTTP reverse proxy is opened on a public host & port number, directly to the camera’s backend web service, allowing for a remote attacker to achieve the following: ✦ Unauthenticated and unencrypted video/audio stream access to the user’s camera ✦ Full administrative access to the camera’s powerful backend web service ✦ This includes manipulating camera configuration or even re-enabling Telnet

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann &amp; Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday &amp; Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM &amp; UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides
Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Material and some slide content from: - Software Architecture: Foundations, Theory, and Practice - Krzysztof Czarnecki Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security: The protection a ff orded a

160 views • 4 slides
Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

1.36k views • 113 slides
Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security policies Computer Security Basic concepts Peter Reiher Security policies for real systems January 13, 2005 Lecture 2 Lecture 2 Page 1

347 views • 9 slides
Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security risks. Attacks in a cloud environment, top threats. Security, a major concern for cloud users. Privacy. Trust. Operating systems

661 views • 38 slides
Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election Security = Physical Security + Cybersecurity Physical Security Security plans Secure storage of voting machines and electronic pollbooks

341 views • 13 slides
Computer Security environment, without compromising functionality or security? Three parts

Computer Security environment, without compromising functionality or security? Three parts

9/7/2013 Some topics Im working on Computing on encrypted data Information flow: Dynamic IFC in Haskell, web Sandboxing Untrusted JavaScript Third party web tracking and other web security stories Practical web security

572 views • 21 slides
Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon Transport Network Link Physical CSE 461 University of Washington 2 Security Threats Security is like performance Means many things

1.12k views • 92 slides

More recommend