Living in a fools wireless - secured paradise Stefan Kiese Topics - PowerPoint PPT Presentation

Living in a fool’s wireless - secured paradise Stefan Kiese

Topics • Wireless (consumer) alarm systems • Hardware • Software • Hacking it ;) 2015/10/02 Stefan Kiese 2

About me • Security Analyst @ ERNW • Heidelberg, Germany • Interested in hardware hacking, SDR, IoT • Beard ;) www.ernw.de • Twitter: @net0SKi www.troopers.de www.insinuator.net 2015/10/02 Stefan Kiese 3

Wireless (consumer) alarm systems • Cheap ($10 - $250) • Easy to get • Easy to install • WIRELESS • Mostly, you get what you pay for 2015/10/02 Stefan Kiese 4

Hardware Tools 2015/10/02 Stefan Kiese 5

SDR: Logic Analyzer: HackRF One Intronix LogicPort LA1034 Yardstick One All-rounder: Scope: JTAGulator Tektronix MSO2012B Bus Pirate Pix ‘ sources: HackRF+YS, greatscottgadgets.com LogicPort, pctestinstruments.com MSO2012B, tek.com JTAGulator, jtagulator.com Bus Pirate v3, dangerousprototypes.com 2015/10/02 Stefan Kiese 6

Software Tools 2015/10/02 Stefan Kiese 7

GNU Radio Companion: Other useful tools: • E.g. minicom (for use of JTAGulator and BP) • Sigrok or other LA-soft • Baudline • Rfcat • Python Audacity: 2015/10/02 Stefan Kiese 8

Usual attack vectors • Hardware: • Over the air: • • UART (Debug info, Wifi console) • Bluetooth • SPI (e.g. r/w EEPROM) • Proprietary protocols • JTAG (e.g. r/w flash, reprogram µC) • I²C (e.g. comm. w/ components) 2015/10/02 Stefan Kiese 9

Comparison of the alarm systems AS 1 AS 2 AS 3 • Many • JTAG + UART • No interfaces unidentified exposed as TP exposed TPs exposed • Also simple • Rolling Code • Simple implemented record&replay record&replay • Costs also • EEPROM • Costs about about $100 • Costs about $100 $60 2015/10/02 Stefan Kiese 10

Alarm system 1 Loooong transmissions … 2015/10/02 Stefan Kiese 11

Alarm system 1 1. Let‘s start with a simple 3. „ Synthesizing “ signal in record&replay attack GNU Radio   successful successful 2. Trying to regain the RF 4. Manipulating messages transmission  unsuccessful  288 Bits x 90, Manchester encoded 2015/10/02 Stefan Kiese 12

2015/10/02 Stefan Kiese 13

2015/10/02 Stefan Kiese 14

Alarm system 2 You shouldn‘t be allowed to issue this CMD, dude! 2015/10/02 Stefan Kiese 15

Alarm system 2 1. Record&replay again … 3. JTAGulating UART   successful 2 UARTs exposed, no „valid“ output on 2. Motion Detector is common baudrates allowed to disarm the base 4. JTAGulating JTAG   Just bruteforce the unsuccessful Device ID 2015/10/02 Stefan Kiese 16

2015/10/02 Stefan Kiese 17

Alarm system 3 Keep on rollin ‘, baby! 2015/10/02 Stefan Kiese 18

Alarm system 3 1. Record&replay again … 3. Some interesting unlabelled ICs on PCB  unsuccessful  acc. to russian board 2. Trying to regain the RF one for signal horn transmission 4. EEPROM  65 bits x 6, two-  parted Rolling Code Connected to µC via SPI; no results yet 2015/10/02 Stefan Kiese 19

2015/10/02 Stefan Kiese 20

What could vendors do better? • Use Rolling Code • Use anti-tampering techniques • Remove IDs from ICs • Send keep-alive packets • Use two-way communication • Use encryption • Be aware of the comm. protocols 2015/10/02 Stefan Kiese 21

Any questions? 2015/10/02 Stefan Kiese 22

Thanks for your … … and have a nice day! 2015/10/02 Stefan Kiese 23