1
00:00:00,000 --> 00:00:06,880
Hi, guys. Welcome to the IoT Village and the 410 Talk. As you can see, we're going to be

2
00:00:06,880 --> 00:00:12,740
talking about IoT, the gift that keeps on giving. And this is presented by Alex Balan,

3
00:00:13,000 --> 00:00:25,620
a.k.a. Jay. Let's do this thing. Thank you. So, first of all, sound check, because during

4
00:00:25,620 --> 00:00:29,600
the last talk, there were a bit of problem with a bit of background noise. So, can anybody

5
00:00:29,600 --> 00:00:36,920
in the back hear me okay? Yeah? Thank you. So, thank you for taking the bait with the

6
00:00:36,920 --> 00:00:43,880
first slide, first of all. And also, big shouts to the guys that actually hacked this thing,

7
00:00:44,100 --> 00:00:54,560
and they're actually in the room right now. So, in case you're wondering, the machines

8
00:00:54,560 --> 00:00:55,600
in the system, they're actually in the room right now. So, in case you're wondering,

9
00:00:55,620 --> 00:01:10,260
these are palace run Linux. These were taken yesterday. Okay. So, we're going to talk about

10
00:01:10,260 --> 00:01:19,160
three major things. First of all, the crazy state of IoT. Second, we will detail a bit

11
00:01:19,160 --> 00:01:25,500
about how we did our research, what were the results, what's the impact, and how much of

12
00:01:25,620 --> 00:01:31,220
the entire planet is going to be impacted by this. Some of you will already know what

13
00:01:31,220 --> 00:01:37,620
we're talking about, and I will ask you to look kindly on us and our methodology. Some

14
00:01:37,620 --> 00:01:43,040
of you who are not familiar with IoT security will learn something today, because we will

15
00:01:43,040 --> 00:01:49,440
take you step by step through each step of our research, how we did each single thing

16
00:01:49,440 --> 00:01:55,300
and how we achieved each single result. So, stay tuned, because if you want to learn how

17
00:01:55,620 --> 00:02:02,780
to attack IoT, now is your chance. And third, conclusions. And you will learn why the presentation's

18
00:02:02,780 --> 00:02:13,740
name is the gift that keeps on giving. So, chapter one, the crazy state of IoT. About

19
00:02:13,740 --> 00:02:21,700
a few months ago, I rented a car. I registered it with my name, my e-mail address. I passed

20
00:02:21,700 --> 00:02:23,640
it on to the car rental.

21
00:02:24,040 --> 00:02:24,840
And then,

22
00:02:24,840 --> 00:02:31,220
after about one year, I keep getting e-mails from the car saying the mileage, what the

23
00:02:31,220 --> 00:02:38,620
car has done, what is the status, the pressure in the tires, whether or not it needs revision,

24
00:02:38,960 --> 00:02:44,020
and that's probably because the car rental didn't bother to deregister it from my name.

25
00:02:44,220 --> 00:02:50,080
So, mind you, up until today, I still get e-mails from that Chrysler with its status.

26
00:02:52,140 --> 00:02:54,820
And a very important thing that I would like to point out is that, in the last two years,

27
00:02:54,820 --> 00:02:58,700
again, but I would like to point out that everything becomes more. This is kind of a

28
00:02:58,700 --> 00:03:07,540
cliché, but you probably have no idea the rate at which this is happening and how little

29
00:03:07,540 --> 00:03:13,360
choice we have in our choices right now. When I say that everything becomes more, I mean

30
00:03:13,360 --> 00:03:19,540
that we will not have the option to buy non-connected devices. And to give you just an example,

31
00:03:19,540 --> 00:03:24,600
For example, we used to have parallel port printers, then USB-connected printers.

32
00:03:24,740 --> 00:03:26,760
Now all printers are network-connected.

33
00:03:26,840 --> 00:03:29,600
We went through that stage without even realizing it.

34
00:03:29,680 --> 00:03:30,820
We took it as a benefit.

35
00:03:31,060 --> 00:03:36,420
It is a benefit, but it's a herald of this new era in which everything,

36
00:03:36,560 --> 00:03:41,320
including your upcoming glass of water, will probably be monitored by something connected.

37
00:03:42,440 --> 00:03:45,200
Xbox without connectivity doesn't exist.

38
00:03:45,540 --> 00:03:48,760
I guess there's no dumb TVs anymore, especially in the U.S.,

39
00:03:48,760 --> 00:03:52,660
maybe in some third-world countries like other countries in Romania.

40
00:03:55,300 --> 00:04:01,620
So it's very important to understand that IoT is not going to be optional.

41
00:04:02,460 --> 00:04:04,120
It's important to realize this.

42
00:04:05,480 --> 00:04:08,280
So these are not picked at random.

43
00:04:09,000 --> 00:04:12,060
All of these have some kind of vulnerability discovered in them.

44
00:04:12,380 --> 00:04:17,560
And that smart power outlet, for example, has a command injection, remotely exploitable.

45
00:04:18,760 --> 00:04:20,080
From anywhere in the world.

46
00:04:22,660 --> 00:04:32,420
As a fun story, I was at this IoT Builders event once in February last year with a colleague of mine.

47
00:04:33,540 --> 00:04:35,560
By the way, it's nice to see so many familiar faces.

48
00:04:36,980 --> 00:04:43,740
So there were these guys that made a device that would make you be calmer or more energetic.

49
00:04:46,300 --> 00:04:48,180
Now, it's the actual...

50
00:04:48,760 --> 00:04:50,560
It's the actual equivalent of electronic drugs.

51
00:04:51,880 --> 00:04:55,880
When you put it on your head, you control it with a mobile app,

52
00:04:56,000 --> 00:05:01,220
and that mobile app talks to the cloud, and that mobile app controls the device through Bluetooth.

53
00:05:02,080 --> 00:05:11,040
And it can make you calmer, much like weed does, or more energetic, much like something else that I did never try.

54
00:05:12,780 --> 00:05:15,240
And the problem was that this is the thing.

55
00:05:16,520 --> 00:05:17,820
I put it on my head.

56
00:05:17,820 --> 00:05:22,600
And I set it to more energetic, because I'm usually a very mellow person.

57
00:05:22,860 --> 00:05:26,180
All my friends know that I'm very calm, very chilled, very relaxed.

58
00:05:27,780 --> 00:05:30,540
And I turned the dial to one, two.

59
00:05:30,640 --> 00:05:33,660
When I got to three and a half, I passed out.

60
00:05:34,360 --> 00:05:36,160
That guy over there was with me.

61
00:05:36,220 --> 00:05:37,880
He can testify to that.

62
00:05:38,820 --> 00:05:39,920
I passed out.

63
00:05:39,940 --> 00:05:40,880
The guy grabbed me.

64
00:05:41,020 --> 00:05:44,240
And for about 20 minutes, I was unconscious almost.

65
00:05:44,400 --> 00:05:44,840
I was like...

66
00:05:45,920 --> 00:05:47,800
And I think that's very dangerous.

67
00:05:47,820 --> 00:05:50,720
Because that device is connected to a mobile application.

68
00:05:50,900 --> 00:05:52,320
It's controlled by a mobile application.

69
00:05:52,820 --> 00:05:55,040
And that mobile application talks to the internet.

70
00:05:55,640 --> 00:05:59,380
So if you can hijack their cloud and send commands to that mobile application,

71
00:05:59,660 --> 00:06:04,860
you could effectively be able to fry all their users' brains at the same time.

72
00:06:05,160 --> 00:06:06,480
And that's kind of screwed up.

73
00:06:06,600 --> 00:06:08,120
It's like science fiction, like Kingsman.

74
00:06:09,220 --> 00:06:13,720
But it's actually theoretically possible now through companies such as these.

75
00:06:13,940 --> 00:06:15,400
I'm not saying that what they're doing is bad.

76
00:06:15,740 --> 00:06:17,040
All I'm saying is that...

77
00:06:17,040 --> 00:06:17,800
Maybe...

78
00:06:17,820 --> 00:06:21,540
Maybe they are not ready to market this without a serious bug bounty first.

79
00:06:24,080 --> 00:06:28,300
The most common issues that we've discovered is, of course, undocumented hard-coded passwords.

80
00:06:28,640 --> 00:06:29,520
Win-blink Mirai.

81
00:06:30,380 --> 00:06:31,340
Weak or no encryption.

82
00:06:32,460 --> 00:06:34,920
There's a lot to be talked about this.

83
00:06:35,060 --> 00:06:37,660
And I would like to focus more on the research part.

84
00:06:38,760 --> 00:06:39,500
Command injection.

85
00:06:39,960 --> 00:06:42,780
This is an example of a command injection in a smart doorbell.

86
00:06:43,060 --> 00:06:47,780
They have a Dell file CGI which calls a system command called RM on UIN.

87
00:06:47,820 --> 00:06:48,500
Right?

88
00:06:49,320 --> 00:06:53,080
And you can just, you know, send my column and append another command to that.

89
00:06:54,800 --> 00:06:57,440
Wi-Fi configuration hotspots that remain open.

90
00:06:59,040 --> 00:07:04,740
Worst of all, and an advice to everybody, if you want to evaluate how good a solution is,

91
00:07:04,840 --> 00:07:06,400
look at the way they update.

92
00:07:06,940 --> 00:07:09,120
This is the simplest thing that you can do.

93
00:07:09,780 --> 00:07:17,500
If they do automatic update, like Nest, Amazon, and a number of other good products, they're okay.

94
00:07:17,500 --> 00:07:25,380
If they ask you to upload a firmware binary file that contains the update in an antique interface,

95
00:07:25,900 --> 00:07:27,400
that means that product is shit.

96
00:07:27,480 --> 00:07:28,220
You should throw it out.

97
00:07:28,480 --> 00:07:29,540
I'm not even joking.

98
00:07:33,180 --> 00:07:37,340
And the most dangerous issues discovered and will be shown today.

99
00:07:38,820 --> 00:07:41,520
U-P-F-N-P.

100
00:07:42,880 --> 00:07:47,480
So, just so I can get a feel of how much I'm supposed to debate about this,

101
00:07:47,500 --> 00:07:50,200
how many here know what U-P-N-P does?

102
00:07:52,460 --> 00:07:52,980
Okay.

103
00:07:53,100 --> 00:07:54,000
A good chunk.

104
00:07:54,100 --> 00:07:54,760
Thank you.

105
00:07:56,560 --> 00:08:01,540
So, for those of you who don't know, U-P-N-P enables the device behind the router

106
00:08:01,540 --> 00:08:04,660
to tell the router to port forward something,

107
00:08:05,700 --> 00:08:08,620
effectively exposing that service directly in the Internet.

108
00:08:08,920 --> 00:08:13,440
So you put this piece of this nice camera in your house,

109
00:08:13,500 --> 00:08:16,820
it's going to tell the router to do port forwarding to you.

110
00:08:16,820 --> 00:08:21,360
And that being said, I'm going to start this.

111
00:08:23,940 --> 00:08:25,020
Just to make sure.

112
00:08:25,080 --> 00:08:26,560
This is part of the demo, right?

113
00:08:26,720 --> 00:08:29,900
This is the router that's going to be used for this demo.

114
00:08:30,260 --> 00:08:32,440
And my laptop simulates the Internet.

115
00:08:32,920 --> 00:08:33,440
Okay?

116
00:08:33,580 --> 00:08:38,640
My laptop provides Internet to the router, connected to the router's external interface,

117
00:08:38,840 --> 00:08:43,880
the WAN interface, and it's going to look perfectly fine, no ports open, rock solid.

118
00:08:45,220 --> 00:08:46,780
The Nmap is going to take a while.

119
00:08:47,420 --> 00:08:50,940
So in the meantime, hang on.

120
00:08:52,320 --> 00:08:52,940
There we go.

121
00:08:54,560 --> 00:08:58,280
Another big issue is device cloud, mobile app synchronization.

122
00:08:58,860 --> 00:09:02,200
In this process, there's a lot of sanitization to be done.

123
00:09:02,340 --> 00:09:04,960
A lot of user input sanitization to be done.

124
00:09:06,040 --> 00:09:10,080
And unfortunately, 90% of the cases, it's not happening.

125
00:09:10,860 --> 00:09:12,580
It's not going to be part of this talk.

126
00:09:12,680 --> 00:09:16,420
We have another paper on it, probably to be presented at another conference.

127
00:09:16,420 --> 00:09:18,220
But it's really, really interesting.

128
00:09:18,420 --> 00:09:19,900
It's very, very fun.

129
00:09:21,580 --> 00:09:30,720
So one of the key messages that I would like to send out.

130
00:09:30,960 --> 00:09:38,340
Most research that's being done right now on IoT is focused on proximity-based attacks.

131
00:09:38,980 --> 00:09:41,440
Stuff like Bluetooth men in the middle.

132
00:09:41,560 --> 00:09:45,080
You know, hijacking the key exchange, key replays, these kind of things.

133
00:09:45,080 --> 00:09:51,100
Or getting root access, you know, through some command injection in the local interface on your LAN.

134
00:09:51,300 --> 00:09:52,960
And I'm not saying that's wrong.

135
00:09:53,740 --> 00:09:55,100
That's really, really cool.

136
00:09:55,520 --> 00:09:59,160
I mean, it gives you the opportunity to share your knowledge with the world.

137
00:09:59,280 --> 00:10:01,400
And, you know, make that device better.

138
00:10:02,240 --> 00:10:04,360
But you know what's even cooler than that?

139
00:10:05,120 --> 00:10:08,540
Mass hacking hundreds of thousands of devices.

140
00:10:09,220 --> 00:10:12,320
Because so far, it's been done with telnet.

141
00:10:12,520 --> 00:10:14,380
And that's pretty, pretty trivial.

142
00:10:14,380 --> 00:10:14,920
Am I right?

143
00:10:15,100 --> 00:10:17,980
That's like the basics of the basics of the basics.

144
00:10:18,400 --> 00:10:25,640
What if there is another step to be taken in remote compromising hundreds of thousands of devices?

145
00:10:26,240 --> 00:10:26,760
Okay?

146
00:10:26,920 --> 00:10:28,220
We should look at that.

147
00:10:28,400 --> 00:10:29,880
And what if there's one more?

148
00:10:29,980 --> 00:10:31,100
Probably more complicated.

149
00:10:31,300 --> 00:10:38,120
But once discovered, it can be reused by the bad guys to compromise hundreds of thousands of devices.

150
00:10:38,420 --> 00:10:42,480
The world does not begin and end with telnet when it comes to mass hacking.

151
00:10:42,960 --> 00:10:43,480
Right?

152
00:10:46,540 --> 00:10:49,980
So, to that point, I would like to make an analogy.

153
00:10:51,260 --> 00:10:56,240
IoT's are small computers with a stack that looks like this.

154
00:10:57,980 --> 00:11:04,860
Hardware, an operating system, and an application layer that companies develop poorly.

155
00:11:05,760 --> 00:11:07,420
Because they don't know any better.

156
00:11:07,580 --> 00:11:08,420
It's not their fault.

157
00:11:09,120 --> 00:11:12,640
Much like, is anybody familiar with this stack?

158
00:11:13,820 --> 00:11:16,760
Is anybody older than 30 years old in here?

159
00:11:18,880 --> 00:11:19,400
Okay.

160
00:11:19,660 --> 00:11:22,900
So, Red Hat 6.2, Vue FTPD?

161
00:11:23,020 --> 00:11:24,060
Ring a bell to anybody?

162
00:11:25,280 --> 00:11:32,240
It was one of the most popular exploits in 1998, 1999, something like that.

163
00:11:33,120 --> 00:11:38,020
I would like you to recognize that it's virtually the same stack if you think about it.

164
00:11:38,100 --> 00:11:41,740
If that IoT is exposed in the internet, from a hacker's perspective,

165
00:11:41,740 --> 00:11:43,560
it's the same goddamn thing.

166
00:11:43,760 --> 00:11:46,440
They don't care if it's IoT or WordPress.

167
00:11:46,980 --> 00:11:48,300
Much like this one.

168
00:11:49,060 --> 00:11:51,900
iOS 5.0, Windows hardware.

169
00:11:52,260 --> 00:11:53,540
Much like this one.

170
00:11:55,400 --> 00:11:56,360
Subway hack.

171
00:11:57,200 --> 00:11:57,860
Right?

172
00:11:58,640 --> 00:12:05,440
Or much like this one, hardware whatever, whatever application that can be hacked.

173
00:12:05,820 --> 00:12:10,740
I would like to emphasize that if an IoT is accessible from the internet,

174
00:12:10,740 --> 00:12:17,380
from a hacker's standpoint, it makes no goddamn difference if it's an IoT or a WordPress.

175
00:12:17,820 --> 00:12:20,740
They will command execute it, add it to a botnet,

176
00:12:20,900 --> 00:12:25,400
and either use it for spam, DDoS, Bitcoin mining, and whatever the hell they do.

177
00:12:25,660 --> 00:12:27,140
They don't care it's IoT.

178
00:12:27,380 --> 00:12:29,640
So, do not treat IoTs differently.

179
00:12:30,680 --> 00:12:34,780
Have a focus on IoTs which are exposed on the internet.

180
00:12:35,400 --> 00:12:38,060
So, that in mind, IoTs have a slight addition

181
00:12:38,060 --> 00:12:41,440
that kind of increases the attack surface,

182
00:12:41,660 --> 00:12:46,340
and that is application cloud application on the IoT communication.

183
00:12:47,120 --> 00:12:52,700
And there's a load of vulnerabilities that can be discovered in this handshake.

184
00:12:56,660 --> 00:12:58,400
So, why that is bad?

185
00:12:58,620 --> 00:13:01,000
Well, because there's no standards in this industry.

186
00:13:01,160 --> 00:13:03,520
The FTC is trying to develop some standards.

187
00:13:03,600 --> 00:13:07,060
I saw this really great talk by Aaron Alva.

188
00:13:07,060 --> 00:13:09,300
I hope I remember the name correctly.

189
00:13:09,380 --> 00:13:10,840
From FTC at Black Hat.

190
00:13:11,360 --> 00:13:13,400
And they want to develop standards,

191
00:13:13,620 --> 00:13:15,940
and they want to develop a certification for IoT.

192
00:13:16,240 --> 00:13:17,520
I salute that initiative.

193
00:13:17,700 --> 00:13:18,980
I would like to be part of that.

194
00:13:19,180 --> 00:13:20,500
We would like to help.

195
00:13:20,760 --> 00:13:22,280
So, that's great.

196
00:13:22,560 --> 00:13:25,600
The lack of standards in building these devices is awful.

197
00:13:25,760 --> 00:13:27,300
It's the main cause for problems.

198
00:13:28,560 --> 00:13:30,840
And obviously, each company builds their own stuff,

199
00:13:30,920 --> 00:13:32,140
and they have no idea what they're doing.

200
00:13:33,160 --> 00:13:34,300
So, chapter two.

201
00:13:34,800 --> 00:13:35,980
We come to the fun part.

202
00:13:37,060 --> 00:13:38,160
From China with love.

203
00:13:38,300 --> 00:13:39,840
We have these two devices here.

204
00:13:40,140 --> 00:13:41,520
I hope you can see them.

205
00:13:41,580 --> 00:13:44,760
It's a webcam and a smart doorbell.

206
00:13:48,780 --> 00:13:52,340
So, step one.

207
00:13:52,440 --> 00:13:54,440
You take one standard Linksys router.

208
00:13:56,320 --> 00:13:57,720
You set up the application.

209
00:13:58,440 --> 00:14:03,220
And I would like to point out one step in the setup process,

210
00:14:03,340 --> 00:14:06,340
which is bad resolution.

211
00:14:07,060 --> 00:14:09,720
But basically, it says, to protect your privacy,

212
00:14:10,040 --> 00:14:11,700
please reset your password.

213
00:14:12,700 --> 00:14:14,080
Which is great, right?

214
00:14:14,840 --> 00:14:16,020
It's a good thing.

215
00:14:16,120 --> 00:14:18,520
And you're going to go saying, oh, my God,

216
00:14:18,560 --> 00:14:21,560
this application is taking care of the security of their users.

217
00:14:21,760 --> 00:14:23,840
They're enforcing a password reset,

218
00:14:24,040 --> 00:14:26,820
so users do not have the same passwords everywhere.

219
00:14:27,440 --> 00:14:28,500
Good job.

220
00:14:29,080 --> 00:14:30,460
And it's awesome.

221
00:14:30,560 --> 00:14:32,700
But as we're going to see later on, useless.

222
00:14:33,700 --> 00:14:34,280
Okay?

223
00:14:34,380 --> 00:14:36,140
But remember this step.

224
00:14:36,140 --> 00:14:38,540
And then you blah, blah, blah, finish setup.

225
00:14:38,820 --> 00:14:40,520
The setup process is the same.

226
00:14:40,680 --> 00:14:43,400
And that brings me to the first thing that I want to point out.

227
00:14:43,820 --> 00:14:47,240
They are two different devices with two different purposes.

228
00:14:47,600 --> 00:14:49,460
However, they have a thing in common.

229
00:14:49,540 --> 00:14:50,080
Video streaming.

230
00:14:51,640 --> 00:14:54,420
So, as it turns out, it's the same firmware.

231
00:14:54,720 --> 00:14:56,920
It's just a different coating on top of it.

232
00:14:57,340 --> 00:15:02,280
And as it turns out, this very same firmware is integrated by,

233
00:15:02,400 --> 00:15:05,200
I have no idea how many other vendors,

234
00:15:05,200 --> 00:15:06,800
that OEM from these guys.

235
00:15:07,460 --> 00:15:11,000
So, different colors, different buttons, different things,

236
00:15:11,200 --> 00:15:13,540
but the same binaries and the same firmware.

237
00:15:13,900 --> 00:15:17,620
So, that means that everybody, it's not going to look like this.

238
00:15:17,660 --> 00:15:18,380
It's going to look different.

239
00:15:18,540 --> 00:15:19,580
It's not going to look like this.

240
00:15:19,640 --> 00:15:20,380
It's going to look different.

241
00:15:20,600 --> 00:15:22,940
But if they have that firmware embedded into them,

242
00:15:23,000 --> 00:15:24,840
they're going to have the same vulnerability.

243
00:15:27,740 --> 00:15:31,460
So, the first thing that we noticed is that from a perfectly good router,

244
00:15:33,200 --> 00:15:35,180
and this is the part where I plug in.

245
00:15:35,200 --> 00:15:35,840
I plug something in.

246
00:15:36,440 --> 00:15:36,660
This.

247
00:15:41,460 --> 00:15:49,100
All 1,000 ports scanned and actually just so you can see live.

248
00:15:50,120 --> 00:15:50,720
Wink, wink.

249
00:15:52,060 --> 00:15:54,700
So, no ports open on the router initially, right?

250
00:15:57,120 --> 00:15:58,800
I'm going to give it a minute to boot up.

251
00:16:03,420 --> 00:16:04,760
Because after that,

252
00:16:05,820 --> 00:16:09,560
the same router is going to have two open ports.

253
00:16:10,480 --> 00:16:11,040
Why?

254
00:16:11,820 --> 00:16:18,380
Because of God damn has to be killed with fire and brimstone UPnP.

255
00:16:19,500 --> 00:16:21,460
I'm very, very serious about this.

256
00:16:22,080 --> 00:16:28,020
UPnP is, I think it's one of the main reasons where IoTs are going to get hacked like crazy.

257
00:16:28,200 --> 00:16:33,620
If your router supports UPnP and the device is retarded enough to ask for port forwarding,

258
00:16:33,700 --> 00:16:35,180
your router is going to die.

259
00:16:35,180 --> 00:16:35,480
You have to do it.

260
00:16:35,520 --> 00:16:38,180
And that device will effectively be exposed on the Internet.

261
00:16:38,400 --> 00:16:42,080
Much like these devices, which are vulnerable, are right now.

262
00:16:43,140 --> 00:16:45,940
So, out of curiosity, let's see if the thing booted up.

263
00:16:46,700 --> 00:16:47,700
The same main map.

264
00:16:47,840 --> 00:16:48,180
There you go.

265
00:16:48,920 --> 00:16:53,480
Port 80 open, port 554 open, port 1935 open.

266
00:16:53,960 --> 00:16:55,640
And they weren't open before, right?

267
00:16:55,760 --> 00:16:57,820
I mean, no tricks, no bots, no coconuts.

268
00:16:58,020 --> 00:16:59,400
You guys see nothing up my sleeves.

269
00:17:02,800 --> 00:17:04,360
So, that's the first issue.

270
00:17:04,360 --> 00:17:05,760
And it's a big deal, again.

271
00:17:07,440 --> 00:17:08,040
Next.

272
00:17:10,140 --> 00:17:13,360
Shodan said that this has great potential.

273
00:17:14,080 --> 00:17:20,900
The web server said, at the time we asked, 135,000 devices.

274
00:17:22,560 --> 00:17:28,720
For the RSTP server, we found 147,000 devices.

275
00:17:31,100 --> 00:17:33,860
And then what we did, we took all the IP addresses.

276
00:17:34,360 --> 00:17:36,480
We did the differentiate between them.

277
00:17:36,720 --> 00:17:40,520
We took out the unique ones to make sure that we were accurate.

278
00:17:40,760 --> 00:17:42,040
We didn't just add them.

279
00:17:42,160 --> 00:17:43,580
We just added the unique ones.

280
00:17:43,820 --> 00:17:56,100
And we ended up with a final total of unique 228,808 devices exposed in the Internet with whatever we're going to show you next.

281
00:17:57,040 --> 00:17:57,880
I know, right?

282
00:17:58,780 --> 00:18:00,160
How messed up is that?

283
00:18:05,120 --> 00:18:06,720
We got pretty excited, obviously.

284
00:18:06,940 --> 00:18:08,260
We were like, woohoo!

285
00:18:08,540 --> 00:18:09,480
This is awesome!

286
00:18:10,480 --> 00:18:12,300
So, we started to do the basics.

287
00:18:13,120 --> 00:18:19,620
Basics being, you know, Wireshark, seeing the way they communicate, taking apart the mobile application and all that blah, blah, blah.

288
00:18:20,420 --> 00:18:26,840
And at some point, we realized that we have become accustomed to a number of stupid things.

289
00:18:26,960 --> 00:18:33,820
If you've discovered the kind of things that we see in IOTs in your web application for your company, you would take down the server.

290
00:18:34,420 --> 00:18:42,280
But we realized that we didn't care anymore because we've grown accustomed to bad coding because of these guys.

291
00:18:42,420 --> 00:18:45,980
For example, they have encryption in their communication with their cloud.

292
00:18:46,720 --> 00:18:52,340
But they don't have any encryption in the authentication process to the web interface or to the video stream.

293
00:18:52,680 --> 00:18:57,140
So, basically, if you connect to the video stream or if you connect to the web interface, that has no authentication.

294
00:18:57,580 --> 00:19:03,320
Now, we all feel that that is lame and ignorable.

295
00:19:03,320 --> 00:19:09,200
But in essence, it's because we got used to these devices being shit, right?

296
00:19:09,780 --> 00:19:12,120
It's not because that's the way it's okay to be.

297
00:19:12,280 --> 00:19:14,880
It's because we got used to these devices being crap.

298
00:19:15,060 --> 00:19:17,280
And I don't personally think that that's okay.

299
00:19:17,460 --> 00:19:19,340
That's something that has to change one way or another.

300
00:19:23,600 --> 00:19:25,880
So, we stumbled across this.

301
00:19:26,360 --> 00:19:30,880
We have an authentication interface on web and an authentication system on RSTP.

302
00:19:31,420 --> 00:19:33,220
What do we do with an input field?

303
00:19:35,960 --> 00:19:37,840
We fuzz it, right?

304
00:19:39,180 --> 00:19:41,660
So, we thought that we're going to have a lot of fun with it.

305
00:19:41,720 --> 00:19:46,740
But unfortunately, it crashed on the first try.

306
00:19:49,060 --> 00:19:50,640
So, yeah, that happened.

307
00:19:50,820 --> 00:19:56,200
And, again, this is stuff that can be done remotely from the Internet on any of those right now.

308
00:19:57,480 --> 00:19:58,720
So, it's kind of bad.

309
00:20:01,060 --> 00:20:03,300
The RSTP server, though, didn't crash yesterday.

310
00:20:03,320 --> 00:20:03,520
It hasn't crashed yet.

311
00:20:03,960 --> 00:20:08,220
As we're going to see later on, they actually did something even more stupid in that place.

312
00:20:08,400 --> 00:20:10,120
But, you know, security by obscurity.

313
00:20:10,720 --> 00:20:13,340
We thought that, you know, it was okay.

314
00:20:13,500 --> 00:20:14,660
But it wasn't.

315
00:20:17,500 --> 00:20:19,580
So, what do crashes smell like?

316
00:20:21,120 --> 00:20:21,600
Right?

317
00:20:23,040 --> 00:20:23,520
Right?

318
00:20:25,140 --> 00:20:25,620
Right.

319
00:20:28,720 --> 00:20:32,400
So, we needed the binaries to see how the crash happened.

320
00:20:33,320 --> 00:20:34,660
In order to be able to reproduce it.

321
00:20:34,840 --> 00:20:38,540
In order to be able to see if we can achieve remote command execution.

322
00:20:39,100 --> 00:20:41,360
And, obviously, I wouldn't be here if we couldn't do it.

323
00:20:41,440 --> 00:20:42,700
So, spoiler alert, we did it.

324
00:20:43,820 --> 00:20:45,720
But let me just tell you how we did that.

325
00:20:47,160 --> 00:20:51,100
First of all, so this is, again, I promise, a quick crash course.

326
00:20:51,200 --> 00:20:54,000
If you want to, you know, do this kind of thing, it's very easy.

327
00:20:54,520 --> 00:20:58,500
One of the key takeaways from this presentation is that IoT hacking is trivial.

328
00:20:59,100 --> 00:21:00,580
Everybody should be able to do it.

329
00:21:00,640 --> 00:21:01,780
Everybody should do it.

330
00:21:01,780 --> 00:21:06,440
And maybe then we're going to have, you know, safer devices and more awareness in this field.

331
00:21:07,280 --> 00:21:08,680
So, we hooked up to the serial.

332
00:21:08,840 --> 00:21:09,420
They had a serial.

333
00:21:09,920 --> 00:21:12,160
It booted up much like you boot a system.

334
00:21:12,240 --> 00:21:13,580
I'm sorry for the low resolution.

335
00:21:13,860 --> 00:21:16,700
It basically says log in.

336
00:21:17,180 --> 00:21:18,100
So, yeah.

337
00:21:19,580 --> 00:21:21,640
This is what we got on the serial interface.

338
00:21:22,780 --> 00:21:24,280
We didn't have any credentials yet.

339
00:21:25,560 --> 00:21:29,720
So, what we do when we don't have credentials, we try to hijack the bootloader.

340
00:21:29,760 --> 00:21:31,640
Much like you would do on a Linux machine.

341
00:21:31,780 --> 00:21:37,680
When you would pass parameters to init and say init equals BIM bash or whatever in order

342
00:21:37,680 --> 00:21:40,320
to reset your root or somebody else's root password.

343
00:21:40,580 --> 00:21:40,720
Right?

344
00:21:40,820 --> 00:21:43,520
So, it's the exact same thing with IoT.

345
00:21:43,700 --> 00:21:46,800
You just pause the bootloader and pass parameters to init.

346
00:21:46,960 --> 00:21:48,900
And I'm sorry, but you're not going to catch anything.

347
00:21:51,580 --> 00:21:55,480
We got a dump shell exactly like you get in round level 2.

348
00:21:56,200 --> 00:21:56,680
Right?

349
00:21:56,960 --> 00:21:57,640
I think.

350
00:21:58,080 --> 00:21:58,820
On Linux.

351
00:21:58,820 --> 00:22:04,960
And we added a telnet service to the startup script.

352
00:22:05,260 --> 00:22:06,820
This you can probably see.

353
00:22:08,220 --> 00:22:10,820
And then we got this.

354
00:22:11,720 --> 00:22:13,440
So, again, this is basic stuff.

355
00:22:13,720 --> 00:22:16,580
It's simply because they do not protect their bootloader.

356
00:22:17,140 --> 00:22:18,840
Some companies do.

357
00:22:18,920 --> 00:22:19,820
Most companies don't.

358
00:22:19,860 --> 00:22:23,360
You should probably be able to do this with almost all devices.

359
00:22:25,060 --> 00:22:28,800
So, the first thing that we saw was, unfortunately,

360
00:22:30,280 --> 00:22:34,520
and do you remember that slide where they asked us to change the admin password?

361
00:22:35,820 --> 00:22:36,260
Yeah.

362
00:22:36,520 --> 00:22:38,460
So, we did change the admin password.

363
00:22:38,680 --> 00:22:45,240
But what we discovered afterwards was that they had two more users backdoored into the thing.

364
00:22:45,440 --> 00:22:47,380
Like with user, user, and guest, guest.

365
00:22:47,780 --> 00:22:49,460
There's no documentation about it.

366
00:22:49,500 --> 00:22:52,360
Absolutely nobody, unless you know where to look, knows about that.

367
00:22:52,600 --> 00:22:57,620
So, if you guys want to see some live streams from people's houses, don't do it because it's illegal.

368
00:22:57,620 --> 00:23:02,100
But if you don't care about that kind of thing, just show them the thing.

369
00:23:02,360 --> 00:23:03,960
And then user, user, guest, guest.

370
00:23:04,700 --> 00:23:09,140
We haven't tried it ourselves, of course, because our legal department didn't allow us to do that.

371
00:23:09,300 --> 00:23:16,640
But we heard from a very reliable source that it works on 99.99999% of all of those devices.

372
00:23:19,040 --> 00:23:21,880
It's not, I'm not proud of this.

373
00:23:22,140 --> 00:23:24,700
I mean, it's not great.

374
00:23:24,800 --> 00:23:25,760
I hate this.

375
00:23:25,880 --> 00:23:26,920
It shouldn't happen.

376
00:23:27,120 --> 00:23:27,600
But it's true.

377
00:23:27,620 --> 00:23:29,480
But, again, it's the sad state of things.

378
00:23:29,840 --> 00:23:37,480
I would expect that after this talk, this to be popped on insecam.org, if you're familiar with the website, or that wall of webcams.

379
00:23:37,940 --> 00:23:44,100
These are easily, very easy to add on those kind of websites because of these things.

380
00:23:46,900 --> 00:23:48,040
So, what's next?

381
00:23:48,120 --> 00:23:50,180
We wanted remote command execution, right?

382
00:23:50,600 --> 00:23:53,900
As you can see, they decided that they want to be monolithical.

383
00:23:54,380 --> 00:23:55,780
And have one binary.

384
00:23:55,780 --> 00:24:05,240
In which they stuffed absolutely everything from web server, video server, authentication mechanism, you name it.

385
00:24:05,340 --> 00:24:09,020
Everything is embedded into one binary.

386
00:24:09,660 --> 00:24:16,060
Which actually, unfortunately, when you hack it, when you do anything to it, it reboots the thing.

387
00:24:16,260 --> 00:24:18,880
But you are able, as you're going to see, to execute something.

388
00:24:20,320 --> 00:24:21,720
So, debug time.

389
00:24:22,300 --> 00:24:24,260
Since we got system file system access.

390
00:24:24,260 --> 00:24:25,760
It had an SD card support.

391
00:24:26,180 --> 00:24:28,820
We copied the entire file system to the SD card.

392
00:24:29,000 --> 00:24:30,880
And we got the binary.

393
00:24:31,440 --> 00:24:33,940
And we started to look at the way things work.

394
00:24:34,220 --> 00:24:36,320
So, authentication works like this.

395
00:24:36,500 --> 00:24:41,340
It checks the URL, HTTP, IP address, question mark user, blah.

396
00:24:42,200 --> 00:24:42,960
Password, blah.

397
00:24:45,040 --> 00:24:49,460
And those blah are being parsed by that data function.

398
00:24:49,880 --> 00:24:50,440
Right?

399
00:24:52,180 --> 00:24:56,260
So, what's going to happen is that libasparse data is going to copy the content of those two arguments.

400
00:24:56,360 --> 00:24:57,800
Use them in passwords onto the stack.

401
00:24:58,020 --> 00:25:00,000
And it's not going to check their length.

402
00:25:01,020 --> 00:25:06,540
Now, as you can see below, there's only 460 bytes allocated to the stack.

403
00:25:06,860 --> 00:25:12,460
So, if you feed it more than 460 bytes, it's going to crash.

404
00:25:12,880 --> 00:25:14,620
Because of out of bounds.

405
00:25:17,400 --> 00:25:20,420
So, what we needed is to be able to exploit it.

406
00:25:20,420 --> 00:25:22,200
And now comes a fun part.

407
00:25:22,300 --> 00:25:23,980
So, pay attention to this one if you're sleeping.

408
00:25:24,100 --> 00:25:24,480
Wake up.

409
00:25:24,700 --> 00:25:27,900
Because the system has ASLR enabled.

410
00:25:30,360 --> 00:25:32,460
So, that was kind of bad for us.

411
00:25:32,600 --> 00:25:37,240
Because if ASLR was enabled, we wouldn't know where to inject our code.

412
00:25:37,560 --> 00:25:38,060
Right?

413
00:25:38,260 --> 00:25:40,300
So, that was kind of a big thing.

414
00:25:40,540 --> 00:25:42,640
And we were like, okay, this sucks.

415
00:25:43,220 --> 00:25:47,860
So, then we, just for the sake of it, we checked the binary with check file.

416
00:25:48,300 --> 00:25:50,400
It's a program by Microsoft.

417
00:25:50,420 --> 00:25:51,460
Some guy in Germany.

418
00:25:53,880 --> 00:25:56,280
And who is familiar with this?

419
00:26:01,580 --> 00:26:05,880
Pi stands for position independent executable.

420
00:26:06,460 --> 00:26:17,040
And it's a flag when you compile a file that allows ASLR to move the program, to put it at different addresses in memory.

421
00:26:17,120 --> 00:26:18,520
Because that's what ASLR does.

422
00:26:19,220 --> 00:26:24,900
ASLR prevents you, even though you're able to crash a process, prevents you from executing your code.

423
00:26:25,020 --> 00:26:29,160
Because it always places the program at different memory addresses.

424
00:26:29,460 --> 00:26:31,320
So, you're not going to know where code is.

425
00:26:31,820 --> 00:26:33,680
So, you're not able to exploit it.

426
00:26:33,780 --> 00:26:36,060
However, they bypassed ASLR.

427
00:26:36,220 --> 00:26:38,080
Because that's how they roll, man.

428
00:26:38,700 --> 00:26:39,960
ASLR is for pussies.

429
00:26:41,920 --> 00:26:42,660
So, yeah.

430
00:26:44,620 --> 00:26:47,580
They compiled it without position independent executable.

431
00:26:47,580 --> 00:26:51,840
And as such, it's always loading at the same address.

432
00:26:53,940 --> 00:26:57,280
So, from that point onwards, we used the RobGadget.

433
00:26:57,480 --> 00:26:59,020
We actually had system available.

434
00:26:59,280 --> 00:27:00,080
We called system.

435
00:27:02,360 --> 00:27:04,060
And this is the exploit.

436
00:27:06,360 --> 00:27:07,680
Actually, this is the exploit.

437
00:27:09,780 --> 00:27:11,480
It's very complex, as you can see.

438
00:27:12,340 --> 00:27:12,840
Very big.

439
00:27:13,900 --> 00:27:17,700
This can get root access on 200,000 devices worldwide.

440
00:27:17,920 --> 00:27:19,200
Actually, not this specifically.

441
00:27:19,340 --> 00:27:22,700
Because you're going to need different targets for different devices.

442
00:27:23,020 --> 00:27:26,020
So, it's the same method to get the targets.

443
00:27:26,180 --> 00:27:27,820
But this is one memory address.

444
00:27:27,940 --> 00:27:29,120
This is another memory address.

445
00:27:30,580 --> 00:27:31,700
So, yeah.

446
00:27:33,460 --> 00:27:34,020
Okay.

447
00:27:34,420 --> 00:27:36,140
That's it for this thing.

448
00:27:36,620 --> 00:27:38,580
The RSTP was a different issue.

449
00:27:38,720 --> 00:27:41,440
As you recall, we weren't able to crash it.

450
00:27:41,520 --> 00:27:42,480
By just, you know.

451
00:27:42,480 --> 00:27:44,120
Sending garbage to it.

452
00:27:44,380 --> 00:27:47,680
And that is because they rewrote it.

453
00:27:48,280 --> 00:27:52,000
They actually rewrote digest authentication in their own way.

454
00:27:52,720 --> 00:27:55,300
And obviously, they did it badly.

455
00:27:55,440 --> 00:28:04,040
Because you see these fields which are basically user field and value.

456
00:28:04,700 --> 00:28:10,460
Digest authentication has multiple entries of field value, field value, field value, field value, field value.

457
00:28:10,460 --> 00:28:17,080
Now, this field value thing is implied to have 256 bytes.

458
00:28:18,200 --> 00:28:24,540
And obviously, the way they wrote it is that they just parse it with scanf.

459
00:28:24,960 --> 00:28:26,760
And they do not validate the limit.

460
00:28:27,340 --> 00:28:34,380
So, if you put in field value, field value, anything beyond 256 bytes, you're going to crash the thing.

461
00:28:35,760 --> 00:28:37,140
So, it works.

462
00:28:37,260 --> 00:28:40,440
You just send this kind of string.

463
00:28:40,440 --> 00:28:42,320
And this is the exploit for RSTP.

464
00:28:42,500 --> 00:28:43,500
We use the same.

465
00:28:43,520 --> 00:28:44,360
It's the same binary.

466
00:28:44,440 --> 00:28:48,520
So, we use the same raw gadget calling system to execute our commands.

467
00:28:50,440 --> 00:28:51,400
So, yeah.

468
00:28:53,800 --> 00:28:54,820
It's time for demo.

469
00:28:55,220 --> 00:28:58,320
So, I will just like to recap my setup here.

470
00:28:58,680 --> 00:29:00,440
The laptop is the Internet.

471
00:29:01,160 --> 00:29:03,680
The router gets Internet from the laptop.

472
00:29:03,800 --> 00:29:05,980
So, the laptop is connected to the router's one port.

473
00:29:06,160 --> 00:29:07,620
The one that's supposed to be filtered.

474
00:29:08,240 --> 00:29:10,220
And these devices are connected to the router.

475
00:29:11,180 --> 00:29:15,880
So, what we're going to try to do is get root access.

476
00:29:16,200 --> 00:29:19,340
Actually, connect back shell because you cannot, you know, move past the router.

477
00:29:19,880 --> 00:29:23,600
We have a Metasplate handler listening here already.

478
00:29:23,920 --> 00:29:24,400
Wait.

479
00:29:27,900 --> 00:29:29,480
That was not supposed to happen.

480
00:29:31,820 --> 00:29:32,820
Okay, demo gods.

481
00:29:34,180 --> 00:29:35,580
Let's see what's happening here.

482
00:29:41,320 --> 00:29:42,340
Okay, this is dead.

483
00:29:43,400 --> 00:29:44,100
No worries.

484
00:29:46,000 --> 00:29:48,960
So, I have a quick and dirty copy-paste file.

485
00:29:51,320 --> 00:29:52,460
Because it's a lot of stuff.

486
00:29:52,780 --> 00:29:57,420
So, you can see we execute our exploit.

487
00:29:57,880 --> 00:30:00,440
As a target, we have NIP22, which is the camera.

488
00:30:00,680 --> 00:30:06,920
The IP address, which is the router IP address, which would be the Internet of accessible router IP addresses.

489
00:30:07,340 --> 00:30:09,280
And then this is the command between codes.

490
00:30:10,440 --> 00:30:15,700
So, we have HTTP, get Jena, which is our binary as a tribute to a great poet.

491
00:30:17,840 --> 00:30:21,320
We write it to a local file called slash TMP slash Jena.

492
00:30:21,560 --> 00:30:24,560
And we get it from a remote server, which would be my laptop.

493
00:30:25,240 --> 00:30:27,100
Then we make it an executable.

494
00:30:27,320 --> 00:30:37,000
And then we fetch another RCS, which is like the script that executes a startup from the TFTP server.

495
00:30:37,160 --> 00:30:39,440
Make a copy of the original RCS.

496
00:30:40,000 --> 00:30:44,320
Replace the original RCS with ours, which actually executes Jena at startup.

497
00:30:44,440 --> 00:30:53,220
Because why we do this is because the thing crashes when you get the command execution.

498
00:30:53,860 --> 00:31:00,080
So, we need to add it to the startup scripts because we're not going to have time to do anything on it otherwise.

499
00:31:06,240 --> 00:31:07,940
So, here's to the demo gods.

500
00:31:14,020 --> 00:31:17,520
Okay, it's supposed to crash in a couple of seconds.

501
00:31:18,280 --> 00:31:22,600
One thing that we've added, just so you see how that script looks like.

502
00:31:29,580 --> 00:31:35,300
So, we have to add a sleep 20 in its script.

503
00:31:35,440 --> 00:31:37,880
Because it wouldn't execute.

504
00:31:37,880 --> 00:31:40,760
It would execute earlier than the network interface would get up.

505
00:31:41,020 --> 00:31:42,840
So, that's why we have to wait a little bit.

506
00:31:44,920 --> 00:31:45,740
Did it reboot?

507
00:31:47,280 --> 00:31:48,740
Okay, it reboots it now.

508
00:31:48,840 --> 00:31:49,380
And there you go.

509
00:31:50,120 --> 00:31:50,540
Shell!

510
00:31:59,060 --> 00:32:02,320
So, sessions minus I3.

511
00:32:04,560 --> 00:32:05,620
IR root.

512
00:32:07,120 --> 00:32:07,680
Yep.

513
00:32:07,720 --> 00:32:11,340
So, I will take commands from the audience for one minute.

514
00:32:11,480 --> 00:32:13,140
Who wants to see stuff like...

515
00:32:17,740 --> 00:32:18,800
It's on ARM.

516
00:32:19,040 --> 00:32:23,760
And I'll show you where the juicy stuff is in MTD.

517
00:32:26,540 --> 00:32:30,420
And then the first thing is RT2878STA.

518
00:32:30,720 --> 00:32:31,280
Okay.

519
00:32:33,020 --> 00:32:34,000
Not this one.

520
00:32:39,600 --> 00:32:40,080
Yeah.

521
00:32:40,620 --> 00:32:41,100
So...

522
00:32:43,320 --> 00:32:44,360
Wi-Fi credentials.

523
00:32:46,540 --> 00:32:47,020
And...

524
00:32:52,500 --> 00:32:55,700
The nice thing that I was telling you about earlier.

525
00:32:55,840 --> 00:32:57,780
Could we move the projector just a little bit?

526
00:32:58,720 --> 00:32:59,360
Thank you.

527
00:33:06,280 --> 00:33:06,760
So...

528
00:33:07,740 --> 00:33:08,600
I'm going to...

529
00:33:08,600 --> 00:33:10,620
Does anybody want to run any commands on it?

530
00:33:10,800 --> 00:33:11,720
Seriously, it's okay.

531
00:33:12,380 --> 00:33:12,860
No?

532
00:33:14,140 --> 00:33:14,620
Okay.

533
00:33:15,940 --> 00:33:17,500
So, we're going to close this session.

534
00:33:18,980 --> 00:33:19,460
Oh.

535
00:33:20,200 --> 00:33:20,680
Wait.

536
00:33:20,800 --> 00:33:22,160
I forgot something very important.

537
00:33:24,740 --> 00:33:25,220
Yeah.

538
00:33:26,220 --> 00:33:26,700
.

539
00:33:30,480 --> 00:33:32,340
It's the same exploit for RSTP.

540
00:33:32,380 --> 00:33:33,420
It's the same thing.

541
00:33:33,620 --> 00:33:35,520
And it's the same thing for this device.

542
00:33:35,760 --> 00:33:41,840
The only difference is that you have to put a slip 60 on this one because it boots much slower than the other one.

543
00:33:42,160 --> 00:33:49,720
So, you have to execute your script in the startup system a bit later than usual.

544
00:33:49,880 --> 00:33:51,900
So, put a slip 60, maybe slip 70.

545
00:33:52,340 --> 00:33:55,100
So, you give it time to boot up and get the network interface up.

546
00:33:55,100 --> 00:33:59,100
So, we have another shell because we are a startup.

547
00:34:00,940 --> 00:34:05,760
And what I want to do is clean it.

548
00:34:05,880 --> 00:34:06,440
So...

549
00:34:10,260 --> 00:34:11,820
Just so it's safe.

550
00:34:12,120 --> 00:34:12,840
Okay.

551
00:34:14,040 --> 00:34:15,180
A board session.

552
00:34:15,680 --> 00:34:17,380
And there you go.

553
00:34:18,240 --> 00:34:18,960
.

554
00:34:22,280 --> 00:34:24,880
So, I have one comment.

555
00:34:24,880 --> 00:34:29,980
One comment for the people who are probably as old as me or older.

556
00:34:32,040 --> 00:34:34,100
I hope they get this reference.

557
00:34:35,840 --> 00:34:50,260
20 years ago, you could telnet to a Solari server, type root as password, and roughly 16 characters as password, and the login process would crash and the system would lock you in as root.

558
00:34:50,640 --> 00:34:51,020
.

559
00:34:53,380 --> 00:34:59,040
So, 20 years later, we have pretty much almost the same problem.

560
00:34:59,920 --> 00:35:00,440
Okay?

561
00:35:01,140 --> 00:35:02,740
In the authentication mechanisms.

562
00:35:04,960 --> 00:35:05,480
Okay.

563
00:35:05,640 --> 00:35:06,460
Key takeaways.

564
00:35:08,460 --> 00:35:09,680
What did I do?

565
00:35:11,040 --> 00:35:12,380
That was not intended.

566
00:35:12,640 --> 00:35:14,360
It was meant to be a different animation.

567
00:35:14,600 --> 00:35:14,880
Okay.

568
00:35:14,900 --> 00:35:19,420
So, as you've seen, the setup flow does request the user to change their password.

569
00:35:19,600 --> 00:35:21,000
But it has two back doors.

570
00:35:21,000 --> 00:35:23,040
User, user, and guest, guest.

571
00:35:23,540 --> 00:35:27,920
For your peeping Tom pleasure when you go to show run and try it out.

572
00:35:30,480 --> 00:35:30,960
Seriously.

573
00:35:31,460 --> 00:35:31,940
Okay.

574
00:35:32,000 --> 00:35:32,280
There we go.

575
00:35:32,640 --> 00:35:33,600
Very lame.

576
00:35:33,940 --> 00:35:34,420
Seriously.

577
00:35:34,500 --> 00:35:36,560
This is not brain surgery.

578
00:35:37,020 --> 00:35:43,060
I mean, the only thing very sophisticated, if you will, that we did was, you know, find the command execution method.

579
00:35:43,420 --> 00:35:43,900
Right?

580
00:35:43,940 --> 00:35:50,220
Other than that, passing 200 characters to a password field is really not rocket science.

581
00:35:50,220 --> 00:35:51,600
So, yeah.

582
00:35:53,980 --> 00:35:59,680
Seriously, check your routers, including your AT&T, Verizon, whatnot, what have you, in your homes.

583
00:35:59,860 --> 00:36:01,260
Check them for UPnP.

584
00:36:01,400 --> 00:36:03,500
If it's enabled, disable it.

585
00:36:04,600 --> 00:36:14,400
UPnP is made so users who like the experience of setting up port forwarding on their own don't have to do that because the devices will do it for them.

586
00:36:14,640 --> 00:36:19,920
But you do not want to let your devices do stuff like that on their own.

587
00:36:19,940 --> 00:36:20,200
It's not good.

588
00:36:20,220 --> 00:36:23,600
Because you want to control stuff like port forwarding.

589
00:36:23,660 --> 00:36:24,120
Trust me.

590
00:36:24,160 --> 00:36:26,160
If you don't believe me, please believe me.

591
00:36:28,600 --> 00:36:31,560
At this point, it's very difficult to tell how many devices are affected.

592
00:36:32,240 --> 00:36:39,660
Unfortunately, as I was saying, our legal department prohibited us from trying all of those devices on the Internet.

593
00:36:40,500 --> 00:36:46,880
But we hear from reliable sources that they crash just like all the others.

594
00:36:46,880 --> 00:36:49,860
We wouldn't know for sure, of course.

595
00:36:50,740 --> 00:36:51,980
But that's what we hear.

596
00:36:53,720 --> 00:36:57,320
You can, you know, buy this stuff yourself and try it on your own.

597
00:36:57,620 --> 00:37:01,760
Or if you're brave enough, you can try it on the Internet, on the wild, wild Internet.

598
00:37:02,060 --> 00:37:02,500
So, yeah.

599
00:37:04,300 --> 00:37:10,480
Very important, for other models, it's the same command execution, it's the same exploit, the same methodology.

600
00:37:11,460 --> 00:37:16,860
But you're going to have to go to a different memory address, very likely, in order to get command execution.

601
00:37:16,860 --> 00:37:21,500
Much like this is different from this, the same methodology, different addresses.

602
00:37:21,840 --> 00:37:28,020
So you're going to have to basically redo our steps to get the targets for new devices.

603
00:37:28,680 --> 00:37:30,980
But it should be very, very easily.

604
00:37:31,360 --> 00:37:34,060
I mean, I imagine that the bad guys would be able to do it very easily.

605
00:37:34,440 --> 00:37:35,540
And you guys as well.

606
00:37:37,560 --> 00:37:38,740
Very important takeaway.

607
00:37:38,980 --> 00:37:43,600
So we need security certifications for these devices.

608
00:37:44,300 --> 00:37:45,480
They're not computers.

609
00:37:45,480 --> 00:37:49,420
They're not computers as accessible as laptops or smartphones.

610
00:37:49,900 --> 00:37:53,400
They don't provide first-hand access to the operating system so you can check them.

611
00:37:53,720 --> 00:37:57,700
You have to do just a little bit to spend one or two days to find out what's happening.

612
00:37:57,840 --> 00:38:01,920
And obviously, all the average users can check their phones and laptops.

613
00:38:02,220 --> 00:38:06,840
No one will check their thermostats or doorbells or whatever.

614
00:38:07,120 --> 00:38:14,060
So they will need to find out whether or not that device has some sort of safety feature embedded into it from the store.

615
00:38:14,060 --> 00:38:20,540
And I would like to stress the fact that military-grade encryption is not security.

616
00:38:21,320 --> 00:38:23,080
Anybody agree with me on this one?

617
00:38:23,780 --> 00:38:24,340
Yes?

618
00:38:24,520 --> 00:38:24,940
Yes?

619
00:38:25,200 --> 00:38:25,560
Yes?

620
00:38:25,600 --> 00:38:26,320
I know.

621
00:38:26,980 --> 00:38:27,540
Yeah.

622
00:38:27,600 --> 00:38:32,300
Military-grade encryption, which is the crap that I get from all the people that build stuff.

623
00:38:32,460 --> 00:38:35,220
You know, I ask them, so what do you do about security on this?

624
00:38:35,280 --> 00:38:38,200
And at application level, you know, about injection and stuff like that.

625
00:38:38,260 --> 00:38:40,140
We use military-grade encryption.

626
00:38:41,300 --> 00:38:42,420
AES-256.

627
00:38:45,060 --> 00:38:45,540
Okay.

628
00:38:45,900 --> 00:38:56,820
We need to educate or otherwise stimulate, and this is one of the other purposes of this talk, the vendors to have a proper incident response mechanism.

629
00:38:57,400 --> 00:38:59,180
You're going to ask me, did you contact them?

630
00:38:59,280 --> 00:39:00,240
Of course I did.

631
00:39:00,340 --> 00:39:04,660
I work for a not public company but, you know, somewhat big company.

632
00:39:04,920 --> 00:39:10,560
And, again, our legal department would have my skin alive, you know, if I didn't do that.

633
00:39:10,660 --> 00:39:12,780
So we did contact them repeatedly.

634
00:39:12,780 --> 00:39:14,300
They ignored us.

635
00:39:15,000 --> 00:39:20,780
We actually contacted another company that OEM the firmware and they confirmed it.

636
00:39:20,900 --> 00:39:23,920
So different device altogether but same firmware.

637
00:39:24,220 --> 00:39:26,340
The German company did confirm the vulnerability.

638
00:39:28,260 --> 00:39:33,300
So I was thinking that there's something that we can do to make them more responsible about this.

639
00:39:34,960 --> 00:39:36,760
So we also need to educate the users.

640
00:39:37,000 --> 00:39:37,420
Right?

641
00:39:38,140 --> 00:39:41,320
I don't want to, you know, turn this into a commercial talk.

642
00:39:41,400 --> 00:39:42,440
I'm just going to put it out there.

643
00:39:42,440 --> 00:39:44,540
Either from us or from our competition.

644
00:39:45,320 --> 00:39:49,300
And I hear that some of our competitors are being hacked as we speak on one of those tables.

645
00:39:50,340 --> 00:39:57,820
People will have to get some tools that evaluate the security of their smart house and ideally also defend it.

646
00:39:58,500 --> 00:40:03,020
So many people have no idea how many devices they have in their houses.

647
00:40:03,440 --> 00:40:06,720
Some of them relate to the things that they bought themselves.

648
00:40:07,060 --> 00:40:10,280
But then you have, like, four devices from ADT or Cox.

649
00:40:10,280 --> 00:40:16,840
You have about, you know, four or five other devices from your media streaming service, something that somebody else installed.

650
00:40:17,160 --> 00:40:24,980
And it turns out that usually in America especially people have about seven, eight, even ten more devices than they knew in their house.

651
00:40:25,220 --> 00:40:37,800
And something that does at the very least a vulnerability assessment on all of those, something that all of you can do, all of you will probably do, but none of the other users will do, something like that has to be accessible to everybody.

652
00:40:38,080 --> 00:40:39,760
And people should know about that.

653
00:40:41,580 --> 00:40:44,160
So there are a lot of vulnerabilities discovered in IoT.

654
00:40:44,340 --> 00:40:48,880
So this is why the presentation is called IoT, the gift that keeps on giving.

655
00:40:49,880 --> 00:40:57,180
You can go, if you want to do a talk at a security conference, go to Best Buy or Target, pick like this.

656
00:40:59,840 --> 00:41:00,980
Take it home.

657
00:41:01,120 --> 00:41:06,760
And I promise you that with a little bit of effort in one week at most, you're going to have a paper.

658
00:41:07,780 --> 00:41:10,260
That's how bad the state is.

659
00:41:10,280 --> 00:41:12,440
I promise you that the state of things is with IoT security right now.

660
00:41:13,300 --> 00:41:13,800
Okay?

661
00:41:14,100 --> 00:41:16,500
At this point, it's the low hanging fruit.

662
00:41:16,660 --> 00:41:19,420
If you want to speak at conferences, just one week.

663
00:41:19,600 --> 00:41:20,780
It's all it's going to take.

664
00:41:20,800 --> 00:41:21,500
I promise you.

665
00:41:21,600 --> 00:41:27,740
And I would urge you, for the safety of everybody, to focus on stuff that could be exploited en masse.

666
00:41:28,280 --> 00:41:28,780
Okay?

667
00:41:28,920 --> 00:41:35,340
So not, it's cool to have the stuff in your house, but try to focus on stuff that is accessible from the Internet.

668
00:41:35,340 --> 00:41:42,940
If somebody would have drawn an alarm for the, you know, myriad of telnet services accessible from the Internet,

669
00:41:43,240 --> 00:41:45,700
maybe Mirai would have had a smaller impact.

670
00:41:46,320 --> 00:41:50,020
If somebody would have, you know, raised that alarm back then.

671
00:41:50,160 --> 00:41:50,560
So, yeah.

672
00:41:52,520 --> 00:41:55,360
So, I guess that's it.

673
00:41:55,560 --> 00:41:56,740
I hope you enjoyed it.

674
00:41:56,940 --> 00:41:58,520
And at this point, thank you.

675
00:42:05,340 --> 00:42:05,900
Thank you.