1
00:00:00,000 --> 00:00:04,400
Daryl Hyland from Rapid7 and he's presenting his talk called

2
00:00:04,400 --> 00:00:07,800
Internet of Vulnerabilities. So take it away. Thank you. Thank

3
00:00:07,800 --> 00:00:19,580
you. How's everyone doing? Outstanding. So again my name is

4
00:00:19,580 --> 00:00:22,840
Daryl Hyland. I'm the research lead for IoT technology at

5
00:00:22,840 --> 00:00:27,120
Rapid7. And hopefully you guys will enjoy this presentation and

6
00:00:27,120 --> 00:00:31,020
I'll be around after the presentation and clear until

7
00:00:31,020 --> 00:00:35,700
Monday. So kind of grab me and we can grab a drink and have

8
00:00:35,700 --> 00:00:40,640
some discussions. I'm always open to feedback. Stuff you're

9
00:00:40,640 --> 00:00:43,980
working on and we can talk about stuff I'm working on that hasn't

10
00:00:43,980 --> 00:00:49,560
been published yet. But not all the details. So it's kind of fun

11
00:00:49,560 --> 00:00:53,100
and this is generally a presentation on some of the work

12
00:00:53,100 --> 00:00:57,100
that I've done over the last 12, 14 months or something like

13
00:00:57,120 --> 00:01:01,840
this. So some smaller items, kind of more of the junk hacking

14
00:01:01,840 --> 00:01:06,560
but kind of looked at it from a, you know, what kind of privacy

15
00:01:06,560 --> 00:01:10,400
issues maybe exist all the way up to enterprise level

16
00:01:10,400 --> 00:01:15,260
technology. So it should be kind of fun. So from a

17
00:01:15,260 --> 00:01:20,040
perspective of IoT research, when I came over at Rapid7 and

18
00:01:20,040 --> 00:01:23,000
took over the position as the research lead, one of the first

19
00:01:23,000 --> 00:01:26,280
questions I was asked was, now you're a research lead, what the

20
00:01:26,280 --> 00:01:27,100
hell is IoT? And I said, well, I'm a research leader. So what's

21
00:01:27,120 --> 00:01:30,600
IoT? And I think you all realize, you know, trying to

22
00:01:30,600 --> 00:01:34,620
define a definition of what IoT is is very difficult. So instead

23
00:01:34,620 --> 00:01:38,140
of doing that approach, I kind of tried to hit the 80-20 type

24
00:01:38,140 --> 00:01:41,400
thing, but kind of frame it around how do we approach

25
00:01:41,400 --> 00:01:45,920
looking at the security of IoT technology. And I kind of use

26
00:01:45,920 --> 00:01:49,560
this model here. It's made up of three general pieces. You know,

27
00:01:49,600 --> 00:01:52,860
we always have the, you know, the hardware aspect of IoT,

28
00:01:53,100 --> 00:01:56,900
which is we're all into hacking the hardware. But the

29
00:01:56,900 --> 00:01:57,100
hardware aspect is, you know, we're all into hacking the

30
00:01:57,120 --> 00:01:58,680
hardware. But the hardware is only one small piece of the

31
00:01:58,680 --> 00:02:02,540
overall puzzle. And some of the other pieces we often run into

32
00:02:02,540 --> 00:02:04,720
are mobile, the mobile application aspects that

33
00:02:04,720 --> 00:02:08,620
interface with this technology. The cloud services, cloud APIs.

34
00:02:09,360 --> 00:02:13,180
So the ultimate goal was, as the research lead and as I drive

35
00:02:13,180 --> 00:02:18,660
research and IoT testing within Rapid7 was, well, let's approach

36
00:02:18,660 --> 00:02:23,380
this from an ecosystem, a full ecosystem of an IoT product. That

37
00:02:23,380 --> 00:02:27,100
way we can examine the impact of one aspect of that ecosystem and

38
00:02:27,560 --> 00:02:32,020
the other. What's the impact of hardware vulnerabilities to cloud

39
00:02:32,440 --> 00:02:36,480
information, cloud data, cloud APIs? What's the impact of mobile

40
00:02:36,480 --> 00:02:40,300
applications on the hardware or on the cloud APIs? And vice versa

41
00:02:40,300 --> 00:02:44,140
across this. And that way, any time I approach a technology, I

42
00:02:44,140 --> 00:02:47,540
look at the entire ecosystem, all the pieces. So in this talk,

43
00:02:47,700 --> 00:02:49,880
we're going to, a lot of it's going to be covered. It's going

44
00:02:49,880 --> 00:02:52,160
to be some of the outline pieces. It's not all going to be

45
00:02:52,160 --> 00:02:54,740
hardware. We're going to talk about web, web API vulnerability

46
00:02:54,740 --> 00:02:57,080
issues that are part of the product line. And we're going to

47
00:02:57,080 --> 00:03:00,840
look at mobile application vulnerabilities. Generally the

48
00:03:00,840 --> 00:03:03,940
most common one that they seem to find on everyone, which is

49
00:03:03,940 --> 00:03:07,900
definitely one to get it fixed. Let's kind of, coming out of

50
00:03:07,900 --> 00:03:12,780
that, we kind of build a methodology for approaching IoT

51
00:03:12,780 --> 00:03:15,560
testing. And it covers these general areas, you know,

52
00:03:15,580 --> 00:03:18,920
functional evaluation all the way down to examining the radio

53
00:03:18,920 --> 00:03:22,640
RF. And the goal is to dive into each one of these in detail

54
00:03:23,120 --> 00:03:26,760
across that ecosystem. If you do that, you're going to get a more

55
00:03:27,080 --> 00:03:31,540
realistic view of the security of that technology, which makes it

56
00:03:31,540 --> 00:03:35,240
all that much easier to actually get the technology fixed, which is

57
00:03:35,240 --> 00:03:38,060
what we're all about. We're not, it's not about vulnerabilities.

58
00:03:38,620 --> 00:03:43,140
It's about fixing the issues. So let's kind of move forward on

59
00:03:43,140 --> 00:03:46,280
this and start talking about some of the IoT hacking. So what we're

60
00:03:46,280 --> 00:03:49,900
going to talk about today is some vulnerability issues we found

61
00:03:49,900 --> 00:03:53,720
around automated lighting solutions. We're going to talk

62
00:03:53,720 --> 00:03:57,060
about BLE trackling dongos. And actually, I think this is a

63
00:03:57,080 --> 00:03:58,120
really interesting story. So if you're actually using one back

64
00:03:58,120 --> 00:04:02,180
here as part of the contest, it's actually, I believe, one of the

65
00:04:02,180 --> 00:04:05,960
tracker, tracker are bravos. So we'll be talking about that one

66
00:04:05,960 --> 00:04:09,040
specifically because it was like, had some serious problems,

67
00:04:09,220 --> 00:04:12,640
especially with the cloud APIs. We're going to talk about

68
00:04:12,640 --> 00:04:14,820
telepresence robots. I don't know if you've ever seen those

69
00:04:14,820 --> 00:04:19,000
crazy freaking robots. It's like an iPad on a Segway. So we're

70
00:04:19,000 --> 00:04:21,420
going to talk about issues discovered there. And then we're

71
00:04:21,420 --> 00:04:25,560
also going to talk about a GPS panic button. And this one has a

72
00:04:25,560 --> 00:04:27,060
really interesting story around it. So we're going to talk about

73
00:04:27,060 --> 00:04:30,800
it. I think you guys will find maybe not funny, but at least

74
00:04:30,800 --> 00:04:34,500
entertaining. So let's kind of move forward. So looking at

75
00:04:34,500 --> 00:04:37,380
automated lighting solutions, and what we looked at was the

76
00:04:37,380 --> 00:04:42,400
Sylvania products, the Lightify products. And there's two pieces

77
00:04:42,400 --> 00:04:45,900
of the Lightify products. There is the home user modules, which

78
00:04:45,900 --> 00:04:49,520
we have one here kind of all gutted out. And there was the

79
00:04:49,520 --> 00:04:52,140
enterprise version. This is what's used in businesses,

80
00:04:52,140 --> 00:04:56,020
organizations that can use to manage lighting within a

81
00:04:56,020 --> 00:04:57,040
building. And then there's the enterprise version. This is

82
00:04:57,060 --> 00:05:01,720
what we found. Things we found, you know, the common, unencrypted

83
00:05:01,720 --> 00:05:05,280
storage of information, poor encryption in the communication,

84
00:05:05,980 --> 00:05:10,340
unauthenticated controls, and embedded web bones. Remember, a

85
00:05:10,340 --> 00:05:12,360
lot of this technology, especially as you move into the

86
00:05:12,360 --> 00:05:16,140
enterprise stuff, all have web servers. And those web servers

87
00:05:16,140 --> 00:05:20,460
are wrought with issues. So let's go ahead and start off. We'll

88
00:05:20,460 --> 00:05:24,660
start off with, starting out with, I manned up and set up the

89
00:05:24,660 --> 00:05:27,040
home Lightify system. And started with the home Lightify system.

90
00:05:27,060 --> 00:05:28,600
And started looking at the mobile applications. And the

91
00:05:28,600 --> 00:05:33,740
first thing I found was the WPA pre-shared keys actually stored

92
00:05:33,740 --> 00:05:36,580
unencrypted on the device, whether it was an Android or IOT.

93
00:05:36,660 --> 00:05:41,180
It was stored unencrypted. The crazy thing is, is this didn't

94
00:05:41,180 --> 00:05:43,520
need to be stored there after the system was set up. But it

95
00:05:43,520 --> 00:05:46,960
continued to store it there. You could log out. You could do

96
00:05:46,960 --> 00:05:49,640
whatever you wanted to do. Reboot the device. And still,

97
00:05:49,740 --> 00:05:52,820
this data was in there. And, you know, how often do we lose our,

98
00:05:52,860 --> 00:05:56,960
like, phones? I guess if you're on IOS, it's a little more, a

99
00:05:57,060 --> 00:05:59,600
little more security built in that. But if you're on Android,

100
00:05:59,860 --> 00:06:04,480
oh, what security, okay? So, you know, you think about it. This

101
00:06:04,480 --> 00:06:08,600
is a common vulnerability. I find this over and over and over

102
00:06:08,600 --> 00:06:12,540
on probably 80% of the products I look at. I'm finding user

103
00:06:12,540 --> 00:06:16,640
IDs, tokens, pre-shared keys, all the information

104
00:06:16,640 --> 00:06:19,640
stored right there on the device, giving you the ability

105
00:06:19,640 --> 00:06:23,200
to do anything from taking over the device, taking over the

106
00:06:23,200 --> 00:06:26,580
home wireless to actually taking over all the cloud APIs and

107
00:06:26,580 --> 00:06:30,180
controlling a person's entire home in some cases. And this is

108
00:06:30,180 --> 00:06:33,820
definitely something we need to get fixed. So, so my goal is, is

109
00:06:33,820 --> 00:06:36,220
if you're out there doing IoT research, look at this stuff.

110
00:06:36,360 --> 00:06:39,420
Look at the mobile applications. Try to identify this stuff and

111
00:06:39,420 --> 00:06:42,000
report it out there. I've already reported, you know, a

112
00:06:42,000 --> 00:06:45,280
systemic issue across all the products. Now we need to get it

113
00:06:45,280 --> 00:06:47,740
fixed. Because this is insane. There's solutions to prevent

114
00:06:47,740 --> 00:06:52,460
this type of stuff. Moving from there, we started looking at the

115
00:06:53,000 --> 00:06:56,560
home enterprise devices and how they have their use cases. And,

116
00:06:56,580 --> 00:06:56,760
you know, I think the key to this is that we need a user name

117
00:06:56,760 --> 00:07:00,060
and passwords for the Wi-Fi. So these devices often, when they

118
00:07:00,060 --> 00:07:03,420
fire up, have a Wi-Fi solution that's actually available. You

119
00:07:03,420 --> 00:07:06,840
connect to it. It's often used to configure the device. So we

120
00:07:06,840 --> 00:07:10,220
started looking at that those defaults for that particular

121
00:07:10,220 --> 00:07:13,820
device, their SSID and the WPA pre-shared keys that are

122
00:07:13,820 --> 00:07:16,020
associated with the configuration of these devices

123
00:07:16,020 --> 00:07:19,960
and go, well, how secure are these? So we jump over here on

124
00:07:19,960 --> 00:07:22,880
the, this is the home, this is the home product, okay, right

125
00:07:22,880 --> 00:07:26,160
here. And we can see it's 8 characters, alpha numeric, or 10

126
00:07:26,580 --> 00:07:28,340
There's African American, upper, lower case.

127
00:07:29,080 --> 00:07:32,360
Not perfect, but in reality, not that bad.

128
00:07:32,640 --> 00:07:35,520
So I get the enterprise product, and I start looking at it.

129
00:07:35,780 --> 00:07:40,300
Now, the big thing with the enterprise product is it actually has Ethernet on it.

130
00:07:40,660 --> 00:07:43,980
It has Wi-Fi, so you can get access to it to Wi-Fi.

131
00:07:44,100 --> 00:07:48,180
And then it can also integrate to your building or your internal Wi-Fi system.

132
00:07:48,360 --> 00:07:50,360
So it has multiple ways for communication,

133
00:07:50,620 --> 00:07:53,360
and literally all of them can function at the same time

134
00:07:53,360 --> 00:07:55,840
based on how the device is configured.

135
00:07:55,840 --> 00:08:00,280
So when we started looking at the actual WPA pre-shared key on this device here,

136
00:08:00,860 --> 00:08:02,680
we noticed that it was only eight characters,

137
00:08:02,780 --> 00:08:07,040
but I couldn't figure out, you know, is it alphanumeric, upper, lower case,

138
00:08:07,180 --> 00:08:08,040
and all that type of stuff.

139
00:08:08,260 --> 00:08:10,260
So I had them send me a second device.

140
00:08:11,120 --> 00:08:14,400
Once I got the second device, the answer become clear.

141
00:08:14,940 --> 00:08:19,860
It's actually hex, A through F, 0 through 9, eight characters only.

142
00:08:20,900 --> 00:08:23,720
So instantly, we set this thing up like it was in an enterprise.

143
00:08:23,960 --> 00:08:25,060
We hooked it on the Ethernet.

144
00:08:25,060 --> 00:08:26,960
It's Wi-Fi came up running.

145
00:08:28,240 --> 00:08:32,260
You could connect the management console into the Wi-Fi or the Ethernet.

146
00:08:32,340 --> 00:08:36,160
But if you're connected through the Wi-Fi, a typical WPA pre-shared key attack.

147
00:08:36,340 --> 00:08:39,140
You kick them off, they rejoin, you capture the data.

148
00:08:40,580 --> 00:08:42,920
And apparently I don't have that slide in there anymore.

149
00:08:43,200 --> 00:08:46,780
But the crack was using a really shitty GPU.

150
00:08:47,340 --> 00:08:50,300
We cracked that in less, right around two hours.

151
00:08:50,880 --> 00:08:54,240
So instantly, a device in an enterprise, not configured,

152
00:08:54,240 --> 00:08:57,920
not shutting that stuff off, which may be very common,

153
00:08:58,540 --> 00:09:01,300
using really bad pre-shared key, key space,

154
00:09:01,640 --> 00:09:04,640
we quickly cracked this in two hours or less,

155
00:09:04,900 --> 00:09:10,720
given an attacker to be able to gain access to an internal network fairly quickly.

156
00:09:13,480 --> 00:09:17,120
So also, this device happened to have a web server.

157
00:09:17,920 --> 00:09:19,960
We found a couple vulnerabilities on there.

158
00:09:20,300 --> 00:09:23,040
So the first one was when I was logging onto the device,

159
00:09:23,100 --> 00:09:24,160
I'm going down through the list,

160
00:09:24,240 --> 00:09:26,020
and I go, security logs.

161
00:09:26,240 --> 00:09:28,220
I always like something when it says security logs.

162
00:09:28,460 --> 00:09:29,880
That's always the greatest thing.

163
00:09:30,100 --> 00:09:31,660
So I go into the security logs,

164
00:09:31,880 --> 00:09:35,680
and I notice it showed the username of my logon.

165
00:09:36,060 --> 00:09:40,320
So I came back out and tried logging on with a bogus name,

166
00:09:40,460 --> 00:09:42,840
went back into logs, and it had that name in there.

167
00:09:43,400 --> 00:09:44,960
So I thought, oh, what the hell?

168
00:09:45,320 --> 00:09:48,640
Cross-site scripting, persistent, in the security logs.

169
00:09:49,060 --> 00:09:51,580
So I gave it a little present of a laughing skull.

170
00:09:51,840 --> 00:09:52,120
So.

171
00:09:54,240 --> 00:09:56,800
So also on the web server, we found some issues

172
00:09:57,480 --> 00:10:00,980
in the configuration page, the management configuration page,

173
00:10:01,180 --> 00:10:05,260
for the actual Wi-Fi setup.

174
00:10:05,680 --> 00:10:07,120
And I don't know,

175
00:10:07,880 --> 00:10:10,960
if you, when you're looking at a Wi-Fi configuration page,

176
00:10:11,060 --> 00:10:13,800
and you see this page, what do you think?

177
00:10:15,580 --> 00:10:17,900
I often ask this, well, what's the first thing

178
00:10:17,900 --> 00:10:18,620
that goes through your head?

179
00:10:18,880 --> 00:10:20,240
The first thing that goes through my head,

180
00:10:20,300 --> 00:10:24,060
it's another injection point for actually injecting cross-site

181
00:10:24,240 --> 00:10:26,460
scripting into a management console on a system.

182
00:10:26,680 --> 00:10:29,580
But it's an out-of-band, which we often don't look at.

183
00:10:30,320 --> 00:10:32,420
Because we're, you know, don't people don't think,

184
00:10:32,540 --> 00:10:36,520
an SSID can be built, the SSID name can be built

185
00:10:36,520 --> 00:10:37,800
to contain Java code.

186
00:10:38,120 --> 00:10:40,820
It can be configured to make calls out to a server

187
00:10:40,820 --> 00:10:42,060
and pull down Java code.

188
00:10:42,500 --> 00:10:48,960
So I have a quick video here, a little bit for entertainment.

189
00:10:52,380 --> 00:10:54,140
So I actually spoke at,

190
00:10:54,240 --> 00:10:57,160
at Black Hat in 2013, and I presented a paper

191
00:10:57,710 --> 00:11:01,600
on attacking embedded devices via SSIDs.

192
00:11:02,840 --> 00:11:05,020
I don't know how well it's easy to see this, but.

193
00:11:07,000 --> 00:11:09,540
So we come over here, and we go to the Wi-Fi configuration,

194
00:11:09,680 --> 00:11:11,540
and we quickly see that,

195
00:11:13,500 --> 00:11:16,760
that we can actually see the Wi-Fi access points

196
00:11:16,760 --> 00:11:17,660
in close proximity.

197
00:11:17,940 --> 00:11:21,440
So we just basically set up our little, own special SSID,

198
00:11:22,520 --> 00:11:23,640
which is always fun.

199
00:11:24,240 --> 00:11:26,820
So a soft access point, we fire it up,

200
00:11:26,920 --> 00:11:30,100
so we can check to see what does the application do

201
00:11:30,860 --> 00:11:34,180
when it interacts with a Wi-Fi injection.

202
00:11:37,740 --> 00:11:38,300
.

203
00:11:41,240 --> 00:11:41,800
.

204
00:11:41,800 --> 00:11:42,200
.

205
00:11:53,400 --> 00:11:57,020
So I've used this attack a number of times over the years.

206
00:11:57,180 --> 00:11:59,840
So something to consider when you're engaged in this,

207
00:11:59,880 --> 00:12:03,920
don't always think about just cross site scripting.

208
00:12:04,180 --> 00:12:06,600
If you go back and look at the paper I published here

209
00:12:06,600 --> 00:12:08,580
on this particular attack vector,

210
00:12:08,840 --> 00:12:10,760
we actually found format string attacks

211
00:12:10,760 --> 00:12:11,960
via this vector also.

212
00:12:12,280 --> 00:12:14,360
So there's a number of things you can carry out

213
00:12:14,360 --> 00:12:18,140
via SSIDs against embedded technologies

214
00:12:18,140 --> 00:12:19,520
that contain web services.

215
00:12:31,460 --> 00:12:33,960
So a number of the one of the things,

216
00:12:34,020 --> 00:12:35,780
something to consider anytime you're testing

217
00:12:36,500 --> 00:12:38,980
any kind of IoT technology,

218
00:12:39,840 --> 00:12:42,380
you're used to testing it in all the normal conditions.

219
00:12:43,060 --> 00:12:44,720
Well we also get to contest it

220
00:12:44,720 --> 00:12:46,560
in what's considered abnormal conditions.

221
00:12:47,060 --> 00:12:49,340
How does the equipment affect or act

222
00:12:49,340 --> 00:12:51,860
when it loses access to its cloud APIs?

223
00:12:52,400 --> 00:12:54,940
Often the technology, especially home automation,

224
00:12:55,300 --> 00:12:58,180
will go into a local control mode.

225
00:12:58,460 --> 00:13:00,560
Local control mode means there's gonna be

226
00:13:00,560 --> 00:13:02,320
some kind of service exposed locally,

227
00:13:02,580 --> 00:13:04,620
giving it the ability to connect to that device.

228
00:13:04,960 --> 00:13:08,180
Often that is not authenticated or encrypted data.

229
00:13:08,420 --> 00:13:08,960
And with that in mind,

230
00:13:08,980 --> 00:13:09,940
it's the same way in this case.

231
00:13:10,020 --> 00:13:11,940
It actually had port 4000 open.

232
00:13:12,400 --> 00:13:14,460
So we're able to capture all the communication

233
00:13:14,980 --> 00:13:18,060
and decode it and figure out how to control the device.

234
00:13:18,400 --> 00:13:21,860
Now I do have a demo here and I'm not sure

235
00:13:21,860 --> 00:13:23,960
how the whole Wi-Fi stuff's gonna work in here,

236
00:13:24,080 --> 00:13:25,800
so it's liable to go to hell in a hand basket.

237
00:13:27,800 --> 00:13:30,360
But either way, we can talk through it if it fails.

238
00:13:38,220 --> 00:13:39,640
So a little bit of camera here.

239
00:13:39,780 --> 00:13:41,340
So we have a device right here.

240
00:13:42,280 --> 00:13:43,800
And I'm gonna go ahead and plug that in.

241
00:13:43,860 --> 00:13:44,760
Let's see if we can get another,

242
00:13:45,980 --> 00:13:47,980
see if we can double a couple screens up here.

243
00:13:55,500 --> 00:13:56,620
So this will be a little difficult,

244
00:13:56,800 --> 00:13:58,260
but let me see if we can do this.

245
00:14:03,060 --> 00:14:05,200
So a couple interesting things you're gonna see here.

246
00:14:05,320 --> 00:14:06,580
So you see the stuff in the background.

247
00:14:06,780 --> 00:14:08,020
I want you to be able to see the bulb,

248
00:14:08,580 --> 00:14:09,400
things start up.

249
00:14:15,400 --> 00:14:17,860
Okay, cannot, let's fix that.

250
00:14:40,260 --> 00:14:41,060
Okay.

251
00:14:42,620 --> 00:14:44,100
Demo gods, man.

252
00:15:00,360 --> 00:15:16,860
or my device died, one of the two. Well, we'll give it one more try and then we'll start to

253
00:15:18,520 --> 00:15:19,320
verbalize it through it.

254
00:15:43,260 --> 00:15:51,560
Well, unfortunately, apparently my Shikra just died. Life's a bitch, ain't it?

255
00:16:10,200 --> 00:16:30,300
Let's see if this is the right one. Okay. So unfortunately, we can't do that live. What

256
00:16:30,360 --> 00:16:36,320
I was hoping to do was show the one command, actually being able to make the device jump from

257
00:16:36,320 --> 00:16:42,220
one access point to another access point with a command. So it was unauthenticated. But if you

258
00:16:42,220 --> 00:16:46,800
watch this screen, there's a couple of interesting things to point out. This is the UART connection

259
00:16:46,800 --> 00:16:54,040
on the device. So in this case, we don't get a full command shell. We get a small subset of

260
00:16:54,040 --> 00:16:59,140
commands. But if you watch clearly, I'm hoping it will come up. It may not. But you'll see,

261
00:16:59,160 --> 00:17:00,140
there it goes. Don't miss it.

262
00:17:00,360 --> 00:17:06,780
Password, device key, product key. It's actually calling out to China. So it's going out to China

263
00:17:06,780 --> 00:17:11,780
and connecting up. Looking at the data and what was being transferred, my best determination,

264
00:17:12,120 --> 00:17:17,240
which was a good one, was that it was connecting out for validating firmwares. The particular

265
00:17:17,240 --> 00:17:23,520
company that produces the underlying hardware here actually seems to be one of the better ones

266
00:17:23,520 --> 00:17:28,500
I've seen so far from the China perspective. And I couldn't determine it doing anything else.

267
00:17:28,500 --> 00:17:35,140
And couldn't figure out if they were doing anything else. It all seemed to be purely testing and

268
00:17:35,140 --> 00:17:40,280
validating firmwares. So if your firmware was out of date, then it would send commands back via

269
00:17:41,000 --> 00:17:47,620
those APIs to communicate to you to be able to upgrade your systems. So it would flag your system

270
00:17:47,620 --> 00:17:52,380
and you'd start getting alerts to actually upgrade the firmware. And that was determined based on

271
00:17:52,380 --> 00:17:56,780
that information there. But you can see there's a couple subsets. You can identify various ports and

272
00:17:56,780 --> 00:17:58,480
stuff that are actually open on the network. And I'm happy to say that the most likely way to get a

273
00:17:58,500 --> 00:18:12,700
the device. So looking at the hardware to be able to get

274
00:18:12,700 --> 00:18:15,560
access, I mean, any time you open up a piece of hardware, if

275
00:18:15,560 --> 00:18:17,500
you're anything like me, the first thing you look for is where

276
00:18:17,500 --> 00:18:20,960
can I connect in and start looking at it. So we find these

277
00:18:20,960 --> 00:18:26,300
small pads and these are .1 millimeter pitch pads. If you're

278
00:18:26,300 --> 00:18:28,880
an old man like me, trying to solder those are a total bitch.

279
00:18:30,380 --> 00:18:33,920
So you can see how big the connector pins are. It's like I

280
00:18:33,920 --> 00:18:37,180
can't even see that good. So we got them soldered in pretty good

281
00:18:37,180 --> 00:18:42,340
and like I tell everyone, I cheat. I use a microscope, which

282
00:18:42,340 --> 00:18:46,240
works really good. And again, we can tap into those. So we step

283
00:18:46,240 --> 00:18:49,440
back here. This one happened to be, in this case right here,

284
00:18:49,480 --> 00:18:53,540
goes to the main processor on the device and would give us the

285
00:18:53,540 --> 00:18:56,280
UART log dump, as we were seeing there. So we're going to

286
00:18:56,280 --> 00:19:00,160
see what was going on. So you could do various things like if

287
00:19:00,620 --> 00:19:05,300
my card hadn't failed on me for some reason, you'd be able to

288
00:19:05,300 --> 00:19:09,060
actually see the device connect out to the Internet, to the

289
00:19:09,060 --> 00:19:12,280
cloud, get the connection. You would also see how it handled

290
00:19:12,280 --> 00:19:15,720
the command, incoming command, unauthenticated over port 4,000

291
00:19:16,240 --> 00:19:20,260
and try to drop off that one and try to connect out to a third

292
00:19:20,260 --> 00:19:26,260
party or to a different access point for control. So that's

293
00:19:26,280 --> 00:19:28,820
pretty cool. And there's the whole rig with the Sheikra that

294
00:19:28,820 --> 00:19:32,660
apparently just died. I actually have a couple spares, but we'll

295
00:19:32,660 --> 00:19:36,560
see if time, time I can probably swap out. But we'll see. Let's

296
00:19:36,560 --> 00:19:38,840
get through the presentation first and see if anyone has any

297
00:19:38,840 --> 00:19:41,340
questions, because I could easily show this to you offline.

298
00:19:42,340 --> 00:19:45,420
So the next one is the telepresence robot. And these

299
00:19:45,420 --> 00:19:47,700
things are truly freaky if you've ever seen them running

300
00:19:47,700 --> 00:19:49,900
around. Has anyone ever seen these running around in offices?

301
00:19:50,460 --> 00:19:56,260
Yeah, it's pretty, pretty wild, you know. So I met a college professor at a university, and he said,

302
00:19:56,280 --> 00:19:59,000
the first thing he asked me was, Daryl, have you ever seen these

303
00:19:59,000 --> 00:20:02,120
new telepresence robots? So he starts telling me about it. He

304
00:20:02,120 --> 00:20:04,480
says, well, I have one, but it wasn't the full one. He had the

305
00:20:04,480 --> 00:20:08,420
desktop version. So he let me play around with it online and

306
00:20:08,420 --> 00:20:11,520
see how it all worked. So I was talking to some people at Rapid

307
00:20:11,520 --> 00:20:14,940
7 and going, you know, it would be really cool to look at these

308
00:20:14,940 --> 00:20:17,800
things. And someone goes, you know, we like have two or three

309
00:20:17,800 --> 00:20:21,700
of these in the Cambridge office. So instantly I start prodding

310
00:20:21,700 --> 00:20:26,160
people. And they packed one up and shipped it to my house, which

311
00:20:26,280 --> 00:20:29,420
was totally cool. So I got to play with it, run it around the

312
00:20:29,420 --> 00:20:33,620
house. I wrecked it. First time I fired it up, it spun around and

313
00:20:33,620 --> 00:20:36,520
run across my office. It hit a wall and then wrecked. Luckily I

314
00:20:36,520 --> 00:20:38,740
didn't destroy it. I'm thinking, oh, shit, I'm going to send this

315
00:20:38,740 --> 00:20:42,060
thing back in a paper bag. But luckily I sent it back fully

316
00:20:42,060 --> 00:20:47,120
functional. So in the case here, we had a couple things. The point,

317
00:20:47,240 --> 00:20:51,920
the first point is, I didn't cut it open, okay? I, I sat and spent

318
00:20:51,920 --> 00:20:54,900
like three hours trying to figure out how to disassemble this thing.

319
00:20:56,280 --> 00:20:59,180
How to safely do it without pulling the rotating wheels on

320
00:20:59,180 --> 00:21:03,200
it to gain access to the locking bolts. And the last thing I

321
00:21:03,200 --> 00:21:06,700
wanted to do was basically send back in a paper bag a $3,500

322
00:21:06,700 --> 00:21:10,400
product that was actually being used by certain people in the

323
00:21:10,400 --> 00:21:13,480
company. So I didn't really focus on digging into the

324
00:21:13,480 --> 00:21:16,860
hardware and tearing it apart to see what I can get. But I did

325
00:21:16,860 --> 00:21:20,480
look at some other things. I looked at the cloud APIs, the

326
00:21:20,480 --> 00:21:23,220
communication. I looked at whether it handled Bluetooth

327
00:21:23,220 --> 00:21:26,260
pairing properly, those type of things. So I looked at the

328
00:21:26,280 --> 00:21:30,160
first thing. Started looking at the API. Man in the middle, the

329
00:21:30,160 --> 00:21:34,200
connectivity from the head to the cloud. And started looking at

330
00:21:34,200 --> 00:21:37,860
how this thing was communicating. And I instantly found out that

331
00:21:37,860 --> 00:21:41,880
the APIs had no freaking authentication to them. Several

332
00:21:41,880 --> 00:21:46,920
of them, no authentication. So you take this URL right here, and

333
00:21:46,920 --> 00:21:50,760
it has this offset. If I set the offset at some astronomical

334
00:21:50,760 --> 00:21:54,100
number, it would error message back to me. And so that's

335
00:21:54,100 --> 00:21:56,100
invalid. The highest number is this.

336
00:21:58,600 --> 00:22:01,800
So the first thing I did was, you know, I threw that higher

337
00:22:01,800 --> 00:22:04,740
number in there. And I didn't know what the limit was. So I

338
00:22:04,740 --> 00:22:08,060
set it at like 200 or 300. Just curious to see what would come

339
00:22:08,060 --> 00:22:12,800
back. Thinking it would be my data and my data only. No, it

340
00:22:12,800 --> 00:22:17,720
wasn't. It was all data. It was data for every robot that was

341
00:22:18,260 --> 00:22:21,820
functioning that day. This particular data here is live

342
00:22:21,820 --> 00:22:26,240
tracking data of session communication as it happens. On

343
00:22:26,280 --> 00:22:29,380
the particular device. It's all recorded into a database. So

344
00:22:30,120 --> 00:22:33,920
instantly I step back. You know, there's a whole ethical issue at

345
00:22:33,920 --> 00:22:37,300
that point. I'm seeing other people's data. Step back. Had the

346
00:22:37,300 --> 00:22:41,160
right legal conversations. We figured out how to appropriately

347
00:22:41,160 --> 00:22:44,900
narrow it down so I can only look at my data and try to focus

348
00:22:44,900 --> 00:22:46,880
on that. Because that's what we're after. We don't want other

349
00:22:46,880 --> 00:22:49,320
people's data. We want to be able to look at our data and

350
00:22:49,320 --> 00:22:53,920
consider the overall security of it. But if you set this offset

351
00:22:53,920 --> 00:22:56,260
at one and set the limit at a million, you're going to have to

352
00:22:56,280 --> 00:23:01,940
pull down all of the data for every robot since the thing was

353
00:23:01,940 --> 00:23:05,920
put into place. For every robot on the face of the earth. And we

354
00:23:05,920 --> 00:23:09,500
get the session data. The session data wouldn't give me the

355
00:23:09,500 --> 00:23:11,720
ability to take full control because there was two

356
00:23:11,720 --> 00:23:14,720
communication paths. One of them was encrypted and pinned

357
00:23:14,720 --> 00:23:18,280
properly. And I couldn't break the pinning. I don't know what

358
00:23:18,280 --> 00:23:20,740
they were doing weird. But I couldn't get in the middle. It

359
00:23:20,740 --> 00:23:24,640
kept failing and causing the robot to fail. And so that was

360
00:23:24,640 --> 00:23:26,260
the case. So looking at another AP, I'm going to look at the

361
00:23:26,280 --> 00:23:30,320
API here. Very similar. That offset. You can set the number.

362
00:23:30,520 --> 00:23:33,780
This was for every registered robot out there. And it would

363
00:23:33,780 --> 00:23:37,440
return back installation key. But it also returned GPS

364
00:23:37,440 --> 00:23:41,200
coordinates, the name of the device. So literally you could

365
00:23:41,200 --> 00:23:45,120
dump all the data, gain access, GPS coordinates for every robot

366
00:23:45,120 --> 00:23:47,920
that was issued in place functioning on the face of the

367
00:23:47,920 --> 00:23:54,120
earth. The third item that I started to look at was dealing

368
00:23:54,120 --> 00:23:56,080
with what's known as the robot key.

369
00:23:56,280 --> 00:23:59,880
This is the key to the kingdom. This one was a little more

370
00:23:59,880 --> 00:24:05,280
secure. You had to be able to be local enough to man in the

371
00:24:05,280 --> 00:24:08,660
middle of the device, okay? But it turned out that once you

372
00:24:08,660 --> 00:24:12,060
accomplished that, what the robot would do, would send out a

373
00:24:12,060 --> 00:24:15,340
robot key information to the cloud, post it to the cloud. The

374
00:24:15,340 --> 00:24:19,820
cloud would return to you the user name. Now, to start off

375
00:24:19,820 --> 00:24:23,040
with, to make the robot function, the only thing that had

376
00:24:23,040 --> 00:24:26,260
to be returned was the user name. Because it wouldn't

377
00:24:26,280 --> 00:24:29,340
get into a menu system where you can say how many users and add

378
00:24:29,340 --> 00:24:32,480
more users. So the only thing needed was the user name to be

379
00:24:32,480 --> 00:24:36,380
returned. But when you put in the robot key, it returned

380
00:24:36,380 --> 00:24:40,740
driver tokens. Driver tokens are nothing but session tokens

381
00:24:40,740 --> 00:24:45,200
that are assigned to somebody forever. So that means they, if

382
00:24:45,200 --> 00:24:49,860
they load the application on their laptop to be able to

383
00:24:49,860 --> 00:24:52,800
control the robot, they would connect out there. And when

384
00:24:52,800 --> 00:24:56,260
they logged in, this session token, or driver token, would

385
00:24:56,280 --> 00:25:00,640
use for them to remote control the robot. So when you put this

386
00:25:00,640 --> 00:25:04,060
thing out there, robot key to the cloud, no authentication, it

387
00:25:04,060 --> 00:25:07,560
will return all the users and all the robot control keys for

388
00:25:07,560 --> 00:25:11,700
every user. Basically meaning that you could become anybody.

389
00:25:12,200 --> 00:25:16,400
So what I did here was out of curiosity, you know, like, okay,

390
00:25:16,440 --> 00:25:20,240
how can I mimic this? So if I did this, let's say I got the

391
00:25:20,240 --> 00:25:24,340
robot key, I go off over here, I post the robot key, it gives me

392
00:25:24,340 --> 00:25:26,260
the list. I put the application in there, and then I put the

393
00:25:26,280 --> 00:25:29,800
application on my machine. I log on out there, create myself a

394
00:25:29,800 --> 00:25:33,000
count. It would give me an account with no control of a

395
00:25:33,000 --> 00:25:36,300
robot. I would go into my session tokens, drop one of

396
00:25:36,300 --> 00:25:39,460
these in there, and all the robots would show up. At that

397
00:25:39,460 --> 00:25:44,920
point, giving me full control of the robots. So yes, a seriously

398
00:25:44,920 --> 00:25:48,680
bad problem. Again, the customers were very receptive,

399
00:25:48,800 --> 00:25:51,200
the vendor was very receptive to this, and we got these problems

400
00:25:51,200 --> 00:25:54,060
fixed quickly. Now, which is always a plus.

401
00:25:57,700 --> 00:26:01,580
So the next one we want to look at is the BLE dongles. Now, I

402
00:26:01,580 --> 00:26:05,600
looked at, I looked at like four or five of these, you know, the

403
00:26:05,600 --> 00:26:09,060
tile, this one, there's one called Nut, there was another one I was

404
00:26:09,060 --> 00:26:12,380
looking at at that time. And I was curious, and this was driven

405
00:26:12,380 --> 00:26:15,180
very much by the fact that I was seeing these people carrying these

406
00:26:15,180 --> 00:26:17,380
around on their keychains all the time. Every time you turned

407
00:26:17,380 --> 00:26:20,520
around, it's like, oh, they had this weird dongle, whether it was a

408
00:26:20,520 --> 00:26:25,320
silver or a blue one or whatever the brand was. And I started thinking,

409
00:26:26,280 --> 00:26:28,720
what kind of issues would be here? Obviously, I would consider

410
00:26:28,720 --> 00:26:33,420
more of a privacy issue. So it was like unauthenticated access was

411
00:26:33,420 --> 00:26:37,560
identified, weak BLE pairing, which is another common

412
00:26:37,560 --> 00:26:40,520
vulnerability we encounter, information leakage, and

413
00:26:40,520 --> 00:26:46,980
insecure cloud APIs. So what we want to do is actually have one

414
00:26:46,980 --> 00:26:51,900
here. So my goal is, let's see if we can look at this and see, I'm

415
00:26:51,900 --> 00:26:55,220
surprised no one's hacked me yet. So apparently they're not doing

416
00:26:55,220 --> 00:26:56,160
anything good back there.

417
00:26:56,280 --> 00:27:12,000
Let's see what we can do on these. Okay. No devices. There's no

418
00:27:12,000 --> 00:27:21,680
devices because I plugged it in to plug this in. What's that? I can't

419
00:27:21,680 --> 00:27:26,180
hear you. Oh, I'm sorry. Yeah, the purpose of the dongle,

420
00:27:26,820 --> 00:27:31,040
uh, is to be able to find your keys when you lose them. Uh, and the

421
00:27:31,040 --> 00:27:34,360
interesting thing with these devices, they use this thing called

422
00:27:34,360 --> 00:27:38,640
crowd GPSing. And the way that works is when you purchase one of

423
00:27:38,640 --> 00:27:42,380
these things and you set up the application on your phone, if you

424
00:27:42,380 --> 00:27:45,600
lose, if you lose your device and you happen to lose it in the city

425
00:27:45,600 --> 00:27:49,840
park, how the hell you find it? Uh, the way you find it is you look on

426
00:27:49,840 --> 00:27:53,220
your phone and what it'll do is if anyone else running that

427
00:27:53,220 --> 00:27:56,160
application passes within proximity of this, it's going to be able to

428
00:27:56,180 --> 00:28:00,480
send the GPS data out to the cloud showing you where you actually lost

429
00:28:00,480 --> 00:28:04,340
your device, taking advantage of everybody using the same product. And

430
00:28:04,340 --> 00:28:05,480
that's how most of them work.

431
00:28:21,020 --> 00:28:25,040
Not sure how well this will work on the screen here, but we'll see. So,

432
00:28:25,040 --> 00:28:25,340
um,

433
00:28:26,720 --> 00:28:31,340
first thing I want to do is turn Bluetooth on, which may be a mistake.

434
00:28:37,060 --> 00:28:41,380
And so we're going to see a shitload of stuff show up here. All the

435
00:28:41,380 --> 00:28:45,320
people that are either futzing with us are too stupid to turn their

436
00:28:45,320 --> 00:28:56,160
devices off. So, the first thing I want to do is, uh, I'm going to

437
00:28:56,180 --> 00:28:59,940
have this device here and we're going to jump over to another screen now that

438
00:28:59,940 --> 00:29:11,960
that's turned on. Now, I don't know if anyone's ever used NRF Connect. Why

439
00:29:11,960 --> 00:29:15,560
are you doing this? Been installed before?

440
00:29:29,180 --> 00:29:37,960
Shit. What was there was? I didn't see it. Ah, thank you. My hand was over

441
00:29:37,960 --> 00:29:43,840
top of it. So, let's do a scan. And this is going to detect Bluetooth low

442
00:29:43,840 --> 00:29:48,760
energy, which is what this device is using. Let's flush this old data out of

443
00:29:48,760 --> 00:29:56,160
here. So, we can see, uh, you can see all the people at DEF CON that didn't bother to turn the

444
00:29:56,160 --> 00:30:04,060
off Bluetooth low energy. And the shit list goes on and on and on. So, let's see of my device

445
00:30:04,060 --> 00:30:06,120
shows up, and see if I can find it in here.

446
00:30:23,340 --> 00:30:26,140
So, this is the fear anytime you do these in large audiences and and music uh, they

447
00:31:07,540 --> 00:31:08,580
Fuckin' piece of shit.

448
00:31:15,080 --> 00:31:15,840
Let's try again.

449
00:31:35,800 --> 00:31:38,980
There's a tile. You can see the tile. That's one of mine.

450
00:31:50,220 --> 00:31:50,660
Okay.

451
00:31:50,860 --> 00:31:51,520
Let's see.

452
00:31:55,660 --> 00:31:56,100
Okay.

453
00:32:17,640 --> 00:32:19,960
Well, the demo gods are being a total bitch today.

454
00:32:20,880 --> 00:32:22,720
Because I don't even see the device back there.

455
00:32:23,640 --> 00:32:24,080
Okay.

456
00:32:29,200 --> 00:32:29,900
Let's see.

457
00:32:29,900 --> 00:32:30,240
You got time.

458
00:32:54,660 --> 00:32:56,240
Well, we're gonna jump on to something else.

459
00:32:56,920 --> 00:32:58,140
Weston, can you jump up here?

460
00:32:58,220 --> 00:32:59,400
Change the battery out on this.

461
00:33:06,200 --> 00:33:07,720
There's some batteries right there in the top.

462
00:33:07,900 --> 00:33:09,500
And there's a little black hole.

463
00:33:10,400 --> 00:33:11,580
Yeah, it should be right there in the top.

464
00:33:11,620 --> 00:33:13,800
In the case there, there's batteries.

465
00:33:14,980 --> 00:33:16,420
So let's go ahead and move on from here.

466
00:33:16,500 --> 00:33:17,240
Come back to that.

467
00:33:18,200 --> 00:33:19,640
Check to see if it's a battery issue.

468
00:33:24,020 --> 00:33:26,860
So what I was gonna show, maybe we're gonna show it at the end.

469
00:33:27,000 --> 00:33:29,200
So basically, when we fire this device up,

470
00:33:29,200 --> 00:33:31,180
so you understand the risk,

471
00:33:31,360 --> 00:33:35,100
is we can actually see the device out there.

472
00:33:35,140 --> 00:33:36,480
Obviously with Bluetooth low energy.

473
00:33:36,720 --> 00:33:39,860
But in a crowd like this, I wouldn't know who was using that device.

474
00:33:40,220 --> 00:33:42,260
But if we look at the actual device,

475
00:33:42,540 --> 00:33:45,440
the device has a couple things.

476
00:33:45,580 --> 00:33:46,620
It has a tracker ID.

477
00:33:46,940 --> 00:33:49,700
The tracker ID is the company identifier.

478
00:33:50,160 --> 00:33:52,820
It's like at four digit, 0000, whatever it is.

479
00:33:52,940 --> 00:33:54,860
And the MAC address is backwards.

480
00:33:55,160 --> 00:33:57,780
So that's the device identifier on this particular device.

481
00:33:57,780 --> 00:34:01,760
Also, it doesn't have Bluetooth, BLE pairing properly.

482
00:34:02,120 --> 00:34:05,060
So I can pair with the device and set the alarm off remotely.

483
00:34:05,600 --> 00:34:08,760
So if you're in an audience and you identify someone using

484
00:34:08,760 --> 00:34:11,780
one of these tracker devices, Bravo devices,

485
00:34:12,120 --> 00:34:13,840
you can set the alarm off,

486
00:34:13,980 --> 00:34:15,680
and now you know who the person is.

487
00:34:15,800 --> 00:34:18,840
Because you look for that poor soul trying not to look stupid

488
00:34:18,840 --> 00:34:21,920
as they try to figure out why their damn dongle is buzzing

489
00:34:21,920 --> 00:34:23,480
and making a loud noise.

490
00:34:24,480 --> 00:34:26,840
To go beyond that, we move from there

491
00:34:26,840 --> 00:34:29,480
and started looking at the cloud APIs.

492
00:34:30,080 --> 00:34:33,340
And it turned out that if we go out to the cloud API,

493
00:34:33,920 --> 00:34:37,040
unauthenticated, and pass that identifier out there,

494
00:34:37,180 --> 00:34:39,860
we could get GPS coordinates of the user.

495
00:34:40,400 --> 00:34:43,520
So now, not only can I identify who's in the audience

496
00:34:43,520 --> 00:34:44,800
with one of those devices,

497
00:34:45,080 --> 00:34:48,180
I can proceed to track them at this point wherever they go.

498
00:34:50,000 --> 00:34:52,100
I don't know about you, but to me,

499
00:34:52,140 --> 00:34:56,000
that's somewhat of a serious issue.

500
00:34:56,000 --> 00:34:59,600
Now again, I've had this conversation with media

501
00:34:59,600 --> 00:35:00,560
and stuff like that.

502
00:35:00,740 --> 00:35:03,400
We also got to put some kind of true risk behind it.

503
00:35:03,660 --> 00:35:07,800
If you're most of us and you have this device,

504
00:35:08,060 --> 00:35:09,980
that risk would not be that big.

505
00:35:10,160 --> 00:35:11,440
Who wants to track me?

506
00:35:12,260 --> 00:35:15,240
So it only becomes an issue if you're somebody important.

507
00:35:15,720 --> 00:35:19,260
You're a politician, a movie star, something like that.

508
00:35:19,480 --> 00:35:21,700
Then it probably would have been a really bad idea.

509
00:35:22,340 --> 00:35:25,000
Or you have somebody that's a known stalker.

510
00:35:25,000 --> 00:35:27,300
Then it becomes more of an issue.

511
00:35:27,500 --> 00:35:30,920
But generally, I don't consider it the most critical issue,

512
00:35:31,040 --> 00:35:32,360
but something that needs to be resolved.

513
00:35:32,680 --> 00:35:35,320
The vendor quickly resolved this issue right here.

514
00:35:35,620 --> 00:35:39,480
Now you have to be authenticated to be able to gain access to that.

515
00:35:39,520 --> 00:35:40,880
You can't read that particular data.

516
00:35:41,100 --> 00:35:42,640
I actually think in this case here,

517
00:35:42,800 --> 00:35:47,100
they took that particular access to that API functionality

518
00:35:47,100 --> 00:35:50,800
out of the system, so it is no longer viewable.

519
00:35:51,140 --> 00:35:52,320
So you changed the battery on it?

520
00:35:52,600 --> 00:35:53,120
Yeah.

521
00:35:53,560 --> 00:35:54,080
Okay.

522
00:36:12,400 --> 00:36:13,540
We'll look for it one more time.

523
00:36:13,640 --> 00:36:15,040
If it's not there, then there it is.

524
00:36:17,020 --> 00:36:18,540
So we can pair with the device.

525
00:36:24,000 --> 00:36:26,960
A lot of times, these type of connectivities and communications

526
00:36:26,960 --> 00:36:30,220
get messed up just based on the amount of Wi-Fi that's in the air.

527
00:36:30,560 --> 00:36:33,360
So, I mean, it's still trying to pair with the device.

528
00:36:39,400 --> 00:36:41,660
So you go to a quiet room, this works every time.

529
00:36:42,700 --> 00:36:45,760
I'm surprised any of this technology works with as many devices

530
00:36:45,760 --> 00:36:47,020
that are out there with all the noise.

531
00:36:50,860 --> 00:36:53,240
So that's thinking about pairing with it.

532
00:36:53,560 --> 00:36:55,040
So we're going to actually move on.

533
00:36:55,360 --> 00:37:03,640
So the next device, this is a panic button, okay?

534
00:37:05,220 --> 00:37:10,780
So the story goes, actual Associated Press came to us and goes,

535
00:37:11,000 --> 00:37:13,740
the Colombian government, South America,

536
00:37:14,560 --> 00:37:16,920
has recommended that we purchase these,

537
00:37:16,920 --> 00:37:20,960
these batteries for protection from being kidnapped, okay?

538
00:37:21,160 --> 00:37:24,660
And we really wonder, is this a good solution?

539
00:37:24,840 --> 00:37:27,800
Is this a secure solution for moving forward?

540
00:37:28,240 --> 00:37:30,640
So very interesting project.

541
00:37:30,800 --> 00:37:34,260
So it's like, let's go ahead and take a look at it and see what's there.

542
00:37:34,440 --> 00:37:37,600
I mean, we found a number of issues, literally just a poor design,

543
00:37:38,200 --> 00:37:42,980
non-SSL communication, some balance check problems within the functionality,

544
00:37:43,660 --> 00:37:46,680
and some real-time web server failures.

545
00:37:47,300 --> 00:37:48,360
So let's look at this.

546
00:37:48,480 --> 00:37:51,920
Let's start with the first total failure of the product.

547
00:37:52,260 --> 00:37:54,780
I didn't even have to open it up, I just opened up the manual.

548
00:37:55,140 --> 00:37:57,680
So we opened up the manual and we found out this thing,

549
00:37:57,760 --> 00:38:01,680
the way this device works, it's configured and controlled via SMS messages.

550
00:38:02,220 --> 00:38:05,620
So you can set a password on this device, a pass pin number,

551
00:38:05,820 --> 00:38:08,540
that would add some level of security against the device

552
00:38:08,540 --> 00:38:11,780
from someone able to get your GPS coordinates and mess with the device,

553
00:38:12,320 --> 00:38:13,720
except for one command.

554
00:38:13,900 --> 00:38:16,720
There's one command you do not have to have,

555
00:38:16,920 --> 00:38:19,060
a passcode to gain access once it's configured.

556
00:38:19,540 --> 00:38:20,400
Guess which one?

557
00:38:20,620 --> 00:38:22,040
It's the reset command.

558
00:38:23,680 --> 00:38:27,180
Reset the device back to factory level.

559
00:38:27,560 --> 00:38:31,220
So basically, you press the button, it ain't calling nobody.

560
00:38:31,720 --> 00:38:37,380
And I can still send an SMS message to you because now there's no password,

561
00:38:37,640 --> 00:38:40,440
and it's going to send back to me your GPS coordinates.

562
00:38:41,100 --> 00:38:45,660
Now if I'm in fear of being kidnapped, that just went to hell in a handbasket real quick.

563
00:38:46,920 --> 00:38:50,260
So that was a vulnerability before we even opened the device up.

564
00:38:50,600 --> 00:38:53,780
One other command they said didn't need a password was reboot.

565
00:38:54,680 --> 00:38:55,800
That was not true.

566
00:38:56,000 --> 00:38:59,840
Reboot would not work unless the passcode was actually put on the device.

567
00:39:00,660 --> 00:39:04,180
But we did find some use for a version of the reboot.

568
00:39:04,820 --> 00:39:08,420
Well, it turned out that this particular command,

569
00:39:08,640 --> 00:39:12,820
reboot all capital, explanation point, was an undocumented command.

570
00:39:13,160 --> 00:39:15,780
We pulled the firmware off the device and I went through the firmware,

571
00:39:15,780 --> 00:39:17,460
and that's where I found that out.

572
00:39:18,000 --> 00:39:21,460
The interesting thing with that was, well, anything,

573
00:39:21,720 --> 00:39:25,980
anytime you send an SMS message to this thing and there is a password set on it,

574
00:39:26,020 --> 00:39:27,440
you get no results back.

575
00:39:28,000 --> 00:39:32,440
So my theory was, is there any way to war dial this thing,

576
00:39:32,560 --> 00:39:34,540
war SMS message this thing?

577
00:39:34,720 --> 00:39:38,360
So we found out with the reboot, it would return a format error.

578
00:39:39,420 --> 00:39:44,980
So instantly, if I know all the reporters probably bought their phone from this location

579
00:39:44,980 --> 00:39:49,200
and they're in this city here, and I wanted to gain access to the device

580
00:39:49,200 --> 00:39:50,660
or figure out who had devices,

581
00:39:50,940 --> 00:39:55,980
how hard would it be just to basically send an SMS message to every one of the phones

582
00:39:55,980 --> 00:39:58,380
and then wait for the response back?

583
00:39:58,580 --> 00:40:00,940
And if I receive a format error response back,

584
00:40:01,220 --> 00:40:04,120
the odds are pretty high it's going to be one of these devices,

585
00:40:04,420 --> 00:40:09,240
giving us the ability to basically do kind of a war dial type of tack on the device.

586
00:40:10,240 --> 00:40:13,460
Moving from there, we also found some bounds check issues.

587
00:40:14,240 --> 00:40:14,960
Didn't find any.

588
00:40:14,980 --> 00:40:18,600
We found an effective way to exploit these,

589
00:40:18,800 --> 00:40:20,720
but it was still something to make note of.

590
00:40:20,960 --> 00:40:24,200
It turns out when you set up a command, when you set up the phone numbers,

591
00:40:24,320 --> 00:40:26,540
there's three phone numbers you can set up on this device.

592
00:40:26,920 --> 00:40:29,880
And you use A and then the phone number, B and the phone number,

593
00:40:29,920 --> 00:40:31,060
and then C and the phone number.

594
00:40:31,380 --> 00:40:37,060
We found out that if you actually put more characters than what's in the phone number,

595
00:40:37,200 --> 00:40:44,120
it would actually overwrite a segment of the configuration on the actual flash device.

596
00:40:44,120 --> 00:40:47,400
Now, I didn't do this to all of the commands.

597
00:40:47,840 --> 00:40:50,300
The first time I did this, I did it to one command

598
00:40:50,300 --> 00:40:54,100
and basically had to reboot the device like a dozen times

599
00:40:54,100 --> 00:40:59,080
and then send a reset message to it to get it to even freaking work right properly after that.

600
00:40:59,200 --> 00:41:01,580
So I never did quite figure out what I overwrote,

601
00:41:01,600 --> 00:41:03,540
but apparently I overwrote something I shouldn't have.

602
00:41:04,020 --> 00:41:05,860
But as an example, you can see here,

603
00:41:06,000 --> 00:41:12,240
we send this command to set up the SMS message to set up the first phone number,

604
00:41:12,240 --> 00:41:15,160
and we end up overwriting the second one, B,

605
00:41:15,360 --> 00:41:16,980
and you see all the A's show up in B,

606
00:41:17,140 --> 00:41:18,820
showing we're able to overwrite that.

607
00:41:19,060 --> 00:41:20,300
Now, there's a whole bunch of commands,

608
00:41:20,480 --> 00:41:24,060
and I went into the flash and I mapped out the structure on the flash

609
00:41:24,060 --> 00:41:27,940
trying to find out if there was a possible way to overwrite some of the code.

610
00:41:28,740 --> 00:41:32,460
And I didn't initially find that, so I don't think there was.

611
00:41:33,300 --> 00:41:37,520
It was getting pretty close to it in the flash to overwrite the actual firmware,

612
00:41:37,680 --> 00:41:39,060
but it didn't quite hit it.

613
00:41:40,600 --> 00:41:45,700
The other thing was, and this was the actual web services,

614
00:41:45,880 --> 00:41:47,060
and this was like totally bad.

615
00:41:47,400 --> 00:41:53,000
So without any authentication, you can actually punch in the user IDs,

616
00:41:53,980 --> 00:41:58,640
and this would return the phone's EMEI number,

617
00:41:59,440 --> 00:42:04,120
which you could use later on to take over the device via the web application.

618
00:42:04,640 --> 00:42:06,740
So all you had to do was start at 1

619
00:42:06,740 --> 00:42:08,960
and increment up over the 66,

620
00:42:09,060 --> 00:42:09,940
70, 80,000,

621
00:42:10,020 --> 00:42:16,220
and basically gain access to all the identifier numbers for the actual devices.

622
00:42:18,980 --> 00:42:24,200
Another attack we were actually able to do using that EMEI number

623
00:42:24,200 --> 00:42:27,200
is you could actually poison the GPS data online.

624
00:42:28,080 --> 00:42:31,960
So literally once you got that EMEI number,

625
00:42:32,100 --> 00:42:35,880
you could make the device look like it was anywhere else on the face of the earth you want.

626
00:42:36,080 --> 00:42:37,280
So of course I did.

627
00:42:37,280 --> 00:42:39,860
So I live in Dayton, Ohio,

628
00:42:40,120 --> 00:42:42,900
and instantly my device decided it was going to jump to Moscow.

629
00:42:43,340 --> 00:42:45,000
So we were actually able to poison it.

630
00:42:45,020 --> 00:42:47,320
And that went over, I'm trying to think of the port it went over,

631
00:42:47,420 --> 00:42:50,260
2050 I think was the port that was actually open,

632
00:42:50,340 --> 00:42:51,660
completely open in the cloud,

633
00:42:51,880 --> 00:42:53,560
sent all the data you want to it.

634
00:42:54,740 --> 00:42:56,540
Another potential attack point,

635
00:42:56,740 --> 00:43:02,100
you know, what happens if I decide to send a number that's 40,000 characters long?

636
00:43:02,620 --> 00:43:04,580
I did not own the web server,

637
00:43:04,640 --> 00:43:07,040
nor was I doing vulnerability testing for the web server.

638
00:43:07,040 --> 00:43:11,200
So in that case I was only able to focus on my particular data

639
00:43:11,200 --> 00:43:12,900
and the impact on my data.

640
00:43:13,280 --> 00:43:17,460
But again, you're able to actually gain a level of access to that data,

641
00:43:17,540 --> 00:43:19,180
which I thought was pretty cool.

642
00:43:19,400 --> 00:43:23,840
So let's check over here and see if the tracker device paired.

643
00:43:26,680 --> 00:43:27,720
And it did not.

644
00:43:32,280 --> 00:43:32,840
Okay.

645
00:43:33,740 --> 00:43:35,320
It says it's pairing now.

646
00:43:37,880 --> 00:43:39,340
Okay, that time it paired.

647
00:43:40,520 --> 00:43:42,760
Apparently it didn't like me clicking on it last time.

648
00:43:49,480 --> 00:43:50,360
No, wrong one.

649
00:43:52,740 --> 00:43:54,780
So we actually were able to pair with the device.

650
00:43:55,120 --> 00:43:59,160
Now let's see if we're lucky enough to actually find it out there in NRF Connect.

651
00:44:20,140 --> 00:44:21,080
Okay, here it is.

652
00:44:28,940 --> 00:44:32,520
Okay, so now we can see there's a number of services on this particular device.

653
00:44:33,200 --> 00:44:35,840
And we can come down here and based on the previous screen,

654
00:44:35,840 --> 00:44:38,720
or you can see it at the top, unfortunately you can't,

655
00:44:38,720 --> 00:44:39,960
you can see the identifier.

656
00:44:40,360 --> 00:44:42,180
So we'll drop back to the other screen.

657
00:44:42,340 --> 00:44:46,320
From here you can easily just jump on alert, go alert,

658
00:44:47,880 --> 00:44:49,300
select it to high alert.

659
00:44:49,620 --> 00:44:52,160
Let's see if this demo fails like hell, Tim.

660
00:44:58,160 --> 00:44:59,500
I hope you can hear that.

661
00:44:59,560 --> 00:45:00,280
It's kind of high frequency.

662
00:45:01,400 --> 00:45:04,780
So you can see without any level of authentication,

663
00:45:04,780 --> 00:45:07,140
we can pair to the device that somebody's carrying.

664
00:45:07,460 --> 00:45:11,020
And we can do, generally what's taking place is a DOS.

665
00:45:11,340 --> 00:45:14,800
This battery ain't going to last long with it screaming like this.

666
00:45:15,080 --> 00:45:18,000
And I assure you the person's going to be digging through their stuff.

667
00:45:18,220 --> 00:45:19,140
This room's a little noisy.

668
00:45:19,400 --> 00:45:23,760
But in most places, coffee shops, they're actually going to notice this fairly quick.

669
00:45:32,280 --> 00:45:33,840
There, turn the alarm off.

670
00:45:34,920 --> 00:45:36,480
So let's come back here.

671
00:45:48,220 --> 00:45:51,280
Okay, if we come down here to this device, let me see.

672
00:45:54,120 --> 00:45:54,900
Ours is already there.

673
00:45:55,020 --> 00:45:55,540
Don't do that.

674
00:45:59,900 --> 00:46:00,260
Okay.

675
00:46:00,720 --> 00:46:03,660
So we can quickly see in here, well, I can see.

676
00:46:03,720 --> 00:46:04,520
I'm not sure if you can.

677
00:46:04,780 --> 00:46:05,740
I was hoping to have bigger screens.

678
00:46:06,020 --> 00:46:07,880
But we can see the tracker ID here.

679
00:46:08,300 --> 00:46:11,520
So we have the four digits, 000, company identifier.

680
00:46:11,980 --> 00:46:13,900
And then we have this identifier here.

681
00:46:14,500 --> 00:46:15,880
And this is the MAC address.

682
00:46:16,240 --> 00:46:19,180
So if you just reverse the MAC address, you have the tracker identifier.

683
00:46:19,860 --> 00:46:25,260
And it gave us the ability to, at that point, once we have identified somebody with the device,

684
00:46:25,340 --> 00:46:27,740
to continue tracking them as long as they own that device.

685
00:46:28,420 --> 00:46:32,060
And at bare minimum, you're going to be able to track them to their home if you want to know where they're living.

686
00:46:32,160 --> 00:46:34,720
So a serious breach of privacy.

687
00:46:34,720 --> 00:46:37,040
A potential serious breach of privacy.

688
00:46:37,780 --> 00:46:39,600
Which I think is pretty serious.

689
00:46:42,300 --> 00:46:46,440
And I think this is closing in on the end of the presentation.

690
00:46:47,120 --> 00:46:48,540
There's my contact information.

691
00:46:48,940 --> 00:46:50,040
Please reach out to me.

692
00:46:50,160 --> 00:46:51,360
I'm always working on new stuff.

693
00:46:51,720 --> 00:46:54,120
I'm always looking for feedback, knowledge.

694
00:46:54,700 --> 00:46:59,280
You know, I think in this field, we're all kind of expanding and growing and learning new stuff.

695
00:47:00,120 --> 00:47:02,200
I've been doing some really cool stuff lately.

696
00:47:02,800 --> 00:47:04,540
Had some cool stuff coming out.

697
00:47:04,720 --> 00:47:05,740
Probably in the next couple months.

698
00:47:05,860 --> 00:47:07,400
I would say super great.

699
00:47:07,480 --> 00:47:13,360
But some interesting, again, similar findings that really impact the overall security of some of these products.

700
00:47:13,880 --> 00:47:16,540
Also some RF stuff we're messing with.

701
00:47:17,880 --> 00:47:24,740
And been doing a lot of stuff with actually data recovery off IoT devices.

702
00:47:26,240 --> 00:47:31,420
From being able to go in and pull the right chips and the right equipment and reading chips.

703
00:47:31,660 --> 00:47:33,380
And doing some BGA.

704
00:47:33,380 --> 00:47:36,260
And working on some BGA reballing techniques right now.

705
00:47:36,360 --> 00:47:37,260
Which is kind of exciting.

706
00:47:37,860 --> 00:47:42,280
Because every time I tear a device apart, the last thing I want to do is throw it in a dumpster.

707
00:47:42,500 --> 00:47:43,660
I want to rebuild it.

708
00:47:44,040 --> 00:47:47,620
And so far I'm pretty good at taking a device completely apart.

709
00:47:47,740 --> 00:47:48,380
Pulling the chip.

710
00:47:48,460 --> 00:47:49,160
Pulling what I need.

711
00:47:49,240 --> 00:47:50,700
And putting the devices back into place.

712
00:47:51,020 --> 00:47:52,800
But that's kind of the stuff I'm working on.

713
00:47:52,900 --> 00:47:54,220
Always looking for new ideas.

714
00:47:54,880 --> 00:47:55,680
New friends.

715
00:47:56,220 --> 00:47:57,460
So any questions?

716
00:48:01,540 --> 00:48:02,340
I guess not.

717
00:48:02,340 --> 00:48:03,260
Well, I'll be around.

718
00:48:03,860 --> 00:48:06,580
Please feel free to grab me if you have any questions.

719
00:48:06,740 --> 00:48:07,380
You want to talk.

720
00:48:08,800 --> 00:48:12,380
Again, thanks to the demo gods and my card dying on me.