1 00:00:00,000 --> 00:00:02,760 I really, really appreciate and grateful for being here. 2 00:00:02,760 --> 00:00:08,360 So thank you a lot for DEF CON, for DEF CON Heritage Village, SentinelOne, and everyone that supported me along the way. 3 00:00:08,400 --> 00:00:10,360 We'll speak about it also soon. 4 00:00:10,360 --> 00:00:13,340 Let's start with the title. 5 00:00:13,380 --> 00:00:15,580 So , Hacking Smart Devices for Fun and Profit. 6 00:00:15,580 --> 00:00:27,520 This is a true and genuine story about me trying from exploiting my smart home into gaining control over thousands of smart devices in the entire world. 7 00:00:27,520 --> 00:00:28,900 So, let's start. 8 00:00:28,900 --> 00:00:30,840 So, first about me. 9 00:00:31,180 --> 00:00:33,040 My name is Barak Sternberg. 10 00:00:33,040 --> 00:00:35,700 I also live in DEF in Twitter, so make sure to follow. 11 00:00:35,700 --> 00:00:40,140 I'm a security researcher and also an author in SentinelOne Labs. 12 00:00:40,360 --> 00:00:43,820 I have a master's in computer science on algorithms. 13 00:00:44,280 --> 00:00:49,980 And one of the favorite things I love to mention is that I'm also a party lover and a DJ. 14 00:00:49,980 --> 00:00:55,720 So, you can make sure you follow my Mixcloud to see my set and stuff. 15 00:00:55,720 --> 00:01:03,620 But besides following our party, which is not so relevant in the corona period, I love to focus on vulnerability research. 16 00:01:03,620 --> 00:01:05,080 I love computer security. 17 00:01:05,080 --> 00:01:12,040 I'm an enthusiast about network security, IoT, embedded devices, Linux, web apps, and more and more. 18 00:01:12,040 --> 00:01:14,920 And also to analyzing malwares in the wild. 19 00:01:14,920 --> 00:01:22,020 I'm a CTF player and I love a good game of hacking any kind of devices. 20 00:01:22,020 --> 00:01:25,080 So, with this in mind, let's start. 21 00:01:25,080 --> 00:01:31,180 So, starting this project goes quite well, well, way back. 22 00:01:31,180 --> 00:01:34,700 And when I say way back, I mean really back, 2010. 23 00:01:35,000 --> 00:01:36,580 What happened in 2010? 24 00:01:36,580 --> 00:01:40,320 So, first, we are renovating our family home. 25 00:01:40,320 --> 00:01:42,420 We are fixing all this home. 26 00:01:42,420 --> 00:01:47,720 The second most important thing was the Walking Dead first season was just coming up. 27 00:01:47,800 --> 00:01:54,400 The first season, just to keep in mind, today it's the 10th season already, I think, of the Walking Dead. 28 00:01:54,400 --> 00:01:55,320 And it's kept counting. 29 00:01:55,320 --> 00:01:56,260 Amazing series. 30 00:01:56,260 --> 00:01:57,140 Much watched. 31 00:01:57,140 --> 00:01:58,600 Must watch one. 32 00:01:59,240 --> 00:02:04,280 And, well, we installed smart home devices, which were the Philips Dynalite. 33 00:02:04,280 --> 00:02:08,960 And the Philips Dynalite have software and apps, but they were really, really expensive. 34 00:02:09,160 --> 00:02:12,260 Back then, it was really high extras. 35 00:02:12,260 --> 00:02:13,320 And we didn't buy it. 36 00:02:13,320 --> 00:02:22,420 Just the technician came, installed the softwares and apps to itself, to configure all of our devices, all of our smart home systems. 37 00:02:22,420 --> 00:02:27,660 And from there on, we didn't have anything to control it. 38 00:02:27,660 --> 00:02:32,840 So, you can say it's a smart home device, but not quite, really. 39 00:02:34,020 --> 00:02:37,220 And so, we don't have any remote app control. 40 00:02:37,280 --> 00:02:47,420 And usually, in these scenarios, we can think about ourselves as, well, our own technicians that can do it by ourselves, right? 41 00:02:47,420 --> 00:02:49,680 So, why not do it ourselves? 42 00:02:49,680 --> 00:02:53,280 So, this scary diagram is not that scary. 43 00:02:53,280 --> 00:03:03,680 What you see here is actually the Philips Dynalite controllers that control my smart home devices in my parents' home. 44 00:03:03,680 --> 00:03:06,300 These actually have been the controllers themselves. 45 00:03:06,300 --> 00:03:14,150 So, as you can see here, this one is the full electricity diagram downloaded freely from the Philips site. 46 00:03:14,580 --> 00:03:19,580 And the interesting thing you can observe here is that, well, each controller controls something. 47 00:03:19,580 --> 00:03:24,100 Controller-specific maybe lights have specific capabilities and attributes. 48 00:03:24,100 --> 00:03:37,260 So, this electricity diagram have on this side the channels, which are directly connected usually to the relays, to the dimmers, to the buttons, to anything. 49 00:03:37,260 --> 00:03:50,720 For example, this channel, channel one, have powered out electricity to your lights, your light bulb, or maybe to a window, or maybe to a large light system, or anything else. 50 00:03:50,720 --> 00:03:54,580 So, this is on these sides, and this is the relay, the switch on and off stuff. 51 00:03:54,640 --> 00:03:58,240 And on the other side, they are connected, as you can see here, the microprocessor. 52 00:03:58,340 --> 00:03:59,780 This is the microprocessor. 53 00:03:59,960 --> 00:04:09,860 And this microprocessor is very cool because it's the thing that connects between the electricity circuits here and the serial, which is here. 54 00:04:09,860 --> 00:04:17,580 So, on its other end, there is a serial output, you can obviously understand it might be the controlling area. 55 00:04:17,580 --> 00:04:24,160 So, when I connect to these devices to configure them, I usually use this serial interface. 56 00:04:24,160 --> 00:04:30,900 And this uses something that's called Dynet protocol of the Dynalite Philips systems. 57 00:04:30,900 --> 00:04:31,920 And it's really cool. 58 00:04:31,920 --> 00:04:48,460 It's connected by RS-485, which is really, it's not that unique, in the sense that many industrial systems are actually using this kind of type of serials compared to the usual serial RS-2322. 59 00:04:49,480 --> 00:04:57,440 And also, what you can understand is that this serial is connected to this building block, which is, what is that? 60 00:04:57,440 --> 00:05:01,160 So , this is, I bought actually an IP serial adapter. 61 00:05:01,820 --> 00:05:10,040 And this is a cool serial adapter that is used to connect all up between the serial and the IP. 62 00:05:10,680 --> 00:05:16,360 And I am sitting here gently and trying to wait for something to happen, right? 63 00:05:16,360 --> 00:05:19,760 Sending commands maybe, seeing something, I don't know. 64 00:05:19,920 --> 00:05:24,040 So, what happened next is that I tried to send codes to these controllers. 65 00:05:24,280 --> 00:05:27,220 I'm sending codes to these controllers and nothing happened. 66 00:05:27,220 --> 00:05:27,740 Nothing. 67 00:05:27,740 --> 00:05:31,120 I use this wonderful GitHub repo, which is not complete. 68 00:05:31,120 --> 00:05:37,860 It has some several API documentations of Dynet-01, but it's not exactly the Dynet I needed. 69 00:05:38,820 --> 00:05:40,420 It's really weird. 70 00:05:40,420 --> 00:05:44,420 And also, the packets. 71 00:05:44,420 --> 00:05:52,180 So, I could have observed the type of the packets used to be sent to Dynet. 72 00:05:52,180 --> 00:06:04,200 The packets usually are in the structure of sync number, an area code, a command type, and some extra data to navigate between the different possibilities. 73 00:06:04,200 --> 00:06:14,240 For example, I want the light to be in 100% or 50% percentage of light. 74 00:06:14,400 --> 00:06:20,120 So, I can put this stuff in the extra data area, which is right here. 75 00:06:20,120 --> 00:06:26,840 So, this is a packet used to be sent over a serial connection, as I've seen before, as we have seen before. 76 00:06:27,040 --> 00:06:28,360 And this is really cool. 77 00:06:28,360 --> 00:06:31,500 So, I start sending packets, nothing happens. 78 00:06:31,500 --> 00:06:38,480 And I remember me and my father sitting in the saloon, and like, why not send in all the packets? 79 00:06:38,480 --> 00:06:42,380 And when I mean all the packets, let's just send, let's just fuzz the system, right? 80 00:06:42,380 --> 00:06:43,860 What could happen, right? 81 00:06:43,860 --> 00:06:47,620 Sending all opcodes to the controllers could be an amazing thing to do, no? 82 00:06:47,880 --> 00:06:49,060 Really, all. 83 00:06:49,060 --> 00:06:52,920 Like, in four, I exchange 256. 84 00:06:54,480 --> 00:07:03,220 And it wasn't a surprise that, yeah, maybe you laugh right now, but it's actually a real thing. 85 00:07:03,220 --> 00:07:06,940 It's a house that people live in that went crazy. 86 00:07:06,980 --> 00:07:18,420 So, we send all of these commands, and all of a sudden, I remember myself sitting in the kitchen, and all the lights are flipping crazy, windows turning on and off at the same time, and we don't know what is happening. 87 00:07:18,480 --> 00:07:24,740 And, well, try to remember which command you're sending, this fuzzing loop that tried to fuzz all these commands. 88 00:07:24,740 --> 00:07:30,780 So, I did try to fix it to my responsibility, of course. 89 00:07:30,780 --> 00:07:33,020 And I tried to fix it. 90 00:07:33,020 --> 00:07:35,020 And I tried to reverse these commands. 91 00:07:35,020 --> 00:07:36,220 And some of them have been fixed. 92 00:07:36,220 --> 00:07:48,900 But remember, these commands, not just for turning on and off the lights, it also controls the configuration, the main configuration of the lights, and the buttons, and everything you can think about. 93 00:07:48,900 --> 00:07:50,460 So, this is insane. 94 00:07:50,460 --> 00:07:53,780 And, well, I tried to fix it. 95 00:07:54,980 --> 00:08:07,880 And, yeah, and all of a sudden, 6 a.m., I got this message from my mom sending me that, well, I hope you guys have fun the other day, because I woke up 6 a.m. 96 00:08:07,880 --> 00:08:11,220 because all the lights were turning on at the same time. 97 00:08:11,300 --> 00:08:20,920 At this point, we've come to a small conclusion that, well, the first one is that Barak is not touching, again, the smartphone devices. 98 00:08:20,920 --> 00:08:22,380 We'll see about that later. 99 00:08:22,380 --> 00:08:33,400 But the second one is that, well, we need to install new smartphone devices, because until we do that, we don't actually have lights, and powers, and electricity for some things. 100 00:08:33,480 --> 00:08:36,400 So, yeah, okay, new smartphone devices. 101 00:08:36,400 --> 00:08:39,020 And I was excited, because for me, it's another research to do. 102 00:08:39,020 --> 00:08:42,860 They didn't know that yet, but for me, it's a whole nother research. 103 00:08:43,040 --> 00:08:44,440 Okay, so let's continue. 104 00:08:46,340 --> 00:08:50,160 So, the new smartphone devices is the HDL automation devices. 105 00:08:50,400 --> 00:08:56,920 And by HDL automation devices, I actually mean a company which is called HDL Automation. 106 00:08:56,980 --> 00:09:00,360 And this company is a big company, an amazing one, actually. 107 00:09:00,620 --> 00:09:12,060 I must say to them, thank you, because they helped me a lot through the disclosure, and working with them, and they really consider the security highly in this manner and respect. 108 00:09:12,160 --> 00:09:25,560 And also, they have more than 10,000 projects around the globe, museums, buildings, hotels, and headquarters of some high priority companies, and stuff like that, using their systems. 109 00:09:25,600 --> 00:09:28,420 So, even airports, if I didn't say that. 110 00:09:28,420 --> 00:09:31,960 So, it's really, really interesting to investigate these controllers, right? 111 00:09:31,960 --> 00:09:39,720 And they have smart controllers for lights, windows, cameras, a sensor, anything, anything you even didn't think about it. 112 00:09:39,800 --> 00:09:40,760 Cool. 113 00:09:41,360 --> 00:09:51,560 So, we learned about the HDL automation, and we've installed in our family home the HDL smart home devices. 114 00:09:51,560 --> 00:09:54,420 Let's now see how the HDL smart home works. 115 00:09:54,620 --> 00:09:55,380 Sorry. 116 00:09:55,380 --> 00:10:00,020 So, the HDL smart home system have three basic components. 117 00:10:00,040 --> 00:10:03,640 The first component is the HDL demo relay modules. 118 00:10:03,640 --> 00:10:07,560 This is the modules which you can observe just right here. 119 00:10:07,560 --> 00:10:28,900 These modules have on the one direction outside the serial, exactly kind of the same serial you've seen in the Philips Dynalite systems, with RS-485 connections, which they call BusPro, of course, because, for example, this BusPro is the complete analogy of the Dynet. 120 00:10:28,900 --> 00:10:36,740 So, this is like the protocols upside on the upper side of the serial connection. 121 00:10:36,760 --> 00:10:37,160 Cool. 122 00:10:37,160 --> 00:10:39,320 And this is connected to the IP gateway. 123 00:10:39,320 --> 00:10:51,000 And the IP gateway is actually kind of the same as I built an IP gateway to adapt between the serial and the IP connection, from the serial to the internet, to the entire world. 124 00:10:51,000 --> 00:10:53,560 So, they have their own smart devices. 125 00:10:53,560 --> 00:10:56,240 They have their own unique IP adapter as well. 126 00:10:56,240 --> 00:10:59,260 Also, Philips have it, but it was really, really expensive. 127 00:10:59,260 --> 00:11:02,380 This is why I didn't bought it also in the second time. 128 00:11:02,380 --> 00:11:07,280 But in our scenario, my parents thought, okay, it's a good idea. 129 00:11:07,280 --> 00:11:08,920 Let's buy all the things. 130 00:11:08,920 --> 00:11:15,620 And Barack doesn't even have an idea to start and jiggering with this kind of things. 131 00:11:15,620 --> 00:11:17,140 Oh, boy, they were wrong. 132 00:11:17,140 --> 00:11:21,000 And this IP gateway is serial to IP. 133 00:11:21,000 --> 00:11:24,920 And the third bullet was the HDL cloud servers. 134 00:11:24,920 --> 00:11:32,000 The HDL cloud servers are actually used mainly for remote connections, but not just remote connections. 135 00:11:32,000 --> 00:11:35,160 They're used to store the configuration for the smart home devices. 136 00:11:35,160 --> 00:11:39,140 They're used to connect remotely to things because you have routers, you have firewall. 137 00:11:39,140 --> 00:11:43,920 So, this IP gateway is connected to this HDL cloud servers. 138 00:11:43,920 --> 00:11:54,220 And then when you are online on the internet, you can connect to their HDL cloud servers with public IP interface so you can reach your devices as well. 139 00:11:54,460 --> 00:12:01,220 And now a little bit deeper about how they install it. 140 00:12:01,220 --> 00:12:04,760 So, first time installation is quite easy and it works like this. 141 00:12:04,760 --> 00:12:07,960 You install the HDL bus for software as a technician. 142 00:12:07,960 --> 00:12:09,500 So, for example, I'm a technician. 143 00:12:09,500 --> 00:12:10,900 I'm coming to your home. 144 00:12:11,100 --> 00:12:15,480 I'm installing the HDL bus for software on my desktop machine. 145 00:12:15,520 --> 00:12:21,840 And I connect directly with my PC, my technician PC, to this IP gateway. 146 00:12:22,080 --> 00:12:23,260 It's very cool. 147 00:12:23,260 --> 00:12:28,880 And when I'm connected to this IP gateway with my HDL bus, I'm starting to configure all these devices. 148 00:12:28,880 --> 00:12:33,140 Because remember, these devices are connected serially to this IP gateway. 149 00:12:33,140 --> 00:12:36,820 So, I connect to this IP gateway and configure all these ones. 150 00:12:38,660 --> 00:12:40,040 And that's what I said. 151 00:12:40,040 --> 00:12:43,140 I configure the bus for adapter and I have a configuration. 152 00:12:43,140 --> 00:12:56,080 Now that I have a configuration, I can use this data, this configuration data, to upload it, for example, to the cloud and save it also on my Android app in other apps as well. 153 00:12:56,080 --> 00:13:00,140 So, what I do next is register a new account in the HDL on application. 154 00:13:00,140 --> 00:13:02,780 This is an Android application of HDL automation. 155 00:13:02,780 --> 00:13:08,620 It's used to control remotely and also locally within the Wi-Fi, these smart home devices. 156 00:13:09,060 --> 00:13:15,440 And when, as a technician, I register this new account, I also upload the local configuration to the app itself. 157 00:13:15,440 --> 00:13:17,740 So now, remember, I have a phone in my hand. 158 00:13:17,740 --> 00:13:20,540 I register the new account in this application. 159 00:13:20,540 --> 00:13:29,340 And I upload the configuration from this IP gateway or from my laptop, from the BusPro desktop software to this phone. 160 00:13:29,340 --> 00:13:31,020 I upload the configuration to my phone. 161 00:13:31,020 --> 00:13:36,580 Now the configuration to control everything in my smart home devices is inside my phone. 162 00:13:36,700 --> 00:13:39,600 So, for my phone, I can also connect to the internet. 163 00:13:39,600 --> 00:13:43,040 And this is exactly how I backup my configuration in the cloud. 164 00:13:43,040 --> 00:13:47,520 So, after I have the configuration in my phone, I upload it also to the cloud. 165 00:13:47,520 --> 00:13:49,560 And now it's also kept here. 166 00:13:50,060 --> 00:13:50,580 Cool. 167 00:13:50,580 --> 00:14:00,240 So, what happens when a new user comes in and joins to our game and wants also to enter these devices and control them? 168 00:14:00,240 --> 00:14:05,820 So, what happens next is that the first time you download the HGLON app. 169 00:14:05,820 --> 00:14:06,400 Why does that? 170 00:14:06,400 --> 00:14:14,900 Because you need to log into the HGL account that has been opened to him directly in order to control all these dimmers and other devices. 171 00:14:15,000 --> 00:14:21,100 So, we download this HGLON app and you log into the HGL account that has been opened by the technician. 172 00:14:21,540 --> 00:14:25,420 And what he does next, you can actually bet on that, that... 173 00:14:27,260 --> 00:14:31,380 Well, yes, he download the configuration from the cloud. 174 00:14:31,480 --> 00:14:44,280 And when he download the configuration from the cloud, he have all the configuration to fully control these devices over here within the Wi-Fi or from remote. 175 00:14:44,280 --> 00:14:49,240 So, I'm a bit cheating here because there are two possibilities to operate these devices. 176 00:14:49,240 --> 00:14:55,400 And we'll talk about it in the next slide, which is the remote and the local mode. 177 00:14:55,400 --> 00:15:01,580 So, we can operate this HGL system in a remote and local connection. 178 00:15:01,580 --> 00:15:06,500 And the difference between them is that the local connection is accessible from Wi-Fi. 179 00:15:06,560 --> 00:15:10,040 Usually only from Wi-Fi and local networks. 180 00:15:10,220 --> 00:15:16,300 And the remote is accessible from the wide internet and from anywhere inside the world. 181 00:15:16,300 --> 00:15:21,640 And usually, it makes a real sense that we want to make a remote control connection about it. 182 00:15:21,640 --> 00:15:25,700 Well, we want to be able to... 183 00:15:25,700 --> 00:15:34,280 For example, I have an air conditioner and I want to control this air conditioner before I get on because it's really, really hot today and it's a summer. 184 00:15:34,400 --> 00:15:38,300 So, I would love it to be operated before I get back home, right? 185 00:15:38,400 --> 00:15:40,000 And this is really a cool thing. 186 00:15:40,000 --> 00:15:48,960 And at first time installation, the technician actually choose whether to enable and allow remote connections or not. 187 00:15:48,960 --> 00:15:54,700 And usually, many times, because of the reasons I mentioned, the remote connection is enabled. 188 00:15:55,060 --> 00:15:56,820 And this is really interesting. 189 00:15:56,820 --> 00:16:05,400 Remember that in any scenario, we are using the HGL cloud service. 190 00:16:05,400 --> 00:16:12,320 Because in the first scenario of the Wi-Fi local connection, we still backup our configuration for new users to come. 191 00:16:12,320 --> 00:16:17,460 And on the remote connection mode, of course, we use this cloud service to connect back to us. 192 00:16:17,460 --> 00:16:21,560 So, the third point, the third bullet is always used. 193 00:16:21,560 --> 00:16:24,620 The HGL cloud servers are amazing, super interesting. 194 00:16:25,800 --> 00:16:27,540 Yeah, Internet of Things. 195 00:16:27,540 --> 00:16:32,140 Now, let's add Wi-Fi to all the things and let's see what happens. 196 00:16:33,040 --> 00:16:33,840 Cool. 197 00:16:33,840 --> 00:16:35,660 So, the focus of my research. 198 00:16:36,080 --> 00:16:38,280 Yes, we can research one and two. 199 00:16:38,660 --> 00:16:47,440 But first, my family will kill me again if I will destroy all their smartphone devices using the connection to the one and two bullets. 200 00:16:47,460 --> 00:16:55,720 And the second reason and the most relevant one, because I love your family, but it's not that exciting and relevant. 201 00:16:55,720 --> 00:16:58,680 The most relevancy is the hardware. 202 00:16:58,680 --> 00:17:02,040 The hardware and the software can be really device dependent. 203 00:17:02,040 --> 00:17:06,940 And it will take a lot of time to investigate and research any specific device. 204 00:17:06,940 --> 00:17:11,860 Because each device has its own capabilities, own serial connection, own things. 205 00:17:11,960 --> 00:17:24,980 And to reach the point you can really research and find vulnerabilities, takes much more time and much more time from other things, which are publicly known as cloud servers or websites. 206 00:17:25,040 --> 00:17:35,840 So, of course, I thought that the Azure cloud server, which are a critical bottleneck in these connections, are really, really an interesting and a great idea to investigate. 207 00:17:35,840 --> 00:17:56,140 And also, when you think about a seesaw, a seesaw view or a view of some people that works for the network security and the integrity of the network, you might think that what you need to defend might be, not always, is from the outside, from arbitrary outside, 208 00:17:56,140 --> 00:17:58,900 and from the inside, from specific devices. 209 00:17:58,900 --> 00:18:15,580 But in this scenario, this cloud server might be okay, might be whitelisted, fully whitelisted, because this cloud server is just connecting to these devices, just connected to your devices, to your certified devices you put in your systems. 210 00:18:15,640 --> 00:18:24,740 But you need to understand, even as someone that works for security, that the bottleneck can be also outside your organization. 211 00:18:24,740 --> 00:18:32,280 And also, in the third bullet, in servers that you don't even have the code for them, and you don't even know what they're actually kind of doing. 212 00:18:32,280 --> 00:18:35,620 So this is really interesting in the point of focus as well. 213 00:18:35,620 --> 00:18:37,900 But we speak about focus a lot. 214 00:18:37,900 --> 00:18:39,620 Let's now speak about the cloud server. 215 00:18:39,620 --> 00:18:44,020 So a starting point for this is the HGLON app, how it works, the HGLON app. 216 00:18:44,020 --> 00:18:46,740 So first is the login screen, yeah, nice login screen. 217 00:18:46,740 --> 00:18:54,880 You can see a simple login here, and a sign-up button also, and the forgot password mechanism, which is really cool. 218 00:18:55,440 --> 00:19:00,140 And also interesting, forgot password actually is working the same as you think. 219 00:19:00,140 --> 00:19:09,260 It sends you a reset link to your email, and you can click on this link, and immediately go to this link. 220 00:19:09,260 --> 00:19:15,840 But the URL in the forgot password was really, really interesting. 221 00:19:15,940 --> 00:19:17,490 And we'll speak about it later. 222 00:19:18,100 --> 00:19:18,780 Sign-up. 223 00:19:18,780 --> 00:19:24,280 Sign-up includes... you can enter either phone or an email, and you can also add the password. 224 00:19:24,380 --> 00:19:27,280 Well, you should add the password. 225 00:19:29,440 --> 00:19:33,520 And then you have all your things enabled. 226 00:19:33,720 --> 00:19:38,570 And after that, you can upload from the app the configuration you have. 227 00:19:38,570 --> 00:19:45,470 Remember this IP gateway, where I configure all this stuff, so I can upload the configuration from this IP adapter to my phone. 228 00:19:45,730 --> 00:19:49,150 And from there on, I can upload this to the cloud. 229 00:19:49,150 --> 00:20:00,210 And I can also download cloud configurations using this app to configure my system, my application, to control these devices in my Wi-Fi network and stuff. 230 00:20:00,530 --> 00:20:02,390 So this is the sign-up. 231 00:20:02,810 --> 00:20:04,570 Well, enough chitchat. 232 00:20:04,570 --> 00:20:06,290 Let's talk about vulnerabilities. 233 00:20:06,290 --> 00:20:09,070 So the first vulnerability, really cool. 234 00:20:09,070 --> 00:20:12,360 Account takeover number one, or let's forget our password together. 235 00:20:12,730 --> 00:20:15,270 So let's forget our password. 236 00:20:15,270 --> 00:20:19,030 I click on the forgot password, and I got this following link. 237 00:20:19,210 --> 00:20:26,590 Well, this seems like a nice, naive link that doesn't going to affect anyone, right? 238 00:20:26,750 --> 00:20:32,290 Well, the main thing you can see here and observe, I'll make sure you understand that. 239 00:20:32,290 --> 00:20:36,630 Well, there are a couple of parameters, really, really interesting. 240 00:20:36,630 --> 00:20:38,570 The first one is the time. 241 00:20:38,670 --> 00:20:41,950 Time seems like just the time in some format. 242 00:20:41,950 --> 00:20:44,750 An email, which is actually my email. 243 00:20:44,750 --> 00:20:48,210 The email that I want to reset the password now for. 244 00:20:48,450 --> 00:20:51,950 And this parameter and these kind of parameters as well. 245 00:20:52,150 --> 00:21:02,270 And this is really, really interesting, because you can think that maybe something random should be placed there, right? 246 00:21:02,270 --> 00:21:05,710 Something random that I couldn't fake this kind of link. 247 00:21:06,690 --> 00:21:13,110 You could also think that if I change this email to any arbitrary email, it won't work, right? 248 00:21:13,110 --> 00:21:19,970 It will be verified in some manner, and they won't let me change the password for any arbitrary user. 249 00:21:19,970 --> 00:21:20,850 Come on. 250 00:21:20,850 --> 00:21:22,450 Well, they did. 251 00:21:22,450 --> 00:21:30,930 They actually did let me change any user password by its email to any user. 252 00:21:30,930 --> 00:21:45,950 The way to exploit it, for example, if I'm thinking hacker-wise, is to do forget password to my email account, get this link, okay, and change only the email, the email area, to the victim emails. 253 00:21:46,450 --> 00:21:51,450 And from there on, I get fully authorization to change its password. 254 00:21:51,450 --> 00:21:54,050 This link needs to change the password of this user. 255 00:21:54,050 --> 00:21:55,310 I can fully change his password. 256 00:21:55,310 --> 00:21:56,170 Really cool. 257 00:21:56,330 --> 00:21:57,070 And it works. 258 00:21:57,070 --> 00:21:57,810 Perfect. 259 00:21:58,930 --> 00:22:01,430 So, let's do it again. 260 00:22:01,430 --> 00:22:03,270 So, account takeover number two. 261 00:22:03,270 --> 00:22:07,050 Or maybe let's forget our password again. 262 00:22:07,330 --> 00:22:10,410 And how can we do it? 263 00:22:10,410 --> 00:22:18,770 So, let's forget now about the users I already showed you, about the users and the forgetting the passwords again. 264 00:22:18,770 --> 00:22:23,210 And now let's focus about other thing that's called the technician user. 265 00:22:23,230 --> 00:22:29,610 The technician user is the user that is automatically generated when the user register with its email. 266 00:22:29,610 --> 00:22:47,010 So, when the user first time register with an email, for example, a technician, install the system, and register your HDL account, what he's doing is actually also opens up automatically a technician user with the same password as the username, as the original user. 267 00:22:47,010 --> 00:22:50,730 For example, I open register with this email at mymail.com. 268 00:22:50,730 --> 00:22:56,070 It is automatically also open a technician user at email-debug at mymail.com. 269 00:22:56,870 --> 00:23:07,910 And this is really interesting now, because the technician user is able to change settings and control all system configuration of the smart home devices as well. 270 00:23:07,910 --> 00:23:11,830 And this can be really bad, right, if we can hack this technician user. 271 00:23:11,830 --> 00:23:13,930 We can also change the cloud configuration. 272 00:23:13,930 --> 00:23:16,190 We can also do many, many more things. 273 00:23:17,210 --> 00:23:24,250 In these times, I usually ask the crowd if they know how to hack this system. 274 00:23:24,250 --> 00:23:31,090 I guess some of you actually understand where I'm going to, and it's actually really working. 275 00:23:31,090 --> 00:23:46,570 So to exploit and to take over any technician user, what we need to do is to find the victim email, let's say victim at mymail.com, and open a new email at this mymail.com service at victim-debug at mymail.com. 276 00:23:46,570 --> 00:23:50,450 So I open this new email account, and I have it. 277 00:23:50,450 --> 00:23:54,230 And yes, what I will do next is just forget my password. 278 00:23:54,230 --> 00:23:59,630 I click on forget password for this victim-debug at mymail.com. 279 00:23:59,630 --> 00:24:10,350 And when I do reset password to this account, I will be sending... they will send to me their email of link reset, the reset of the password. 280 00:24:10,350 --> 00:24:17,390 So I actually can change the victim-debug at mymail.com password. 281 00:24:17,390 --> 00:24:22,050 So I actually can get access to all the technician features. 282 00:24:22,050 --> 00:24:24,330 I can access the technician user. 283 00:24:24,710 --> 00:24:35,710 Just to conclude, and to make sure everyone is with me, what I'm doing is I'm opening another account for the technician email at victim-debug at mymail.com. 284 00:24:35,710 --> 00:24:39,750 And I call the reset password for this email. 285 00:24:40,150 --> 00:24:43,210 And this is really cool, and it's working. 286 00:24:43,210 --> 00:25:07,970 And the reason it's working is because they don't verify this email is not a valid email, and they shouldn't send a forget password to this technician users at all, or even find another way to put users for the technician, which is not relevant with this dash-debug. 287 00:25:08,610 --> 00:25:15,430 Yes, it's really worked, and it made me to take over any account of, well, technician accounts. 288 00:25:16,410 --> 00:25:17,230 Very cool. 289 00:25:17,230 --> 00:25:19,570 It's working for some providers, not all of them. 290 00:25:20,130 --> 00:25:30,970 I feel in the sense that some of them replacing dash with another, so it can probably be bypassed even in mails that doesn't allow dash in their username, but I need to think about it even more. 291 00:25:31,510 --> 00:25:32,070 Cool. 292 00:25:32,070 --> 00:25:34,990 So now we spoke about the pre-authentication vulnerabilities. 293 00:25:35,050 --> 00:25:37,610 Let's see what is happening post-authentication. 294 00:25:37,610 --> 00:25:44,190 So let's get our devices and start investigating some several API endpoints. 295 00:25:44,190 --> 00:25:52,270 And I actually encountered many API endpoints which are open, and some of them were the device by region list. 296 00:25:52,270 --> 00:25:55,710 And the device by region list is a very interesting API endpoint. 297 00:25:56,150 --> 00:25:58,250 It comes right after the login. 298 00:25:58,250 --> 00:26:09,810 You log in, and you have a device list, and you can actually search this device list by the region name, the region ID, by device ID, by anything you want. 299 00:26:09,810 --> 00:26:11,250 So it's really cool. 300 00:26:11,710 --> 00:26:19,630 And how you do it, you go to the device section, and the parameters to control is the region ID, device ID, device name. 301 00:26:19,630 --> 00:26:23,650 So all of these guys are fully controllable and very, very interesting. 302 00:26:25,650 --> 00:26:29,990 So the first try I did was sending this. 303 00:26:29,990 --> 00:26:35,370 This was in the post data body of the message I've been sending. 304 00:26:35,370 --> 00:26:42,790 And this data was containing the parameters need to be searched for. 305 00:26:42,790 --> 00:26:46,630 And as you can observe quite well, there is the SQL injection I tried to put. 306 00:26:47,090 --> 00:26:51,970 And, well, yes, it did return to me all the devices in the system. 307 00:26:51,970 --> 00:27:03,810 But remember, to find out if there is an SQL injection in the site or not, it's not enough just to test for this kind of screen and to see that I get all the data. 308 00:27:03,810 --> 00:27:05,770 I need to do a little bit more than that. 309 00:27:05,770 --> 00:27:11,790 And to see that it actually does an SQL statement I fully control of, black box wise. 310 00:27:12,090 --> 00:27:12,890 Cool. 311 00:27:12,890 --> 00:27:16,710 And so the second try was something like this. 312 00:27:16,850 --> 00:27:18,970 And it actually worked again. 313 00:27:18,970 --> 00:27:20,890 And I got all the devices. 314 00:27:20,890 --> 00:27:21,830 So it's not... 315 00:27:21,830 --> 00:27:26,130 And also I tried to make an invalid SQL statement. 316 00:27:26,130 --> 00:27:33,350 And what I got is that I get a response, an error response, specifically on invalid SQL statements. 317 00:27:33,350 --> 00:27:35,070 So, yes, I have an SQL injection. 318 00:27:35,070 --> 00:27:36,210 Very, very cool. 319 00:27:36,210 --> 00:27:37,290 I get in all the data. 320 00:27:37,290 --> 00:27:39,450 All the data not in the DB. 321 00:27:39,450 --> 00:27:41,950 All the data I have on my devices. 322 00:27:41,950 --> 00:27:48,650 So there is some way to gain control and to get all the data of the HDL database. 323 00:27:49,130 --> 00:27:51,710 So why not extract more data, right? 324 00:27:52,070 --> 00:27:54,250 Well, problems. 325 00:27:54,250 --> 00:28:01,610 Some of the problems is that the return columns and specifically the ASP parser. 326 00:28:01,610 --> 00:28:06,110 So the server, as far as I tell you, it's the HDL cloud servers. 327 00:28:06,230 --> 00:28:08,970 They have ASP server inside of them. 328 00:28:08,970 --> 00:28:09,930 Windows server. 329 00:28:10,030 --> 00:28:14,230 And this ASP parser checks the validity of the return columns. 330 00:28:14,330 --> 00:28:23,290 So, for example, if I do a union SQL injection, I need to verify and validate that all my data return is correctly to the manner of the ASP parser. 331 00:28:23,290 --> 00:28:26,210 And if it's not, I wouldn't be able to pass and get my data. 332 00:28:26,210 --> 00:28:27,350 I just get in an error. 333 00:28:27,350 --> 00:28:28,350 Error response. 334 00:28:28,350 --> 00:28:29,470 Nothing happens. 335 00:28:29,470 --> 00:28:34,990 And, well, yes, you might think to yourself, well, let's do blind SQL injection, right? 336 00:28:34,990 --> 00:28:39,130 Let's do, like, SQL timed SQL injection, something like that. 337 00:28:39,130 --> 00:28:40,910 But it's not that easy. 338 00:28:40,910 --> 00:28:46,250 Because I am bounded in this scenario by not sending so much data. 339 00:28:46,250 --> 00:28:52,210 Well, first thing is that I didn't want to alert the system. 340 00:28:52,210 --> 00:28:54,090 I didn't want to bomb the system. 341 00:28:54,110 --> 00:28:59,150 I didn't want to stress the system or to do anything like that, in a sense. 342 00:28:59,470 --> 00:29:07,490 And, well, and the second thing is that even if I do I will do it, it can take a lot of time. 343 00:29:07,490 --> 00:29:18,350 Because I have more than 11 columns returning from the SQL injection, from this SQL query, not the injection, from the SQL query, more than 11 columns. 344 00:29:18,350 --> 00:29:26,550 Which means almost 4 million queries were required to inspect all the relevant types and values. 345 00:29:26,550 --> 00:29:33,370 Remember, the ASP parser also checks for the validity even of the ranges of some of the values returned. 346 00:29:34,570 --> 00:29:35,390 Yes. 347 00:29:35,450 --> 00:29:40,490 And also it's worth mentioning that, well, I didn't use VPN. 348 00:29:40,930 --> 00:29:48,350 And it's a really good reason not to, like, jiggle with the site and try to brute force, like, arbitrary sites. 349 00:29:48,690 --> 00:29:51,270 So, yeah, not a good idea. 350 00:29:51,270 --> 00:29:52,710 Don't try it at all. 351 00:29:52,790 --> 00:29:55,790 And so this is the blind SQL injection idea. 352 00:29:55,790 --> 00:30:00,150 As I told you, even timed or parser error, yes or no, will take a lot of time. 353 00:30:00,670 --> 00:30:01,710 Cool. 354 00:30:01,850 --> 00:30:06,850 But let's forget about this SQL injection. 355 00:30:06,850 --> 00:30:09,870 Let's think about another way to bypass the ASP parser. 356 00:30:10,070 --> 00:30:31,210 You all must agree with me that if I find another SQL injection that returns much, much less columns, I could go over all the possibilities with this union SQL injection or something and finding out the relevant order to make it work and to return all the data and bypass the ASP parser. 357 00:30:31,210 --> 00:30:34,010 So this is exactly what I was going for. 358 00:30:34,010 --> 00:30:38,710 So to bypass the ASP parser, I was going to the... you remember the device name. 359 00:30:38,710 --> 00:30:41,910 This is the original parameter for the SQL injection. 360 00:30:41,910 --> 00:30:48,070 I tried to find this device name, the exact name, the exact argument in another API endpoint. 361 00:30:48,890 --> 00:30:50,450 And I actually did find it. 362 00:30:50,450 --> 00:30:52,390 I find it in the get room binding device. 363 00:30:52,390 --> 00:30:54,210 There is the device name parameter. 364 00:30:54,210 --> 00:30:56,350 There is an SQL injection there. 365 00:30:56,350 --> 00:31:02,470 You go to the room section, you search by the device binding name, and voila, you have an SQL injection. 366 00:31:02,490 --> 00:31:03,330 Very cool. 367 00:31:03,330 --> 00:31:05,130 SQL injection in the same argument. 368 00:31:05,230 --> 00:31:13,490 And the most amazing thing here is that only four columns are being returned. 369 00:31:13,490 --> 00:31:14,650 Only four columns. 370 00:31:14,650 --> 00:31:15,590 That's all. 371 00:31:15,590 --> 00:31:17,190 And it's really amazing. 372 00:31:17,190 --> 00:31:29,110 We can do the permutation over all these options with the possibility to do all of it really, really in short amount of queries. 373 00:31:31,410 --> 00:31:37,590 So permutating over columns order and trying the correct way to make it was doing like this. 374 00:31:37,590 --> 00:31:44,950 So here you can see the union SQL injection, and here you can see and observe the parameters I've been put. 375 00:31:44,950 --> 00:31:50,250 And I just scrambled and permuted this one any time and tried to see if it works. 376 00:31:50,250 --> 00:31:54,170 And I also increased the number of columns because I didn't really know the number of columns. 377 00:31:54,170 --> 00:31:57,090 But I knew it was around four. 378 00:31:57,290 --> 00:31:58,790 I say only four. 379 00:31:58,790 --> 00:31:59,190 I'm sorry. 380 00:31:59,190 --> 00:32:10,470 It's like it was really around four because I seen that the number of columns was four in the data, but it could be maybe one more for the ID or the key saved in the SQL. 381 00:32:10,470 --> 00:32:12,450 But it was eventually four. 382 00:32:12,450 --> 00:32:14,310 So it doesn't really interesting. 383 00:32:14,310 --> 00:32:16,090 And I found that this is working. 384 00:32:16,130 --> 00:32:34,850 And to conclude all of this, it was quite amazing to see that I'm getting all the database with one single query, one single SQL injection to rule them all, bypassing the ASP parser and getting all the database, all the things as well. 385 00:32:34,850 --> 00:32:35,810 Cool. 386 00:32:35,810 --> 00:32:41,270 So at this point, of course, I reached the HGL automation company. 387 00:32:41,850 --> 00:32:48,050 I did fully coordinated disclosure with them, worked with them silently and helped them a lot. 388 00:32:48,050 --> 00:32:49,790 And they also helped me. 389 00:32:50,590 --> 00:32:54,030 They were really enthusiastic about helping and securing the system. 390 00:32:54,030 --> 00:32:55,750 So it was great for them. 391 00:32:56,630 --> 00:33:01,570 But let's now speak about how we can hack into any arbitrary HGL user. 392 00:33:01,570 --> 00:33:08,890 For example, you have your own, I don't know, HGL account in your smart home in Dubai. 393 00:33:08,890 --> 00:33:13,070 Or you have your own smart home in some airport. 394 00:33:13,070 --> 00:33:16,150 Because there are airports and museums in HGL. 395 00:33:16,150 --> 00:33:23,240 So you can actually find a scenario of how you can fully control any HGL account. 396 00:33:23,730 --> 00:33:28,260 What we found, the vulnerabilities we have is two SQL injections and two account takeovers. 397 00:33:28,930 --> 00:33:33,470 And there are two scenarios to gain full takeover over any user. 398 00:33:33,470 --> 00:33:39,350 The first scenario, you know the attackers, you know the victim's email. 399 00:33:39,350 --> 00:33:41,310 You know the victim's email. 400 00:33:41,310 --> 00:33:47,230 And you just get from the database the hashed, salted password. 401 00:33:47,230 --> 00:33:49,430 And you now brute force this password. 402 00:33:49,430 --> 00:33:55,110 And when you brute force this password, you can get after some time the password, of course. 403 00:33:55,250 --> 00:33:59,610 And the second option is to do one of the takeovers I've mentioned. 404 00:33:59,610 --> 00:34:02,890 Actually, the second one, the technician one, is much more silently. 405 00:34:02,890 --> 00:34:17,730 When you do account takeover over the technician account, usually the normal accounts use the normal people, the older people that use normal people in the sense of using the system. 406 00:34:17,730 --> 00:34:20,810 They use the normal accounts. 407 00:34:20,810 --> 00:34:22,630 And they don't use the technician account. 408 00:34:22,630 --> 00:34:25,150 Only for configuration and when something gets wrong. 409 00:34:25,150 --> 00:34:28,610 So you can connect and take over only the technician account. 410 00:34:28,610 --> 00:34:31,130 And it will work silently and no one will know. 411 00:34:31,750 --> 00:34:42,210 The second scenario is where you can control any arbitrary HDL user without an email. 412 00:34:42,210 --> 00:34:43,490 And now we can do it. 413 00:34:43,490 --> 00:34:45,530 For example, you know the company name. 414 00:34:45,530 --> 00:34:48,330 You know the phone name of the victim. 415 00:34:48,430 --> 00:34:52,290 You know its full name, in a sense, or something like that. 416 00:34:52,290 --> 00:34:57,030 So you can scrape through the HDL database and find its account, find its email. 417 00:34:57,030 --> 00:35:04,770 And then go back to the first scenario and hack its user by any of these possibilities. 418 00:35:05,790 --> 00:35:07,650 Okay, really, really cool. 419 00:35:07,650 --> 00:35:10,810 So we can hack any HDL user in the entire world. 420 00:35:10,810 --> 00:35:15,050 Let's now go through the security implications to conclude what I've been talking about. 421 00:35:15,050 --> 00:35:18,230 So let's start with the easygoing security implications. 422 00:35:18,230 --> 00:35:21,390 Not to frighten all the people so much. 423 00:35:21,390 --> 00:35:25,170 So the first security implications are the private data leaks, of course. 424 00:35:25,170 --> 00:35:30,790 Hash passwords, emails, phone numbers, company names, names in general. 425 00:35:32,730 --> 00:35:36,550 Tremendous amount of data. 426 00:35:36,610 --> 00:35:41,270 And also the HDL cloud backup configuration is there, which gives us the following. 427 00:35:41,270 --> 00:35:43,350 The full smart devices info. 428 00:35:43,350 --> 00:35:45,530 And the full smart devices info is amazing. 429 00:35:45,530 --> 00:35:50,050 What you see here, what you can observe here, is exactly from the app. 430 00:35:50,550 --> 00:36:01,750 You can see that this app can control cameras, TVs, security sensors in other manners, and air conditioners also in the server rooms as well. 431 00:36:02,650 --> 00:36:08,110 Internal network IPs can be exposed using these systems as well, firmware versions. 432 00:36:08,110 --> 00:36:13,010 Internal network IPs are because they are written inside of the configuration, some of them. 433 00:36:13,010 --> 00:36:21,010 And you can actually use some of them to observe and see where are the HDL devices, IPs, and some of them kind of in the sense. 434 00:36:22,190 --> 00:36:23,630 And very cool. 435 00:36:23,630 --> 00:36:25,410 And also the remote control. 436 00:36:25,490 --> 00:36:29,770 So you can actually, again, of course, remote control over these things. 437 00:36:29,930 --> 00:36:34,630 And you can adjust, well, as I said before, the air conditioner in the server room. 438 00:36:34,630 --> 00:36:37,350 You can make it up to 50 Celsius. 439 00:36:37,750 --> 00:36:45,670 I don't think they actually support it, but 35, something like that for a week, would probably destroy the server room, I guess. 440 00:36:45,670 --> 00:36:48,310 And also to watch their IP cameras. 441 00:36:48,850 --> 00:36:50,310 So it can be really, really bad. 442 00:36:50,310 --> 00:36:51,910 Disable some sensors. 443 00:36:53,350 --> 00:36:56,190 Now, I'm sorry for that in advance. 444 00:36:56,190 --> 00:36:59,670 This is kind of a pure evil, pure evil ideas. 445 00:36:59,670 --> 00:37:19,290 But we need to discuss them because we need to understand and realize that the security implications, even if I don't have a full RCE over any kind of device, there are tremendous and high impact and costly impacts over the organizations as well that can be done. 446 00:37:19,290 --> 00:37:23,430 And the first one is, well, you can add internal non-exposed IP address. 447 00:37:23,430 --> 00:37:27,590 Sometimes they are hiding the gateways that control other systems. 448 00:37:27,590 --> 00:37:32,170 For example, hidden security areas, hidden secure rooms and stuff like that. 449 00:37:32,170 --> 00:37:36,370 You can actually expose them because there is an auto search functionality in the app. 450 00:37:36,370 --> 00:37:45,670 Another thing you can do is you can encrypt all the configurations, remove all the configurations from the AGL app. 451 00:37:46,010 --> 00:37:51,250 And some people can do kind of a ransomware and blackmail the companies. 452 00:37:51,250 --> 00:38:00,750 And until they won't do it, you won't give them back their possibility to control their system, to control their lights, to control their powers, their RCEs. 453 00:38:00,750 --> 00:38:06,110 This can really shut down a company in the logistics, in the industry manner. 454 00:38:07,510 --> 00:38:09,110 Logistics manner a lot. 455 00:38:09,210 --> 00:38:13,010 Another thing is to use a conditional to affect critical locations. 456 00:38:13,410 --> 00:38:19,270 And also something I really love, which is called an hidden trigger attack. 457 00:38:19,270 --> 00:38:20,570 What is a hidden trigger attack? 458 00:38:20,570 --> 00:38:24,750 So let's, for example, say that we are not in the Wi-Fi. 459 00:38:24,750 --> 00:38:26,570 We are not in a local connection. 460 00:38:26,690 --> 00:38:28,870 OK, you are smart guys. 461 00:38:28,870 --> 00:38:31,270 You block all the remote connections. 462 00:38:31,270 --> 00:38:33,410 You keep only the local connections. 463 00:38:33,410 --> 00:38:37,710 But remember, the configuration is still on the AGL cloud servers. 464 00:38:37,710 --> 00:38:56,270 So when the user will update, and it will update its configuration sometimes, you can actually connect the button, for example, switch on the lights to the button that's also switch and adjust the air conditioner to 35 degrees, 35 Celsius degrees. 465 00:38:56,270 --> 00:38:59,950 So you can connect two buttons, for example, to the same button. 466 00:38:59,950 --> 00:39:03,190 So the user just opens up the light. 467 00:39:03,210 --> 00:39:05,770 But he actually did a lot of other stuff as well. 468 00:39:05,770 --> 00:39:08,210 Disabled sensors and did a lot of other things. 469 00:39:08,210 --> 00:39:12,250 And for this attack, you don't even need the remote mode connection. 470 00:39:12,250 --> 00:39:16,830 Even in the local mode, it can really affect the users in the organization. 471 00:39:16,830 --> 00:39:21,170 Because the configuration is still on the AGL cloud backup database. 472 00:39:21,170 --> 00:39:25,530 The AGL cloud servers are really affecting the organization as a bottleneck. 473 00:39:26,110 --> 00:39:29,930 Also, another thing you can do, you can disable and control other critical sensors. 474 00:39:30,490 --> 00:39:32,230 You can disable security cameras. 475 00:39:32,230 --> 00:39:39,570 You can disable sensors for overheating, security alerts, and also you name it. 476 00:39:40,970 --> 00:39:42,650 Well, this is another idea. 477 00:39:42,650 --> 00:39:45,170 This is not a direct security issue. 478 00:39:45,170 --> 00:39:49,710 But this is another idea I had in mind, which is exploiting the internal network. 479 00:39:49,750 --> 00:39:53,310 For example, I can change a cloud configuration file to a malicious one. 480 00:39:53,310 --> 00:39:56,970 Maybe something that does something on the device. 481 00:39:56,970 --> 00:40:02,010 Maybe I can exploit the device when they update the configuration file on the device. 482 00:40:02,050 --> 00:40:03,290 It can be really interesting. 483 00:40:03,290 --> 00:40:05,930 It can be ideas for further research and stuff like that. 484 00:40:05,970 --> 00:40:07,230 So this is really cool. 485 00:40:07,230 --> 00:40:13,770 And it increased the attack surface to the internal network and to the organization as well. 486 00:40:14,550 --> 00:40:15,090 Cool. 487 00:40:15,090 --> 00:40:16,970 So we are coming to conclusion. 488 00:40:17,270 --> 00:40:26,750 And some of the ideas to continue is, of course, to find a way from the account takeover to getting into the internal network of the organization. 489 00:40:26,750 --> 00:40:27,790 Can it be done? 490 00:40:27,790 --> 00:40:29,190 How it can be done? 491 00:40:29,190 --> 00:40:30,770 Taking over the device. 492 00:40:30,770 --> 00:40:32,770 Taking over something like something else. 493 00:40:32,770 --> 00:40:38,090 Maybe taking advantage of the way they control the smart home devices in the network. 494 00:40:38,090 --> 00:40:38,610 I don't know. 495 00:40:38,610 --> 00:40:39,710 You name it. 496 00:40:40,210 --> 00:40:45,150 And another thing is to access from the LAN and the Wi-Fi access. 497 00:40:45,150 --> 00:40:48,130 For example, I have already Wi-Fi and LAN access. 498 00:40:48,130 --> 00:40:52,070 To find an RC over one of the smart devices platform. 499 00:40:52,150 --> 00:40:55,850 Specifically, of course, the IP adapter. 500 00:40:55,850 --> 00:41:00,810 The IP serial adapter of the HDL gateway devices, which is really cool also. 501 00:41:01,370 --> 00:41:04,810 And yes, so many amazing ideas can be done. 502 00:41:05,010 --> 00:41:06,550 It can be amazing. 503 00:41:06,550 --> 00:41:11,290 I had so much fun working for this project. 504 00:41:11,370 --> 00:41:12,970 And I come really to conclusion. 505 00:41:12,970 --> 00:41:22,430 I want to thank anyone, starting from the HDL automation company, for fast fix and coordinated disclosure of all the vulnerabilities. 506 00:41:22,430 --> 00:41:24,030 HDL automation, you are really great. 507 00:41:24,030 --> 00:41:26,190 And I love working with you guys. 508 00:41:26,450 --> 00:41:38,190 The second thing is that I wanted to really thank Ofer Peleg, which is the HDL Israel representative, for supporting me along the way and helping me fixing this. 509 00:41:38,190 --> 00:41:41,150 He was also an amazing guy. 510 00:41:41,790 --> 00:41:47,110 And well, of course, thank you to my family for letting me break in their house. 511 00:41:47,190 --> 00:41:48,610 But only one time. 512 00:41:48,610 --> 00:41:49,650 Only one time. 513 00:41:49,650 --> 00:41:52,490 Hopefully not on the second time, but we'll see about that. 514 00:41:52,490 --> 00:41:56,950 And of course, and of course, I'm really thankful for Sentinel One. 515 00:41:56,950 --> 00:42:00,750 Sentinel One, thank you for sponsoring and supporting my research. 516 00:42:02,030 --> 00:42:03,470 Thank you so much. 517 00:42:04,250 --> 00:42:06,550 And well, I think this is it. 518 00:42:06,550 --> 00:42:09,430 We are coming to reach to a live questions and answers. 519 00:42:09,430 --> 00:42:17,510 So if you want to, if you have any questions about my lecture, or if you want to read my full blog. 520 00:42:17,510 --> 00:42:25,770 So first, I wanted to know that my full blog and my full research will be published right now as we speak in the Sentinel Labs blog. 521 00:42:25,770 --> 00:42:31,730 So make sure you follow Sentinel Labs and go to the Sentinel Labs website in Sentinel One. 522 00:42:31,750 --> 00:42:37,090 And there is my full research with a lot of other code sections and stuff like this. 523 00:42:37,090 --> 00:42:44,690 And from now on, I will go to the questions and answers in the Discord channel in DEF CON for more questions and answers. 524 00:42:44,690 --> 00:42:47,570 And I'll be happy to answer any questions you have in mind. 525 00:42:47,850 --> 00:42:49,490 And thank you all for listening. 526 00:42:49,490 --> 00:42:52,430 Thank you all for coming here. 527 00:42:52,430 --> 00:42:56,910 And I hope to see you soon in DEF CON in another, even non-Corona events. 528 00:42:56,910 --> 00:42:59,050 We can see face to face also. 529 00:42:59,050 --> 00:43:00,390 So thank you very much.