start	end	text
0	2760	I really, really appreciate and grateful for being here.
2760	5840	So thank you a lot for DEF CON, for DEF CON Heritage Village,
5840	8360	SentinelOne, and everyone that supported me along the way.
8400	13340	We'll speak about it also soon. Let's start with the title.
13380	15580	So, Hacking Smart Devices for Fun and Profit.
15580	22140	This is a true and genuine story about me trying from exploiting my smart home
22140	27520	into gaining control over thousands of smart devices in the entire world.
27520	28900	So, let's start.
28900	33040	So, first about me. My name is Barak Sternberg.
33040	35700	I also live in DEF in Twitter, so make sure to follow.
35700	40140	I'm a security researcher and also an author in SentinelOne Labs.
40360	43820	I have a master's in computer science on algorithms.
44280	49980	And one of the favorite things I love to mention is that I'm also a party lover and a DJ.
49980	55720	So, you can make sure you follow my Mixcloud to see my set and stuff.
55720	59980	But besides following our party, which is not so relevant in the corona period,
60400	63620	I love to focus on vulnerability research.
63620	67300	I love computer security. I'm an enthusiast about network security,
67300	72040	IoT, embedded devices, Linux, web apps, and more and more.
72040	74920	And also to analyzing malwares in the wild.
74920	82020	I'm a CTF player and I love a good game of hacking any kind of devices.
82020	85080	So, with this in mind, let's start.
85080	91180	So, starting this project goes quite well, well, way back.
91180	94700	And when I say way back, I mean really back, 2010.
95000	96580	What happened in 2010?
96580	100320	So, first, we are renovating our family home.
100320	102420	We are fixing all this home.
102420	107720	The second most important thing was the Walking Dead first season was just coming up.
107800	113140	The first season, just to keep in mind, today it's the 10th season already, I think,
113140	114400	of the Walking Dead.
114400	115320	And it's kept counting.
115320	116260	Amazing series.
116260	117140	Much watched.
117140	118600	Must watch one.
119240	124280	And, well, we installed smart home devices, which were the Philips Dynalite.
124280	128960	And the Philips Dynalite have software and apps, but they were really, really expensive.
129160	132260	Back then, it was really high extras.
132260	133320	And we didn't buy it.
133320	138700	Just the technician came, installed the softwares and apps to itself,
138700	142420	to configure all of our devices, all of our smart home systems.
142420	147660	And from there on, we didn't have anything to control it.
147660	152840	So, you can say it's a smart home device, but not quite, really.
154020	157220	And so, we don't have any remote app control.
157280	162480	And usually, in these scenarios, we can think about ourselves as, well,
162480	167420	our own technicians that can do it by ourselves, right?
167420	169680	So, why not do it ourselves?
169680	173280	So, this scary diagram is not that scary.
173280	178120	What you see here is actually the Philips Dynalite controllers
178120	183680	that control my smart home devices in my parents' home.
183680	186300	These actually have been the controllers themselves.
186300	190560	So, as you can see here, this one is the full electricity diagram
190560	194150	downloaded freely from the Philips site.
194580	197800	And the interesting thing you can observe here is that, well,
197800	199580	each controller controls something.
199580	204100	Controller-specific maybe lights have specific capabilities and attributes.
204100	209320	So, this electricity diagram have on this side the channels,
209320	212900	which are directly connected usually to the relays,
212900	217260	to the dimmers, to the buttons, to anything.
217260	220980	For example, this channel, channel one,
220980	224560	have powered out electricity to your lights,
224560	227440	your light bulb, or maybe to a window,
227440	230720	or maybe to a large light system, or anything else.
230720	232840	So, this is on these sides, and this is the relay,
232840	234580	the switch on and off stuff.
234640	237040	And on the other side, they are connected, as you can see here,
237040	239780	the microprocessor. This is the microprocessor.
239960	242580	And this microprocessor is very cool
242580	247700	because it's the thing that connects between the electricity circuits here
247700	249860	and the serial, which is here.
249860	252320	So, on its other end, there is a serial output,
252320	257580	you can obviously understand it might be the controlling area.
257580	260920	So, when I connect to these devices to configure them,
260920	264160	I usually use this serial interface.
264160	266560	And this uses something that's called Dynet protocol
266560	270900	of the Dynalite Philips systems.
270900	271920	And it's really cool.
271920	278820	It's connected by RS-485, which is really, it's not that unique,
278820	280980	in the sense that many industrial systems
280980	283300	are actually using this kind of type of serials
283300	288460	compared to the usual serial RS-2322.
289480	292860	And also, what you can understand is that this serial
292860	297440	is connected to this building block, which is, what is that?
297440	301160	So, this is, I bought actually an IP serial adapter.
301820	306500	And this is a cool serial adapter that is used to connect
306500	310040	all up between the serial and the IP.
310680	314520	And I am sitting here gently and trying to wait
314520	316360	for something to happen, right?
316360	319760	Sending commands maybe, seeing something, I don't know.
319920	322760	So, what happened next is that I tried to send codes
322760	324040	to these controllers.
324280	327220	I'm sending codes to these controllers and nothing happened.
327220	327740	Nothing.
327740	331120	I use this wonderful GitHub repo, which is not complete.
331120	335640	It has some several API documentations of Dynet-01,
335640	337860	but it's not exactly the Dynet I needed.
338820	340420	It's really weird.
340420	344420	And also, the packets.
344420	350540	So, I could have observed the type of the packets used
350540	352180	to be sent to Dynet.
352180	356040	The packets usually are in the structure of sync number,
356040	359800	an area code, a command type, and some extra data
359800	364200	to navigate between the different possibilities.
364200	368840	For example, I want the light to be in 100%
368840	374240	or 50% percentage of light.
374400	378980	So, I can put this stuff in the extra data area,
378980	380120	which is right here.
380120	384100	So, this is a packet used to be sent over a serial connection,
384100	386840	as I've seen before, as we have seen before.
387040	388360	And this is really cool.
388360	391500	So, I start sending packets, nothing happens.
391500	395020	And I remember me and my father sitting in the saloon,
395020	398480	and like, why not send in all the packets?
398480	400960	And when I mean all the packets, let's just send,
400960	402380	let's just fuzz the system, right?
402380	403860	What could happen, right?
403860	406040	Sending all opcodes to the controllers could be
406040	407620	an amazing thing to do, no?
407880	409060	Really, all.
409060	412920	Like, in four, I exchange 256.
414480	420360	And it wasn't a surprise that, yeah,
420360	423220	maybe you laugh right now, but it's actually a real thing.
423220	426940	It's a house that people live in that went crazy.
426980	428660	So, we send all of these commands,
428660	430980	and all of a sudden, I remember myself sitting in the kitchen,
430980	433840	and all the lights are flipping crazy,
433840	436600	windows turning on and off at the same time,
436600	438420	and we don't know what is happening.
438480	441600	And, well, try to remember which command you're sending,
441600	444740	this fuzzing loop that tried to fuzz all these commands.
444740	450780	So, I did try to fix it to my responsibility, of course.
450780	453020	And I tried to fix it.
453020	455020	And I tried to reverse these commands.
455020	456220	And some of them have been fixed.
456220	457940	But remember, these commands,
457940	461080	not just for turning on and off the lights,
461080	464220	it also controls the configuration,
464220	466020	the main configuration of the lights,
466020	468900	and the buttons, and everything you can think about.
468900	470460	So, this is insane.
470460	473780	And, well, I tried to fix it.
474980	479420	And, yeah, and all of a sudden, 6 a.m.,
479420	483700	I got this message from my mom sending me that,
483700	486280	well, I hope you guys have fun the other day,
486280	487880	because I woke up 6 a.m.
487880	491220	because all the lights were turning on at the same time.
491300	497280	At this point, we've come to a small conclusion that,
497280	499600	well, the first one is that Barak is not touching, again,
499600	500920	the smartphone devices.
500920	502380	We'll see about that later.
502380	505760	But the second one is that, well,
505760	507600	we need to install new smartphone devices,
507600	508900	because until we do that,
508900	511740	we don't actually have lights, and powers,
511740	513400	and electricity for some things.
513480	516400	So, yeah, okay, new smartphone devices.
516400	517980	And I was excited, because for me,
517980	519020	it's another research to do.
519020	519980	They didn't know that yet,
519980	522860	but for me, it's a whole nother research.
523040	524440	Okay, so let's continue.
526340	530160	So, the new smartphone devices is the HDL automation devices.
530400	532280	And by HDL automation devices,
532280	536920	I actually mean a company which is called HDL Automation.
536980	540360	And this company is a big company, an amazing one, actually.
540620	542460	I must say to them, thank you,
542460	545700	because they helped me a lot through the disclosure,
545700	547020	and working with them,
547020	552060	and they really consider the security highly in this manner and respect.
552160	555340	And also, they have more than 10,000 projects around the globe,
555340	557840	museums, buildings, hotels,
557840	562860	and headquarters of some high priority companies,
562860	565560	and stuff like that, using their systems.
565600	568420	So, even airports, if I didn't say that.
568420	571960	So, it's really, really interesting to investigate these controllers, right?
571960	575180	And they have smart controllers for lights, windows, cameras,
575340	579720	a sensor, anything, anything you even didn't think about it.
579800	580760	Cool.
581360	583660	So, we learned about the HDL automation,
583660	591560	and we've installed in our family home the HDL smart home devices.
591560	594420	Let's now see how the HDL smart home works.
594620	595380	Sorry.
595380	600020	So, the HDL smart home system have three basic components.
600040	603640	The first component is the HDL demo relay modules.
603640	607560	This is the modules which you can observe just right here.
607560	612400	These modules have on the one direction outside the serial,
612400	616880	exactly kind of the same serial you've seen in the Philips Dynalite systems,
616880	623500	with RS-485 connections, which they call BusPro, of course,
623500	628900	because, for example, this BusPro is the complete analogy of the Dynet.
628900	636740	So, this is like the protocols upside on the upper side of the serial connection.
636760	639320	Cool. And this is connected to the IP gateway.
639320	644580	And the IP gateway is actually kind of the same as I built an IP gateway
644580	648240	to adapt between the serial and the IP connection,
648240	651000	from the serial to the internet, to the entire world.
651000	653560	So, they have their own smart devices.
653560	656240	They have their own unique IP adapter as well.
656240	659260	Also, Philips have it, but it was really, really expensive.
659260	662380	This is why I didn't bought it also in the second time.
662380	667280	But in our scenario, my parents thought, okay, it's a good idea.
667280	668920	Let's buy all the things.
668920	675620	And Barack doesn't even have an idea to start and jiggering with this kind of things.
675620	677140	Oh, boy, they were wrong.
677140	681000	And this IP gateway is serial to IP.
681000	684920	And the third bullet was the HDL cloud servers.
684920	690020	The HDL cloud servers are actually used mainly for remote connections,
690020	692000	but not just remote connections.
692000	695160	They're used to store the configuration for the smart home devices.
695160	699140	They're used to connect remotely to things because you have routers, you have firewall.
699140	703920	So, this IP gateway is connected to this HDL cloud servers.
703920	707940	And then when you are online on the internet, you can connect to their HDL cloud servers
707940	714220	with public IP interface so you can reach your devices as well.
714460	721220	And now a little bit deeper about how they install it.
721220	724760	So, first time installation is quite easy and it works like this.
724760	727960	You install the HDL bus for software as a technician.
727960	730900	So, for example, I'm a technician. I'm coming to your home.
731100	735480	I'm installing the HDL bus for software on my desktop machine.
735520	741840	And I connect directly with my PC, my technician PC, to this IP gateway.
742080	743260	It's very cool.
743260	746120	And when I'm connected to this IP gateway with my HDL bus,
746120	748880	I'm starting to configure all these devices.
748880	753140	Because remember, these devices are connected serially to this IP gateway.
753140	756820	So, I connect to this IP gateway and configure all these ones.
758660	763140	And that's what I said. I configure the bus for adapter and I have a configuration.
763140	768600	Now that I have a configuration, I can use this data, this configuration data,
768600	776080	to upload it, for example, to the cloud and save it also on my Android app in other apps as well.
776080	780140	So, what I do next is register a new account in the HDL on application.
780140	782780	This is an Android application of HDL automation.
782780	788620	It's used to control remotely and also locally within the Wi-Fi, these smart home devices.
789060	792220	And when, as a technician, I register this new account,
792220	795440	I also upload the local configuration to the app itself.
795440	797740	So now, remember, I have a phone in my hand.
797740	800540	I register the new account in this application.
800540	805160	And I upload the configuration from this IP gateway or from my laptop,
806060	809340	from the BusPro desktop software to this phone.
809340	811020	I upload the configuration to my phone.
811020	816580	Now the configuration to control everything in my smart home devices is inside my phone.
816700	819600	So, for my phone, I can also connect to the internet.
819600	823040	And this is exactly how I backup my configuration in the cloud.
823040	827520	So, after I have the configuration in my phone, I upload it also to the cloud.
827520	829560	And now it's also kept here.
830060	830580	Cool.
830580	835320	So, what happens when a new user comes in and joins to our game
835320	840240	and wants also to enter these devices and control them?
840240	845820	So, what happens next is that the first time you download the HGLON app.
845820	846400	Why does that?
846400	850140	Because you need to log into the HGL account that has been opened to him
850140	854900	directly in order to control all these dimmers and other devices.
855000	858560	So, we download this HGLON app and you log into the HGL account
858560	861100	that has been opened by the technician.
861540	865420	And what he does next, you can actually bet on that, that...
867260	871380	Well, yes, he download the configuration from the cloud.
871480	875440	And when he download the configuration from the cloud,
875440	880960	he have all the configuration to fully control these devices over here
880960	884280	within the Wi-Fi or from remote.
884280	889240	So, I'm a bit cheating here because there are two possibilities to operate these devices.
889240	895400	And we'll talk about it in the next slide, which is the remote and the local mode.
895400	901580	So, we can operate this HGL system in a remote and local connection.
901580	906500	And the difference between them is that the local connection is accessible from Wi-Fi.
906560	910040	Usually only from Wi-Fi and local networks.
910220	916300	And the remote is accessible from the wide internet and from anywhere inside the world.
916300	921640	And usually, it makes a real sense that we want to make a remote control connection about it.
921640	925700	Well, we want to be able to...
925700	931220	For example, I have an air conditioner and I want to control this air conditioner before I get on
931220	934280	because it's really, really hot today and it's a summer.
934400	938300	So, I would love it to be operated before I get back home, right?
938400	940000	And this is really a cool thing.
940000	944820	And at first time installation, the technician actually choose whether
944820	948960	to enable and allow remote connections or not.
948960	954700	And usually, many times, because of the reasons I mentioned, the remote connection is enabled.
955060	956820	And this is really interesting.
956820	965400	Remember that in any scenario, we are using the HGL cloud service.
965400	968680	Because in the first scenario of the Wi-Fi local connection,
968680	972320	we still backup our configuration for new users to come.
972320	977460	And on the remote connection mode, of course, we use this cloud service to connect back to us.
977460	981560	So, the third point, the third bullet is always used.
981560	984620	The HGL cloud servers are amazing, super interesting.
985800	987540	Yeah, Internet of Things.
987540	992140	Now, let's add Wi-Fi to all the things and let's see what happens.
993040	993840	Cool.
993840	995660	So, the focus of my research.
996080	998280	Yes, we can research one and two.
998660	1004020	But first, my family will kill me again if I will destroy all their smartphone devices
1004820	1007440	using the connection to the one and two bullets.
1007460	1011440	And the second reason and the most relevant one, because I love your family,
1011440	1015720	but it's not that exciting and relevant.
1015720	1018680	The most relevancy is the hardware.
1018680	1022040	The hardware and the software can be really device dependent.
1022040	1026940	And it will take a lot of time to investigate and research any specific device.
1026940	1031860	Because each device has its own capabilities, own serial connection, own things.
1031960	1036300	And to reach the point you can really research and find vulnerabilities,
1036300	1040000	takes much more time and much more time from other things,
1040000	1044980	which are publicly known as cloud servers or websites.
1045040	1048240	So, of course, I thought that the Azure cloud server,
1048240	1052440	which are a critical bottleneck in these connections,
1052440	1055840	are really, really an interesting and a great idea to investigate.
1055840	1061440	And also, when you think about a seesaw, a seesaw view or a view of some people that
1061440	1067740	works for the network security and the integrity of the network,
1067740	1073400	you might think that what you need to defend might be, not always,
1073400	1078900	is from the outside, from arbitrary outside, and from the inside, from specific devices.
1078900	1085100	But in this scenario, this cloud server might be okay, might be whitelisted, fully whitelisted,
1085100	1090400	because this cloud server is just connecting to these devices,
1090400	1095580	just connected to your devices, to your certified devices you put in your systems.
1095640	1100780	But you need to understand, even as someone that works for security,
1100780	1104740	that the bottleneck can be also outside your organization.
1104740	1109720	And also, in the third bullet, in servers that you don't even have the code for them,
1109720	1112280	and you don't even know what they're actually kind of doing.
1112280	1115620	So this is really interesting in the point of focus as well.
1115620	1119620	But we speak about focus a lot. Let's now speak about the cloud server.
1119620	1124020	So a starting point for this is the HGLON app, how it works, the HGLON app.
1124020	1126740	So first is the login screen, yeah, nice login screen.
1126740	1131440	You can see a simple login here, and a sign-up button also,
1131440	1134880	and the forgot password mechanism, which is really cool.
1135440	1140140	And also interesting, forgot password actually is working the same as you think.
1140140	1147260	It sends you a reset link to your email, and you can click on this link,
1147260	1149260	and immediately go to this link.
1149260	1155840	But the URL in the forgot password was really, really interesting.
1155940	1157490	And we'll speak about it later.
1158100	1162180	Sign-up. Sign-up includes... you can enter either phone or an email,
1162180	1167280	and you can also add the password. Well, you should add the password.
1169440	1173520	And then you have all your things enabled.
1173720	1178570	And after that, you can upload from the app the configuration you have.
1178570	1181250	Remember this IP gateway, where I configure all this stuff,
1181250	1185470	so I can upload the configuration from this IP adapter to my phone.
1185730	1189150	And from there on, I can upload this to the cloud.
1189150	1193110	And I can also download cloud configurations using this app
1193110	1196830	to configure my system, my application,
1196830	1200210	to control these devices in my Wi-Fi network and stuff.
1200530	1202390	So this is the sign-up.
1202810	1206290	Well, enough chitchat. Let's talk about vulnerabilities.
1206290	1209070	So the first vulnerability, really cool.
1209070	1212360	Account takeover number one, or let's forget our password together.
1212730	1215270	So let's forget our password.
1215270	1219030	I click on the forgot password, and I got this following link.
1219210	1226590	Well, this seems like a nice, naive link that doesn't going to affect anyone, right?
1226750	1232290	Well, the main thing you can see here and observe, I'll make sure you understand that.
1232290	1236630	Well, there are a couple of parameters, really, really interesting.
1236630	1238570	The first one is the time.
1238670	1241950	Time seems like just the time in some format.
1241950	1244750	An email, which is actually my email.
1244750	1248210	The email that I want to reset the password now for.
1248450	1251950	And this parameter and these kind of parameters as well.
1252150	1254470	And this is really, really interesting,
1254470	1262270	because you can think that maybe something random should be placed there, right?
1262270	1265710	Something random that I couldn't fake this kind of link.
1266690	1271230	You could also think that if I change this email to any arbitrary email,
1271230	1273110	it won't work, right?
1273110	1275790	It will be verified in some manner,
1275790	1279970	and they won't let me change the password for any arbitrary user.
1279970	1280850	Come on.
1280850	1282450	Well, they did.
1282450	1290930	They actually did let me change any user password by its email to any user.
1290930	1292630	The way to exploit it,
1292630	1295590	for example, if I'm thinking hacker-wise,
1295590	1299230	is to do forget password to my email account,
1299230	1301670	get this link, okay,
1301670	1305950	and change only the email, the email area, to the victim emails.
1306450	1311450	And from there on, I get fully authorization to change its password.
1311450	1314050	This link needs to change the password of this user.
1314050	1315310	I can fully change his password.
1315310	1316170	Really cool.
1316330	1317070	And it works.
1317070	1317810	Perfect.
1318930	1321430	So, let's do it again.
1321430	1323270	So, account takeover number two.
1323270	1327050	Or maybe let's forget our password again.
1327330	1330410	And how can we do it?
1330410	1334730	So, let's forget now about the users I already showed you,
1334730	1338770	about the users and the forgetting the passwords again.
1338770	1343210	And now let's focus about other thing that's called the technician user.
1343230	1346550	The technician user is the user that is automatically generated
1346550	1349610	when the user register with its email.
1349610	1352490	So, when the user first time register with an email,
1352490	1355150	for example, a technician, install the system,
1355150	1357430	and register your HDL account,
1357430	1363030	what he's doing is actually also opens up automatically a technician user
1363030	1367010	with the same password as the username, as the original user.
1367010	1370730	For example, I open register with this email at mymail.com.
1370730	1376070	It is automatically also open a technician user at email-debug at mymail.com.
1376870	1379150	And this is really interesting now,
1379150	1382810	because the technician user is able to change settings
1382810	1387910	and control all system configuration of the smart home devices as well.
1387910	1391830	And this can be really bad, right, if we can hack this technician user.
1391830	1393930	We can also change the cloud configuration.
1393930	1396190	We can also do many, many more things.
1397210	1404250	In these times, I usually ask the crowd if they know how to hack this system.
1404250	1408810	I guess some of you actually understand where I'm going to,
1408810	1411090	and it's actually really working.
1411090	1414970	So to exploit and to take over any technician user,
1414970	1417370	what we need to do is to find the victim email,
1417370	1419570	let's say victim at mymail.com,
1419570	1426570	and open a new email at this mymail.com service at victim-debug at mymail.com.
1426570	1430450	So I open this new email account, and I have it.
1430450	1434230	And yes, what I will do next is just forget my password.
1434230	1439630	I click on forget password for this victim-debug at mymail.com.
1439630	1441910	And when I do reset password to this account,
1441910	1448750	I will be sending... they will send to me their email of link reset,
1448750	1450350	the reset of the password.
1450350	1457390	So I actually can change the victim-debug at mymail.com password.
1457390	1462050	So I actually can get access to all the technician features.
1462050	1464330	I can access the technician user.
1464710	1467510	Just to conclude, and to make sure everyone is with me,
1467510	1473110	what I'm doing is I'm opening another account for the technician email
1473110	1475710	at victim-debug at mymail.com.
1475710	1479750	And I call the reset password for this email.
1480150	1483210	And this is really cool, and it's working.
1483210	1494550	And the reason it's working is because they don't verify this email is not a valid email,
1494550	1500970	and they shouldn't send a forget password to this technician users at all,
1500970	1505170	or even find another way to put users for the technician,
1505170	1507970	which is not relevant with this dash-debug.
1508610	1515430	Yes, it's really worked, and it made me to take over any account of, well, technician accounts.
1516410	1517230	Very cool.
1517230	1519570	It's working for some providers, not all of them.
1520130	1524250	I feel in the sense that some of them replacing dash with another,
1524250	1529110	so it can probably be bypassed even in mails that doesn't allow dash in their username,
1529110	1530970	but I need to think about it even more.
1531510	1532070	Cool.
1532070	1534990	So now we spoke about the pre-authentication vulnerabilities.
1535050	1537610	Let's see what is happening post-authentication.
1537610	1544190	So let's get our devices and start investigating some several API endpoints.
1544190	1548410	And I actually encountered many API endpoints which are open,
1548410	1552270	and some of them were the device by region list.
1552270	1555710	And the device by region list is a very interesting API endpoint.
1556150	1558250	It comes right after the login.
1558250	1560310	You log in, and you have a device list,
1560310	1566210	and you can actually search this device list by the region name,
1566210	1569810	the region ID, by device ID, by anything you want.
1569810	1571250	So it's really cool.
1571710	1574330	And how you do it, you go to the device section,
1574330	1579630	and the parameters to control is the region ID, device ID, device name.
1579630	1583650	So all of these guys are fully controllable and very, very interesting.
1585650	1589990	So the first try I did was sending this.
1589990	1595370	This was in the post data body of the message I've been sending.
1595370	1602790	And this data was containing the parameters need to be searched for.
1602790	1606630	And as you can observe quite well, there is the SQL injection I tried to put.
1607090	1611970	And, well, yes, it did return to me all the devices in the system.
1611970	1618650	But remember, to find out if there is an SQL injection in the site or not,
1618650	1623810	it's not enough just to test for this kind of screen and to see that I get all the data.
1623810	1625770	I need to do a little bit more than that.
1625770	1631790	And to see that it actually does an SQL statement I fully control of, black box wise.
1632090	1632890	Cool.
1632890	1636710	And so the second try was something like this.
1636850	1638970	And it actually worked again.
1638970	1640890	And I got all the devices.
1640890	1641830	So it's not...
1641830	1646130	And also I tried to make an invalid SQL statement.
1646130	1650830	And what I got is that I get a response, an error response,
1650830	1653350	specifically on invalid SQL statements.
1653350	1655070	So, yes, I have an SQL injection.
1655070	1656210	Very, very cool.
1656210	1657290	I get in all the data.
1657290	1659450	All the data not in the DB.
1659450	1661950	All the data I have on my devices.
1661950	1668650	So there is some way to gain control and to get all the data of the HDL database.
1669130	1671710	So why not extract more data, right?
1672070	1674250	Well, problems.
1674250	1681610	Some of the problems is that the return columns and specifically the ASP parser.
1681610	1686110	So the server, as far as I tell you, it's the HDL cloud servers.
1686230	1688970	They have ASP server inside of them.
1688970	1689930	Windows server.
1690030	1694230	And this ASP parser checks the validity of the return columns.
1694330	1699810	So, for example, if I do a union SQL injection, I need to verify and validate that all my data
1699810	1703290	return is correctly to the manner of the ASP parser.
1703290	1706210	And if it's not, I wouldn't be able to pass and get my data.
1706210	1707350	I just get in an error.
1707350	1708350	Error response.
1708350	1709470	Nothing happens.
1709470	1714990	And, well, yes, you might think to yourself, well, let's do blind SQL injection, right?
1714990	1719130	Let's do, like, SQL timed SQL injection, something like that.
1719130	1720910	But it's not that easy.
1720910	1726250	Because I am bounded in this scenario by not sending so much data.
1726250	1732210	Well, first thing is that I didn't want to alert the system.
1732210	1734090	I didn't want to bomb the system.
1734110	1739150	I didn't want to stress the system or to do anything like that, in a sense.
1739470	1747170	And, well, and the second thing is that even if I do I will do it, it can take a lot of
1747170	1747490	time.
1747490	1755370	Because I have more than 11 columns returning from the SQL injection, from this SQL query,
1755370	1758350	not the injection, from the SQL query, more than 11 columns.
1758350	1765830	Which means almost 4 million queries were required to inspect all the relevant types
1765830	1766550	and values.
1766550	1771670	Remember, the ASP parser also checks for the validity even of the ranges of some of the
1771670	1773370	values returned.
1774570	1775390	Yes.
1775450	1780490	And also it's worth mentioning that, well, I didn't use VPN.
1780930	1786670	And it's a really good reason not to, like, jiggle with the site and try to brute force,
1786670	1788350	like, arbitrary sites.
1788690	1791270	So, yeah, not a good idea.
1791270	1792710	Don't try it at all.
1792790	1795790	And so this is the blind SQL injection idea.
1795790	1800150	As I told you, even timed or parser error, yes or no, will take a lot of time.
1800670	1801710	Cool.
1801850	1806850	But let's forget about this SQL injection.
1806850	1809870	Let's think about another way to bypass the ASP parser.
1810070	1816830	You all must agree with me that if I find another SQL injection that returns much, much
1816830	1823210	less columns, I could go over all the possibilities with this union SQL injection or something
1823210	1830110	and finding out the relevant order to make it work and to return all the data and bypass
1830110	1831210	the ASP parser.
1831210	1834010	So this is exactly what I was going for.
1834010	1838710	So to bypass the ASP parser, I was going to the... you remember the device name.
1838710	1841910	This is the original parameter for the SQL injection.
1841910	1848070	I tried to find this device name, the exact name, the exact argument in another API endpoint.
1848890	1850450	And I actually did find it.
1850450	1852390	I find it in the get room binding device.
1852390	1854210	There is the device name parameter.
1854210	1856350	There is an SQL injection there.
1856350	1861190	You go to the room section, you search by the device binding name, and voila, you have
1861190	1862470	an SQL injection.
1862490	1863330	Very cool.
1863330	1865130	SQL injection in the same argument.
1865230	1873490	And the most amazing thing here is that only four columns are being returned.
1873490	1874650	Only four columns.
1874650	1875590	That's all.
1875590	1877190	And it's really amazing.
1877190	1885710	We can do the permutation over all these options with the possibility to do all of it really,
1885710	1889110	really in short amount of queries.
1891410	1897090	So permutating over columns order and trying the correct way to make it was doing like
1897090	1897590	this.
1897590	1903770	So here you can see the union SQL injection, and here you can see and observe the parameters
1903770	1904950	I've been put.
1904950	1910250	And I just scrambled and permuted this one any time and tried to see if it works.
1910250	1913490	And I also increased the number of columns because I didn't really know the number of
1913490	1914170	columns.
1914170	1917090	But I knew it was around four.
1917290	1918790	I say only four.
1918790	1919190	I'm sorry.
1919190	1924150	It's like it was really around four because I seen that the number of columns was four
1924150	1930470	in the data, but it could be maybe one more for the ID or the key saved in the SQL.
1930470	1932450	But it was eventually four.
1932450	1934310	So it doesn't really interesting.
1934310	1936090	And I found that this is working.
1936130	1942330	And to conclude all of this, it was quite amazing to see that I'm getting all the database
1942330	1948070	with one single query, one single SQL injection to rule them all, bypassing the ASP parser
1948070	1954850	and getting all the database, all the things as well.
1954850	1955810	Cool.
1955810	1961270	So at this point, of course, I reached the HGL automation company.
1961850	1967410	I did fully coordinated disclosure with them, worked with them silently and helped them
1967550	1968050	a lot.
1968050	1969790	And they also helped me.
1970590	1974030	They were really enthusiastic about helping and securing the system.
1974030	1975750	So it was great for them.
1976630	1981570	But let's now speak about how we can hack into any arbitrary HGL user.
1981570	1985390	For example, you have your own, I don't know,
1985390	1988890	HGL account in your smart home in Dubai.
1988890	1993070	Or you have your own smart home in some airport.
1993070	1996150	Because there are airports and museums in HGL.
1996150	2003240	So you can actually find a scenario of how you can fully control any HGL account.
2003730	2008260	What we found, the vulnerabilities we have is two SQL injections and two account takeovers.
2008930	2013470	And there are two scenarios to gain full takeover over any user.
2013470	2019350	The first scenario, you know the attackers, you know the victim's email.
2019350	2021310	You know the victim's email.
2021310	2027230	And you just get from the database the hashed, salted password.
2027230	2029430	And you now brute force this password.
2029430	2035110	And when you brute force this password, you can get after some time the password, of course.
2035250	2039610	And the second option is to do one of the takeovers I've mentioned.
2039610	2042890	Actually, the second one, the technician one, is much more silently.
2042890	2049510	When you do account takeover over the technician account,
2049510	2052590	usually the normal accounts use the normal people,
2052590	2057730	the older people that use normal people in the sense of using the system.
2057730	2060810	They use the normal accounts.
2060810	2062630	And they don't use the technician account.
2062630	2065150	Only for configuration and when something gets wrong.
2065150	2068610	So you can connect and take over only the technician account.
2068610	2071130	And it will work silently and no one will know.
2071750	2082210	The second scenario is where you can control any arbitrary HDL user without an email.
2082210	2083490	And now we can do it.
2083490	2085530	For example, you know the company name.
2085530	2088330	You know the phone name of the victim.
2088430	2092290	You know its full name, in a sense, or something like that.
2092290	2097030	So you can scrape through the HDL database and find its account, find its email.
2097030	2104770	And then go back to the first scenario and hack its user by any of these possibilities.
2105790	2107650	Okay, really, really cool.
2107650	2110810	So we can hack any HDL user in the entire world.
2110810	2115050	Let's now go through the security implications to conclude what I've been talking about.
2115050	2118230	So let's start with the easygoing security implications.
2118230	2121390	Not to frighten all the people so much.
2121390	2125170	So the first security implications are the private data leaks, of course.
2125170	2130790	Hash passwords, emails, phone numbers, company names, names in general.
2132730	2136550	Tremendous amount of data.
2136610	2141270	And also the HDL cloud backup configuration is there, which gives us the following.
2141270	2143350	The full smart devices info.
2143350	2145530	And the full smart devices info is amazing.
2145530	2150050	What you see here, what you can observe here, is exactly from the app.
2150550	2157750	You can see that this app can control cameras, TVs, security sensors in other manners,
2157750	2161750	and air conditioners also in the server rooms as well.
2162650	2168110	Internal network IPs can be exposed using these systems as well, firmware versions.
2168110	2173010	Internal network IPs are because they are written inside of the configuration, some of them.
2173010	2177970	And you can actually use some of them to observe and see where are the HDL devices,
2178430	2181010	IPs, and some of them kind of in the sense.
2182190	2183630	And very cool.
2183630	2185410	And also the remote control.
2185490	2189770	So you can actually, again, of course, remote control over these things.
2189930	2194630	And you can adjust, well, as I said before, the air conditioner in the server room.
2194630	2197350	You can make it up to 50 Celsius.
2197750	2202730	I don't think they actually support it, but 35, something like that for a week,
2202730	2205670	would probably destroy the server room, I guess.
2205670	2208310	And also to watch their IP cameras.
2208850	2210310	So it can be really, really bad.
2210310	2211910	Disable some sensors.
2213350	2216190	Now, I'm sorry for that in advance.
2216190	2219670	This is kind of a pure evil, pure evil ideas.
2219670	2225070	But we need to discuss them because we need to understand and realize that the security
2225070	2230510	implications, even if I don't have a full RCE over any kind of device,
2230510	2237930	there are tremendous and high impact and costly impacts over the organizations as well
2237930	2239290	that can be done.
2239290	2243430	And the first one is, well, you can add internal non-exposed IP address.
2243430	2247590	Sometimes they are hiding the gateways that control other systems.
2247590	2252170	For example, hidden security areas, hidden secure rooms and stuff like that.
2252170	2256370	You can actually expose them because there is an auto search functionality in the app.
2256370	2262990	Another thing you can do is you can encrypt all the configurations, remove all the configurations
2263700	2265670	from the AGL app.
2266010	2271250	And some people can do kind of a ransomware and blackmail the companies.
2271250	2277050	And until they won't do it, you won't give them back their possibility to control their
2277050	2280750	system, to control their lights, to control their powers, their RCEs.
2280750	2286110	This can really shut down a company in the logistics, in the industry manner.
2287510	2289110	Logistics manner a lot.
2289210	2293010	Another thing is to use a conditional to affect critical locations.
2293410	2299270	And also something I really love, which is called an hidden trigger attack.
2299270	2300570	What is a hidden trigger attack?
2300570	2304750	So let's, for example, say that we are not in the Wi-Fi.
2304750	2306570	We are not in a local connection.
2306690	2308870	OK, you are smart guys.
2308870	2311270	You block all the remote connections.
2311270	2313410	You keep only the local connections.
2313410	2317710	But remember, the configuration is still on the AGL cloud servers.
2317710	2322310	So when the user will update, and it will update its configuration sometimes, you can
2322310	2327770	actually connect the button, for example, switch on the lights to the button that's
2327770	2336270	also switch and adjust the air conditioner to 35 degrees, 35 Celsius degrees.
2336270	2339950	So you can connect two buttons, for example, to the same button.
2339950	2343190	So the user just opens up the light.
2343210	2345770	But he actually did a lot of other stuff as well.
2345770	2348210	Disabled sensors and did a lot of other things.
2348210	2352250	And for this attack, you don't even need the remote mode connection.
2352250	2356830	Even in the local mode, it can really affect the users in the organization.
2356830	2361170	Because the configuration is still on the AGL cloud backup database.
2361170	2365530	The AGL cloud servers are really affecting the organization as a bottleneck.
2366110	2369930	Also, another thing you can do, you can disable and control other critical sensors.
2370490	2372230	You can disable security cameras.
2372230	2379570	You can disable sensors for overheating, security alerts, and also you name it.
2380970	2382650	Well, this is another idea.
2382650	2385170	This is not a direct security issue.
2385170	2389710	But this is another idea I had in mind, which is exploiting the internal network.
2389750	2393310	For example, I can change a cloud configuration file to a malicious one.
2393310	2396970	Maybe something that does something on the device.
2396970	2402010	Maybe I can exploit the device when they update the configuration file on the device.
2402050	2403290	It can be really interesting.
2403290	2405930	It can be ideas for further research and stuff like that.
2405970	2407230	So this is really cool.
2407230	2413770	And it increased the attack surface to the internal network and to the organization as well.
2414550	2415090	Cool.
2415090	2416970	So we are coming to conclusion.
2417270	2422590	And some of the ideas to continue is, of course, to find a way from the account takeover
2423190	2426750	to getting into the internal network of the organization.
2426750	2427790	Can it be done?
2427790	2429190	How it can be done?
2429190	2430770	Taking over the device.
2430770	2432770	Taking over something like something else.
2432770	2438090	Maybe taking advantage of the way they control the smart home devices in the network.
2438090	2438610	I don't know.
2438610	2439710	You name it.
2440210	2445150	And another thing is to access from the LAN and the Wi-Fi access.
2445150	2448130	For example, I have already Wi-Fi and LAN access.
2448130	2452070	To find an RC over one of the smart devices platform.
2452150	2455850	Specifically, of course, the IP adapter.
2455850	2460810	The IP serial adapter of the HDL gateway devices, which is really cool also.
2461370	2464810	And yes, so many amazing ideas can be done.
2465010	2466550	It can be amazing.
2466550	2471290	I had so much fun working for this project.
2471370	2472970	And I come really to conclusion.
2472970	2479470	I want to thank anyone, starting from the HDL automation company, for fast fix and
2479470	2482430	coordinated disclosure of all the vulnerabilities.
2482430	2484030	HDL automation, you are really great.
2484030	2486190	And I love working with you guys.
2486450	2494170	The second thing is that I wanted to really thank Ofer Peleg, which is the HDL Israel
2494170	2498190	representative, for supporting me along the way and helping me fixing this.
2498190	2501150	He was also an amazing guy.
2501790	2507110	And well, of course, thank you to my family for letting me break in their house.
2507190	2508610	But only one time.
2508610	2509650	Only one time.
2509650	2512490	Hopefully not on the second time, but we'll see about that.
2512490	2516950	And of course, and of course, I'm really thankful for Sentinel One.
2516950	2520750	Sentinel One, thank you for sponsoring and supporting my research.
2522030	2523470	Thank you so much.
2524250	2526550	And well, I think this is it.
2526550	2529430	We are coming to reach to a live questions and answers.
2529430	2536590	So if you want to, if you have any questions about my lecture, or if you want to read my
2536590	2537510	full blog.
2537510	2543030	So first, I wanted to know that my full blog and my full research will be published right
2543030	2545770	now as we speak in the Sentinel Labs blog.
2545770	2550930	So make sure you follow Sentinel Labs and go to the Sentinel Labs website in Sentinel
2550930	2551730	One.
2551750	2557090	And there is my full research with a lot of other code sections and stuff like this.
2557090	2563490	And from now on, I will go to the questions and answers in the Discord channel in DEF CON for
2563490	2564690	more questions and answers.
2564690	2567570	And I'll be happy to answer any questions you have in mind.
2567850	2569490	And thank you all for listening.
2569490	2572430	Thank you all for coming here.
2572430	2576910	And I hope to see you soon in DEF CON in another, even non-Corona events.
2576910	2579050	We can see face to face also.
2579050	2580390	So thank you very much.