1
00:00:01,360 --> 00:00:02,900
Hi everyone!

2
00:00:02,900 --> 00:00:09,080
In this presentation, we will tell you about our experiences about IoT hacking.

3
00:00:09,380 --> 00:00:17,600
I will also mention the weakness and misconfiguration that we have identified and can be detected.

4
00:00:19,860 --> 00:00:22,940
But firstly, I want to talk about myself.

5
00:00:23,380 --> 00:00:30,380
When I look at myself in general, there are a few keywords I can use about me.

6
00:00:30,460 --> 00:00:35,620
These are co-founder, author, speaker, and trainer.

7
00:00:36,520 --> 00:00:43,800
So, apart from this, there is not much I can say for myself.

8
00:00:44,440 --> 00:00:48,280
And I can say I love Wi-Fi hackers.

9
00:00:51,460 --> 00:00:55,280
This place also contains some information about my friends.

10
00:00:55,280 --> 00:01:07,040
Since we cannot make the presentation live and we are in different locations, I am the only one giving the presentation right now.

11
00:01:09,810 --> 00:01:12,110
Let's start, guys.

12
00:01:12,210 --> 00:01:18,730
In IoT hacking research, there is something that everyone is serious about.

13
00:01:19,450 --> 00:01:22,650
How should IoT devices be analyzed?

14
00:01:22,790 --> 00:01:25,050
What is the methodology?

15
00:01:25,110 --> 00:01:31,610
What tools should I use in IoT hacking or research?

16
00:01:31,610 --> 00:01:40,110
Many, many, many questions like how can I find weakness in IoT devices?

17
00:01:40,110 --> 00:01:49,890
In order to answer these questions, we should be able to look deeply or understand everything correctly.

18
00:01:53,040 --> 00:01:59,460
In this context, the first step is to choose the product to be analyzed.

19
00:01:59,460 --> 00:02:05,760
In order to do this, we should ask ourselves the following questions.

20
00:02:06,140 --> 00:02:09,660
Which industry am I targeting?

21
00:02:09,660 --> 00:02:12,620
Which area of the industry I target?

22
00:02:12,620 --> 00:02:21,330
For example, your target in the financial sector may be products used in banks.

23
00:02:21,330 --> 00:02:28,710
Your target in the health sector may be products used in patient rooms of hospitals.

24
00:02:29,090 --> 00:02:37,570
If you ask yourself this question and write down the answer you will have, define your goal.

25
00:02:40,510 --> 00:02:45,370
After defining the target, the product must be supplied.

26
00:02:45,370 --> 00:02:48,290
There are several solutions for this.

27
00:02:48,510 --> 00:02:52,290
You can contact the manufacturer of the target product.

28
00:02:52,290 --> 00:02:55,910
You can contact the customer using the target product.

29
00:02:55,910 --> 00:02:59,590
You can buy the target product.

30
00:02:59,830 --> 00:03:08,630
By using one of these methods, you can contact the manufacturer, developer, or customer to improve security.

31
00:03:10,810 --> 00:03:20,710
This is the most important step because now your target industry and target area are certain.

32
00:03:20,710 --> 00:03:23,890
You also provided the product.

33
00:03:24,050 --> 00:03:36,530
To model this place correctly, we should know that every product has many properties associated with it.

34
00:03:36,530 --> 00:03:46,570
Not that these features associated with the product itself can actually be used as an attack point against the product.

35
00:03:46,890 --> 00:03:57,130
For this reason, you need to take a piece of paper in your hand and write the feature associated with the product.

36
00:03:57,310 --> 00:04:04,130
You can try it yourself for understanding attack surface mapping.

37
00:04:06,710 --> 00:04:17,110
Once you have correctly defined the attack points, you will need the necessary hardware and software to perform the associated attack.

38
00:04:17,910 --> 00:04:25,530
And as you see, this resource you see in the presentation will be very, very, very helpful for this.

39
00:04:25,530 --> 00:04:30,210
You can find a lot of hardware and software in this resource.

40
00:04:32,710 --> 00:04:39,490
Finally, after all of them, you can start exploiting the product now.

41
00:04:42,580 --> 00:04:50,710
In this presentation, I would like to share the detail of three types and four products.

42
00:04:52,390 --> 00:04:56,170
The first is a robotic assistance.

43
00:04:58,140 --> 00:05:14,080
I can say about this target, this is a robot assistant and it has target features such as Wi-Fi connection, internet connection, and USB inputs, and you know, and others.

44
00:05:14,400 --> 00:05:24,780
And this target and product is used in hospital, restaurant, airport, and in other possible areas.

45
00:05:26,720 --> 00:05:36,440
On this product, we found weaknesses such as privilege escalation, hidden admin panel, weak password, unsecured communication, and login bypass.

46
00:05:37,000 --> 00:05:44,140
Let's take a closer look at them and understand deeply.

47
00:05:45,880 --> 00:05:56,800
This login bypass in this target, you know, usually on the main screen, there are processes related to the service of the device.

48
00:05:57,680 --> 00:06:01,060
But remember, there was a keyboard input.

49
00:06:01,060 --> 00:06:10,500
When you press a fifth key combination with a keyboard attached here, you can bypass the service screen and access the terminal directly.

50
00:06:12,620 --> 00:06:24,540
After accessing the terminal with the previous weakness, we gather the information about the device with the uname-e command.

51
00:06:24,540 --> 00:06:36,980
Then we saw that there was a kernel weakness and we increased the authority on the system with the exploit we downloaded from exploit-db.

52
00:06:38,040 --> 00:06:43,400
Another feature is the hidden admin panel in this product.

53
00:06:43,400 --> 00:06:51,420
You know, clicking on a particular area of the screen multiple times opens this screen.

54
00:06:51,580 --> 00:06:58,460
If it is also protected by a weak password, you can directly access it in admin authority.

55
00:06:58,720 --> 00:07:00,760
And yes, we did it.

56
00:07:02,480 --> 00:07:10,600
As my authority increased on the product, I started to try different things.

57
00:07:10,600 --> 00:07:22,700
And in analysis, I saw that the product performed firmware and other software updates with insecure protocols like FTP.

58
00:07:23,280 --> 00:07:39,020
And you know, FTP is an insecure protocol and if attacker there is an environment can sniff and can see username, password, and others in the traffic.

59
00:07:40,200 --> 00:07:48,580
After all of them, I took control of the robots by capturing the information of the server where the robots were updated.

60
00:07:48,580 --> 00:07:53,640
This is now a zombie robot network.

61
00:07:53,700 --> 00:07:59,320
We can do anything on the robots and we can control.

62
00:08:03,170 --> 00:08:07,350
This is the second story about the smart scooter.

63
00:08:08,030 --> 00:08:19,130
And I can say about this product, it's a widget used for transportation purpose.

64
00:08:19,130 --> 00:08:27,650
It has a feature that can be targeted such as smart lock, mobile application, developer, and other ones.

65
00:08:27,650 --> 00:08:31,030
And we will talk about it.

66
00:08:31,030 --> 00:08:44,550
And this smart scooter is generally used for short distance transportation like campus of the university.

67
00:08:44,550 --> 00:08:55,250
And I also saw some people use it to carry household items in Turkey.

68
00:08:57,210 --> 00:09:04,770
When we look at this product, we found that there are basically four different attack points.

69
00:09:04,770 --> 00:09:14,210
The most important of this attack point is, of course, the human factor and is ignorant in most research.

70
00:09:17,040 --> 00:09:19,500
Here is the mobile application.

71
00:09:20,000 --> 00:09:24,940
There are many functions that can be used as an attack vector in this mobile app.

72
00:09:24,940 --> 00:09:33,560
And in general, every electrical and smart scooter also solve the same function like reserve.

73
00:09:33,560 --> 00:09:50,840
But, you know, you can reserve your scooter, you can start ringing function, and you can log in, register, reset, you know.

74
00:09:51,020 --> 00:09:59,920
And this mobile application it could be an APK file or API file, you know.

75
00:10:00,940 --> 00:10:04,480
And this is singing function.

76
00:10:05,020 --> 00:10:17,440
And at the same time, you can light the device constantly so people around you understand that someone else found it first.

77
00:10:17,440 --> 00:10:27,860
In our study, we have seen that this function can only be triggered without authorization by the QR code number on this device.

78
00:10:28,180 --> 00:10:30,710
We can watch this video.

79
00:10:34,170 --> 00:10:41,390
And we captured mobile application traffic for ringing function.

80
00:10:41,890 --> 00:11:00,590
And when delayed an authorization header from the request, we saw we can repeat every time this function, not limited, not anything for secure.

81
00:11:07,560 --> 00:11:22,500
And when I analyzed the mobile apps for two different products of the manufacturer, I saw that they used the same ISK value as hard-coded.

82
00:11:22,840 --> 00:11:26,000
And as you see in the presentation screen.

83
00:11:27,200 --> 00:11:35,660
Another weak point is again from within the mobile application, hosting hard-coded information on mobile application is a common problem.

84
00:11:35,660 --> 00:11:42,080
Here, I saw that the secret password information was left statically in mobile application.

85
00:11:42,080 --> 00:11:51,300
And when you analyze any mobile application related with the smart scooter, you can find the same bug.

86
00:11:51,660 --> 00:12:03,880
So in a mobile application penetration testing related smart hardware, you should check some static information.

87
00:12:04,680 --> 00:12:10,780
You can find a lot of hard-coded information like super password, ISK value.

88
00:12:12,160 --> 00:12:20,000
The main weakness here is the human and the devices that he uses.

89
00:12:20,000 --> 00:12:26,660
Therefore, we can expand the attack surface by asking the following question for developer.

90
00:12:27,220 --> 00:12:30,840
Computer connected any Wi-Fi?

91
00:12:30,920 --> 00:12:33,640
Connected any USB?

92
00:12:33,640 --> 00:12:39,860
He opening every email and download file or run any file?

93
00:12:39,920 --> 00:12:42,820
Operation system is updated?

94
00:12:42,820 --> 00:12:47,140
Mobile phone of the developer is jailbreak or rooted?

95
00:12:48,200 --> 00:12:55,660
After this question, we can launch a social engineering attack or hack the wireless network the person is using.

96
00:12:55,660 --> 00:12:59,980
In our research, we saw that there is a weakness here.

97
00:12:59,980 --> 00:13:02,700
The developers are very careless.

98
00:13:05,020 --> 00:13:12,360
And this is smart lock user lock and unlock the smart electrical scooter.

99
00:13:12,360 --> 00:13:17,980
It usually has a QR code on it and has multiple energy communication.

100
00:13:18,780 --> 00:13:23,280
It is also the main point associated with the mobile application.

101
00:13:23,280 --> 00:13:32,780
The most dangerous point here is the QR code which does not directly harm the smart scooter vehicle.

102
00:13:32,900 --> 00:13:38,940
But we have seen that it is an attack point for users indirectly.

103
00:13:39,200 --> 00:13:40,540
Think like that.

104
00:13:40,540 --> 00:13:52,780
You can try to install malware on the phone with the fake QR code or redirect users to phishing page with the fake QR code on the smart scooter.

105
00:13:56,170 --> 00:14:08,830
And this story about the fifth smart lock, we want to tell you about it in no time.

106
00:14:15,140 --> 00:14:28,580
We can say about this target, this smart lock, it has targeted points such as mobile application, web service, internet connection, bluetooth low energy communication, firmware and hardware.

107
00:14:29,260 --> 00:14:37,300
All of them are attack vectors for us, for our research.

108
00:14:37,740 --> 00:14:54,260
And this smart lock it could be used in hospital, home, in the smart scooter and you know and others.

109
00:14:56,300 --> 00:15:10,680
There are a lot of weakness here in the smart lock, especially if you are using cloud-based devices, using your home wireless network, you will lose communication with your smart device, Wi-Fi does attack.

110
00:15:10,960 --> 00:15:21,340
Another point is the wrong authorization may tough the mobile application so an attacker can control your locks.

111
00:15:23,220 --> 00:15:30,340
The weakness of the product is related to the web service that the mobile application communicates with.

112
00:15:30,340 --> 00:15:47,900
As you can see, there are many related points and in the Knock Lock API, bind and unbind function is vulnerable, related with broken authentication.

113
00:15:48,360 --> 00:15:59,780
Attacker can bind or unbind, can use bind and unbind function without any security

114
00:16:04,180 --> 00:16:06,000
restriction, you know.

115
00:16:08,760 --> 00:16:17,640
Finally, we have seen that other users' profile information can be updated without authorization in Knock Lock API.

116
00:16:20,120 --> 00:16:25,920
And thanks a lot to Ruchal Labs for their support and thank you for listening to us.