start	end	text
1360	9080	Hi everyone! In this presentation, we will tell you about our experiences about IoT hacking.
9380	16300	I will also mention the weakness and misconfiguration that we have identified and can be
16300	26280	detected. But firstly, I want to talk about myself. When I look at myself in general,
26280	35620	there are a few keywords I can use about me. These are co-founder, author, speaker, and trainer.
36520	48280	So, apart from this, there is not much I can say for myself. And I can say I love Wi-Fi hackers.
51460	55280	This place also contains some information about my friends.
55280	63220	Since we cannot make the presentation live and we are in different locations,
63220	67040	I am the only one giving the presentation right now.
69810	78730	Let's start, guys. In IoT hacking research, there is something that everyone is serious about.
79450	87490	How should IoT devices be analyzed? What is the methodology? What tools should I use
87490	97910	in IoT hacking or research? Many, many, many questions like how can I find weakness in
97910	105630	IoT devices? In order to answer these questions, we should be able to look deeply
106360	117960	or understand everything correctly. In this context, the first step is to choose the product
117960	125760	to be analyzed. In order to do this, we should ask ourselves the following questions.
126140	133630	Which industry am I targeting? Which area of the industry I target? For example,
134450	142730	your target in the financial sector may be products used in banks. Your target in the
142730	151550	health sector may be products used in patient rooms of hospitals. If you ask yourself this
151550	162770	question and write down the answer you will have, define your goal. After defining the target,
162770	170590	the product must be supplied. There are several solutions for this. You can contact the manufacturer
170590	177090	of the target product. You can contact the customer using the target product. You can buy
177090	184370	the target product. By using one of these methods, you can contact the manufacturer,
184370	188630	developer, or customer to improve security.
190810	200710	This is the most important step because now your target industry and target area are certain.
200710	209210	You also provided the product. To model this place correctly, we should know
209210	219050	that every product has many properties associated with it. Not that these features
219050	226570	associated with the product itself can actually be used as an attack point against the product.
226890	234710	For this reason, you need to take a piece of paper in your hand and write the feature
234710	244130	associated with the product. You can try it yourself for understanding attack surface mapping.
246710	252310	Once you have correctly defined the attack points, you will need the necessary hardware
252310	260670	and software to perform the associated attack. And as you see, this resource you see in the
260670	267670	presentation will be very, very, very helpful for this. You can find a lot of hardware and software
268240	279490	in this resource. Finally, after all of them, you can start exploiting the product now.
282580	290710	In this presentation, I would like to share the detail of three types and four products.
292390	303780	The first is a robotic assistance. I can say about this target, this is a robot assistant
303780	311360	and it has target features such as Wi-Fi connection, internet connection, and USB inputs, and
311360	321660	you know, and others. And this target and product is used in hospital, restaurant, airport, and
322180	331720	in other possible areas. On this product, we found weaknesses such as privilege escalation,
331720	336440	hidden admin panel, weak password, unsecured communication, and login bypass.
337000	344140	Let's take a closer look at them and understand deeply.
345880	352220	This login bypass in this target, you know, usually on the main screen, there are processes
352220	362420	related to the service of the device. But remember, there was a keyboard input. When you press a fifth
362420	368680	key combination with a keyboard attached here, you can bypass the service screen and access the
368680	378520	terminal directly. After accessing the terminal with the previous weakness, we gather the information
378520	388840	about the device with the uname-e command. Then we saw that there was a kernel weakness and we
388840	396980	increased the authority on the system with the exploit we downloaded from exploit-db.
398040	406800	Another feature is the hidden admin panel in this product. You know, clicking on a particular area
406800	414680	of the screen multiple times opens this screen. If it is also protected by a weak password,
414680	420760	you can directly access it in admin authority. And yes, we did it.
422480	431020	As my authority increased on the product, I started to try different things. And in
431960	438880	analysis, I saw that the product performed firmware and other software updates with
438880	449200	insecure protocols like FTP. And you know, FTP is an insecure protocol and if attacker
449200	459020	there is an environment can sniff and can see username, password, and others in the traffic.
460200	465260	After all of them, I took control of the robots by capturing the information of the server
465260	475560	where the robots were updated. This is now a zombie robot network. We can do anything
475560	487350	on the robots and we can control. This is the second story about the smart scooter.
488030	493510	And I can say about this product, it's a widget
495250	502230	used for transportation purpose. It has a feature that can be targeted such as
502850	511030	smart lock, mobile application, developer, and other ones. And we will talk about it.
511030	521290	And this smart scooter is generally used for short distance transportation like
521730	535250	campus of the university. And I also saw some people use it to carry household items in Turkey.
537210	544770	When we look at this product, we found that there are basically four different attack points.
544770	554210	The most important of this attack point is, of course, the human factor and is ignorant in most research.
557040	563460	Here is the mobile application. There are many functions that can be used as an attack vector
563460	569040	in this mobile app. And in general, every electrical and smart scooter also
569600	580180	solve the same function like reserve. But, you know, you can reserve your scooter, you can
582800	592620	start ringing function, and you can log in, register, reset, you know. And this mobile application
593920	604480	it could be an APK file or API file, you know. And this is singing function.
605020	613920	And at the same time, you can light the device constantly so people around you understand that
613920	622940	someone else found it first. In our study, we have seen that this function can only be triggered
622940	630710	without authorization by the QR code number on this device. We can watch this video.
634170	644550	And we captured mobile application traffic for ringing function. And when delayed
645250	652970	an authorization header from the request, we saw we can
653970	660590	repeat every time this function, not limited, not anything for secure.
667560	676460	And when I analyzed the mobile apps for two different products of the manufacturer, I saw
676920	686000	that they used the same ISK value as hard-coded. And as you see in the presentation screen.
687200	692680	Another weak point is again from within the mobile application, hosting hard-coded information on
692680	699720	mobile application is a common problem. Here, I saw that the secret password information was left
699720	706160	statically in mobile application. And when you analyze any mobile application related with the
706160	718460	smart scooter, you can find the same bug. So in a mobile application penetration testing related
718460	726920	smart hardware, you should check some static information. You can find a lot of hard-coded
726920	737860	information like super password, ISK value. The main weakness here is the human and the devices
737860	745480	that he uses. Therefore, we can expand the attack surface by asking the following question for
745480	756780	developer. Computer connected any Wi-Fi? Connected any USB? He opening every email and download file
757480	767140	or run any file? Operation system is updated? Mobile phone of the developer is jailbreak or rooted?
768200	774000	After this question, we can launch a social engineering attack or hack the wireless network
774000	781160	the person is using. In our research, we saw that there is a weakness here. The developers are very
781160	792360	careless. And this is smart lock user lock and unlock the smart electrical scooter.
792360	797980	It usually has a QR code on it and has multiple energy communication.
798780	804800	It is also the main point associated with the mobile application. The most dangerous point here
805240	813960	is the QR code which does not directly harm the smart scooter vehicle. But we have seen
813960	822660	that it is an attack point for users indirectly. Think like that. You can try to install malware
823440	830600	on the phone with the fake QR code or redirect users to phishing page with the fake QR code on
830600	848830	the smart scooter. And this story about the fifth smart lock, we want to tell you about it in no time.
855140	862540	We can say about this target, this smart lock, it has targeted points such as mobile application,
862540	868580	web service, internet connection, bluetooth low energy communication, firmware and hardware.
869260	880340	All of them are attack vectors for us, for our research. And this smart lock
880340	894260	it could be used in hospital, home, in the smart scooter and you know and others.
896300	901780	There are a lot of weakness here in the smart lock, especially if you are using cloud-based
901780	908080	devices, using your home wireless network, you will lose communication with your smart device,
908600	913980	Wi-Fi does attack. Another point is the wrong authorization may
915880	921340	tough the mobile application so an attacker can control your locks.
923220	927720	The weakness of the product is related to the web service
927720	933960	that the mobile application communicates with. As you can see, there are many related points
934920	944540	and in the Knock Lock API, bind and unbind function is vulnerable,
944540	954300	related with broken authentication. Attacker can bind or unbind, can use bind and unbind function
954300	959780	without any security
964180	974440	restriction, you know. Finally, we have seen that other users' profile information can be
974440	983360	updated without authorization in Knock Lock API. And thanks a lot to Ruchal Labs for their support
983360	985920	and thank you for listening to us.