WEBVTT 00:01.360 --> 00:02.900 Hi everyone! 00:02.900 --> 00:09.080 In this presentation, we will tell you about our experiences about IoT hacking. 00:09.380 --> 00:17.600 I will also mention the weakness and misconfiguration that we have identified and can be detected. 00:19.860 --> 00:22.940 But firstly, I want to talk about myself. 00:23.380 --> 00:30.380 When I look at myself in general, there are a few keywords I can use about me. 00:30.460 --> 00:35.620 These are co-founder, author, speaker, and trainer. 00:36.520 --> 00:43.800 So, apart from this, there is not much I can say for myself. 00:44.440 --> 00:48.280 And I can say I love Wi-Fi hackers. 00:51.460 --> 00:55.280 This place also contains some information about my friends. 00:55.280 --> 01:07.040 Since we cannot make the presentation live and we are in different locations, I am the only one giving the presentation right now. 01:09.810 --> 01:12.110 Let's start, guys. 01:12.210 --> 01:18.730 In IoT hacking research, there is something that everyone is serious about. 01:19.450 --> 01:22.650 How should IoT devices be analyzed? 01:22.790 --> 01:25.050 What is the methodology? 01:25.110 --> 01:31.610 What tools should I use in IoT hacking or research? 01:31.610 --> 01:40.110 Many, many, many questions like how can I find weakness in IoT devices? 01:40.110 --> 01:49.890 In order to answer these questions, we should be able to look deeply or understand everything correctly. 01:53.040 --> 01:59.460 In this context, the first step is to choose the product to be analyzed. 01:59.460 --> 02:05.760 In order to do this, we should ask ourselves the following questions. 02:06.140 --> 02:09.660 Which industry am I targeting? 02:09.660 --> 02:12.620 Which area of the industry I target? 02:12.620 --> 02:21.330 For example, your target in the financial sector may be products used in banks. 02:21.330 --> 02:28.710 Your target in the health sector may be products used in patient rooms of hospitals. 02:29.090 --> 02:37.570 If you ask yourself this question and write down the answer you will have, define your goal. 02:40.510 --> 02:45.370 After defining the target, the product must be supplied. 02:45.370 --> 02:48.290 There are several solutions for this. 02:48.510 --> 02:52.290 You can contact the manufacturer of the target product. 02:52.290 --> 02:55.910 You can contact the customer using the target product. 02:55.910 --> 02:59.590 You can buy the target product. 02:59.830 --> 03:08.630 By using one of these methods, you can contact the manufacturer, developer, or customer to improve security. 03:10.810 --> 03:20.710 This is the most important step because now your target industry and target area are certain. 03:20.710 --> 03:23.890 You also provided the product. 03:24.050 --> 03:36.530 To model this place correctly, we should know that every product has many properties associated with it. 03:36.530 --> 03:46.570 Not that these features associated with the product itself can actually be used as an attack point against the product. 03:46.890 --> 03:57.130 For this reason, you need to take a piece of paper in your hand and write the feature associated with the product. 03:57.310 --> 04:04.130 You can try it yourself for understanding attack surface mapping. 04:06.710 --> 04:17.110 Once you have correctly defined the attack points, you will need the necessary hardware and software to perform the associated attack. 04:17.910 --> 04:25.530 And as you see, this resource you see in the presentation will be very, very, very helpful for this. 04:25.530 --> 04:30.210 You can find a lot of hardware and software in this resource. 04:32.710 --> 04:39.490 Finally, after all of them, you can start exploiting the product now. 04:42.580 --> 04:50.710 In this presentation, I would like to share the detail of three types and four products. 04:52.390 --> 04:56.170 The first is a robotic assistance. 04:58.140 --> 05:14.080 I can say about this target, this is a robot assistant and it has target features such as Wi-Fi connection, internet connection, and USB inputs, and you know, and others. 05:14.400 --> 05:24.780 And this target and product is used in hospital, restaurant, airport, and in other possible areas. 05:26.720 --> 05:36.440 On this product, we found weaknesses such as privilege escalation, hidden admin panel, weak password, unsecured communication, and login bypass. 05:37.000 --> 05:44.140 Let's take a closer look at them and understand deeply. 05:45.880 --> 05:56.800 This login bypass in this target, you know, usually on the main screen, there are processes related to the service of the device. 05:57.680 --> 06:01.060 But remember, there was a keyboard input. 06:01.060 --> 06:10.500 When you press a fifth key combination with a keyboard attached here, you can bypass the service screen and access the terminal directly. 06:12.620 --> 06:24.540 After accessing the terminal with the previous weakness, we gather the information about the device with the uname-e command. 06:24.540 --> 06:36.980 Then we saw that there was a kernel weakness and we increased the authority on the system with the exploit we downloaded from exploit-db. 06:38.040 --> 06:43.400 Another feature is the hidden admin panel in this product. 06:43.400 --> 06:51.420 You know, clicking on a particular area of the screen multiple times opens this screen. 06:51.580 --> 06:58.460 If it is also protected by a weak password, you can directly access it in admin authority. 06:58.720 --> 07:00.760 And yes, we did it. 07:02.480 --> 07:10.600 As my authority increased on the product, I started to try different things. 07:10.600 --> 07:22.700 And in analysis, I saw that the product performed firmware and other software updates with insecure protocols like FTP. 07:23.280 --> 07:39.020 And you know, FTP is an insecure protocol and if attacker there is an environment can sniff and can see username, password, and others in the traffic. 07:40.200 --> 07:48.580 After all of them, I took control of the robots by capturing the information of the server where the robots were updated. 07:48.580 --> 07:53.640 This is now a zombie robot network. 07:53.700 --> 07:59.320 We can do anything on the robots and we can control. 08:03.170 --> 08:07.350 This is the second story about the smart scooter. 08:08.030 --> 08:19.130 And I can say about this product, it's a widget used for transportation purpose. 08:19.130 --> 08:27.650 It has a feature that can be targeted such as smart lock, mobile application, developer, and other ones. 08:27.650 --> 08:31.030 And we will talk about it. 08:31.030 --> 08:44.550 And this smart scooter is generally used for short distance transportation like campus of the university. 08:44.550 --> 08:55.250 And I also saw some people use it to carry household items in Turkey. 08:57.210 --> 09:04.770 When we look at this product, we found that there are basically four different attack points. 09:04.770 --> 09:14.210 The most important of this attack point is, of course, the human factor and is ignorant in most research. 09:17.040 --> 09:19.500 Here is the mobile application. 09:20.000 --> 09:24.940 There are many functions that can be used as an attack vector in this mobile app. 09:24.940 --> 09:33.560 And in general, every electrical and smart scooter also solve the same function like reserve. 09:33.560 --> 09:50.840 But, you know, you can reserve your scooter, you can start ringing function, and you can log in, register, reset, you know. 09:51.020 --> 09:59.920 And this mobile application it could be an APK file or API file, you know. 10:00.940 --> 10:04.480 And this is singing function. 10:05.020 --> 10:17.440 And at the same time, you can light the device constantly so people around you understand that someone else found it first. 10:17.440 --> 10:27.860 In our study, we have seen that this function can only be triggered without authorization by the QR code number on this device. 10:28.180 --> 10:30.710 We can watch this video. 10:34.170 --> 10:41.390 And we captured mobile application traffic for ringing function. 10:41.890 --> 11:00.590 And when delayed an authorization header from the request, we saw we can repeat every time this function, not limited, not anything for secure. 11:07.560 --> 11:22.500 And when I analyzed the mobile apps for two different products of the manufacturer, I saw that they used the same ISK value as hard-coded. 11:22.840 --> 11:26.000 And as you see in the presentation screen. 11:27.200 --> 11:35.660 Another weak point is again from within the mobile application, hosting hard-coded information on mobile application is a common problem. 11:35.660 --> 11:42.080 Here, I saw that the secret password information was left statically in mobile application. 11:42.080 --> 11:51.300 And when you analyze any mobile application related with the smart scooter, you can find the same bug. 11:51.660 --> 12:03.880 So in a mobile application penetration testing related smart hardware, you should check some static information. 12:04.680 --> 12:10.780 You can find a lot of hard-coded information like super password, ISK value. 12:12.160 --> 12:20.000 The main weakness here is the human and the devices that he uses. 12:20.000 --> 12:26.660 Therefore, we can expand the attack surface by asking the following question for developer. 12:27.220 --> 12:30.840 Computer connected any Wi-Fi? 12:30.920 --> 12:33.640 Connected any USB? 12:33.640 --> 12:39.860 He opening every email and download file or run any file? 12:39.920 --> 12:42.820 Operation system is updated? 12:42.820 --> 12:47.140 Mobile phone of the developer is jailbreak or rooted? 12:48.200 --> 12:55.660 After this question, we can launch a social engineering attack or hack the wireless network the person is using. 12:55.660 --> 12:59.980 In our research, we saw that there is a weakness here. 12:59.980 --> 13:02.700 The developers are very careless. 13:05.020 --> 13:12.360 And this is smart lock user lock and unlock the smart electrical scooter. 13:12.360 --> 13:17.980 It usually has a QR code on it and has multiple energy communication. 13:18.780 --> 13:23.280 It is also the main point associated with the mobile application. 13:23.280 --> 13:32.780 The most dangerous point here is the QR code which does not directly harm the smart scooter vehicle. 13:32.900 --> 13:38.940 But we have seen that it is an attack point for users indirectly. 13:39.200 --> 13:40.540 Think like that. 13:40.540 --> 13:52.780 You can try to install malware on the phone with the fake QR code or redirect users to phishing page with the fake QR code on the smart scooter. 13:56.170 --> 14:08.830 And this story about the fifth smart lock, we want to tell you about it in no time. 14:15.140 --> 14:28.580 We can say about this target, this smart lock, it has targeted points such as mobile application, web service, internet connection, bluetooth low energy communication, firmware and hardware. 14:29.260 --> 14:37.300 All of them are attack vectors for us, for our research. 14:37.740 --> 14:54.260 And this smart lock it could be used in hospital, home, in the smart scooter and you know and others. 14:56.300 --> 15:10.680 There are a lot of weakness here in the smart lock, especially if you are using cloud-based devices, using your home wireless network, you will lose communication with your smart device, Wi-Fi does attack. 15:10.960 --> 15:21.340 Another point is the wrong authorization may tough the mobile application so an attacker can control your locks. 15:23.220 --> 15:30.340 The weakness of the product is related to the web service that the mobile application communicates with. 15:30.340 --> 15:47.900 As you can see, there are many related points and in the Knock Lock API, bind and unbind function is vulnerable, related with broken authentication. 15:48.360 --> 15:59.780 Attacker can bind or unbind, can use bind and unbind function without any security 16:04.180 --> 16:06.000 restriction, you know. 16:08.760 --> 16:17.640 Finally, we have seen that other users' profile information can be updated without authorization in Knock Lock API. 16:20.120 --> 16:25.920 And thanks a lot to Ruchal Labs for their support and thank you for listening to us.