start	end	text
0	6580	Hello, IoT Village, first and foremost. What it be, what it do. I'm Mark, and boy,
6580	12440	have I got some zero days for you. Now, the reason why I call this talk Assembly Voluntron
12440	17740	isn't just because I'm hacking a robot and it's a cool name, and incredibly clever, too. But also
17740	23020	because there's four unique CVEs in this target, and when they work together, they kind of create
23020	27940	something that's greater than the sum of its parts. Just like a mech you might have heard of.
29300	33780	So, the next thing you might be wondering is, who are you, and why should we care what we have to
33780	40060	say? Well, to start off, like I said, I'm Mark, to which there's really only one natural response.
41680	47740	And you can find me on Twitter, at Ropsicle. And I'm currently a security researcher for
47740	52200	McAfee's Advanced Threat Research Team, which I'll be referring to as ATR from now on, because
52200	57020	it's kind of a mouthful. Now, my focus has been on finding zero-day vulnerabilities,
57020	61540	particularly in embedded systems. So, this talk is really on-brand for me, so to speak.
62140	67540	Now, as for previous experience, I spoke at last year's DEF CON and ICS Village,
67540	75960	so I'm basically a celebrity. Now, for hobbies, I really only do two things. I hack and I squat.
78000	81980	Now, depending on how nice you guys are to me in the Discord channel after,
81980	85120	I might add streaming to that list. But for now, it's just those two.
85920	91640	Okay, so let's move on to the target. Temmie or Teemee, or however you want to pronounce it.
92040	98100	The fact is, it's actually a pretty cutting-edge piece of tech. So, the marketing describes it as
98100	103940	the world's first truly intelligent, mobile, personal robot for your home. That's a lot of
103940	110900	qualifiers. And as you can see here, it's actually a pretty small device. It's about four feet tall,
110900	116360	and it's got kind of like an Android brain. That's like an Android tablet at the top with
116360	121580	like a camera and a microphone and a fully functioning touchscreen. Now, this device
121580	126320	was created by RoboTemmie Global LTD, and they're sort of like a startup company. This is their
126320	131500	first venture into the consumer space. But they actually spun off of a parent company called
131500	137940	RoboTeam, which did military robotics based out of Israel. Now, this thing isn't cheap. It's going
137940	142600	to set you back about two grand, but you do get a lot of hardware for that price point.
142700	147100	So, it has the ability to do remote teleconferencing, thanks to its camera and microphone.
147520	151960	But more importantly, it also has autonomous movement and obstacle detection, thanks to the
151960	158120	various sensors it features, and also the 360 LiDAR. And finally, as you'd expect, it has Alexa
158120	163060	and smart device integration, being a smart IoT device. And you get all the standard things you'd
163060	167460	expect from an Android tablet. Wi-Fi, Bluetooth, it even has a wireless charging pad on the back
167460	175280	that doubles as a coaster, at least for us. So, although RoboTaming likes to advertise their
175280	180480	robot as being, you know, sort of a consumer device, the reality is that it's actually seen
180600	185620	a lot of use outside of that space. So, I think one of the biggest things we've seen recently is
185620	192140	that it's used sort of as a mobile kiosk. So, in places like the Mall of America and the Nautilus
192140	199040	Hotel, and even in certain corporate environments, like TransFighter corporate offices, you'll see
199040	203700	that it serves as an informational kiosk that has the advantage of being able to show people around.
203700	207700	So, instead of just telling people where to find, you know, like Jimmy John's in the mall, for example,
207700	213800	it can actually navigate them there. But perhaps the most important and impactful application of
213800	219480	this robot is in healthcare, especially given the recent pandemic. So, with doctors' visits becoming
219480	224080	more and more, you know, the standards becoming more remote visits and remote, you know,
224080	228420	teleconferencing for doctors' appointments, this has actually seen a lot of pickup in the healthcare
228420	233180	space. So, already we're seeing it being used by places like Trillium Health Resources.
233800	238820	In fact, it's also been picked up by Israel's Ministry of Defense as, like, the de facto
240200	246140	teleconferencing solution for the medical wards throughout Israel. And we also see a lot of
246140	251080	applications in Southeast Asia, of all places, with places like China and South Korea, you know,
251080	255260	ordering hundreds of these units for their nursing homes and medical institutions.
255680	260660	And to accommodate this increased demand, RoboTemy has actually increased production of these units
260660	266400	to about a thousand a month, I believe, just to meet this growing demand in the medical space.
267400	272140	So, now that we know what Temy is, what it's capable of, and where it's being used,
272140	277280	it's important for us to sort of draw a box about what the normal operations of it look like,
277280	283100	so then we can have a lot of fun breaking that box. So, to start off, normal operation of the Temy
283100	288680	is done through a use of its smartphone app, and this is both on Android and iOS.
288840	294680	So, you can call the Temy from it, you remotely control it that way, that sort of thing. And the
294680	298000	registration process for using this app is, basically, you just put in your phone number
298000	301740	and it verifies it, and that's how it identifies you. So, if you reinstall the app
301740	307040	and use the same phone number, it'll still find up your account details.
307520	312820	Now, upon first booting up the robot, which already was a super fun experience unboxing this thing,
312820	318520	but we are prompted to scan a QR code. And this, basically, just turns whatever user scans that QR
318520	325360	code into the de facto admin of that Temy robot. And the admin is only one per Temy,
325360	328200	and they have sort of the highest privileges for that robot.
329160	332860	Now, it doesn't mean that other people can't call your robot or even use it.
332860	338740	Phone contacts that use the Temy app, so phone contacts in, like, your smartphone,
338740	342100	if they have the Temy app installed, they're synced automatically. And this can be done
342100	346280	one of two ways. If the admin has phone contacts that have the Temy app,
346280	349880	they'll be synced automatically to the robot, and the robot will be aware of them.
350400	353960	Alternatively, if you're just a regular user of the phone app, you don't own a Temy,
353960	357640	but you have a friend that does, for example, and they're in your phone contacts list,
357640	361260	you'll be able to call your friend's Temy robot from the app.
361640	366600	And we can sort of show you how that works. So once you boot up the app, if it finds a contact
366600	373280	that owns a Temy, they'll show up down here on the left under your contacts list. So here,
373280	378440	we have a lab phone as one of the contacts that owns a Temy. And by selecting this contact,
378440	382180	you can see the Temy robot associated with it, and even has a button that lets you just call
382180	388020	it straight from the screen. And then once a call is actually initiated, this is sort of the
388020	393580	interface you're presented with. You can drive the robot around, control your audio options,
393580	402460	pretty standard stuff. Now, calling is very much so the primo functionality of this robot. And
402460	407180	really, callers get a lot of control over the device during the call. They get audio and video
407180	411480	feeds from the Temy, but they also have control of its movement, which they can control manually
411480	416380	using the little D-pad you saw, but also has access to all of its saved locations.
417300	421600	So this immediately became a very interesting potential attack vector to us.
421600	427800	Now, the Temy does ring when someone besides its admin calls it. So in that sense, if you just
427800	432740	added someone's phone number that they don't know you, it turns into basically just
432740	438540	trying to cold call a cell phone. There is one exception to this, and the admins can actually
438540	444160	grant certain users in their contacts list special privileges to bypass this limitation.
444380	448060	So if you have like a family that all uses the same robot, and you can't be bothered with having
448060	452980	to pick up on the other end each time, an admin can grant several other users the ability to call
452980	458000	in without having it ring. And this is also done through the phone app. You can just invite new
458000	462300	members and then select whatever contacts you want to be able to control the robot,
462300	468460	whatever they want. So now that we have a good grasp of what the normal operation of this device
468460	473840	looks like, we can sort of get into the spirit of trying to hack this thing now. Now, although
473840	478960	this tech is pretty novel and cutting edge in a lot of ways, the approach we took to ReconnaSense
478960	484840	was fairly standard and typical. So we started with trying to get a local shell on the device.
484840	490660	This was actually super easy and short-circuited by the fact that the device comes with developer
490660	496980	options, which include ADB, or Android Debug Bridge, which allows you to remotely connect to
496980	501660	it like you would an SSH session. So that already made our lives a lot easier for moving files
501660	506700	around and accessing the device at startup. The next thing we tried to do was actually capture
506700	514460	traffic on the device using Wireshark. And during stuff like boot up and during phone calls,
514460	519860	we saw three IPs being hit pretty frequently. One of these mapped to a Yahoo URL. So this is
519860	525680	probably being used for its news app. And then two more mapped to Amazon AWS instances, which while
525680	533100	not surprising, don't really reveal much either. The next thing we did was used our ADB shell to
533100	539920	actually run... sorry, not ADB, that's a little later. We ran an Nmap port scan on the device
539920	544180	to see what the ports it was listening on. Another standard thing you'd do for attack vectors.
544260	550900	And the only port it identified as being open was the port 4443, which Nmap classified as
550900	555280	being used for the service Feros, which is actually related to printing. So this is probably
555420	560060	a false classification. It's more likely that this port is being used as an alternative to the
560060	569120	standard 443 you'd see used for HTTPS. Now, to verify that, we actually used the ADB shell we
569120	574680	had to the device to run Netstat, and actually found that the service associated with this port
574680	581680	is something called com-roboteam-teamy-usa, which looks a lot more like an Android application than
581680	586960	it does, you know, a standard Linux binary. And sure enough, that was the case. By parsing the list
586960	592820	of installed packages on the device, we actually found the APK associated with this Android
592820	599400	application. And using our ADB shell, it was trivial to pull this APK off and start
599400	605780	examining the software. So now that we had access to the software, and we also had access to the
605780	610180	phone app software at this stage as well, because we could just download the APK from the Play Store.
610180	615960	It's completely free, and you don't even need to own a Temi to run it. So we could, you know, start looking
615960	620860	at both of those at the same time. Now, the rest of this is really going to be, like, 80%
620860	626760	reversing and static analysis. That's just sort of the nature of this project. Now, why, you might
626760	634000	ask, why? Well, a great man once said, the road to exploitation is paved with months of staring
634360	643060	a decompiled Java code. That man's name? Albert Einstein. So who am I to argue with that?
645510	654290	Now, once we actually got to decompiling the code, we decided to use a program called JADX.
654310	659550	And JADX was sort of a favorite of ours because it has a functionality of being able to right
659550	665350	click on any symbol and click on it to find usage, which became really important later on.
666630	671290	From there, we had to pick a vector. Now, I don't know how many of you have actually
671290	675630	looked at reversing in a full Android app, but they have massive code bases frequently,
675630	679830	and Temi was no exception. Instead of groping in the dark, we decided that we needed to sort of
679830	686510	hone in on a specific subset of the code to refine our search. In our case, we were already interested
686510	690250	in the calling functionality of the robot, since that would grant us the greatest level of control
690250	697630	entirely remotely. So we began digging through the different libraries that are part of the APK.
697970	702510	After Googling around a bit, the one that jumped out at us particularly was something called Lib
702510	709030	Agora. And this is actually a binary related to the Agora video SDK, which is a third party library
709030	713870	used specifically for video calling functionality. Okay, that's perfect. That's exactly what we're
713870	719710	interested in. So from there, we needed to find an entry point related to the attack vector.
719710	723930	And you can sort of imagine this as being like a strand on like a wool sweater,
723930	727890	the thing you start pulling on to really unravel the whole thing.
728790	734390	So we began by actually pulling up this library in IDA and looking at its exports, and immediately
734390	739490	the function native join channel jumped out at us. It looked like something related to joining a
739490	746290	chat room, for example. Opening up the APK now, we saw the same function with the same signature
746290	752890	appear in the decompiled app. So that was a good sign. So from there, we could use JADX's
752890	758850	find usage feature like about 600 times to sort of begin tracing the code path taken for
759470	766730	starting video calls. Now, at this stage, there really is no more advice or cool shortcuts.
766730	771230	It really is, you just have to draw the rest of the L. You really have to just put in the
771230	776130	legwork to trace the different function calls that are being made in order to get a better
776130	781130	understanding of how the code works. But the fruits of our labor in this case was actually
781130	785590	pretty impressive. It's sort of like staring at the sun, so I'll only show it briefly.
788560	796980	Did you catch that? All right. Let's take a closer look at it. So highlighted in the
796980	802460	different colors near the top are the different entry points for the calling code. So there's
802460	806060	four ways to initiate a call from the phone app, and that correlates to these four.
806060	812300	You can call a phone contact, you can call a robot contact, you can call either contact from
812300	817600	the recent calls list, and if you happen to be a Temi admin, you can also call your specific robot.
818240	824600	Moreover, we decided to segregate these based on the code flow that's either for outgoing calls
824600	830120	indicated in red or incoming calls indicated in blue. And I'm not going to go through this too
830120	835040	deeply because it's sort of massive, but this did serve as a good reference point for a lot of the
835040	841020	reversing we had to do later. Okay. So we have four vulnerabilities to get through, so let's just
841020	845860	jump right into it. The very first one, both chronologically and in terms of complexity,
845860	853180	is the CVE ending in 70. And we can see here that it's categorized as being a use of hard-coded
853180	861560	credentials. And it's present in the Temi Android app. Now, to have a better understanding of what
861560	866200	this vulnerability entails, let's go through the process we used to actually discover it.
866780	874040	So this really consisted of four easy steps. R, T, F, and M. And I do mean that pretty literally.
874080	880400	Just by looking through the Agora documentation for their video calling API, we were able to get
880400	887220	80% of the way to finding this vulnerability. So specifically, we decided to take a second
887220	892300	look at that join channel function we saw earlier. According to the Agora documentation, it has two
892300	898400	required parameters and two optional ones. And this is really all that's needed to join an existing
898400	904900	video call. Now, the first one is something called a token. And it seems that a token, if the user
904900	910500	uses a static app ID, the token is also optional and can be set as null. This was interesting to
910500	917100	us. And the second required parameter for joining a channel is a channel name. This is something
917100	922380	we'll touch on a bit later. For now, we were interested in the static app ID and whether the
922380	928080	Temi was using a token at all. Taking a look at the same function in the code, we found that it is
928080	933660	indeed setting that token parameter to null, which means that it's likely using a static app ID as
933660	939720	indicated in the documentation. Okay, so then we decided to start looking for this static
939720	945000	app ID. Where could it be found? Referring back to the Agora documentation, we found the one function
945000	951740	or the one API call that actually uses it as a parameter. And that's the rtcengine.create function.
952320	957640	And it uses it as a parameter and it describes it as being an app ID issued by Agora to the
957640	962040	developers, which is sort of vague. But after some more digging, we sort of discovered that this is
962040	967280	used as a sort of namespace that segregates different users or different implementations
968000	976100	on the Agora remote servers. So what it means is that you have a set static app ID that's shared
976100	982800	amongst all Temi robots and Temi phone app users. And the app ID ensures that users of that service
982800	991140	can only call other Temi users. They can't call an arbitrary Agora client. So this is actually a
991140	996040	pretty important credential to have access to. Well, since we knew the function that takes it
996040	999880	argument, we decided to look for this function in the Temi's decompiled code.
1000320	1004640	And sure enough, there was the app ID hard-coded directly into the app that's
1004640	1009660	freely accessible at the Play Store and fairly trivial to decompile.
1010320	1015440	So this was already a good start. But really, to exploit this as a vulnerability,
1015440	1021040	we needed not only the app ID, but also the channel name. So we could actually join an
1021040	1028880	potentially. So if we still needed the channel name, how could we get it? Well, by going through
1028880	1034060	that nice little graph I showed earlier, we were able to trace down what function actually generates
1034060	1038220	the channel name. And here it's being called a session ID. But they're really the same thing.
1038800	1044220	And as you can see, this is doing something not too complicated. It's actually just generating
1044420	1050400	a random six-digit value. Now, this is important because, you know, 900,000 possibilities may seem
1050400	1054980	like a lot, but it's well within the range of brute-forceable attack vectors.
1056580	1062080	So in theory, an attacker could use the hard-coded app ID they extracted from downloading the app,
1062080	1067320	which is shared amongst all Temmie installs. And then they could just use a brute-force method
1067320	1073280	to try and guess every single possible channel name. And by doing so, they could potentially
1073280	1078880	intercept every ongoing Temmie call used by any Temmie install.
1079540	1083560	Now, obviously, we couldn't test such a brute-force attack vector against a live production
1083560	1090000	server. But what we could do is we could create a custom Agora app to join a Temmie call just
1090560	1098020	launched locally. And we did this by logging the channel name using ADB. And sure enough,
1098020	1105680	using this custom app, we were able to join the existing call and essentially spy on the other two
1106460	1112320	call members. So thereby proving this is a legitimate attack vector.
1113320	1117940	So the next vulnerability I'm going to discuss is sort of a helper vulnerability.
1118020	1125500	It is classified as an origin validation error, and it is also present in the Temmie Android app.
1127860	1137040	Now, the reason why we call this a helper vulnerability is that it actually is related to
1137040	1144620	the fact that you can modify the Temmie app and it still has full access to all the remote services
1144620	1148980	it uses. It doesn't perform any kind of tamper checking to make sure that it's not running on
1149080	1154740	a rooted device, that the code for the app hasn't been modified in any way. It just isn't aware of
1154740	1160460	that. And the reason we were motivated to even pursue this as an attack vector is that it's much
1160460	1165860	easier to modify an existing code than to start from scratch, but more importantly, the Temmie
1165860	1171500	Android app already has access to all those remote services, which requires some degree of authentication.
1171500	1175800	Instead of trying to extract the keys it's using and whatever other authentication mechanisms
1175800	1181220	from the app and trying to make it our own, we just leverage the existing app and inject our
1181220	1189420	code into it. So the way we'd accomplish this is by first unpacking the APK, which we can do using
1189420	1197200	APK tool. Next, we would search for the particular piece of code that we want to modify. This could
1197200	1201940	be either through the decompiled code or through the various resource files included with the APK.
1202100	1206800	As a proof of concept, we decided to try and change the text for the call button,
1207220	1212840	which we found through some grepping. Okay, so now that we knew which part of the APK we wanted
1212840	1217440	to change, the next thing was to simply make that modification. And that was as simple as pulling
1217440	1222240	it up in a text editor and replacing the string with what we wanted. In this case, we decided to
1222240	1228940	rename it Pwn, give it a little more spice. And the last but not least, we had to repack but also
1228940	1235000	re-sign the app. And the reason why we need to re-sign it is Android does not allow apps that
1235000	1240860	are not signed to be installed on the device. And by modifying the existing app's contents,
1240860	1245200	we invalidated the existing signature. But no worries, since the signature is not being checked
1245200	1250440	by the device, there's no reason why we can't just create our own signature and use that.
1251240	1257000	So the repacking process is once again done using APK tool. And then we create a signature
1257000	1261780	using a combination of key tool and jar signer, as shown here.
1263140	1268340	And the end result was that we were able to successfully change the string on this call
1268340	1273240	button. And perhaps more importantly, modifying the app in this way proved not to impact this
1273240	1278960	functionality in the least, meaning that we could potentially make non-trivial changes and still be
1278960	1284900	able to perform things like calling. Now, exploitation of this vulnerability is a little
1284900	1290000	tricky without spoiling the rest of the presentation, because really its main application
1290000	1294720	is used to help exploit the next two vulnerabilities. So we'll save the discussion for that.
1295240	1304460	No spoilers. Okay. Vulnerability numero trace. So this one is actually missing authentication
1304460	1308960	for a critical function. A little more serious than the last two. And this is actually present
1308960	1314380	in Temi's MQTT broker, which if you don't know what MQTT is, I'm going to give you guys a real
1314380	1321020	quick crash course on it, just so we're all on the same page. So MQTT is a publish-subscribe
1321020	1326200	messaging protocol that's specifically designed for IoT and other lightweight devices. So it's
1326200	1331840	not too surprising to see Temi using it. Now, the way it works is that clients will publish
1331840	1337820	messages to certain topics, and then subscribers to those topics then receive the messages.
1337860	1341680	You can think of it as sort of being like subscribing to a YouTube channel,
1341680	1346100	and then receiving notifications whenever your favorite YouTubers upload, for example.
1347780	1352060	And then the topics themselves are strings that are organized into a hierarchy, and the hierarchy
1352060	1357020	itself is delineated much in the same way that a Unix file system is. So just forward slashes.
1358320	1364000	Now, in terms of the Temi, it uses MQTT for basically all communication between itself,
1364000	1369080	the phone app, and the various cloud services. So you see it being used for things like video
1369080	1374120	call invitations, syncing contacts from the admin, and even, most importantly,
1374120	1377620	privilege management, which is something we'll delve into in the next vulnerability.
1381000	1384640	So let's get into the discovery and exploitation of this vulnerability.
1385100	1389660	How are we using MQTT, and what authentication is not being implemented?
1390420	1394960	Well, we started by looking at the code that was used by the app to subscribe to its call
1394960	1399660	invite topic. After all, we are interested first and foremost in the calling functionality.
1400180	1406320	This is just the topic that either a phone app or a robot will listen on when it receives phone
1406320	1411740	calls, and then the person creating a call for that user will publish a message to that same topic.
1412920	1419220	So in our case, it takes the form... you can see it being invoked here on line 408. That's
1419220	1424660	the actual function that is used to subscribe to that topic. And the topic string itself takes
1424660	1430660	the form client something followed by invite. And that something in the middle is a client ID,
1430660	1437320	or an MQTT client ID, rather. And an MQTT client ID is just a unique identifier for a specific
1437320	1443020	client that's connected to the same MQTT broker. It's a way to identify different users.
1443900	1449580	So this actually gave us an idea. Could we subscribe to someone else's call invite topic
1449580	1457660	if we're able to modify the app? Well, in order to do that, we would need to know their client ID.
1458260	1464920	So we would need to somehow get this information. But how are these client IDs even assigned?
1465920	1470360	Well, looking back at how recent calls are initiated actually gave us a clue.
1472040	1476280	So if you try to initiate a call from the recent calls list,
1476280	1481320	this is the call code that gets executed. It invokes a function called telepresence
1481320	1485480	service dot initiate call. And the first parameter is actually an identifier for the
1486200	1491740	contact you're trying to initiate a call with. In this case, it gets that ID by invoking a function
1491740	1497540	called get MD5 phone number. At this point, we were thinking, is it possible that the client ID is
1497540	1504560	just an MD5 hash of the phone number the user used to register? We decided to verify this theory.
1505440	1510920	So we did this simply by taking the Google voice number we used for our Temi admin,
1510920	1516460	computing the MD5 hash, and then searching for that exact hash in all the various Temi files
1516460	1520520	we had. And sure enough, we got a hit in one of the logs we recorded during a call.
1520520	1525200	And it classifies it right there as client ID. Seems pretty straightforward to me.
1527080	1532600	Now, at this stage, we decided to modify the app, taking advantage of the previous vulnerability
1532600	1538740	we outlined. And using this technique, we were able to successfully subscribe to another user's
1538740	1543060	call invite topic instead of our own, which basically meant that every single time they
1543060	1547840	received a call, we would get that same call. And the only thing we needed to make this happen
1547840	1553200	is the victim's phone number, which telemarketers will constantly remind us is not a high bar.
1554800	1559920	Okay. So getting to the last and easily the most impactful vulnerability.
1560780	1565420	This one is an authentication bypass using an alternate path or channel.
1565420	1569840	And this is present in the Temi's REST API, which is something we'll cover as well.
1571380	1576540	Now, in order to understand the authentication bypass, we first need to understand the authentication.
1576700	1579820	And this is related to Temi's privilege management system,
1579820	1584140	which is something I've already sort of touched on with the admin versus regular contacts thing.
1586380	1591400	So we already know about admins. That's just the person that first registers with the QR code.
1591480	1594900	But there's also two other types of privilege levels.
1595900	1600040	Another one is contacts, which are just the default
1600040	1605380	permissions given to a user. It's also the lowest level.
1605380	1611180	Now, there are two ways to become a contact. The first is simply by cold calling the Temi.
1611180	1616380	And the other is through the Temi admin syncing contacts to the robot.
1616620	1622600	We'll be focusing on this latter use case. So the Temi robot actually listens on the
1622600	1627580	topic sync contacts and then followed by its MQTT client ID or its robot ID.
1627580	1633820	They're the same thing. For requests from the admin to sync contacts, as we can see here.
1634780	1638800	Now, the requests themselves have the following structure.
1638800	1643060	They're called... it uses an object of type sync contacts message.
1643060	1649480	And all this contains is a list of contacts and the client ID of the person sending the request.
1649680	1657080	And then the contact list is just a tuples of MQTT client IDs and the display names.
1657220	1662440	Pretty straightforward. And the reason why the sender client ID is included is because the Temi
1663460	1668780	locally ensures that the sender is equivalent to the ID of its admin.
1668800	1673360	Just as a sanity check. Okay. So that's contacts.
1673360	1677640	The third privilege level that's possible is something called an owner.
1678700	1683060	And owners are actually related to that functionality I showed earlier where you can
1683760	1691500	add certain users as an admin and let them call into the Temi remotely without having it ring.
1692740	1700000	So, a Temi admin can send... now, sorry, let me back up a bit here.
1700140	1706340	This is actually a little bit different from adding contacts because while adding a contact
1706340	1712200	is pretty straightforward, adding owners is a little more complex because the request sent
1712200	1717860	by the admin from the phone app is actually quite a bit different than what the Temi expects on the
1717860	1726400	receiving end. So, the admin sends its request to a REST API at the following URL as we can see here.
1727800	1730700	And the requests themselves have the following structure.
1731540	1737140	They contain an inner request and also a signature that's basically generated using
1737140	1742120	the client's private key. It's a way to identify who the origin is.
1742680	1746640	And then the inner request consists of the list of the users...
1749900	1756780	the list of users that we want to promote to owners, the ID of the robot that we're sending
1756780	1762180	the request for, the source of the request, a timestamp, and then finally a type
1764560	1768000	which is simply adding an owner or removing.
1772580	1776540	Now, how is this different from what the Temi expects to receive on the other end?
1776540	1781480	Well, it's quite a bit different. First of all, the Temi is listening on an entirely different channel.
1781880	1788040	While the admin is sending its request to a REST API, the Temi robot is listening on an MQTT topic.
1789460	1796000	This one specifically. And also the structure of the request has also changed.
1796280	1801660	It seems to be a subset of the request that the admin is sending where it still has the list of
1801660	1807320	owner IDs and the type, but has been stripped of its signature, its timestamp, and its source.
1808100	1812540	Now, at this point, we speculated that the reason for this is because the REST API itself
1812540	1820180	is being used as an authentication mechanism for adding owners. This is sort of a sensitive
1820180	1826300	privilege escalation type of deal. And so what the REST API would do is it verifies the
1826980	1832700	request by checking the signature, and then it strips out all that verified information before
1832700	1837580	sending it off to the Temi's MQTT topic, essentially serving as like a middleman.
1839240	1844140	So that means that our flowchart sort of looks like this. And presumably, if the
1845220	1849020	verification server deems the signature invalid, nothing happens.
1849900	1856660	Okay, so these privilege levels mostly have utility in how calling works. So when a Temi
1856660	1863420	receives a call from a user, if that caller is either an admin or an owner,
1863420	1869560	the Temi will pick up the call automatically. On the other hand, if the caller is a contact,
1869560	1874800	it'll ring. So unfortunately, as an attacker, if we just tried to cold call a Temi,
1874800	1877400	we would become a contact, and the Temi would ring.
1879020	1884100	What do we want? Well, we want to be able to call the Temi and have it pick up automatically.
1884600	1888800	This is because calling is sort of the endgame. You know, you get full control of the
1889500	1892580	Temi's movement and also audio and video feeds to it.
1894560	1899040	So what do we already know and what do we already have that can help us get there?
1899500	1903800	Well, we do know that the Temi uses MQTT for calling and privilege management.
1904380	1908820	And we know that we can subscribe to arbitrary topics, like we showed when we subscribed to
1908820	1915520	someone else's call-invite topic. So our next question was, can we also publish to arbitrary
1915520	1921700	topics? Because if we could, we may be able to escalate our privilege by publishing the
1921700	1926500	owner's message that the Temi expects to get from the authentication server directly,
1926500	1931600	and just publish it right to that MQTT topic it's listening on, thereby bypassing that
1931600	1937420	authentication middleman entirely. Well, this all sounds well and good,
1937420	1944900	but there was a slight caveat here. And that was, the Temi will only process privilege escalation
1944900	1949920	requests for existing contacts. Now, why is this a problem? Well, there's only two ways to become
1950060	1955080	a contact, one of which is the cold call to Temi, which is far from ideal because that might arouse
1955080	1960640	suspicion for various reasons, if you have some stranger calling your robot. And then the other
1960640	1965260	way is to have an admin send the sync's contacts message with you on it. Those are really the only
1965260	1971040	two ways. Well, the solution is actually trying... is that's the latter. What we can do is we can
1971040	1976640	actually spoof the admin's sync contacts message by simply setting the sender client ID to the
1976640	1983080	admin's client ID, since the Temi just implicitly trusts that this value is accurate. In this way,
1983080	1988300	we can send a sync contacts message first, followed by an add owner's message, and then finally
1988300	1995220	initiate the call of the robot. So, this is sort of what the same functionality looks like
1995220	2000680	after we've modified the app in the following ways. We can see already that it's a lot simpler.
2002540	2008040	And in order to become a contact, we just send a malformed request. In order to escalate to
2008040	2013900	becoming an owner, we just send another malformed MQTT request. And then finally, unlike before,
2013900	2019580	now that we have owner privileges, the Temi will pick up the call automatically.
2025040	2030860	Now, just as a quick recap of what these vulnerabilities can do together,
2030860	2036180	it's sort of a recipe for disaster. And the recipe includes these following steps.
2036240	2041020	First, you find a vulnerability in the Temi. And then you just find three more.
2041600	2047040	And here's a completely unrelated graphic of a bucket with holes. I just like buckets.
2048340	2053620	The ingredients for this recipe involved just the user's phone number and honestly not much else.
2054280	2060380	And what this produces is the ability to spy on calls, the ability to intercept calls intended
2060380	2065320	for other users, and most importantly, the ability to remotely control the robot and
2065860	2073700	see through its eyes and hear through its ears. Now, I've been teasing you guys enough. So,
2073700	2078120	at this point, I think it's a good time to show you guys a demo of how this all works.
2093530	2101670	So, Shane or Sam, if you guys could queue up the video. Hopefully.
2103690	2105130	Demo is playing.
2105170	2111750	Okay. So, on the left, we have the Temi admin. And on the right, we have the attacker's phone.
2112050	2115670	And we can see that I've already added the admin as a phone contact,
2115670	2120190	thereby syncing it to the Temi's contact list. And the first thing I'm going to do is I'm going
2120190	2128770	install the Temi app. Normally, unmodified, just straight from the Play Store, just to show that
2128770	2133390	there's no smoke and mirrors involved. We'll later be using the modified app with the exact
2133390	2136930	same credentials and going through the same registration process to show you that it
2136930	2140130	really is the vulnerabilities that gives us the greater privileges.
2144010	2147570	So, once we're done registering it, we're just going to attempt to cold call the Temi.
2149330	2152610	And you can see the Temi screen in the bottom center there.
2154930	2159130	Now, as expected, the Temi rings. It does not pick up automatically. This is because
2159130	2163910	we only have contact privileges at this stage. The admin hasn't granted us any special rights.
2171200	2175820	Okay. Now that we know what the normal operation looks like, let's go ahead and install our custom
2176260	2178700	modified app that leverages these vulnerabilities.
2185000	2189000	And right off the bat, you'll see this actually looks very similar to the original app.
2189080	2193420	We only modified what we needed to do. It's not until we initiate a call that we'll see
2193420	2198320	how different it is. So, as I stated previously, we'll be using the exact same credentials to
2198320	2202100	register. And, in theory, we should have the same privileges.
2209220	2212440	All right. Now the registration is done, we'll try initiating the call again.
2212640	2216480	Except this time, it says Pwn instead of Call, so you know it's going to work.
2223560	2226880	This time, the Temi picks up the call automatically,
2226880	2232300	and the attacker now has full access to the Temi's movement, its camera, and its microphone.
2232580	2236700	Now, the first thing an attacker might do is actually mute the microphone, their microphone,
2236700	2241560	I mean, and turn off their camera, thereby essentially remaining anonymous as they do this.
2242000	2246900	And you can start driving around whatever location it's in, looking around at whiteboards
2246900	2252420	and other sensitive information. And you can also, you know, modify its volume to annoy people.
2252420	2256180	But more importantly, you can actually navigate to its various save locations.
2256820	2260820	So here we're going to navigate back to its home base, just so it doesn't run out of battery.
2272980	2276480	So that attack vector leveraged that last vulnerability it described,
2276480	2281380	which gives us owner privileges. Let's look at how we can exploit the
2282660	2285620	previous vulnerability, which had to do with intercepting calls.
2286120	2291240	So first, we'll begin by starting a call from the Temi for its admin.
2291900	2295640	And as normal, you know, all's well with the world,
2295640	2299720	the admin gets the call, but the attacker doesn't. This is expected behavior.
2303880	2308160	But from the HackDAF, with a simple button press, we can change this entirely.
2311660	2317980	By subscribing to the admin's call invite topic, now when the Temi calls it again,
2317980	2323460	both the attacker and the admin will receive the call. And the attacker is free to pick up this
2323460	2328180	and gain the same control over the robot it did with the other attack vector.
2336860	2344920	All right, that concludes the demo. Got a couple slides to finish off.
2346980	2350720	So let's talk about the vendor's response to our research.
2352180	2358200	So we disclosed all four vulnerabilities to RoboTemi Global LTD on March 5th.
2359200	2364740	They responded very quickly, and they were very receptive to all the suggested mitigations for
2364740	2369340	these vulnerabilities that we outlined in our report. But perhaps most importantly,
2369340	2373320	they maintained constant communication throughout the process,
2373320	2376960	working with us to mitigate the vulnerabilities.
2378340	2383380	Speaking of which, all four CVEs are actually patched as of July 15th.
2384020	2388940	And McAfee ATR, my team, has reviewed the patches and has confirmed that they
2388940	2396980	successfully mitigate all four CVEs. Now, all code shown as a result is from the older vulnerable
2396980	2403180	versions of the APKs. In fact, the code is now heavily obfuscated and much harder to parse.
2403300	2408940	And this is sort of the gold standard we seek out in security researcher and vendor relationships,
2408940	2415560	where it's a mutually beneficial thing where the vendor responds quickly and we're able to
2415560	2419900	get these things patched as soon as possible, ultimately resulting in a safer product for
2419900	2429660	everyone. Now, before I let you guys go, I do want to discuss really briefly the various impact
2429660	2436320	scenarios you might see used for these vulnerabilities. I think the biggest one is
2436320	2442380	healthcare. There's obvious privacy concerns whenever you, you know, spy on a potential
2442380	2448100	medical appointment or anything to do with health information. That's why HIPAA is such a big deal.
2448640	2453980	But another potential attack vector might be, you know, using it as a sort of espionage for
2453980	2459220	getting the status or location of persons of interest within a hospital. That might be something
2459360	2465680	a nation-state actor might be interested in. Another attack scenario I want to have you
2465680	2469800	guys think about is the enterprise one. We've already seen that these robots are being used in
2469800	2476420	corporate offices. Now, you know, this actually would grant an attacker access to certain
2476420	2481560	information that simply isn't accessible from a network-based attack scenario. Things like, you
2481560	2487100	know, information posted on bulletin boards, on post-its, on computers. I hope it wouldn't be a
2487100	2492140	password, but who knows? Network diagrams on whiteboards and other sensitive information.
2492140	2496620	And perhaps more obviously, the ability to spy on boardroom meetings.
2496620	2501900	What kind of sensitive information or trade secrets could be listened through? And it's
2501900	2507600	not too surprising to see a teleconference robot being used in a room for teleconferencing.
2508820	2514400	And with that said, that concludes my talk. I will be present in the Discord server to
2514400	2519500	answer any questions you guys have. And thanks for tuning in.