1 00:00:00,000 --> 00:00:17,560 Welcome to Offensive Embedded Exploitation Getting Your Hands Dirty with IoT and Embedded Devices So, the agenda, before we start with the talk I would like to tell you that I am conducting a training I would like to thank Mr. 2 00:00:17,560 --> 00:00:18,500 Omer and Mr. 3 00:00:18,500 --> 00:00:32,740 Joseph for allowing me to conduct a training with Defcon Red Team Village, which is on Day 1 So, I request you to, if you want if you like this talk, if you want to attend this in a more deeper manner you can attend tomorrow's training. 4 00:00:32,980 --> 00:00:36,940 So, let's start with the agenda of today's talk. 5 00:00:36,940 --> 00:00:55,020 Today, we will first have an introduction to IoT then we will do a preparing the arsenal that is a setting up our requirement then we will have recon, then show time that is a firmware analysis, then getting hands dirty, dynamic testing and lastly we will touch base upon fuzzing, 6 00:00:55,020 --> 00:01:14,340 reverse engineering and exploit development So, let me introduce myself I am Kaustubh Padwad from India also known as Security Beast on Twitter I have dozens of exploits listed on GitHub and CVE details on IoT. 7 00:01:14,340 --> 00:01:37,580 Also, I am a security researcher at Reliance Jio that is Jio Platform now, Jio Platform Limited where we conduct device security testing for all of the Jio Platform devices Also, I am a SINAC Red Team member to keep myself updated and to hack into the toughest infrastructure, 8 00:01:37,580 --> 00:01:51,920 SINAC is a great learning platform and also I do bug bounty there and I like to share my knowledge, so I am a speaker I speak at conferences And now, it's time to get started with the topic. 9 00:01:52,340 --> 00:01:58,460 So, the I have classified IoT in a three style. 10 00:01:58,460 --> 00:02:05,500 One is a industry IoT , second a human IoT and third IoT for others, that is animals. 11 00:02:05,500 --> 00:02:25,080 So, we will see , I have classified here all the industry in this image taken from a source is mentioned Here , I have listed all the industries like manufacturing industry, smart government, mobile network, mobility and Wi-Fi, smart digital citizens, 12 00:02:25,080 --> 00:02:35,140 that is us, then open data, health is a key element in IoT, then smart agriculture and smart building smart transportation. 13 00:02:35,140 --> 00:02:38,600 So, these things are getting smart with the help of IoT. 14 00:02:38,600 --> 00:03:04,060 Major like, for example, a transportation industry, Tesla is building Tesla is the best example for IoT based car even for a logistic, IoT is getting used in very huge manner to track their shipments that to ensure the data, the packages which is shipping should not get tampered they are putting tamper detection based on IoT. 15 00:03:04,060 --> 00:03:16,600 So, it's like simply if someone opens the door, that means it is tampered and as the door is opened, that small IoT device will send generate an alert and send to the respective logistic person. 16 00:03:16,600 --> 00:03:25,320 Manufacturing industries are using IoT to improve their services or to improve their production product qualities. 17 00:03:25,320 --> 00:03:32,720 So, there should be a zero error product development, we can say with the manufacturing industry. 18 00:03:32,800 --> 00:03:43,880 And government, like government should implement IoT In my training, I have an excellent example, which I covered there in my training. 19 00:03:43,880 --> 00:03:53,560 So, let's assume that every city have a street light hundreds and thousands of street lights, which is running from night, which is running whole night. 20 00:03:53,560 --> 00:04:08,200 So, if you install one small IoT module of let's say $5 cost to that light, then that light will become smart and it will turn on only when the vehicle is passing through. 21 00:04:08,200 --> 00:04:12,080 And rest of the time, it will stay in an ideal state, let's say power off state. 22 00:04:12,080 --> 00:04:18,640 So, that $5 module can save your $500 electricity bill for every month. 23 00:04:18,740 --> 00:04:29,440 So, it makes sense of using IoT in government covered areas or government entities. 24 00:04:29,440 --> 00:04:33,860 Mobility and Wi-Fi, they are key provider for the IoT. 25 00:04:33,860 --> 00:04:43,640 As I said in mobility as government needs or let's say if you want to create a IoT environment so, mobility is the best way. 26 00:04:43,640 --> 00:04:49,260 They provide us a NB -IoT, Narrowband IoT and LTE -IoT. 27 00:04:49,300 --> 00:04:53,740 So, these two ways they can provide us IoT connectivity to everywhere. 28 00:04:53,740 --> 00:04:54,980 Health is the key element. 29 00:04:54,980 --> 00:04:56,840 We are discussing this here. 30 00:04:56,840 --> 00:05:07,480 Agriculture, one of my friends have built IoT based water system to his farm. 31 00:05:07,480 --> 00:05:17,860 So, it detects soil dryness, it detects wind speed, it detects temperature and accordingly it turns on his water pump. 32 00:05:17,860 --> 00:05:23,760 So, it will automatically give water to the plants to his farm also. 33 00:05:23,760 --> 00:05:34,520 And smart building, there is an excellent example in the next slide for smart building and transportation as we just talked about Tesla. 34 00:05:34,520 --> 00:05:36,540 Now, in human IoT. 35 00:05:36,540 --> 00:05:40,000 So, devices are getting inside the body. 36 00:05:40,000 --> 00:05:41,740 Like for example, a pacemaker. 37 00:05:41,740 --> 00:05:44,840 Pacemaker is a medical device, medical IoT device. 38 00:05:44,840 --> 00:05:52,520 It's a really critical device in IoT aspect or in any aspect. 39 00:05:52,520 --> 00:05:59,060 And insulin pumps and these are other devices which can be currently using inside the body. 40 00:05:59,060 --> 00:06:02,280 There could be more but as of now I corrected this. 41 00:06:02,600 --> 00:06:12,640 Now, you can trigger insulin shots to your loved ones remotely with this insulin pump. 42 00:06:12,640 --> 00:06:26,180 You can check if there is a what we say abnormal behavior of heart or abnormal behavior inside the body. 43 00:06:26,180 --> 00:06:27,860 These pacemakers are also smart. 44 00:06:27,860 --> 00:06:39,040 They can send data to doctor that it is not behaving good or you can as we know pacemaker is a critical medical device. 45 00:06:39,040 --> 00:06:41,100 It controls your heartbeat. 46 00:06:41,100 --> 00:06:43,700 Now, why cow is here? 47 00:06:43,720 --> 00:06:47,780 So, IoT animals are getting smarter. 48 00:06:47,780 --> 00:06:54,940 So, like if your pet lost direction then there are some patterns which they triggers every time. 49 00:06:54,940 --> 00:07:05,020 If they feel like lost or if they are not let's say you are not with your pet a complete day and suddenly he developed a fever. 50 00:07:05,020 --> 00:07:05,740 Then what? 51 00:07:05,740 --> 00:07:19,520 So, some guys are working on the solution which will be a kind of belt inside their body or inside their neck tied to their neck and that belt will keep analyzing their behavior. 52 00:07:19,520 --> 00:07:20,980 Are they behaving normal? 53 00:07:20,980 --> 00:07:23,160 Are they feeling like lost? 54 00:07:23,160 --> 00:07:25,480 Is their temperature is normal? 55 00:07:25,480 --> 00:07:38,620 So that you can take appropriate care of your loved one pet and you can track your animals also like your pet also that if they are lost or then you can track them. 56 00:07:38,820 --> 00:07:41,820 So, IoT is a major part of our body. 57 00:07:41,820 --> 00:07:48,380 IoT is an emerging field and IoT is too much powerful than we imagine. 58 00:07:48,500 --> 00:07:51,720 So, with the great power, great responsibilities also come. 59 00:07:51,720 --> 00:07:54,820 That we will discuss in a further section. 60 00:07:55,140 --> 00:07:58,040 Now, let's have a look of smart building. 61 00:07:58,040 --> 00:08:02,720 How one can implement IoT in a smart building. 62 00:08:10,100 --> 00:08:12,280 Jing Jing. 63 00:08:14,080 --> 00:08:15,060 Tian Bao Jin Ling. 64 00:08:15,920 --> 00:08:23,600 Tian Bao Jin Ling. 65 00:08:29,820 --> 00:08:33,120 Tian Bao Jin Ling. 66 00:08:42,720 --> 00:08:51,980 The self-check-in machine like the guest mobile check-in like the robot service and Timogeneous voice spatula. 67 00:08:51,980 --> 00:09:00,240 The purpose of this kind of service and technology is to improve the efficiency of the service and the consistency of the service quality. 68 00:09:03,120 --> 00:09:03,700 Jing Jing. 69 00:09:12,700 --> 00:09:14,580 Jing Jing. 70 00:09:14,740 --> 00:09:16,380 Jing Jing. 71 00:09:16,380 --> 00:09:17,760 Jing Jing. 72 00:09:17,760 --> 00:09:18,320 Jing Jing. 73 00:09:18,920 --> 00:09:19,680 Jing Jing . 74 00:09:21,420 --> 00:09:21,640 Jing Jing. 75 00:09:21,640 --> 00:09:22,180 As 76 00:09:25,850 --> 00:09:33,810 you can see, a smart building a brilliant example of smart building IoT in action. 77 00:09:33,810 --> 00:09:38,130 So, I would definitely like to go there and check-in to test the services. 78 00:09:38,550 --> 00:09:42,890 So, with the great news, great responsibilities do come. 79 00:09:42,890 --> 00:09:50,250 So, what I think is why IoT security assessment or why embedded devices security assessment is important. 80 00:09:50,250 --> 00:09:52,410 I have collected some hot news. 81 00:09:52,890 --> 00:10:00,690 This is IoT hot news where we can see multiple threats and risks that currently associated with IoT. 82 00:10:00,690 --> 00:10:04,610 The first and most important risk here. 83 00:10:04,930 --> 00:10:07,870 Risk with IoT in a medical field. 84 00:10:07,870 --> 00:10:23,890 So, when I was a kid, my grandparents used to tell us that there is a witchcraft and there is a black magic kind of stuff which can remotely kill someone. 85 00:10:24,070 --> 00:10:30,030 So, I don't believe on that but here you can see with IoT you can do it. 86 00:10:30,030 --> 00:10:38,310 Let's say, instead of giving 10ml pump shot, if I trigger 100ml pump shot, then who can save you? 87 00:10:38,310 --> 00:10:47,730 Instead of setting your heart rate to the normal heart rate if I set it to 3000 beats per second you will suffer from a major cardiac arrest. 88 00:10:48,030 --> 00:10:54,510 So, as we can see these are inside the body and these are very critical devices. 89 00:10:54,510 --> 00:11:01,730 So, security assessment for these devices must be done in a very aggressive way. 90 00:11:01,990 --> 00:11:09,370 I believe that if such kind of devices are manufactured by a very renowned vendor, it should be tested country-wide. 91 00:11:09,370 --> 00:11:17,690 It should be offered to the expertise all across the globe and then you can ensure that this product is secured or not. 92 00:11:17,690 --> 00:11:21,750 Because everything has a different mindset to test everything. 93 00:11:21,750 --> 00:11:36,150 So, same way Now you brought an IoT product that is a surveillance robot to secure your house and to take care of your loved ones when you are not in the home. 94 00:11:36,230 --> 00:11:40,570 And hackers use that robot for spying you. 95 00:11:40,570 --> 00:11:47,530 Here you can see hackers break into a smart home, play inappropriate music and communicate with a resident via camera. 96 00:11:47,530 --> 00:11:48,990 It's a horrible thing. 97 00:11:48,990 --> 00:11:50,110 It's a scary thing. 98 00:11:50,110 --> 00:11:57,150 If someone is continuously watching you and someone is talking with your speakers only, how would it feel? 99 00:11:57,150 --> 00:11:57,510 Right ? 100 00:11:57,530 --> 00:11:58,650 It's scary. 101 00:11:58,650 --> 00:11:59,810 Super scary. 102 00:12:00,290 --> 00:12:04,530 And this attack it is an industry grade attack. 103 00:12:04,530 --> 00:12:09,790 Someone discovered a remake of Mirai botnet. 104 00:12:09,790 --> 00:12:13,470 It was the OMG attack was discovered by Fortinet. 105 00:12:13,470 --> 00:12:15,430 It was the second Mirai. 106 00:12:15,510 --> 00:12:19,710 So, Mirai is the biggest attack, biggest IoT attack till now. 107 00:12:19,710 --> 00:12:21,150 You can read about it. 108 00:12:21,150 --> 00:12:23,250 It's a really interesting attack. 109 00:12:23,590 --> 00:12:33,670 This is again like you brought a surveillance system to watch your home and that surveillance system is watching is watched by hackers. 110 00:12:33,670 --> 00:12:46,370 So, this device was running one video talk protocol which was sending the audio, which was recording the audio by mic and sending it to the one who connects over video talk to the camera. 111 00:12:46,670 --> 00:12:47,550 It is again scary. 112 00:12:47,550 --> 00:12:48,130 Right? 113 00:12:48,130 --> 00:12:54,190 I believe there should be some system which will ensure that how this product is secure on scale of 10. 114 00:12:54,190 --> 00:12:58,330 So, it will be easy to judge whether we should buy it or not. 115 00:12:58,330 --> 00:13:03,810 Like a product rating, there should be a security rating also should be there. 116 00:13:03,810 --> 00:13:05,430 And this is the major threat. 117 00:13:05,430 --> 00:13:11,510 FDA recalls nearly half of million pacemakers over This is the really critical issue. 118 00:13:11,510 --> 00:13:17,710 So, as you see the life risk is associated with the risk of with the IoT devices. 119 00:13:17,710 --> 00:13:23,770 So, that's why the security assessment of such a product is really crucial and really important. 120 00:13:23,770 --> 00:13:25,790 It should be done right. 121 00:13:26,530 --> 00:13:35,350 Now, my case study for this is can this decent looking IP phone change into a botnet? 122 00:13:35,430 --> 00:13:36,130 What do you think? 123 00:13:36,130 --> 00:13:39,630 You can turn this device into a botnet? 124 00:13:39,810 --> 00:13:43,550 Most of the guys will be thinking how this can be possible. 125 00:13:43,690 --> 00:13:48,550 Or if there are experts who have already played with it, may know the trick what I am going to try. 126 00:13:48,550 --> 00:13:49,030 Right? 127 00:13:49,190 --> 00:13:58,930 Now, one day, one fine day I was thinking about which device should I pick up for the training for this product and which device should I pick up for the brief also. 128 00:13:58,930 --> 00:14:04,650 So, I was staring at IP phone and suddenly it comes in my mind that why not this IP phone only. 129 00:14:04,950 --> 00:14:08,770 As every corporate have IP phone. 130 00:14:08,770 --> 00:14:09,350 Right? 131 00:14:09,350 --> 00:14:13,830 So, let's say our corporate is one of the biggest large corporate. 132 00:14:13,830 --> 00:14:19,910 So, we have at least 40,000 IP phone of same brand inside our office. 133 00:14:19,910 --> 00:14:22,490 And Mumbai is a corporate hub. 134 00:14:22,490 --> 00:14:31,150 So, I guess that there should be more than crores of IP phone will be there in Mumbai of same brand. 135 00:14:31,150 --> 00:14:33,470 I am not talking about multiple brands. 136 00:14:33,570 --> 00:14:42,230 Let's say if vendor X is producing X type of IP phone, that same type of IP phone you will find at least 1 crore IP phone in the city. 137 00:14:42,490 --> 00:14:51,070 And if you target a specific call center, BPO and KPO then their business is IP phone. 138 00:14:51,070 --> 00:14:51,450 Right? 139 00:14:51,450 --> 00:14:55,510 So, if you target that, you will get lots and lots and lots of target. 140 00:14:55,570 --> 00:15:03,090 So, if you are able to remotely compromise one IP phone, you are able to compromise crores of IP phone. 141 00:15:03,090 --> 00:15:08,950 At least same types of crores of IP phone using this technology. 142 00:15:08,950 --> 00:15:21,950 So, if you have hacked two organizations having 50,000 IP phones each, that will create 1 lakh, that creates your 1 lakh bots. 143 00:15:22,430 --> 00:15:24,990 Maybe it could take 8 days, 10 days 15 days. 144 00:15:24,990 --> 00:15:30,170 But within 15 days, you will get 1 lakh computers, 1 lakh bots. 145 00:15:30,170 --> 00:15:32,590 Basically, what IP phone is inside. 146 00:15:32,590 --> 00:15:35,010 It's an ARM machine or MIPS machine. 147 00:15:35,010 --> 00:15:35,570 Right? 148 00:15:35,690 --> 00:15:40,810 So, you may get 1 lakh bots in just 8 to 15 days. 149 00:15:40,810 --> 00:15:47,050 Now, let's say if you target complete city, you may end up with 50 lakhs IP phone. 150 00:15:47,050 --> 00:15:47,530 Right? 151 00:15:47,530 --> 00:15:49,490 In a city you will definitely get. 152 00:15:49,490 --> 00:15:59,970 Now, let's say if you target cities, multiple cities then you can, let's say India have 4 big corporate hubs. 153 00:15:59,970 --> 00:16:03,590 Mumbai, Delhi, Chennai and Bangalore. 154 00:16:03,590 --> 00:16:08,830 So, if you hack even those 4 cities, 4 corporate hubs and Hyderabad also, sorry. 155 00:16:08,830 --> 00:16:15,030 So, these 5 cities, you may end up with at least 5 crores IP phone. 156 00:16:15,030 --> 00:16:27,030 Now, let's assume if that 5 crore IP phone, you are instructing those 5 crore IP phone to make a 10 request per second to the facebook.com So , 5 into 10 is 50. 157 00:16:27,030 --> 00:16:29,530 50 crore request per second to the facebook. 158 00:16:29,570 --> 00:16:32,710 You think how long it can survive? 159 00:16:32,850 --> 00:16:34,410 Let's say any big provider. 160 00:16:34,410 --> 00:16:39,210 Facebook, Google or for how long time it can hold such a load? 161 00:16:39,210 --> 00:16:45,810 Even you can increase a 10 to 20 request per second that is around 100 crore request per second. 162 00:16:45,810 --> 00:16:46,390 Right. 163 00:16:46,470 --> 00:16:48,530 It could be a bigger storm. 164 00:16:48,690 --> 00:16:51,770 And I am just talking about 5 cities of 1 country. 165 00:16:51,770 --> 00:16:59,730 Now, let's say if you target a multiple country with the same attack, you can create a biggest TBPS attack in the history. 166 00:17:00,150 --> 00:17:02,690 So, I build a case study. 167 00:17:02,690 --> 00:17:04,890 How can we make this possible? 168 00:17:06,610 --> 00:17:11,030 But before that, we need to set up our machine to test this. 169 00:17:13,370 --> 00:17:28,670 Most of the time when I give a talk to a conference or seminar or chapters like null chapters or somewhere, they ask me Sir, I want to start with IOT but I don't have enough requirement machines. 170 00:17:29,050 --> 00:17:35,890 So, this is like, you know, you need nothing literally nothing to set up a basic setup for IOT test. 171 00:17:35,890 --> 00:17:42,030 Here I have shortlisted to get started What all you need is a Linux. 172 00:17:42,090 --> 00:17:43,130 Why Linux? 173 00:17:43,130 --> 00:17:49,290 Because Linux is smooth with virtualization of ARM and MIPS devices. 174 00:17:49,290 --> 00:17:56,770 And all IOT devices binary not all, most of the binary work with the ARM technology or MIPS technology. 175 00:17:56,770 --> 00:18:00,430 So, to smoothly virtualize it, you need a Linux. 176 00:18:00,970 --> 00:18:05,630 Secondly, Linux gives you lowest level access to the operating system. 177 00:18:05,630 --> 00:18:18,250 So, if you connect a device to USB port it will definitely give you something like manufacturer, product ID vendor ID, device type ID, something it will give. 178 00:18:18,250 --> 00:18:22,130 It won't tell you like a Windows that unknown device. 179 00:18:22,150 --> 00:18:22,970 Right? 180 00:18:23,030 --> 00:18:24,330 That's why Linux. 181 00:18:24,330 --> 00:18:30,390 And there are more reasons which we are which you may get in a training section. 182 00:18:30,950 --> 00:18:35,110 This device is the JTAGulator. 183 00:18:35,290 --> 00:18:40,750 So, JTAG is an interface which some devices don't have any interface. 184 00:18:40,750 --> 00:18:52,070 No UART no console cable, no USB no LAN port, no WAN port So, in that case what you should use to interact with device. 185 00:18:52,070 --> 00:18:52,250 Right? 186 00:18:52,250 --> 00:18:54,910 Our target is to get into the device. 187 00:18:54,910 --> 00:18:57,450 That is our first target as an IOT guy. 188 00:18:57,690 --> 00:19:06,610 So, in that case what you can do is you can use JTAGulator to connect with the JTAG ports of the device. 189 00:19:06,610 --> 00:19:10,670 Now, you may say why not no JTAG in the device? 190 00:19:10,810 --> 00:19:12,770 Because this is not the case. 191 00:19:12,770 --> 00:19:20,750 JTAG is present in most of the devices because it is used for purely factory debugging process or factory QA process. 192 00:19:20,750 --> 00:19:30,890 Let's say device is an assembly line, it gets manufactured it puts a required data and now before going to production, device needs to run a QA . 193 00:19:30,970 --> 00:19:40,750 So, nobody is going to check manually that hundreds and lakhs and millions of devices with manually checking 1 , 1, 1, 1 pin. 194 00:19:40,750 --> 00:19:41,310 No. 195 00:19:41,710 --> 00:19:50,210 What it do is, it will connect JTAG pins to the device and it will test all the functionality with their JTAG testing suite. 196 00:19:50,210 --> 00:19:51,590 So, JTAG is present. 197 00:19:51,590 --> 00:20:03,070 You may not find the JTAG pins on the device, but you will find a point where you can solder the pins and you can connect a JTAG regulator and identify the appropriate JTAG pins. 198 00:20:03,230 --> 00:20:08,330 Now, as a IoT comes in the mind second thing come is a wireless. 199 00:20:08,510 --> 00:20:10,810 IoT gives you a wireless freedom. 200 00:20:10,810 --> 00:20:17,310 So, like now the device with 2 sensors and 1 server is not connected over wire. 201 00:20:17,410 --> 00:20:19,890 These will be connected with a wireless technology. 202 00:20:19,890 --> 00:20:24,910 For example our ZigBee protocol, Z-Wave protocol. 203 00:20:24,990 --> 00:20:31,890 So, to test this kind of protocol, we need some specific hardware which will identify those frequencies. 204 00:20:31,890 --> 00:20:41,590 So, this API motor is a gadget which can, which allow you to perform a ZigBee test like ZigBee packet injection, ZigBee packet replay attack. 205 00:20:41,590 --> 00:20:47,210 So, you may see building lights, these are controlled most of the lights are controlled by ZigBee. 206 00:20:47,770 --> 00:20:49,650 And connectors, finally. 207 00:20:49,650 --> 00:20:51,350 Seriously, they are life. 208 00:20:51,990 --> 00:20:54,350 Without connector, you cannot test IoT. 209 00:20:54,350 --> 00:21:07,070 We need at least 1 extra LAN card, we need at least 1 WAN card, we need an additional Bluetooth adapter, we need 1 screwdriver set, we need a Skira, because Skira is an all-in-one connector. 210 00:21:07,070 --> 00:21:25,430 So, instead of spending for individual connectors, if you can spend that's fine, but instead of spending on this multiple you can buy 1 Skira connector which supports GPIO communication, which supports JTAG communication, which supports UART communication and also SPI communication. 211 00:21:25,430 --> 00:21:29,470 So, if you buy this 1 product your all problems will get solved. 212 00:21:29,470 --> 00:21:34,410 And lastly to hack the radio frequencies, we need a hack RF device. 213 00:21:34,410 --> 00:21:39,410 So, this is the minimum thing you need to get started with a IoT test. 214 00:21:39,410 --> 00:21:40,250 Ok. 215 00:21:41,030 --> 00:21:44,690 Now, this is a basic setup. 216 00:21:44,690 --> 00:21:46,690 Now, what about advanced setup? 217 00:21:47,690 --> 00:21:48,590 This. 218 00:21:50,510 --> 00:21:52,930 You can buy endless stuff. 219 00:21:53,070 --> 00:21:56,350 As new device will come, you need to buy something. 220 00:21:56,650 --> 00:22:04,790 As new device may have other way to communicate, you have to build your own PCB boards to communicate with that device. 221 00:22:04,910 --> 00:22:11,150 So, there was 1 device which is not directly connected over USB, so there was a mediator chip in between. 222 00:22:11,150 --> 00:22:13,990 So, you have to connect that device to that mediator chip. 223 00:22:13,990 --> 00:22:20,090 That mediator chip was converting those signals into UART and then UART to USB converter and that to laptop. 224 00:22:20,170 --> 00:22:21,770 So, this was the complete setup. 225 00:22:21,770 --> 00:22:24,190 So, there is no limitation for advanced setup. 226 00:22:24,190 --> 00:22:26,690 You can build up to whatever you want. 227 00:22:27,510 --> 00:22:30,390 Now, we are done with the hardware part. 228 00:22:30,390 --> 00:22:31,350 What about software? 229 00:22:31,350 --> 00:22:32,610 Which tools are required? 230 00:22:32,610 --> 00:22:34,170 Are those tools are expensive? 231 00:22:34,170 --> 00:22:35,590 Are those tools are paid? 232 00:22:35,590 --> 00:22:39,570 Are those tools are really too much heavy that one cannot afford? 233 00:22:39,570 --> 00:22:41,970 No, this is not the case. 234 00:22:42,130 --> 00:22:49,070 This I called as a weapons and these are the minimal weapons which are needed for testing. 235 00:22:49,110 --> 00:22:50,270 One is a BinWalk. 236 00:22:50,270 --> 00:22:52,090 So, BinWalk is a great tool. 237 00:22:52,090 --> 00:22:54,510 You can do a firmware extraction. 238 00:22:54,610 --> 00:22:56,690 BinWalk is basically give a firmware to BinWalk. 239 00:22:56,690 --> 00:23:01,670 BinWalk will extract you if there is a uncompressed, sorry unencrypted firmware. 240 00:23:01,670 --> 00:23:02,310 Ok. 241 00:23:02,990 --> 00:23:04,370 We need a Firmadyn. 242 00:23:04,370 --> 00:23:07,410 So, Firmadyn is a collection of multiple tools. 243 00:23:07,550 --> 00:23:20,730 The Firmadyn consists of BinWalk, QMove and Postgres database and it's a properly it's a properly organized framework for emulating the firmware. 244 00:23:20,730 --> 00:23:21,330 Ok. 245 00:23:21,410 --> 00:23:29,610 So, we need a Firmadyn to emulate a device firmware in case you don't have a device and you have only the firmware and you want to test it. 246 00:23:29,810 --> 00:23:32,190 I hope everyone is familiar with it. 247 00:23:32,190 --> 00:23:34,470 It is the great software tool we have. 248 00:23:34,470 --> 00:23:39,110 And we need a Python because most of the tasks we have to do it on repeated basis. 249 00:23:39,110 --> 00:23:43,330 So, to automate that stuff Python is the great and easy to write language. 250 00:23:43,450 --> 00:23:45,790 And lastly, IDA Pro. 251 00:23:45,810 --> 00:23:47,910 So, if you can't afford IDA Pro, it's ok. 252 00:23:47,910 --> 00:23:55,290 You can buy IDA Community Edition or you can use some open source tools like Radare or NSA Ghidra also. 253 00:23:55,290 --> 00:23:58,930 NSA Ghidra is also a great tool to reverse engineer. 254 00:23:58,930 --> 00:24:02,210 But trust me, reverse engineering is the life. 255 00:24:02,210 --> 00:24:08,470 Reverse engineering is the life and reverse engineering is the most important aspect of device. 256 00:24:08,890 --> 00:24:16,410 So, there are few things that comes in the mind when someone asks why you need to reverse engineer the binary. 257 00:24:16,410 --> 00:24:18,570 Hard-coded backdoor account. 258 00:24:18,850 --> 00:24:36,730 Some devices, recently when there is a news called on I forgot the name of that router OS but that router OS is having 7 major issues was recently identified and most of it was a hard-coded backdoor account. 259 00:24:36,810 --> 00:24:38,750 That too listening on a WAN interface. 260 00:24:38,750 --> 00:24:47,850 So, let's say if your device is running a telnet on WAN interface and if there is a backdoor account, you never know how one can enter in your network. 261 00:24:48,310 --> 00:24:50,050 So, this is one aspect. 262 00:24:50,050 --> 00:24:55,890 Second is identifying a critical vulnerability like remote code execution. 263 00:24:55,890 --> 00:24:58,910 As in embedded device, there is very limited space. 264 00:24:58,910 --> 00:25:02,590 So, you have to fit everything in that small space. 265 00:25:02,630 --> 00:25:08,850 So, application logic and application code is inside the web application binary only. 266 00:25:09,090 --> 00:25:31,890 So, to identify that binary the best way is to reverse engineer that binary and get assembly code out of it and then perform assembly analysis to identify where the native vulnerable calls like sprintf or system call fopen, popen kind of calls are in use. 267 00:25:31,910 --> 00:25:35,190 So, to reverse engineer we need a IWP. 268 00:25:36,070 --> 00:25:45,170 Now, let's move towards, once you have set up everything we start with the first stage is always the reconnection of WAN testing. 269 00:25:45,350 --> 00:25:47,890 In IoT also it's not exceptional. 270 00:25:47,890 --> 00:25:49,470 First stage is recon. 271 00:25:49,470 --> 00:25:52,230 I split this recon section into two parts. 272 00:25:52,310 --> 00:25:55,850 First active recon and second passive recon. 273 00:25:55,850 --> 00:26:01,110 So, generally in pen testing we perform active recon first and then passive recon. 274 00:26:01,110 --> 00:26:02,310 Here we have to do reverse. 275 00:26:02,310 --> 00:26:05,630 Like first we have to identify, we have to do a passive recon. 276 00:26:05,630 --> 00:26:16,790 Let's say if you got one device for example this headset and now the manufacturer of this headset is saying that this device does not support a WiFi. 277 00:26:16,790 --> 00:26:18,950 So, how can you ensure it? 278 00:26:18,950 --> 00:26:24,090 Just because he said this doesn't support WiFi, you are going to believe that this doesn't support WiFi. 279 00:26:24,090 --> 00:26:24,830 No. 280 00:26:24,890 --> 00:26:27,330 You have to read their specifications. 281 00:26:27,770 --> 00:26:42,490 So, each device have one unique FCC ID and if you search that FCC ID into the FCC ID database, it will come up with all the specifications are exist with the device. 282 00:26:42,490 --> 00:26:43,010 Ok. 283 00:26:43,010 --> 00:26:49,090 So, sometimes vendor may lie to you that this functionality is not supported at hardware level and they can disable it. 284 00:26:49,090 --> 00:26:56,190 Like this happens with me with one product that vendor was saying, Sir, this device doesn't support WiFi. 285 00:26:56,190 --> 00:27:01,230 And on FCC ID device, they have mentioned that this device supports WiFi. 286 00:27:01,410 --> 00:27:08,970 So, we had a long debate and lastly I ended up with creating custom firmware which loads the WiFi driver. 287 00:27:08,970 --> 00:27:11,050 So, basically they just disabled the WiFi driver. 288 00:27:11,050 --> 00:27:13,990 That's why WiFi is not coming up of that device. 289 00:27:13,990 --> 00:27:14,590 Ok. 290 00:27:14,590 --> 00:27:18,430 So, first we have to do a FCC ID analysis. 291 00:27:18,470 --> 00:27:20,810 Second, documents . 292 00:27:20,810 --> 00:27:24,710 You should ask for as much as possible documents. 293 00:27:25,270 --> 00:27:30,890 So , like that document could be a security architecture document. 294 00:27:30,890 --> 00:27:34,370 That document could be a product data sheet. 295 00:27:34,370 --> 00:27:41,330 That document could be a project description sheet or could be a user manual of the product. 296 00:27:41,930 --> 00:27:42,270 Ok. 297 00:27:42,270 --> 00:27:47,930 So, these are the things that you should do first and then you should touch to the device. 298 00:27:48,150 --> 00:27:53,410 And then once you touch to the device, first thing is to know your device. 299 00:27:53,450 --> 00:27:54,210 Right. 300 00:27:54,250 --> 00:28:01,430 So, if I give you something like you have to test this device, what you will do? 301 00:28:01,430 --> 00:28:11,190 Like in web application, we see what technology it is built on, like LAMP stack is there or what are the directories are in use, what is the server. 302 00:28:11,230 --> 00:28:18,430 So, same way in device security testing or IoT pen testing, we have to identify the multiple entry points to the device. 303 00:28:18,430 --> 00:28:20,830 For example, a LAN port. 304 00:28:20,830 --> 00:28:39,490 In this device, there is a LAN port, there is a console port or there could be a WiFi this IP phone might be using and some like if device is running on Android, there could be a ADB running on it. 305 00:28:39,650 --> 00:28:48,630 Some advanced devices that I told you about Narrowband IoT, they could be using an IDD interface to communicate with the server. 306 00:28:48,630 --> 00:28:50,690 No IP network basically. 307 00:28:50,690 --> 00:28:52,630 No IP data delivery network. 308 00:28:52,630 --> 00:28:53,230 Ok. 309 00:28:53,230 --> 00:29:02,850 And then you can check for the UART, if UART is present, console port is present, if Android is there, then ADB is present. 310 00:29:02,950 --> 00:29:08,850 If classic ports are there, then LAN port is there, console port is there. 311 00:29:09,250 --> 00:29:11,210 So, first thing is to know your device. 312 00:29:11,210 --> 00:29:12,890 How can you interact with that device? 313 00:29:12,890 --> 00:29:16,930 How can your Linux, your pen testing machine can interact with the device? 314 00:29:17,210 --> 00:29:26,350 And once you know that you can interact with device with specific way, you should go through the documents. 315 00:29:26,350 --> 00:29:32,810 So, here are some glimpse that will help you in identifying why document review is important. 316 00:29:32,810 --> 00:29:39,470 So, here in this document, vendor is saying that this device supports SIP version 2 and RTP. 317 00:29:39,470 --> 00:29:43,130 That means this device does not support SIP TLS. 318 00:29:43,130 --> 00:29:44,110 SIP TLS. 319 00:29:44,110 --> 00:29:57,170 So, if someone is able to sit in the MITM attack, he could able to hear your hear your traffic, hear your call which you had word with. 320 00:29:57,170 --> 00:30:00,390 Here you can see this device support TR-069. 321 00:30:00,490 --> 00:30:07,930 So, most of the classic guys who is working on Windows, on Linux, on network pen testing are not familiar with the TR-069. 322 00:30:07,930 --> 00:30:17,010 So, TR-069 is the protocol through which you can provision and reconfigure device completely using ACS server. 323 00:30:19,010 --> 00:30:24,220 And here is a user I am sorry. 324 00:30:24,750 --> 00:30:26,670 Here is a user manual. 325 00:30:26,910 --> 00:30:41,150 That user manual tells us that firmware of device is upgradable, device have a password management, device have a local and remote syslog, device is having auto provisioning using PFTP, HTTP and HTTPS. 326 00:30:41,290 --> 00:30:43,970 And also multi-user level. 327 00:30:43,970 --> 00:30:52,370 So, if owner of device have changed the password from device to admin, admin to admin, admin at 1, 2, 3. 328 00:30:52,370 --> 00:31:02,690 Still, though it's upgradable, still there could be a multiple users like support, like tech, this kind of user you may find generally inside the product. 329 00:31:02,690 --> 00:31:05,210 And their password will be same as the username. 330 00:31:05,210 --> 00:31:10,070 So, this you can identify from the manual itself. 331 00:31:10,330 --> 00:31:13,690 Now, this is one algorithm. 332 00:31:14,230 --> 00:31:19,030 Algorithms, reviewing algorithms is one of the most critical part in IoT. 333 00:31:19,030 --> 00:31:22,630 You may be thinking what we have to do with an algorithm. 334 00:31:22,750 --> 00:31:29,170 So, the practical example for this is, let's say vendor X have decided to produce a router. 335 00:31:29,250 --> 00:31:42,510 So, as per the standard or minimal requirement, all routers Wi-Fi SSID should be unique or Wi-Fi SSID should be random or at least the password to connect that SSID should be random. 336 00:31:43,050 --> 00:31:47,470 So, how you think that for 1 crore devices how you are going to do a password? 337 00:31:47,470 --> 00:31:49,590 You are going to write a C program for that? 338 00:31:49,590 --> 00:31:49,990 No. 339 00:31:49,990 --> 00:31:50,710 Right. 340 00:31:50,730 --> 00:31:57,610 Or even if you write, so you are going to maintain the unique password for every device with you? 341 00:31:57,610 --> 00:31:58,110 No. 342 00:31:58,110 --> 00:31:58,770 Right. 343 00:31:58,770 --> 00:32:03,870 So, what you are doing here is you are using one algorithm to generate a SSID password. 344 00:32:03,870 --> 00:32:18,070 So, basically first 4 digits of your MAC address and last 4 digits of your last 4 digits of your serial number plus current date and time could be a password for SSID. 345 00:32:18,070 --> 00:32:32,130 So, if you search for the Belkin password generation hack password generation algorithm hack, you may come up with a, you may get what I am trying to say here. 346 00:32:32,130 --> 00:32:43,350 So, if they design the poor algorithm just by adding first 4 digits of MAC address last 4 digits of serial number, anyone can generate a password for any device. 347 00:32:43,350 --> 00:32:43,970 Right. 348 00:32:44,030 --> 00:32:46,130 Or MAC address plus date on time. 349 00:32:46,130 --> 00:33:08,430 So, like you know that if vendor X is generating a password based on MAC address and date on time, so what you do is you set a packet capture, you capture a beacon, you get that MAC address first 4 digits and you add a current DDMM format and connect with the password to the SSID if the SSID is on default password. 350 00:33:08,430 --> 00:33:09,030 Right. 351 00:33:09,370 --> 00:33:18,190 So, to ensure that they are not doing such a silly mistake, we have to review the algorithm and lastly, the magic number. 352 00:33:18,670 --> 00:33:20,170 So, what the magic number is? 353 00:33:20,170 --> 00:33:23,310 You know, you found some fault in your device. 354 00:33:23,310 --> 00:33:40,170 For example, set-top box or for example, in any of your device, let's say router, if you are a non-techy guy, you take that router hey man, this router is not working, it's not showing up you take that router to the respective service center. 355 00:33:40,170 --> 00:33:49,050 That service center guy connects to the router and enters some code and in 15 minutes, he will give you that sir, it is working again. 356 00:33:49,050 --> 00:33:51,230 So, how you think it is possible? 357 00:33:51,450 --> 00:34:07,210 So, every device have some specific additional access mode that we called a, what we called it developer mode or debugger mode or engineer mode. 358 00:34:07,210 --> 00:34:13,310 So, to access those modes, you need to enter some secret code which is also generated by algorithm. 359 00:34:13,310 --> 00:34:16,410 So, it calls a magic number generation algorithm. 360 00:34:16,410 --> 00:34:34,230 So, you have to review it like there was one USB which was supporting which is locked to support with specific ISPX for internet provide for internet providing and let's then, you want to unlock it and you want to use it over other network. 361 00:34:34,230 --> 00:34:35,990 So, how you can do it? 362 00:34:36,530 --> 00:34:56,290 You access the engineering mode of that device, you remove that restriction may be a PLM unlock is there, may be some MCC MNC code or white listed inside that device or it could be a single like only name of ISP is written there to latch on this network only if you find. 363 00:34:56,290 --> 00:34:57,910 So, you can easily modify. 364 00:34:57,910 --> 00:35:02,450 So, to access this additional modes, you need this magic number. 365 00:35:02,450 --> 00:35:07,190 So, magic number generation logic should be tough to identify. 366 00:35:07,190 --> 00:35:11,170 Otherwise, once this logic is leaked, you are over. 367 00:35:12,070 --> 00:35:19,270 Now, this is the most interesting aspect of the commentary. 368 00:35:20,290 --> 00:35:22,650 Credentials to access the device. 369 00:35:22,770 --> 00:35:24,170 Here, you can see funny part. 370 00:35:24,170 --> 00:35:27,490 Default PC port connection type is bridge. 371 00:35:27,490 --> 00:35:28,970 Ok, that's fine. 372 00:35:28,970 --> 00:35:34,350 Default username for user mode is admin Sorry, for admin mode, it's admin. 373 00:35:34,350 --> 00:35:35,630 Ok, that's ok. 374 00:35:35,630 --> 00:35:38,430 Default username for user mode is user. 375 00:35:38,430 --> 00:35:40,170 Default password for web is null. 376 00:35:40,170 --> 00:35:40,990 Wow! 377 00:35:40,990 --> 00:35:49,810 Like they set up a complete web UI they set up a user, they set up a password policy and now they are setting password to null. 378 00:35:50,010 --> 00:35:53,430 That means all you need to do is you have to identify the IP address. 379 00:35:53,430 --> 00:35:58,950 Once you identify the IP address, you type admin, you are admin, you type a user and you are a user. 380 00:35:58,950 --> 00:36:00,070 Isn't it so funny? 381 00:36:00,690 --> 00:36:02,970 And here is the default web login port. 382 00:36:02,970 --> 00:36:05,750 So, they are giving you everything in their documents . 383 00:36:05,930 --> 00:36:07,850 So, you should review those documents. 384 00:36:07,850 --> 00:36:11,390 You should search for the word like ENC. 385 00:36:11,390 --> 00:36:14,370 So, if there is an encryption logic, it will pop up. 386 00:36:14,370 --> 00:36:17,650 You should search for the word SECU like secure. 387 00:36:17,650 --> 00:36:24,410 So, security related stuff is there it will pop up because sometimes user manual is of 400 to 500 pages. 388 00:36:24,630 --> 00:36:34,310 To quickly review it as if you are a device tester, you may get limited time of 5 to 10 days to complete one device, a security test. 389 00:36:34,310 --> 00:36:38,230 So, in that case, you need to follow such kind of tricks. 390 00:36:39,850 --> 00:36:42,750 Now, active recon of the device. 391 00:36:42,750 --> 00:36:47,550 So, active recon here is not just the identifying open port. 392 00:36:47,550 --> 00:36:55,930 But when it comes to open port, you should do a port scan of all ports for device because they always use non-standard port. 393 00:36:55,930 --> 00:36:58,150 Here is one device which I scanned. 394 00:36:58,150 --> 00:36:59,710 This was the IP address of it. 395 00:36:59,710 --> 00:37:07,350 On 2017, I did scan on this device Monday and I found this port was open 1380. 396 00:37:07,350 --> 00:37:14,490 After reversing that binary which was associated to this port, I was able to perform a remote code execution on this device. 397 00:37:14,530 --> 00:37:15,970 And this is an end user device. 398 00:37:15,970 --> 00:37:17,910 So, multiple users are having access. 399 00:37:17,910 --> 00:37:26,230 So, I could have executed a code on maybe 70,000 people in a city. 400 00:37:26,390 --> 00:37:31,290 Same way, I discovered this crash on 4046 port. 401 00:37:31,290 --> 00:37:41,990 So, if I fired one command on random IP addresses, wherever it connects to 4046, those devices will get crashed and I could cause a disruptive denial of service attack. 402 00:37:41,990 --> 00:37:50,050 And this was also an interesting crash I identified on 415654 after reversing that binary. 403 00:37:50,050 --> 00:37:52,450 Oh, I forgot to hide this MAC address. 404 00:37:52,450 --> 00:37:53,250 That's ok. 405 00:37:54,230 --> 00:37:56,930 So, this is an active recon. 406 00:37:56,930 --> 00:37:59,930 But, we don't stop here for recognition. 407 00:38:00,190 --> 00:38:04,730 We have to identify what is the underlying OS of this device. 408 00:38:05,450 --> 00:38:09,290 So, let's say you saw a fine working Android TV. 409 00:38:09,290 --> 00:38:11,630 So, you know that underlying OS is Android. 410 00:38:11,630 --> 00:38:13,190 Now, what about IP phone? 411 00:38:13,190 --> 00:38:15,110 What do you think IP phone is running? 412 00:38:15,890 --> 00:38:21,590 IP phone, most of the run, mostly all of this embedded device runs on a Linux. 413 00:38:21,810 --> 00:38:26,310 And they use BusyBox as a kernel and BusyBox to save the space. 414 00:38:26,310 --> 00:38:30,910 Because, as I told you, we have a very short space associated with it. 415 00:38:31,290 --> 00:38:38,210 So, to save space, we have these embedded devices uses BusyBox. 416 00:38:38,350 --> 00:38:41,010 And why BusyBox is false in a recon? 417 00:38:41,010 --> 00:38:43,310 Because BusyBox itself has some vulnerabilities. 418 00:38:43,750 --> 00:38:47,810 So, if you search a CV details for BusyBox, you may end up with a vulnerability. 419 00:38:48,010 --> 00:38:55,970 And underlying operating system will tell you what are the vulnerabilities are associated with that operating system. 420 00:38:55,970 --> 00:39:09,050 So, basically, if the device is using Linux kernel of version 2.10 to 2.15, then in this 5 versions, there could be lots of vulnerabilities which you can exploit later. 421 00:39:09,050 --> 00:39:25,130 So, identifying underlying operating system, identifying BusyBox version, identifying all open ports, TCP, UDP, and apart from this, what we can do is like accessible locations. 422 00:39:25,130 --> 00:39:34,410 Like, let's say, if root console is running without password, with the UART, all you need is to connect one cable using UART to USB converter. 423 00:39:34,650 --> 00:39:38,830 So, this is an active recon for embedded devices. 424 00:39:39,490 --> 00:39:46,270 Now, we will touch base some more aspects of recon in our upcoming training. 425 00:39:47,710 --> 00:40:00,170 Now, the great part of device testing is when you are testing device as a white box approach, you may get with a firmware. 426 00:40:00,170 --> 00:40:03,350 So, there are two types of firmware basically. 427 00:40:03,430 --> 00:40:06,430 Encrypted firmware and Compressed firmware. 428 00:40:06,530 --> 00:40:21,450 So, agenda for this firmware analysis talk is to identify what is firmware, obtaining firmware, ways to obtain the firmware, unpacking firmware, and finding vulnerability inside the firmware. 429 00:40:21,970 --> 00:40:30,090 So, here the best part of device testing, if you are doing a white box, then you get a firmware. 430 00:40:30,110 --> 00:40:41,690 So, that will help you identifying the directories or entry points or network services running on it using the firmware itself. 431 00:40:41,690 --> 00:40:49,550 So, you don't have to do just a brute force using FFUF or you don't have to do a content discovery in a very large way. 432 00:40:49,550 --> 00:40:53,610 Like , you have to perform analysis here, not a content discovery. 433 00:40:53,610 --> 00:41:01,350 So, that section, it really skip from recon and here you if this is a white box testing. 434 00:41:01,550 --> 00:41:03,450 So, what is the firmware? 435 00:41:03,450 --> 00:41:12,970 Firmware is the file which contains a file system of device, a kernel for the device and a bootloader. 436 00:41:13,090 --> 00:41:16,810 And this firmware are of two types. 437 00:41:16,810 --> 00:41:20,950 One is a full firmware, second is a delta firmware. 438 00:41:20,950 --> 00:41:25,450 So, let's say you are using a mobile, like I am using a Samsung mobile. 439 00:41:25,450 --> 00:41:31,470 So, you are using a Samsung firmware version 1.1. 440 00:41:31,470 --> 00:41:36,970 Now, there was a issue when you open a dialer, it gets crashed. 441 00:41:36,970 --> 00:41:40,170 So, this is a small issue, maybe developer messed it somewhere. 442 00:41:40,210 --> 00:41:42,770 Now , Samsung want to send a update. 443 00:41:42,770 --> 00:41:49,110 So, do you think Samsung is going to send you a 3 GB update for complete operating system for one small patch? 444 00:41:49,110 --> 00:41:49,710 No. 445 00:41:49,710 --> 00:41:57,490 What they will do is they perform the respective changes at file system layer if it's a file system level. 446 00:41:57,490 --> 00:42:04,070 Then that delta part they will calculate of KBs and MBs and that will ship to your device. 447 00:42:04,070 --> 00:42:06,030 So, that is called a partial update. 448 00:42:06,030 --> 00:42:07,850 So, that is a delta firmware. 449 00:42:07,850 --> 00:42:14,270 And that firmware you receive over the air to your handset for update perspective. 450 00:42:14,310 --> 00:42:14,970 Ok. 451 00:42:15,990 --> 00:42:19,730 So, these are the types of firmware. 452 00:42:19,730 --> 00:42:24,910 Now, what are the ways to obtain the firmware? 453 00:42:25,030 --> 00:42:28,250 So, here are few ways I listed down. 454 00:42:28,250 --> 00:42:31,690 We are going to touch base on more ways in our training. 455 00:42:31,810 --> 00:42:34,630 So, first is downloading from the website. 456 00:42:34,630 --> 00:42:37,550 Like here you can see the firmware is listed on their website. 457 00:42:37,550 --> 00:42:41,130 You can click on download, you will get a complete firmware. 458 00:42:41,290 --> 00:42:45,830 Second is like you set up a bridge like this is your device. 459 00:42:46,090 --> 00:42:49,210 This is the LAN card of your PC. 460 00:42:49,330 --> 00:42:51,210 This is your additional LAN card. 461 00:42:51,210 --> 00:42:55,330 You set up a bridge connection and this is your ISP cable. 462 00:42:55,330 --> 00:42:58,350 Now, on device end, click on check for update. 463 00:42:58,350 --> 00:43:04,310 If there is a firmware available, start Wireshark capture here on your bridge and click on download. 464 00:43:04,310 --> 00:43:05,530 So, what happens? 465 00:43:06,190 --> 00:43:12,790 That capture will get stopped here and you can download the firmware from the update. 466 00:43:12,790 --> 00:43:14,590 Now, extracting for a device. 467 00:43:14,590 --> 00:43:25,330 I told you like some device don't have literally any way to connect with a JTAG and you can dump the firmware using JTAG. 468 00:43:25,330 --> 00:43:26,750 Then, Google Docs. 469 00:43:26,750 --> 00:43:32,390 So, like if you search index of or FTP of a product name, you may come with a firmware. 470 00:43:32,390 --> 00:43:34,430 And lastly, analyzing device traffic. 471 00:43:34,430 --> 00:43:46,290 So, believe me, some devices most of the devices which we use like smart watch or mobile phone gets a silent update. 472 00:43:46,370 --> 00:43:57,050 So, what that silent update is, device is checking periodically whether the firmware update is available or not with the respective vendor. 473 00:43:57,170 --> 00:44:03,510 So, let's say it on one fine night device checks for the update. 474 00:44:03,510 --> 00:44:06,590 Now, that update requires restart and device is restarted. 475 00:44:06,590 --> 00:44:13,730 So, I woke up with my phone and saying why my phone is restarted as it was charged full. 476 00:44:13,730 --> 00:44:14,390 How? 477 00:44:14,390 --> 00:44:17,330 So, these are the tricks that vendor push the firmware silently. 478 00:44:17,330 --> 00:44:19,030 That is called silent update. 479 00:44:19,030 --> 00:44:24,350 So, to obtain such kind of update, you need to keep eye on device traffic. 480 00:44:24,350 --> 00:44:41,510 So, basically, you can set up one interception server itself so that all the devices which are at your home are connected to that interception server and that server is downloading everything from you can have a track of all the things that is getting downloaded at your home. 481 00:44:41,510 --> 00:44:42,430 Ok. 482 00:44:43,050 --> 00:44:44,650 Now, you got a firmware. 483 00:44:44,650 --> 00:44:45,850 What now? 484 00:44:45,910 --> 00:44:49,070 So, everyone knows that binwalk-e can extract the firmware. 485 00:44:49,070 --> 00:44:49,790 No. 486 00:44:49,790 --> 00:44:54,410 That is the most inappropriate approach to extract the firmware. 487 00:44:54,410 --> 00:44:57,950 First thing you should do is an entropy analysis. 488 00:44:58,130 --> 00:45:02,890 So, some firmwares are compressed and some firmwares are encrypted. 489 00:45:02,890 --> 00:45:06,910 So, if you run a binwalk on encrypted firmware, it will create a garbage. 490 00:45:06,910 --> 00:45:12,530 It may literally fill your GBs and TBs of data with garbage and you will get nothing. 491 00:45:12,530 --> 00:45:20,490 So, first proper way is to perform an entropy analysis on firmware with binwalk-E. 492 00:45:20,690 --> 00:45:22,970 It will generate a graph like this. 493 00:45:22,970 --> 00:45:27,190 As you can see here, a line is completely on the one. 494 00:45:27,190 --> 00:45:30,130 That means the firmware is very nicely encrypted. 495 00:45:30,130 --> 00:45:34,070 But here you can see some part is here is not encrypted. 496 00:45:34,070 --> 00:45:35,230 So, now what? 497 00:45:35,230 --> 00:45:47,310 Now, we can run a DD on this part and we can download this particular information to our device and we see what is there present. 498 00:45:47,310 --> 00:45:58,970 So, believe me, once I found the private key to decrypt that firmware in this part, once I found the password, so that is a fun to identify the firmware entropy. 499 00:45:59,310 --> 00:46:02,830 And with that password, I was able to open that firmware. 500 00:46:02,830 --> 00:46:09,210 Now, sometimes in hexdump only you will see the password of firmware. 501 00:46:09,750 --> 00:46:11,330 It happens to me. 502 00:46:11,330 --> 00:46:14,590 And then you can perform a signature analysis. 503 00:46:14,690 --> 00:46:22,310 So, if you are able to perform a signature analysis, you may come up with knowing which type of file system are in use. 504 00:46:22,310 --> 00:46:24,950 So, like in Windows, we have FAT and TFS. 505 00:46:24,950 --> 00:46:29,410 In Linux, we have XT, XT1234 and Razer FS. 506 00:46:29,590 --> 00:46:36,410 And same way, in device you may never find this FAT and XT4. 507 00:46:36,410 --> 00:46:47,210 You will find operative file system like cramfs, ubfs, squashfs squashfs is majorly I have seen till now and yzfs. 508 00:46:47,210 --> 00:46:52,810 So, these are the very small file systems are in use because due to the restriction of space. 509 00:46:52,810 --> 00:46:53,670 Ok. 510 00:46:54,170 --> 00:46:59,970 Now, once you are able to extract the file system from the firmware. 511 00:47:00,150 --> 00:47:01,830 Now, what to look inside it. 512 00:47:01,830 --> 00:47:02,030 Right. 513 00:47:02,030 --> 00:47:06,810 We are going to touch base details aspect of this in our tomorrow's training. 514 00:47:06,970 --> 00:47:11,150 But, as of now, what are the most critical aspect that you should look. 515 00:47:11,150 --> 00:47:18,750 First, obviously a passwd file to get a credentials and decode that hash to login inside the device. 516 00:47:18,870 --> 00:47:21,370 Second, you should look for the document root. 517 00:47:21,370 --> 00:47:23,110 So, what are the web pages are there. 518 00:47:23,110 --> 00:47:26,110 Some hidden pages which is not listed in GUI. 519 00:47:26,110 --> 00:47:34,230 Those hidden pages may use to access a device core functionality or execute a root level command. 520 00:47:34,270 --> 00:47:43,490 Then, as I told you in this application binary and the docu application logic is built inside the web binary. 521 00:47:43,490 --> 00:47:51,610 So, that binary should be downloaded and reverse engineer for the purpose of identifying vulnerability. 522 00:47:51,610 --> 00:47:55,990 And lastly, this is the first command which I run on firmware. 523 00:47:56,030 --> 00:48:03,030 Find slash name dot sh with type of file and having permission 777. 524 00:48:03,070 --> 00:48:07,830 So, this is the most important aspect. 525 00:48:07,930 --> 00:48:18,090 As you can see there are cron jobs running with a root and that was a shell script and it was having a permission of 777. 526 00:48:18,230 --> 00:48:19,250 What you want? 527 00:48:19,250 --> 00:48:20,370 You are root now. 528 00:48:20,370 --> 00:48:30,270 You can edit that shell script put add user command and once that script is run by cron you get a add user. 529 00:48:30,270 --> 00:48:33,490 Your user is added so you can backdoor that device. 530 00:48:33,490 --> 00:48:39,290 Or as it is 777 and having SS type so you can execute it yourself. 531 00:48:39,290 --> 00:48:40,010 Right. 532 00:48:40,070 --> 00:48:45,030 So, this kind of interesting stuff you can look what are the shell script files are there. 533 00:48:45,030 --> 00:48:47,790 You can look up for their email addresses. 534 00:48:47,790 --> 00:48:51,230 We are taking this in a little deeper manner in tomorrow's training. 535 00:48:51,970 --> 00:48:56,230 So, these are the crucial part of firmware you should look for. 536 00:48:57,010 --> 00:49:05,150 Now, here in document root you may ended up a source code review of a web application completely. 537 00:49:05,150 --> 00:49:14,590 And in application binary itself also you can review a source code review of the application binary to execute a command from a web interface. 538 00:49:14,590 --> 00:49:16,790 Now, getting hands dirty. 539 00:49:17,290 --> 00:49:19,990 First thing is like obvious. 540 00:49:19,990 --> 00:49:22,130 You are running a port scan. 541 00:49:22,130 --> 00:49:29,110 So, once you remember we conducted a document review where we found a default credential is admin. 542 00:49:29,150 --> 00:49:33,490 Now, I ran a port scan on this one fine device. 543 00:49:33,490 --> 00:49:34,730 One fine IP phone. 544 00:49:34,730 --> 00:49:36,210 It was an IP phone. 545 00:49:36,210 --> 00:49:38,570 And I found that telnet was open. 546 00:49:38,630 --> 00:49:42,730 And simply connecting to telnet and running admin admin. 547 00:49:42,730 --> 00:49:44,150 I got this. 548 00:49:45,750 --> 00:49:49,170 Here you can see UID 0, JID 0. 549 00:49:49,290 --> 00:49:53,410 We got a root over this device just by typing admin admin. 550 00:49:53,450 --> 00:49:57,450 Now, we see that ATN 443 is running also. 551 00:49:57,450 --> 00:49:59,870 As we know that web server is running on document. 552 00:49:59,870 --> 00:50:06,730 I found this two new ports from port scan that 7547 is there and 53 is filtered on the device. 553 00:50:06,730 --> 00:50:11,130 So, generally this device don't have a capacity to host a DNS server. 554 00:50:11,130 --> 00:50:14,890 So, they use a very fine utility called DNS mask. 555 00:50:14,890 --> 00:50:19,910 Almost in every device you find a DNS mask which is running on a port 53. 556 00:50:19,910 --> 00:50:24,270 That DNS mask itself acts as a DHCP server also in device. 557 00:50:24,990 --> 00:50:28,810 And I found one new port that is called 7547 port. 558 00:50:28,810 --> 00:50:36,230 So, after studying a lot I come to know that that is a CWMPC port which was doing a device management on 7547. 559 00:50:36,230 --> 00:50:40,210 And here you can see operating system is Linux kernel 2.6. 560 00:50:40,210 --> 00:50:45,490 Just Google about Linux kernel 2.6 exploit. 561 00:50:45,970 --> 00:50:52,650 I believe you may find a 5 to 6 pages of CVE details with the exploit available on the device. 562 00:50:52,650 --> 00:50:57,770 And here is a specific version 2.6.17 to 2.6.36. 563 00:50:57,770 --> 00:51:01,650 So, you may find more critical vulnerability. 564 00:51:01,650 --> 00:51:04,770 And now you have a deeper angle and you have deeper aspects. 565 00:51:04,770 --> 00:51:10,370 So, all you need is to look into 17 to 18 exploits. 566 00:51:10,370 --> 00:51:14,590 Like 18 versions and exploit for that 18 version only. 567 00:51:14,590 --> 00:51:23,910 So, you may use it for a remote code execution if exploit is supporting RC or you may end up with a privileged escalation vulnerability. 568 00:51:24,990 --> 00:51:31,610 Now , obviously, as we seen in a port scan, the device is running web server. 569 00:51:31,610 --> 00:51:34,950 I connected to that device and found this index.asp. 570 00:51:34,950 --> 00:51:36,690 I entered username and password. 571 00:51:36,690 --> 00:51:40,490 Here you can see username is travelling and password is travelling. 572 00:51:40,490 --> 00:51:41,610 But what? 573 00:51:41,930 --> 00:51:44,670 I think something is missing here. 574 00:51:44,910 --> 00:51:46,650 So, what is missing? 575 00:51:46,730 --> 00:51:50,510 That missing part is nothing but a XFrame option header. 576 00:51:50,510 --> 00:51:54,030 Now, you are thinking why I am making a critical issue. 577 00:51:54,030 --> 00:51:56,550 Why I am asking this as a critical issue. 578 00:51:56,550 --> 00:51:58,910 I will tell you in a next slide. 579 00:51:59,470 --> 00:52:03,150 But keep in mind that we have no XFrame option here. 580 00:52:03,150 --> 00:52:07,230 So, that means these devices are vulnerable for click jacking vulnerability. 581 00:52:07,590 --> 00:52:23,390 Then after further accessing or after further obtaining view from this device, I got to this one request that this one request could manage a complete device. 582 00:52:23,430 --> 00:52:29,390 So, I can, with this one request, I can manipulate every parameter of device. 583 00:52:29,390 --> 00:52:43,310 Here you can see user type is admin, username is admin, admin password is admin, then DBID, CLCD language is 0, management use VPN 0, remote web login is 1. 584 00:52:43,310 --> 00:52:46,830 That means remote web login is enabled or disabled. 585 00:52:46,830 --> 00:52:47,690 Ok. 586 00:52:47,810 --> 00:52:52,450 So, you can change it also as you have a, in one request only. 587 00:52:52,450 --> 00:53:06,930 Wireless access 0, LAN port is 80, DBID web port is 80, DBID web SSL port is 443 and remote web, remote legal IP is everything. 588 00:53:06,930 --> 00:53:11,030 So, every remote web is legal IP. 589 00:53:11,030 --> 00:53:18,230 Then remote telnet is 1, telnet security code and telnet, local telnet is 1, telnet port is 23. 590 00:53:18,230 --> 00:53:21,930 Telnet remote legal IP is 0.0.0.0. 591 00:53:21,930 --> 00:53:25,870 So, anything, any any 592 00:53:29,630 --> 00:53:35,590 any characters anyone can connect to device over a telnet. 593 00:53:35,590 --> 00:53:53,130 As this device is listening on 0.0.0.0 and hostname was there, radius access is there, IP for instance, log, enable, device plan So, as you can see here, everything is controlled in just one request. 594 00:53:53,130 --> 00:53:53,830 Ok. 595 00:53:54,430 --> 00:53:57,010 And can you notice something here? 596 00:53:58,050 --> 00:54:01,390 So, this is an interactive session, generally. 597 00:54:01,670 --> 00:54:06,170 I will tell you, there is no uniqueness in this request. 598 00:54:06,170 --> 00:54:09,530 As you can see apart from this cookies, there is no uniqueness. 599 00:54:09,530 --> 00:54:13,770 So, that means this device is vulnerable for request forgery also. 600 00:54:13,770 --> 00:54:18,870 Now, we have a click jacking vulnerability and request forgery vulnerability. 601 00:54:18,870 --> 00:54:21,810 So, we can do a cross-site request forgery to this device. 602 00:54:22,370 --> 00:54:26,010 Now, let's look at last part. 603 00:54:26,630 --> 00:54:45,490 Here, these devices have some one page called diagnostic to perform this kind of operation, like to ping the device or to see whether the device is properly configured in a network. 604 00:54:45,490 --> 00:54:50,410 So, like, you can't do the SSH to the device and ping for the device. 605 00:54:50,410 --> 00:54:54,170 So, these guys generally give such kind of option in web UI. 606 00:54:54,210 --> 00:54:56,410 And here you can see, here was a ping option. 607 00:54:56,410 --> 00:55:00,910 I just put a ID command in backtake and it returns me an ID. 608 00:55:01,050 --> 00:55:08,690 So, basically, we have a remote code execution vulnerability or say code execution vulnerabilities on the device. 609 00:55:08,730 --> 00:55:16,890 Now, we have a click jacking, we have a cross-site request forgery and we have a code execution. 610 00:55:17,250 --> 00:55:25,410 Now, if you put some logic that this is an IP phone, it is connected to the laptop. 611 00:55:25,490 --> 00:55:27,950 Now, laptop is directly connected to IP phone. 612 00:55:27,950 --> 00:55:35,150 In most of the company, wherever you see, IP phone network and laptop network are same. 613 00:55:35,150 --> 00:55:40,490 Generally, IP phone itself gives IP to using that cable to laptop. 614 00:55:40,490 --> 00:55:43,350 So, that means your laptop is reachable to IP phone. 615 00:55:43,350 --> 00:55:56,930 Now, let's make some fancy page to retain this organization employment you have to agree to policy. 616 00:55:56,950 --> 00:56:00,730 Means to continue with employment, you have to agree to those policies. 617 00:56:00,730 --> 00:56:08,570 If you don't want to, if you want to get terminated, you can or in case you want to leave the organization, you can click on ID security. 618 00:56:09,010 --> 00:56:11,970 Now, add a click jacking. 619 00:56:12,330 --> 00:56:18,130 Using click jacking, make a request to the IP phone with the default credential. 620 00:56:18,150 --> 00:56:31,250 It works most of the time and instead of that ID parameter, change that value with a call facebook.com or let's say, let's add a cron job. 621 00:56:32,210 --> 00:57:01,670 Let's add a cron job using command execution vulnerability like for i in 1 is to 100 do curl -ik https://facebook .com or any website for example, .com and once you once this request is fired, that bot is under your control or you can add a backdoor to the device and those will become your destructive bots. 622 00:57:01,990 --> 00:57:03,810 Isn't it easy? 623 00:57:03,810 --> 00:57:09,950 This is how we can turn a simple IP phone into a botnet . 624 00:57:11,230 --> 00:57:13,030 That's all. 625 00:57:13,710 --> 00:57:22,670 Here is the POC which I have done on my laptop and this was connected to a laptop IP phone. 626 00:57:22,670 --> 00:57:31,250 I just clicked on I agree and it executed ID command on the device using this simple way. 627 00:57:31,250 --> 00:58:00,070 Now what I need to use this I need to host this test POC to one server and all I need to do is send that server link to anyone means to send that server link to users so that once users click on that link it will create a request to device and with the CSRF and default credentials and command execution it will authenticate and execute the command. 628 00:58:01,510 --> 00:58:05,630 So this was all getting hands dirty with IoT. 629 00:58:05,630 --> 00:58:09,730 Now we will touch base upon a fuzzing reverse engineering and expert development. 630 00:58:09,730 --> 00:58:23,130 We have a complete one hour section in tomorrow's training or in my training at day 1 of fuzzing on this fuzzing reverse engineering and expert development. 631 00:58:23,130 --> 00:58:28,030 In this brief due to lack of time we are just touching base on this. 632 00:58:28,370 --> 00:58:32,210 So first thing is to get the shell. 633 00:58:32,210 --> 00:58:40,030 Before we start fuzzing or debugging we need to install the debugging tool on the device. 634 00:58:40,030 --> 00:58:47,890 So for that we need to get access to the root or we need at least some shell to device for testing this. 635 00:58:47,890 --> 00:58:55,850 Second what are the ways to obtain this shell it's like one I showed demonstrated just now with web vulnerability. 636 00:58:55,890 --> 00:59:05,810 Instead of id command you can execute npf and lvp on 4444 you will get bind shell to the device. 637 00:59:05,830 --> 00:59:07,930 Second is firmware analysis. 638 00:59:07,930 --> 00:59:23,010 In firmware analysis you may come up with a hardcoded account, backdoored account or you may come up with a way to execute a command some binaries might be there which is listening silently and there is some clients to connect that device. 639 00:59:23,210 --> 00:59:42,330 Third is document review in document dimension that in case of emergency you need to connect on this port by this way or by pressing this button multiple times you may get a shell and last default credential is always good and reverse engineering the binary. 640 00:59:42,330 --> 00:59:53,110 Default credential we used in earlier our telnet server and exploiting web vulnerability also we used right now and lastly reverse engineering the binary. 641 00:59:53,430 --> 01:00:02,790 So this looks complicated earlier but when I start exploring this it is not as complicated as it is. 642 01:00:02,790 --> 01:00:40,270 So there was one fine admin panel, I just put admin on it I intercepted this and I found this these are the request, username logoff, login time login time 0 and login value password, wrong password, password 2 is wrong password this is the input I typed here and again there is a user password is wrong password so I saw multiple fields there as a password and I decided to first make sure whenever you are fuzzing a device you should fuzz each and every request you never know when you got a surprise . 643 01:00:40,610 --> 01:00:43,550 Then I created this fuzz list here . 644 01:00:43,550 --> 01:00:58,570 A, 2 times A, 5 times A , 10 times A, 20 times A, 50 times A 100 times A, 200 times A and I loaded it into burst payload and I fired this into that. 645 01:00:58,570 --> 01:01:01,770 Now here you can see this is a missed part. 646 01:01:01,930 --> 01:01:05,330 Here you can see the responses is here but here it is missing. 647 01:01:05,330 --> 01:01:07,690 Again device started responding. 648 01:01:07,690 --> 01:01:13,430 So let's see what happened in the background here is a logoff device what you can see here. 649 01:01:13,430 --> 01:01:26,750 Can you see something interesting here so the boa server was running here on the then there is a extra body it got, what it got? 650 01:01:26,810 --> 01:01:27,530 6er. 651 01:01:27,530 --> 01:01:30,550 A buffer overflow here, a static buffer overflow. 652 01:01:30,550 --> 01:01:33,890 Dumping core and flash tmp now what? 653 01:01:33,890 --> 01:01:42,450 Again boa server started with a different PID 1170, 1169 and what here? 654 01:01:42,450 --> 01:01:59,050 Extra radiant body, again it got 6er, again dumping core and tmp now again it got crash, again it started so someone might be wondering that if we are able to crash, if the device is getting crash how this binary is getting up? 655 01:01:59,090 --> 01:02:13,770 It's because there are procmon kind of activities are running inside the device which will keep eyes on process like if the web interface is up or not if the SIP interface is up or not if a LAN interface is up or not. 656 01:02:13,770 --> 01:02:20,070 So whenever we are crashing this with our payload as you can see here here when we send 657 01:02:23,270 --> 01:02:48,690 5000 A's as a password to the device device get crash, again we send 10,000 A it is getting crash again we send 20,000 it is getting crash again with the 50,000 it is getting crash so this is how we are getting crashes here so first thing is once you got a server , 658 01:02:48,690 --> 01:03:12,970 you need to fuzz all each and every request with each and every parameters you may get a surprise anytime so this is a fuzzing with HTTP section we are doing now now you got a crash right , but you have to identify at what level device is getting crash so here you may see when you are sending a 5000 A, 659 01:03:12,970 --> 01:03:34,490 the device is getting crash so what you have to do now with the MSF you have to generate a payload of 5000 and you have to copy that payload into a request and you have to send that payload to identify those offsets at which point device is getting crash to develop a successful exploit. 660 01:03:34,490 --> 01:03:45,430 Now how you can achieve it so first thing is as you have a root shell first thing is to grape for the process ID which process is running. 661 01:03:45,490 --> 01:03:48,770 Now you have to install the GDB server. 662 01:03:48,770 --> 01:04:12,910 We are taking this in deeper manner that how we are going to install GDB in training and you have to attach the process here with GDB now GDB is listening to this process and then you have to connect GDB we need a GDB multi architecture here to connect this and once you connected to GDB, 663 01:04:12,910 --> 01:04:15,090 you have to regenerate the crash. 664 01:04:15,090 --> 01:04:38,470 As the device is crash, you can see here the registers from GDB it's a Pond GDB I used to use here you can see from register S0 to S3 this 4 registers are in our control then here you can see T4 register and T7 register are in our control and also we have a control over return address. 665 01:04:38,470 --> 01:04:56,310 So once we got this much of access now you know what to do just get a dirty shell code or reverse shell or bind shell and fire it and once you fired it, you will get the device. 666 01:04:56,310 --> 01:05:20,970 So this is the owning the device so here is an exploit which is a simple exploit I developed here for this IP phone only here you can see username is buffer overflow and password is equal to A into 999 times, this is the padding till T4, then first register comes is T4 then again we have a T7 here, 667 01:05:20,970 --> 01:05:50,010 then T6 and here you can see S0 register, S1 register S2 and S3 register so all you need to do is you have to host this register here in S0 to S4 and then you have to give some padding here again till return address and some padding and then you have to call the return address and by this way you can own the device without any interaction just by knowing the IP address. 668 01:05:50,010 --> 01:05:54,190 All you need is IP address once you perform an extensive research to this. 669 01:05:54,570 --> 01:06:07,970 So as I am available with you from long time on this all, still you have a question you can mail me at incosubatme.com and you can follow me at twitter at securitibill. 670 01:06:07,970 --> 01:06:14,430 Thanks a lot, hope you like this talk and hope I can see you again for tomorrow's training.