Welcome to Offensive Embedded Exploitation
Getting Your Hands Dirty with IoT and Embedded Devices
So, the agenda, before we start with the talk
I would like to tell you that I am conducting a training
I would like to thank Mr. Omer and Mr. Joseph
for allowing me to conduct a training
with Defcon Red Team Village, which is on Day 1
So, I request you to, if you want
if you like this talk, if you want to attend this in a more deeper manner
you can attend tomorrow's training.
So, let's start with the agenda of today's talk.
Today, we will first have an introduction to IoT
then we will do a preparing the arsenal
that is a setting up our requirement
then we will have recon, then show time
that is a firmware analysis, then getting hands dirty, dynamic testing
and lastly we will touch base upon
fuzzing, reverse engineering and exploit development
So, let me introduce myself
I am Kaustubh Padwad from India
also known as Security Beast on Twitter
I have dozens of exploits listed on
GitHub and CVE details
on IoT. Also, I am a
security researcher at Reliance Jio
that is Jio Platform now, Jio Platform Limited
where we conduct device security testing
for all of the Jio Platform devices
Also, I am a SINAC Red Team member
to keep myself updated and to
hack into the toughest
infrastructure, SINAC is a great
learning platform and also I do bug bounty there
and I like to share my knowledge, so I am a speaker
I speak at conferences
And now, it's time to get started with the
topic. So, the
I have classified IoT in a
three style. One is a industry
IoT, second a human IoT and third
IoT for others, that is animals. So, we will
see, I have classified here all the industry in
this image taken from a source is mentioned
Here, I have listed
all the industries like manufacturing industry, smart
government, mobile network,
mobility and Wi-Fi, smart digital
citizens, that is us, then open
data, health is a key element in IoT, then
smart agriculture and smart building
smart transportation. So, these
things are getting smart with the help of IoT. Major
like, for example, a transportation
industry, Tesla is building
Tesla is the best example for IoT based car
even for a logistic, IoT is getting
used in very huge manner to track their shipments
that to ensure the data, the packages
which is shipping should not get tampered
they are putting tamper detection based
on IoT. So, it's like simply if someone
opens the door, that means it is tampered and as the door is
opened, that small IoT device will send
generate an alert and send to the respective
logistic person. Manufacturing industries are
using IoT to improve their
services or to improve their production
product qualities. So, there should be
a zero error product development, we can
say with the manufacturing industry. And
government, like government should implement IoT
In my training, I have an excellent
example, which I
covered there in my training. So, let's assume
that every city have a street light
hundreds and thousands of street lights, which is running
from night, which is running whole night.
So, if you install one small IoT module
of let's say $5 cost to that
light, then
that light will become smart and it will turn on only
when the vehicle is passing through. And rest of the time, it
will stay in an ideal state, let's say power off state.
So, that $5 module can save your $500
electricity bill for every month.
So, it makes sense
of using IoT in
government covered areas
or government entities. Mobility
and Wi-Fi, they are key provider for the
IoT. As I said in mobility
as government needs
or let's say if you want to create a IoT environment
so, mobility is the best way. They provide us a
NB-IoT, Narrowband IoT and
LTE-IoT. So, these two ways they can provide
us IoT connectivity to everywhere. Health
is the key element. We are discussing this here.
Agriculture, one of my friends have built
IoT based
water system
to his farm. So, it detects
soil dryness, it detects wind
speed, it detects temperature and accordingly
it turns on his water pump.
So, it will automatically give water to the plants
to his farm also.
And smart building, there is an
excellent example in the next slide for smart building
and transportation as we just talked
about Tesla. Now, in human
IoT. So, devices are getting inside
the body. Like for example, a pacemaker.
Pacemaker is a medical device, medical IoT device.
It's a really critical device
in IoT aspect or
in any aspect. And insulin pumps
and these are other devices which can be
currently using inside the body. There could be more
but as of now I corrected this.
Now, you can
trigger insulin shots
to your loved ones remotely with this insulin
pump. You can check if
there is a
what we say abnormal
behavior of heart or
abnormal behavior inside the body. These pacemakers
are also smart. They can send data to
doctor that it is not behaving good
or you can
as we know pacemaker is a critical medical device.
It controls your heartbeat. Now,
why cow is here? So, IoT
animals are getting smarter.
So, like if your pet lost
direction then there are some patterns which
they triggers every time. If they feel like lost
or if they are not
let's say you are not with your pet a complete day and
suddenly he developed a fever. Then what?
So, some guys are working on the solution
which will be a kind of belt inside their
body or inside their neck tied to their
neck and that belt will keep analyzing
their behavior. Are they behaving normal?
Are they feeling like lost? Is their
temperature is normal? So that you can take appropriate
care of your loved one pet and you can track
your animals also like your pet also
that if they are lost or
then you can track them. So,
IoT is a major part of our body. IoT is
an emerging field and IoT is too much
powerful than we imagine.
So, with the great power, great responsibilities also
come. That we will discuss in a further section.
Now, let's have a look of smart
building. How one can implement
IoT in a smart building.
Jing Jing.
Tian Bao Jin Ling.
Tian Bao Jin Ling.
Tian Bao Jin Ling.
The self-check-in machine
like the guest mobile check-in
like the robot service and
Timogeneous voice spatula.
The purpose of this kind of service and
technology is to improve the efficiency
of the service and the consistency of the
service quality.
Jing Jing.
Jing Jing.
Jing Jing.
Jing Jing.
Jing Jing.
Jing Jing.
Jing Jing.
As you can see, a smart building
a brilliant example of smart building
IoT in action. So, I would definitely
like to go there and check-in to test the services.
So, with the great news,
great responsibilities do come. So, what I
think is why IoT security
assessment or why embedded devices security assessment is important.
I have collected some hot news.
This is IoT hot news where
we can see multiple threats and risks that
currently associated with IoT. The first and most
important risk here.
Risk with IoT in a medical field.
So, when I was a kid, my
grandparents used to tell us that there is a witchcraft and
there is a black magic kind of stuff
which can remotely
kill
someone. So, I don't believe on that
but here you can see with IoT
you can do it. Let's say, instead of giving
10ml pump shot, if I trigger
100ml pump shot, then who can save you?
Instead of setting your heart rate to the normal heart rate
if I set it to 3000 beats per second
you will suffer from a major cardiac arrest.
So, as we can see
these are inside the body and these are
very critical devices. So, security
assessment for these devices must be done
in a very aggressive way.
I believe that if such kind of devices
are manufactured by a very renowned vendor, it should be
tested country-wide. It should be
offered to the expertise all across the globe
and then you can ensure that this product is secured or not.
Because everything has a different mindset
to test everything. So, same way
Now
you brought an IoT product that is
a surveillance robot to secure your house
and to take care of your loved ones when you are not in
the home. And hackers use that robot
for spying you. Here you can see
hackers break into a smart home, play inappropriate music
and communicate with a resident via camera.
It's a horrible thing. It's a scary thing.
If someone is continuously watching you and someone is talking
with your speakers only, how would it feel?
Right? It's scary. Super scary.
And this attack
it is an industry grade attack. Someone discovered
a remake of Mirai
botnet. It was the OMG attack
was discovered by Fortinet. It was the
second Mirai. So, Mirai is the biggest
attack, biggest IoT attack till now.
You can read about it. It's a really interesting attack.
This is again like
you brought a surveillance system to watch your home
and that surveillance system is watching
is watched by hackers. So, this device
was running one video talk protocol which was
sending the audio, which was recording the audio by
mic and sending it to the one who connects
over video talk to the camera. It is again scary.
Right? I believe there should be some system
which will ensure that how this product is secure on
scale of 10. So, it will be easy to judge
whether we should buy it or not.
Like a product rating, there should be a security rating
also should be there. And this is the major threat.
FDA recalls nearly half of million pacemakers over
This is the really critical issue. So, as you see the
life risk is associated with the risk of
with the IoT devices. So, that's why the
security assessment of such a product is
really crucial and really important. It should be done
right. Now, my
case study for this is
can this decent looking IP phone
change into a botnet? What do you think?
You can turn this device into a botnet?
Most of the guys will be thinking how this
can be possible. Or if there are experts who have already
played with it, may know the trick what I am going to try.
Right? Now, one day, one fine day I was
thinking about which device should I pick up for the training
for this product and which device should I pick
up for the brief also. So, I was staring at IP phone
and suddenly it comes in my mind that why not this
IP phone only. As every corporate
have IP phone. Right?
So, let's say our corporate is one of the
biggest large corporate. So, we have at least
40,000 IP phone of same brand
inside our office. And Mumbai is a
corporate hub. So, I guess that
there should be more than
crores of IP phone will be there in Mumbai of
same brand. I am not talking about multiple brands.
Let's say if vendor X is producing
X type of IP phone, that same type of IP phone
you will find at least 1 crore IP phone in the city.
And if you target a specific
call center, BPO and KPO
then their business is IP phone. Right?
So, if you target that, you will get lots and lots
and lots of target. So, if you are able to remotely
compromise one IP phone, you are
able to compromise crores of IP phone.
At least same types of crores of IP phone
using this technology.
So, if you have hacked
two organizations having 50,000
IP phones each, that will create
1 lakh, that creates your 1 lakh bots.
Maybe it could take 8 days, 10 days
15 days. But within 15 days, you will get
1 lakh computers, 1 lakh bots.
Basically, what IP phone is inside. It's an ARM machine
or MIPS machine. Right?
So, you may get 1 lakh bots
in just 8 to 15 days. Now, let's say if you target
complete city, you may end up
with 50 lakhs IP phone. Right? In a city
you will definitely get. Now, let's say
if you target cities, multiple cities
then you can, let's say
India have 4 big corporate hubs. Mumbai,
Delhi, Chennai and Bangalore.
So, if you hack even those 4 cities, 4
corporate hubs and Hyderabad also, sorry. So,
these 5 cities, you may end up with at least
5 crores IP phone.
Now, let's assume if that 5 crore IP phone, you are
instructing those 5 crore IP phone to make a
10 request per second to the facebook.com
So, 5 into 10 is 50.
50 crore request per second to the facebook.
You think how long it can survive?
Let's say any big provider. Facebook, Google
or for how long time it can hold such a load?
Even you can increase a 10 to 20 request per second
that is around 100 crore request per second.
Right. It could be a bigger storm.
And I am just talking about 5 cities of 1 country.
Now, let's say if you target a multiple country with the same
attack, you can create a biggest TBPS
attack in the history.
So, I build a case study. How can we make
this possible?
But before that, we need to set up our machine
to test this.
Most of the time
when I give a talk to a conference
or seminar or chapters like
null chapters or somewhere, they ask me
Sir, I want to start with IOT but
I don't have enough requirement machines.
So, this is like, you know, you need nothing
literally nothing to set up a basic setup
for IOT test. Here I have shortlisted to get started
What all you need is a Linux.
Why Linux? Because Linux is smooth with
virtualization of ARM and MIPS devices.
And all IOT devices binary
not all, most of the binary work with the
ARM technology or MIPS technology.
So, to smoothly virtualize it, you need a Linux.
Secondly, Linux gives you
lowest level access to the operating system.
So, if you connect a device to USB port
it will definitely give you something
like manufacturer, product ID
vendor ID, device type ID, something it will give.
It won't tell you like a Windows that
unknown device. Right? That's why Linux.
And there are more reasons which we are
which you may get in a training section.
This device is
the JTAGulator.
So, JTAG is an interface which some devices
don't have any interface. No UART
no console cable, no USB
no LAN port, no WAN port
So, in that case what you should use
to interact with device. Right? Our target is to get
into the device. That is our first target as an IOT guy.
So, in that case what you can do is
you can use JTAGulator
to connect with the JTAG ports of the device.
Now, you may say why not no
JTAG in the device? Because this is
not the case. JTAG is present in most of the devices
because it is used for purely factory debugging
process or factory QA process. Let's say
device is an assembly line, it gets manufactured
it puts a required data and now
before going to production, device needs to run a
QA. So, nobody is going to
check manually that hundreds and
lakhs and millions of devices with manually
checking 1, 1, 1, 1 pin. No.
What it do is, it will connect
JTAG pins to the device and it will test all the
functionality with their JTAG testing suite. So, JTAG
is present. You may not find the JTAG
pins on the device, but you will find a point
where you can solder the pins and you can connect a JTAG
regulator and identify the appropriate JTAG pins.
Now, as a IoT comes in the mind
second thing come is a wireless. IoT
gives you a wireless freedom. So, like now
the device with 2 sensors and 1
server is not connected over wire. These
will be connected with a wireless technology. For example
our ZigBee protocol, Z-Wave
protocol. So, to test this
kind of protocol, we need some specific hardware
which will identify those frequencies. So, this
API motor is a gadget which can, which
allow you to perform a ZigBee test like
ZigBee packet injection, ZigBee packet replay attack.
So, you may see building lights, these are controlled
most of the lights are controlled by ZigBee.
And connectors, finally. Seriously, they are life.
Without connector, you cannot test IoT.
We need at least 1 extra LAN card, we need
at least 1 WAN card, we need an additional Bluetooth
adapter, we need 1 screwdriver set,
we need a Skira, because Skira is an all-in-one
connector. So, instead of spending for
individual connectors, if you can spend
that's fine, but instead of spending on this multiple
you can buy 1 Skira connector which supports
GPIO communication, which supports JTAG communication,
which supports UART communication and also
SPI communication. So, if you buy this 1 product
your all problems will get solved. And lastly
to hack the radio frequencies, we need a hack RF
device. So, this is the minimum
thing you need to get started with a IoT test.
Ok.
Now,
this is a basic setup. Now, what about advanced setup?
This.
You can buy endless stuff. As new
device will come, you need to buy something.
As new device may have
other way to communicate, you have to build your own
PCB boards to communicate with that device. So, there
was 1 device which is not directly connected over
USB, so there was a mediator chip in between.
So, you have to connect that device to that mediator chip. That
mediator chip was converting those signals into UART and
then UART to USB converter and that to laptop.
So, this was the complete setup. So, there is no limitation
for advanced setup. You can build up to whatever you want.
Now, we are done with the hardware part.
What about software? Which tools are required? Are those tools
are expensive? Are those tools are paid? Are those tools
are really too much heavy that one cannot afford?
No, this is not the case. This
I called as a weapons and these are the minimal
weapons which are needed for testing.
One is a BinWalk. So, BinWalk is a great
tool. You can do a firmware extraction.
BinWalk is basically give a firmware to BinWalk. BinWalk will extract you
if there is a uncompressed, sorry
unencrypted firmware. Ok. We need
a Firmadyn. So, Firmadyn is a collection of multiple
tools. The Firmadyn consists of BinWalk, QMove
and Postgres database and it's
a properly
it's a properly organized framework
for emulating the firmware. Ok.
So, we need a Firmadyn to emulate a device firmware
in case you don't have a device and you have only the
firmware and you want to test it.
I hope everyone is familiar with it. It is the great software tool we have.
And we need a Python because most of the tasks we have
to do it on repeated basis. So, to automate that stuff
Python is the great and easy to write language.
And lastly, IDA Pro. So, if you can't
afford IDA Pro, it's ok. You can buy IDA Community Edition
or you can use some open source
tools like Radare or NSA Ghidra also.
NSA Ghidra is also a great tool to reverse engineer.
But trust me, reverse engineering is the life.
Reverse engineering is the life and reverse engineering
is the most important aspect of device.
So, there are few things that comes
in the mind when someone asks why you
need to reverse engineer the binary. Hard-coded backdoor
account. Some devices, recently
when there is a news called on
I forgot the name of that router OS
but that router OS is having
7 major issues was recently
identified and most of it was a hard-coded
backdoor account. That too listening on a WAN interface.
So, let's say if your device is running
a telnet on WAN interface and if there is a backdoor account, you
never know how one can enter in your network.
So, this is one aspect.
Second is identifying a critical vulnerability
like remote code execution.
As in embedded device, there is very limited space.
So, you have to fit everything in that small space.
So, application logic and application
code is inside the web application binary only.
So,
to identify that binary
the best way is to reverse engineer that binary and get
assembly code out of it and then perform
assembly analysis to identify where the
native vulnerable calls like
sprintf or system call
fopen, popen kind of calls are in use.
So, to reverse engineer we need a IWP.
Now, let's move
towards, once you have set up everything
we start with the first stage is always the reconnection
of WAN testing. In IoT also
it's not exceptional. First stage is recon.
I split this recon section into two parts.
First active recon and second passive recon.
So, generally in
pen testing we perform active recon first and then passive recon. Here we have
to do reverse. Like first we have to identify, we have to do
a passive recon. Let's say if you got one device
for example this headset
and now the manufacturer of this headset is
saying that this device does not support a WiFi.
So, how can you ensure it? Just because he said
this doesn't support WiFi, you are going to believe that this
doesn't support WiFi. No. You have to read
their specifications. So, each device
have one unique FCC ID
and if you search that FCC ID
into the FCC ID database, it will
come up with all the specifications are
exist with the device. Ok. So, sometimes
vendor may lie to you that this functionality is not supported at
hardware level and they can disable it. Like
this happens with me with one product
that vendor was saying, Sir, this device doesn't support
WiFi. And on FCC ID device, they have
mentioned that this device supports WiFi.
So, we had a long debate and
lastly I ended up with creating custom firmware
which loads the WiFi driver. So, basically they just disabled the WiFi
driver. That's why WiFi is not coming up of that device.
Ok. So, first we have to do a
FCC ID analysis. Second,
documents. You should ask for as much
as possible documents.
So, like that document could be
a security architecture document. That document
could be a product data sheet.
That document could be a project description sheet
or could be a user manual of the
product. Ok. So, these are the things
that you should do first and then you should touch to
the device. And then
once you touch to the device, first thing is to know
your device. Right. So, if
I give you something like you have to
test this device, what you will do?
Like in web application, we see what technology
it is built on, like LAMP stack is there or
what are the directories are in use, what is the server.
So, same way in device security testing
or IoT pen testing, we have to identify the multiple
entry points to the device. For example,
a LAN port. In this device, there is a LAN
port, there is a console port or
there could be a WiFi this IP phone might be using
and some
like if device is running on Android,
there could be a
ADB running on it. Some
advanced devices that I told you about Narrowband
IoT, they could be using an
IDD interface to communicate with the server.
No IP network basically. No IP data delivery
network. Ok. And
then you can check for the UART, if
UART is present, console port is present, if Android
is there, then ADB is present. If
classic ports are there, then LAN port
is there, console port is there. So,
first thing is to know your device. How can you interact with that device?
How can your Linux, your pen testing machine can interact
with the device? And once
you know that you can interact
with device with specific way, you should go
through the documents. So, here are some
glimpse that will help you in identifying
why document review is important. So, here
in this document, vendor is saying that this device supports
SIP version 2 and RTP.
That means this device does not support SIP TLS.
SIP TLS. So, if someone
is able to sit in the MITM
attack, he could able to hear your
hear your traffic, hear your call
which you had word with. Here you can see
this device support TR-069. So,
most of the classic guys who is working on Windows,
on Linux, on network pen testing are not familiar with the
TR-069. So, TR-069 is the protocol
through which you can provision and reconfigure device
completely using
ACS server.
And here is a user
I am sorry.
Here is a user manual. That user
manual tells us that firmware of device is
upgradable, device have a password management,
device have a local and remote syslog, device
is having auto provisioning using PFTP,
HTTP and HTTPS. And also
multi-user level. So, if
owner of device have changed the password from
device to admin, admin to admin, admin
at 1, 2, 3. Still, though it's upgradable,
still there could be a multiple users like support,
like tech, this kind of user you may find
generally inside the product. And their password
will be same as the username. So, this you can identify
from the manual itself.
Now, this is one
algorithm. Algorithms, reviewing
algorithms is one of the most critical part in
IoT. You may be thinking what we have to do with
an algorithm. So, the practical example for this
is, let's say vendor X have decided
to produce a router. So, as per
the standard or minimal requirement, all routers
Wi-Fi SSID should be unique or Wi-Fi
SSID should be random or at least the password
to connect that SSID should be random.
So, how you think that for 1 crore devices
how you are going to do a password? You are going to write a C program
for that? No. Right. Or even
if you write, so you are going to maintain
the unique password for every device with you?
No. Right. So, what you are doing here is
you are using one algorithm to generate a SSID password.
So, basically first 4 digits of your
MAC address and last 4 digits of your
last 4 digits of your
serial number plus current date and time
could be a password for SSID. So,
if you search for the
Belkin password generation hack
password generation algorithm hack, you may
come up with a, you may get
what I am trying to say here. So, if
they design the poor algorithm
just by adding first 4 digits of MAC address
last 4 digits of serial number, anyone can generate a password
for any device. Right. Or MAC address plus
date on time. So, like you know that
if vendor X is generating a password based on MAC address
and date on time, so what you do is you set a
packet capture, you capture a beacon, you get
that MAC address first 4 digits and
you add a current DDMM format
and connect with the password to the SSID
if the SSID is on default password. Right.
So, to ensure that they are not doing such a silly
mistake, we have to review the algorithm
and lastly, the magic number.
So, what the magic number is? You know, you
found some fault in your device. For example,
set-top box or for example, in any
of your device, let's say router, if
you are a non-techy guy, you take that router
hey man, this router is not working, it's not showing up
you take that router to the
respective service center. That service center guy connects to
the router and enters some code
and in 15 minutes, he will give you that
sir, it is working again. So, how you think it is possible?
So, every device have some specific
additional access mode that we
called a, what we called it
developer mode or
debugger mode or
engineer mode. So, to access those modes, you
need to enter some secret code which is also generated
by algorithm. So, it calls a magic
number generation algorithm. So, you have to review it like
there was one USB which was supporting
which is locked to support with specific
ISPX for internet provide
for internet providing and let's
then, you want to unlock it and you want to use it
over other network. So, how you can do it?
You access the engineering
mode of that device, you remove that restriction
may be a PLM unlock is there, may be some MCC
MNC code or white listed inside that device
or it could be a single
like only name of ISP is written there
to latch on this network only if you find. So, you can
easily modify. So, to access this additional
modes, you need this magic number.
So, magic number generation logic should be
tough to identify. Otherwise, once this
logic is leaked, you are over.
Now,
this is the most
interesting aspect of the commentary.
Credentials to access the device.
Here, you can see funny part. Default PC
port connection type is bridge. Ok, that's fine.
Default username for user mode is admin
Sorry, for admin mode, it's admin.
Ok, that's ok. Default username for user mode
is user. Default password for web is null. Wow!
Like they set up a complete web UI
they set up a user, they set up a password policy
and now they are setting password to null.
That means all you need to do is you have to identify the
IP address. Once you identify the IP address, you type
admin, you are admin, you type a user and you are a user.
Isn't it so funny? And here is the default
web login port. So, they are giving you everything in their
documents. So, you should review those documents.
You should search for the word like
ENC. So, if there is an encryption logic, it will pop up.
You should search for the word SECU
like secure. So, security related stuff is there
it will pop up because sometimes user manual is of 400
to 500 pages. To quickly review it
as if you are a device tester, you may get
limited time of 5 to 10 days to
complete one device, a security test.
So, in that case, you need to follow such kind of tricks.
Now,
active recon of the device. So,
active recon here is not just the identifying
open port. But when it comes to open port,
you should do a port scan of all ports
for device because they always use non-standard port.
Here is one device which I scanned. This was
the IP address of it. On 2017,
I did scan on this device Monday
and I found this port was open 1380.
After reversing that binary which was associated to
this port, I was able to perform a remote code execution on
this device. And this is an end user device. So,
multiple users are having access. So, I could have
executed a code on
maybe 70,000 people in a city.
Same way, I discovered this
crash on 4046 port.
So, if I fired one command on random IP addresses,
wherever it connects to 4046, those devices will get
crashed and I could cause a disruptive
denial of service attack. And this was also an
interesting crash I identified
on 415654 after reversing that binary.
Oh, I forgot to hide this MAC address.
That's ok. So,
this is an active recon. But, we don't stop here
for recognition. We have to identify
what is the underlying OS of this device.
So, let's say you saw a
fine working Android TV. So, you know that underlying
OS is Android. Now, what about IP phone?
What do you think IP phone is running?
IP phone, most of the run, mostly all of this
embedded device runs on a Linux. And they use
BusyBox as a kernel and BusyBox to save the
space. Because, as I told you, we have a very short
space associated with it. So,
to save space, we have
these embedded devices uses BusyBox.
And why BusyBox is false in a recon?
Because BusyBox itself has some vulnerabilities.
So, if you search a CV details for BusyBox, you may end up with
a vulnerability. And underlying operating system
will tell you what are the
vulnerabilities are associated with that operating system.
So, basically, if the device is using
Linux kernel of version 2.10
to 2.15, then in this
5 versions, there could be lots of vulnerabilities which you can
exploit later. So, identifying underlying operating
system, identifying BusyBox version,
identifying all open ports, TCP,
UDP, and apart from
this, what we can do
is like accessible locations. Like, let's
say, if root console is running without
password, with the UART, all you need is to connect one cable
using UART to USB converter.
So, this is an active recon for embedded
devices. Now,
we will touch base some more aspects of recon
in our upcoming training.
Now,
the great part of device testing is
when you are testing device as a white box
approach, you may get
with a firmware. So, there are two types
of firmware basically. Encrypted firmware
and Compressed firmware.
So, agenda for this firmware analysis talk is
to identify what is firmware,
obtaining firmware, ways to obtain the firmware,
unpacking firmware, and finding vulnerability
inside the firmware.
So, here the best part of
device testing, if you are doing a white box, then you
get a firmware. So, that will help
you identifying
the directories or
entry points or network services running on it using the
firmware itself. So, you don't have to do just a brute force
using FFUF or you don't have to do a
content discovery in a very large way.
Like, you have to perform analysis here, not
a content discovery. So, that section, it really
skip from recon and here you
if this is a white box testing.
So, what is the firmware? Firmware is the file
which contains a file system
of device, a kernel for the
device and a bootloader.
And this firmware are of two types.
One is a full firmware, second is
a delta firmware. So, let's say you are using
a mobile, like I am using a Samsung mobile.
So, you are using a Samsung firmware version
1.1.
Now, there was a issue when you open
a dialer, it gets crashed. So, this is a
small issue, maybe developer messed it somewhere.
Now, Samsung want to send a update. So, do you think
Samsung is going to send you a 3 GB update
for complete operating system for one small patch? No.
What they will do is they perform
the respective changes at file system layer
if it's a file system level. Then that delta
part they will calculate of KBs and MBs
and that will ship to your device. So, that is
called a partial update. So, that is a delta firmware.
And that firmware you receive over the air to your
handset for update perspective.
Ok.
So, these are the types of firmware.
Now, what are the ways
to obtain the firmware? So,
here are few ways I listed down.
We are going to touch base on more ways in our training.
So, first is downloading from the website.
Like here you can see the firmware is listed on their website.
You can click on download, you will get a complete firmware.
Second is like you set up a bridge
like this is your device.
This is the LAN card of your PC.
This is your additional LAN card. You set up a bridge connection
and this is your ISP cable.
Now, on device end, click on check for update.
If there is a firmware available, start Wireshark capture
here on your bridge and click on download.
So, what happens? That capture
will get stopped here and you can
download the firmware from the update. Now, extracting
for a device. I told you like some device don't have
literally any way to connect with a
JTAG and you can dump the firmware using JTAG.
Then, Google Docs. So, like if you search
index of or FTP of a product name, you
may come with a firmware. And lastly, analyzing
device traffic. So, believe me, some devices
most of the devices
which we use like smart watch or
mobile phone gets a silent update.
So, what that silent update is, device
is checking periodically whether the firmware
update is available or not
with the respective vendor. So,
let's say it on one fine night
device checks for the update. Now,
that update requires restart and device is restarted. So,
I woke up with my phone and saying
why my phone is restarted as it was
charged full. How? So, these are the tricks
that vendor push the firmware silently. That is called silent update.
So, to obtain such kind of update,
you need to keep eye on device traffic. So,
basically, you can set up one interception server itself so that
all the devices which are at your home are
connected to that interception server and that server is
downloading everything from
you can have a track of all the things that
is getting downloaded at your home.
Ok. Now, you got a firmware.
What now? So, everyone knows that
binwalk-e can extract the firmware. No. That is the most
inappropriate approach to extract
the firmware. First thing you should do is an
entropy analysis. So, some firmwares are
compressed and some firmwares are encrypted.
So, if you run a binwalk on encrypted firmware,
it will create a garbage. It may literally fill
your GBs and TBs of data with garbage and you will
get nothing. So, first proper way
is to perform an entropy analysis on
firmware with binwalk-E.
It will generate a graph like this. As you can see
here, a line is completely
on the one. That means the firmware is very nicely
encrypted. But here you can see some part is here
is not encrypted. So, now what?
Now, we can run a DD on this part
and we can download this particular
information to our
device and we see what is there present.
So, believe me, once I found the private key to
decrypt that firmware in this part, once I
found the password, so that is a fun
to identify the firmware entropy.
And with that password, I was able to open that firmware.
Now, sometimes
in hexdump only you will see the password of firmware.
It happens to me. And then
you can perform a signature analysis.
So, if you are able to perform a signature analysis, you may come up with
knowing which type of file system
are in use. So, like in Windows, we have FAT
and TFS. In Linux, we have XT, XT1234
and Razer FS. And
same way, in device
you may never find this FAT and XT4.
You will find operative file system like
cramfs, ubfs, squashfs
squashfs is majorly I have seen till now
and yzfs. So, these are the
very small file systems are in use because
due to the restriction of space. Ok.
Now, once you are able
to extract the file system from the firmware.
Now, what to look inside it. Right. We are going to touch base
details aspect of this in our tomorrow's training.
But, as of now, what are the
most critical aspect that you should look. First, obviously
a passwd file to get a credentials and
decode that hash to login inside the device.
Second, you should look for the document root.
So, what are the web pages are there. Some hidden pages which is
not listed in GUI. Those hidden pages
may use to access a device
core functionality or execute a root
level command. Then, as I told you
in this application binary
and the docu application logic is built inside
the web binary. So, that binary should be
downloaded and reverse engineer
for the purpose of identifying vulnerability.
And lastly, this is the first command which I run on
firmware. Find slash name
dot sh with type of file
and having permission 777. So,
this is the most important
aspect. As you can see
there are cron jobs running with a root
and that was a shell script
and it was having a permission of 777. What you want?
You are root now. You can edit that shell script
put add user command and once
that script is run by cron
you get a add user. Your user is added
so you can backdoor that device. Or as it is 777
and having SS type so you can
execute it yourself. Right.
So, this kind of interesting stuff you can look what are the shell
script files are there. You can look up for
their email addresses. We are taking this in a little deeper
manner in tomorrow's training. So,
these are the crucial part of firmware you should look
for. Now,
here in document root you may
ended up a source code review of a web application
completely. And in application binary itself also
you can review a source code review
of the application binary to execute a command
from a web interface. Now, getting hands dirty.
First thing is like
obvious. You are running a port scan.
So, once you remember we
conducted a document review where we found a default credential is
admin. Now, I ran a port scan on
this one fine device. One fine
IP phone. It was an IP phone. And I found that
telnet was open. And simply connecting to
telnet and running admin admin. I got
this.
Here you can see UID 0, JID 0.
We got a root over this device just by typing
admin admin. Now, we see that
ATN 443 is running also. As we know that
web server is running on document. I found this two new
ports from port scan that 7547 is there
and 53 is filtered on the device. So,
generally this device don't have a capacity to host a DNS
server. So, they use a very fine utility called
DNS mask. Almost in every device you find
a DNS mask which is running on a port 53.
That DNS mask itself acts as a DHCP
server also in device. And I
found one new port that is called 7547 port.
So, after studying a lot I come to know that that is
a CWMPC port which was doing a device
management on 7547. And here you can
see operating system is Linux kernel 2.6.
Just Google about Linux
kernel 2.6 exploit.
I believe you may find a 5 to 6 pages
of CVE details with the exploit available on the
device. And here is a specific version 2.6.17
to 2.6.36. So,
you may find more critical
vulnerability. And now you have a deeper angle and you have
deeper aspects. So, all you need is to look into
17 to 18 exploits.
Like 18 versions and exploit for that
18 version only. So, you may
use it for a remote code execution if exploit is
supporting RC or you may end up with a
privileged escalation vulnerability.
Now, obviously, as we
seen in a port scan, the device is running
web server. I connected to that device and found this
index.asp. I entered username and password. Here you can
see username is travelling and password is
travelling. But what? I think
something is missing here. So, what is missing?
That missing part is nothing but
a XFrame option header. Now, you are thinking why
I am making a critical issue. Why I am asking this
as a critical issue. I will tell you in a next slide.
But keep in mind that we have
no XFrame option here. So, that means these devices
are vulnerable for click jacking vulnerability.
Then after further accessing
or after further obtaining
view from this device, I got to
this one request that this one request
could manage a
complete device. So, I can, with this one
request, I can manipulate every
parameter of device. Here you can see
user type is admin, username is admin,
admin password is admin, then
DBID, CLCD language is 0, management
use VPN 0, remote web login is 1.
That means remote web login is enabled
or disabled. Ok. So, you can change it
also as you have a, in one request only.
Wireless access 0, LAN port
is 80, DBID web port
is 80, DBID web SSL port is
443 and remote
web, remote legal IP is everything.
So, every remote web is
legal IP. Then remote telnet is 1, telnet
security code and telnet, local telnet
is 1, telnet port is 23. Telnet
remote legal IP is 0.0.0.0.
So, anything, any
any
any characters
anyone can connect
to device over a telnet. As this device
is listening on 0.0.0.0
and hostname was there, radius
access is there, IP
for instance, log, enable, device plan
So, as you can see here, everything is controlled in
just one request. Ok.
And can you notice something here?
So, this is an interactive session, generally.
I will tell you, there is no
uniqueness in this request. As you can see
apart from this cookies, there is no uniqueness.
So, that means this device is vulnerable for request forgery
also. Now, we have a click jacking vulnerability
and request forgery vulnerability.
So, we can do a cross-site request forgery to this device.
Now, let's look at
last part.
Here, these devices
have some
one page called diagnostic
to perform this kind of
operation, like to ping the device
or to see whether the device is properly
configured in a network. So, like, you can't do the SSH to the device
and ping for the device.
So, these guys generally give such kind of option in web UI.
And here you can see, here was a ping option.
I just put a ID command in backtake
and it returns me an ID. So, basically, we have a
remote code execution vulnerability or say
code execution vulnerabilities on the device.
Now, we have a click jacking,
we have a cross-site request forgery
and we have a code execution.
Now, if you put some logic that
this is an IP phone, it is connected
to the laptop. Now, laptop is directly
connected to IP phone. In most of the company,
wherever you see, IP phone network and
laptop network are same. Generally,
IP phone itself gives IP to
using that cable to laptop. So, that means your laptop
is reachable to IP phone. Now, let's
make some fancy page
to retain
this organization employment
you have to agree to policy.
Means to continue with employment, you have to agree
to those policies. If you don't want to, if you want to
get terminated, you can or in case you want
to leave the organization, you can click on ID security.
Now, add a click jacking.
Using click jacking, make a request
to the IP phone with the default credential.
It works most of the time and
instead of that ID parameter, change
that value with a call facebook.com
or let's say, let's add a
cron job.
Let's add a cron job using command execution vulnerability like
for i in 1 is to 100
do curl-ik
https://facebook.com or any website
for example, .com
and once you
once this request is fired, that bot is under your control
or you can add a backdoor to the device
and those will become your
destructive bots. Isn't it
easy? This is how we can turn a simple
IP phone into a
botnet.
That's all. Here is the
POC which I have done on my laptop
and this was connected to a laptop
IP phone. I just clicked on
I agree and it executed ID command on the device
using this
simple way. Now what I need to use this
I need to host this test POC to one
server and all I need to do is send that
server link to anyone
means to send that server link to
users so that once users click on that link
it will create a request to device
and with the CSRF and default credentials
and command execution it will authenticate and
execute the command.
So this was all
getting hands dirty with IoT. Now we will
touch base upon a fuzzing reverse engineering and expert development.
We have a complete one hour section
in tomorrow's training or in
my training at day 1
of fuzzing on this fuzzing reverse engineering
and expert development. In this brief due to lack of time
we are just touching base on this.
So first thing
is to get the shell. Before we start fuzzing
or debugging we need to install the
debugging tool on the device.
So for that we need to get access to the root
or we need at least some shell
to device for testing this. Second
what are the ways to obtain this shell
it's like one I showed demonstrated just now
with web vulnerability. Instead of id command you can execute
npf and lvp on 4444 you will get
bind shell
to the device. Second is
firmware analysis. In firmware analysis you may come up
with a hardcoded account, backdoored account or you may
come up with a way to execute a command
some binaries might be there which is listening silently
and there is some clients to connect
that device. Third is document review
in document dimension that in case of
emergency you need to connect
on this port by this way or by pressing this
button multiple times you may get a shell
and last default credential is always good
and reverse engineering the binary. Default credential
we used in earlier our telnet server
and exploiting web vulnerability also we used
right now and lastly reverse engineering
the binary. So
this looks complicated earlier but
when I start exploring this it is
not as complicated as it is. So there was
one fine admin panel, I just put admin on it
I intercepted this and I found this
these are the request, username
logoff, login time
login time 0 and login value
password, wrong password, password 2 is wrong password
this is the input I typed here and again
there is a user password is wrong password
so I saw multiple fields there as a password
and I decided to first make sure
whenever you are fuzzing a device you should fuzz each and every request
you never know when you got a
surprise. Then I created this fuzz list
here. A, 2 times A, 5 times
A, 10 times A, 20 times A, 50 times A
100 times A, 200 times A
and I loaded it into burst payload
and I fired this
into that. Now here you can see this is a
missed part. Here you can see the responses
is here but here it is missing. Again
device started responding. So let's see what happened in the background
here is a logoff device
what you can see here. Can you see something interesting here
so the boa server was running here
on the
then there is a extra body
it got, what it got?
6er. A buffer overflow here, a static buffer
overflow. Dumping core and flash tmp
now what? Again boa server started
with a different PID
1170, 1169 and
what here? Extra radiant body, again it got
6er, again dumping core and tmp
now again it got crash, again it started
so someone might be wondering that if we are
able to crash, if the device is getting crash
how this binary is getting up? It's because
there are procmon kind of activities are running inside
the device which will keep
eyes on process like if the web interface is up or not
if the SIP interface is up or not
if a LAN interface is up or not. So whenever we are
crashing this with our payload as you can see here
here when we send
5000 A's
as a password to the device
device get crash, again we send
10,000 A it is getting crash
again we send 20,000 it is getting crash
again with the 50,000 it is getting crash
so this is how
we are getting crashes here
so first thing is once you got a
server, you need to fuzz all
each and every request with each and every parameters
you may get a surprise anytime
so this is a fuzzing with HTTP section we are doing now
now you got a crash
right, but you have to identify
at what level device is getting crash
so here you may see when you are sending
a 5000 A, the device is getting crash
so what you have to do now with the MSF
you have to generate a payload of 5000
and you have to copy that payload into a
request and you have to send that payload to identify those
offsets
at which point device is getting crash
to develop a successful exploit. Now how you can achieve it
so first thing is
as you have a root shell
first thing is to grape for the process ID
which process is running. Now you have to install
the GDB server. We are taking this in deeper manner
that how we are going to install GDB in training
and you have to attach the process
here with GDB
now GDB is listening to this process and then
you have to connect GDB
we need a GDB multi architecture
here to connect this
and once you connected to GDB, you have to regenerate
the crash. As the device is crash, you can see
here the registers from GDB
it's a Pond GDB I used to use
here you can see from register S0 to S3
this 4 registers are in our control
then here you can see
T4 register and T7 register
are in our control and also we have a control
over return address. So once we got this much of access
now you know what to do
just get a dirty shell code or reverse shell
or bind shell
and fire it
and once you fired it, you will get
the device. So this is the owning the device
so here is an exploit which is a simple exploit
I developed here for this IP phone only
here you can see username is buffer overflow
and password is equal to A into
999 times, this is the padding
till T4, then first register comes is T4
then again we have a
T7 here, then T6
and here you can see S0 register, S1 register
S2 and S3 register
so all you need to do is you have to host this register here
in S0 to S4 and then you have to
give some padding here
again till return address and
some padding and then you have to call the return address
and by this way you can own the device
without any interaction just by knowing the
IP address. All you need is IP address once you perform
an extensive research to this.
So as I am available with you from long time
on this all, still you have a question you can
mail me at incosubatme.com
and you can follow me at twitter
at securitibill. Thanks a lot, hope you like this talk
and hope I can see you again
for tomorrow's training.