start	end	text
0	3000	Welcome to Offensive Embedded Exploitation
3000	7140	Getting Your Hands Dirty with IoT and Embedded Devices
8380	12180	So, the agenda, before we start with the talk
12180	15180	I would like to tell you that I am conducting a training
15180	18880	I would like to thank Mr. Omer and Mr. Joseph
18880	21120	for allowing me to conduct a training
21120	23880	with Defcon Red Team Village, which is on Day 1
23880	27140	So, I request you to, if you want
27140	30580	if you like this talk, if you want to attend this in a more deeper manner
30580	32740	you can attend tomorrow's training.
32980	36940	So, let's start with the agenda of today's talk.
36940	39160	Today, we will first have an introduction to IoT
39160	41900	then we will do a preparing the arsenal
41900	44320	that is a setting up our requirement
44910	47560	then we will have recon, then show time
47560	51720	that is a firmware analysis, then getting hands dirty, dynamic testing
51720	54320	and lastly we will touch base upon
54320	57100	fuzzing, reverse engineering and exploit development
57100	59980	So, let me introduce myself
59980	62020	I am Kaustubh Padwad from India
62020	64760	also known as Security Beast on Twitter
64760	68140	I have dozens of exploits listed on
69260	71740	GitHub and CVE details
72320	76440	on IoT. Also, I am a
76440	78520	security researcher at Reliance Jio
78920	81340	that is Jio Platform now, Jio Platform Limited
81340	83880	where we conduct device security testing
83880	87360	for all of the Jio Platform devices
87360	90660	Also, I am a SINAC Red Team member
90660	93060	to keep myself updated and to
94260	96140	hack into the toughest
96140	99160	infrastructure, SINAC is a great
99160	101500	learning platform and also I do bug bounty there
102130	105300	and I like to share my knowledge, so I am a speaker
105300	106900	I speak at conferences
106900	110960	And now, it's time to get started with the
110960	113080	topic. So, the
114240	117080	I have classified IoT in a
117080	120100	three style. One is a industry
120100	122900	IoT, second a human IoT and third
123440	126140	IoT for others, that is animals. So, we will
126140	129240	see, I have classified here all the industry in
129240	131910	this image taken from a source is mentioned
132960	134820	Here, I have listed
134820	138020	all the industries like manufacturing industry, smart
138020	141140	government, mobile network,
141140	143340	mobility and Wi-Fi, smart digital
144160	146860	citizens, that is us, then open
146860	149940	data, health is a key element in IoT, then
149940	153140	smart agriculture and smart building
153140	155740	smart transportation. So, these
155740	159160	things are getting smart with the help of IoT. Major
159160	162060	like, for example, a transportation
162060	164460	industry, Tesla is building
165060	168020	Tesla is the best example for IoT based car
168020	171360	even for a logistic, IoT is getting
171360	174300	used in very huge manner to track their shipments
174620	177440	that to ensure the data, the packages
177440	180320	which is shipping should not get tampered
180320	183280	they are putting tamper detection based
183280	186140	on IoT. So, it's like simply if someone
186140	188980	opens the door, that means it is tampered and as the door is
188980	191940	opened, that small IoT device will send
191940	194980	generate an alert and send to the respective
194980	197980	logistic person. Manufacturing industries are
197980	200460	using IoT to improve their
200980	203680	services or to improve their production
203680	206220	product qualities. So, there should be
207260	210160	a zero error product development, we can
210160	213160	say with the manufacturing industry. And
213160	216000	government, like government should implement IoT
216000	219240	In my training, I have an excellent
219240	221800	example, which I
221800	224800	covered there in my training. So, let's assume
224800	227600	that every city have a street light
227600	230680	hundreds and thousands of street lights, which is running
230680	233560	from night, which is running whole night.
233560	236760	So, if you install one small IoT module
236760	239680	of let's say $5 cost to that
239680	242060	light, then
242060	246280	that light will become smart and it will turn on only
246280	249240	when the vehicle is passing through. And rest of the time, it
249240	252080	will stay in an ideal state, let's say power off state.
252080	255240	So, that $5 module can save your $500
255240	258640	electricity bill for every month.
258740	260180	So, it makes sense
261400	264060	of using IoT in
264060	267200	government covered areas
267200	270020	or government entities. Mobility
270020	273140	and Wi-Fi, they are key provider for the
273140	276420	IoT. As I said in mobility
277260	278820	as government needs
278820	281680	or let's say if you want to create a IoT environment
281680	285300	so, mobility is the best way. They provide us a
285300	288300	NB-IoT, Narrowband IoT and
288300	291900	LTE-IoT. So, these two ways they can provide
291900	294240	us IoT connectivity to everywhere. Health
294240	296840	is the key element. We are discussing this here.
296840	299980	Agriculture, one of my friends have built
299980	301980	IoT based
304420	306020	water system
306020	308520	to his farm. So, it detects
308520	311800	soil dryness, it detects wind
311800	314840	speed, it detects temperature and accordingly
314840	317860	it turns on his water pump.
317860	320480	So, it will automatically give water to the plants
320480	323760	to his farm also.
323760	326900	And smart building, there is an
326900	329520	excellent example in the next slide for smart building
329520	333140	and transportation as we just talked
333140	335800	about Tesla. Now, in human
335800	338940	IoT. So, devices are getting inside
338940	341740	the body. Like for example, a pacemaker.
341740	344840	Pacemaker is a medical device, medical IoT device.
344840	347940	It's a really critical device
347940	350740	in IoT aspect or
350740	353700	in any aspect. And insulin pumps
353700	356280	and these are other devices which can be
356280	359740	currently using inside the body. There could be more
359740	362280	but as of now I corrected this.
362600	366240	Now, you can
366240	368680	trigger insulin shots
368680	371780	to your loved ones remotely with this insulin
371780	374720	pump. You can check if
374720	377960	there is a
377960	380900	what we say abnormal
380900	383080	behavior of heart or
383960	386740	abnormal behavior inside the body. These pacemakers
386740	389760	are also smart. They can send data to
389760	392960	doctor that it is not behaving good
392960	394700	or you can
395760	399040	as we know pacemaker is a critical medical device.
399040	401980	It controls your heartbeat. Now,
401980	404800	why cow is here? So, IoT
405660	407780	animals are getting smarter.
407780	410540	So, like if your pet lost
410540	413600	direction then there are some patterns which
413600	415980	they triggers every time. If they feel like lost
416580	418620	or if they are not
418620	422620	let's say you are not with your pet a complete day and
422620	425740	suddenly he developed a fever. Then what?
425740	428820	So, some guys are working on the solution
428820	431800	which will be a kind of belt inside their
431800	434920	body or inside their neck tied to their
434920	438080	neck and that belt will keep analyzing
438080	440980	their behavior. Are they behaving normal?
440980	443920	Are they feeling like lost? Is their
443920	446880	temperature is normal? So that you can take appropriate
446880	450000	care of your loved one pet and you can track
450000	452680	your animals also like your pet also
452680	454420	that if they are lost or
454420	459400	then you can track them. So,
459400	462280	IoT is a major part of our body. IoT is
462280	465200	an emerging field and IoT is too much
465200	468380	powerful than we imagine.
468500	471200	So, with the great power, great responsibilities also
471200	474820	come. That we will discuss in a further section.
475140	477260	Now, let's have a look of smart
477260	479720	building. How one can implement
480180	482720	IoT in a smart building.
490100	492280	Jing Jing.
494080	495060	Tian Bao Jin Ling.
495920	503600	Tian Bao Jin Ling.
509820	513120	Tian Bao Jin Ling.
522720	524520	The self-check-in machine
524520	527220	like the guest mobile check-in
527220	529060	like the robot service and
529060	531980	Timogeneous voice spatula.
531980	533780	The purpose of this kind of service and
533780	536260	technology is to improve the efficiency
536260	539280	of the service and the consistency of the
539280	540240	service quality.
543120	543700	Jing Jing.
552700	554580	Jing Jing.
554740	556380	Jing Jing.
556380	557760	Jing Jing.
557760	558320	Jing Jing.
558920	559680	Jing Jing.
561420	561640	Jing Jing.
561640	568650	As you can see, a smart building
569530	571690	a brilliant example of smart building
571690	574670	IoT in action. So, I would definitely
574670	578130	like to go there and check-in to test the services.
578550	581410	So, with the great news,
581410	583730	great responsibilities do come. So, what I
583730	586490	think is why IoT security
586490	590250	assessment or why embedded devices security assessment is important.
590250	592410	I have collected some hot news.
592890	595790	This is IoT hot news where
595790	598710	we can see multiple threats and risks that
598710	601990	currently associated with IoT. The first and most
602650	604610	important risk here.
604930	607870	Risk with IoT in a medical field.
607870	609850	So, when I was a kid, my
610650	613950	grandparents used to tell us that there is a witchcraft and
613950	616470	there is a black magic kind of stuff
616470	619690	which can remotely
621770	622370	kill
622370	626050	someone. So, I don't believe on that
626050	628830	but here you can see with IoT
628830	632010	you can do it. Let's say, instead of giving
633030	634730	10ml pump shot, if I trigger
634730	638310	100ml pump shot, then who can save you?
638310	641150	Instead of setting your heart rate to the normal heart rate
641150	643650	if I set it to 3000 beats per second
643650	647730	you will suffer from a major cardiac arrest.
648030	650190	So, as we can see
650190	652910	these are inside the body and these are
652910	655870	very critical devices. So, security
655870	658810	assessment for these devices must be done
658810	661730	in a very aggressive way.
661990	664930	I believe that if such kind of devices
664930	667930	are manufactured by a very renowned vendor, it should be
667930	671170	tested country-wide. It should be
671170	673670	offered to the expertise all across the globe
673670	677690	and then you can ensure that this product is secured or not.
677690	679970	Because everything has a different mindset
679970	682950	to test everything. So, same way
685010	685690	Now
685690	689190	you brought an IoT product that is
689670	692110	a surveillance robot to secure your house
692110	695090	and to take care of your loved ones when you are not in
695090	697990	the home. And hackers use that robot
697990	701150	for spying you. Here you can see
701150	704310	hackers break into a smart home, play inappropriate music
704490	707530	and communicate with a resident via camera.
707530	710110	It's a horrible thing. It's a scary thing.
710110	713510	If someone is continuously watching you and someone is talking
713510	717150	with your speakers only, how would it feel?
717150	719810	Right? It's scary. Super scary.
720290	722170	And this attack
722170	725430	it is an industry grade attack. Someone discovered
727050	728670	a remake of Mirai
728670	731570	botnet. It was the OMG attack
731570	734190	was discovered by Fortinet. It was the
734190	737030	second Mirai. So, Mirai is the biggest
737030	739710	attack, biggest IoT attack till now.
739710	743250	You can read about it. It's a really interesting attack.
743590	745470	This is again like
745470	749150	you brought a surveillance system to watch your home
749150	751650	and that surveillance system is watching
752190	754850	is watched by hackers. So, this device
754850	758090	was running one video talk protocol which was
758090	761110	sending the audio, which was recording the audio by
761110	764370	mic and sending it to the one who connects
764370	767550	over video talk to the camera. It is again scary.
767550	769990	Right? I believe there should be some system
769990	773250	which will ensure that how this product is secure on
773250	776350	scale of 10. So, it will be easy to judge
776350	778330	whether we should buy it or not.
778330	782430	Like a product rating, there should be a security rating
782430	785430	also should be there. And this is the major threat.
785430	788210	FDA recalls nearly half of million pacemakers over
788210	792310	This is the really critical issue. So, as you see the
792310	795590	life risk is associated with the risk of
795590	798370	with the IoT devices. So, that's why the
798370	801510	security assessment of such a product is
801510	804390	really crucial and really important. It should be done
804390	807470	right. Now, my
807470	810030	case study for this is
810030	812430	can this decent looking IP phone
813210	816130	change into a botnet? What do you think?
816130	819630	You can turn this device into a botnet?
819810	822330	Most of the guys will be thinking how this
822330	825530	can be possible. Or if there are experts who have already
825530	828550	played with it, may know the trick what I am going to try.
828550	831290	Right? Now, one day, one fine day I was
831290	833990	thinking about which device should I pick up for the training
833990	837210	for this product and which device should I pick
837210	840350	up for the brief also. So, I was staring at IP phone
840350	843250	and suddenly it comes in my mind that why not this
843250	846330	IP phone only. As every corporate
846330	849350	have IP phone. Right?
849350	852350	So, let's say our corporate is one of the
852350	854910	biggest large corporate. So, we have at least
854910	857590	40,000 IP phone of same brand
858170	861630	inside our office. And Mumbai is a
861630	864430	corporate hub. So, I guess that
864430	867510	there should be more than
867510	870030	crores of IP phone will be there in Mumbai of
870030	873470	same brand. I am not talking about multiple brands.
873570	875750	Let's say if vendor X is producing
876310	879250	X type of IP phone, that same type of IP phone
879250	882230	you will find at least 1 crore IP phone in the city.
882490	884370	And if you target a specific
884990	888230	call center, BPO and KPO
888230	891450	then their business is IP phone. Right?
891450	894210	So, if you target that, you will get lots and lots
894210	897130	and lots of target. So, if you are able to remotely
897130	900170	compromise one IP phone, you are
900170	903090	able to compromise crores of IP phone.
903090	905230	At least same types of crores of IP phone
906450	908950	using this technology.
908950	911550	So, if you have hacked
912130	914910	two organizations having 50,000
914910	917910	IP phones each, that will create
917910	921950	1 lakh, that creates your 1 lakh bots.
922430	924390	Maybe it could take 8 days, 10 days
924390	926510	15 days. But within 15 days, you will get
926510	930170	1 lakh computers, 1 lakh bots.
930170	933630	Basically, what IP phone is inside. It's an ARM machine
933630	935570	or MIPS machine. Right?
935690	938810	So, you may get 1 lakh bots
938810	942070	in just 8 to 15 days. Now, let's say if you target
942070	945130	complete city, you may end up
945130	948250	with 50 lakhs IP phone. Right? In a city
948250	951250	you will definitely get. Now, let's say
951250	953630	if you target cities, multiple cities
954150	955850	then you can, let's say
956850	960950	India have 4 big corporate hubs. Mumbai,
960950	963590	Delhi, Chennai and Bangalore.
963590	966190	So, if you hack even those 4 cities, 4
966190	969090	corporate hubs and Hyderabad also, sorry. So,
969090	972210	these 5 cities, you may end up with at least
972210	975030	5 crores IP phone.
975030	978150	Now, let's assume if that 5 crore IP phone, you are
978150	981410	instructing those 5 crore IP phone to make a
981410	985470	10 request per second to the facebook.com
985470	987370	So, 5 into 10 is 50.
987370	990130	50 crore request per second to the facebook.
990130	993410	You think how long it can survive?
993410	996510	Let's say any big provider. Facebook, Google
996510	999990	or for how long time it can hold such a load?
999990	1002630	Even you can increase a 10 to 20 request per second
1002630	1005810	that is around 100 crore request per second.
1005810	1008530	Right. It could be a bigger storm.
1008690	1011770	And I am just talking about 5 cities of 1 country.
1011770	1014730	Now, let's say if you target a multiple country with the same
1014730	1017690	attack, you can create a biggest TBPS
1017690	1019730	attack in the history.
1020150	1023750	So, I build a case study. How can we make
1023750	1024890	this possible?
1026610	1029150	But before that, we need to set up our machine
1029730	1031030	to test this.
1033370	1034430	Most of the time
1034430	1037250	when I give a talk to a conference
1037250	1040150	or seminar or chapters like
1040150	1042970	null chapters or somewhere, they ask me
1042970	1045690	Sir, I want to start with IOT but
1045690	1048670	I don't have enough requirement machines.
1049050	1052090	So, this is like, you know, you need nothing
1052090	1054530	literally nothing to set up a basic setup
1054790	1058210	for IOT test. Here I have shortlisted to get started
1059130	1062030	What all you need is a Linux.
1062090	1065610	Why Linux? Because Linux is smooth with
1065610	1069290	virtualization of ARM and MIPS devices.
1069290	1071070	And all IOT devices binary
1071070	1073990	not all, most of the binary work with the
1073990	1076770	ARM technology or MIPS technology.
1076770	1080430	So, to smoothly virtualize it, you need a Linux.
1080970	1082910	Secondly, Linux gives you
1082910	1085630	lowest level access to the operating system.
1085630	1089230	So, if you connect a device to USB port
1089230	1091490	it will definitely give you something
1091490	1095070	like manufacturer, product ID
1095070	1098250	vendor ID, device type ID, something it will give.
1098250	1100490	It won't tell you like a Windows that
1100490	1104330	unknown device. Right? That's why Linux.
1104330	1107030	And there are more reasons which we are
1107030	1110390	which you may get in a training section.
1110950	1113050	This device is
1113050	1115110	the JTAGulator.
1115290	1119010	So, JTAG is an interface which some devices
1119010	1121430	don't have any interface. No UART
1122050	1125030	no console cable, no USB
1125950	1128550	no LAN port, no WAN port
1128550	1130670	So, in that case what you should use
1130670	1133690	to interact with device. Right? Our target is to get
1133690	1137450	into the device. That is our first target as an IOT guy.
1137690	1140050	So, in that case what you can do is
1140050	1142870	you can use JTAGulator
1142870	1146610	to connect with the JTAG ports of the device.
1146610	1149110	Now, you may say why not no
1149110	1152030	JTAG in the device? Because this is
1152030	1155230	not the case. JTAG is present in most of the devices
1155230	1158290	because it is used for purely factory debugging
1158290	1161070	process or factory QA process. Let's say
1161070	1163430	device is an assembly line, it gets manufactured
1163970	1166790	it puts a required data and now
1166790	1170330	before going to production, device needs to run a
1170330	1174010	QA. So, nobody is going to
1174010	1176090	check manually that hundreds and
1176090	1179330	lakhs and millions of devices with manually
1179330	1182370	checking 1, 1, 1, 1 pin. No.
1182370	1185050	What it do is, it will connect
1185050	1188650	JTAG pins to the device and it will test all the
1188650	1191590	functionality with their JTAG testing suite. So, JTAG
1191590	1193650	is present. You may not find the JTAG
1193650	1196510	pins on the device, but you will find a point
1196510	1199830	where you can solder the pins and you can connect a JTAG
1199830	1203070	regulator and identify the appropriate JTAG pins.
1203230	1205890	Now, as a IoT comes in the mind
1205890	1208770	second thing come is a wireless. IoT
1208770	1211570	gives you a wireless freedom. So, like now
1211570	1214590	the device with 2 sensors and 1
1214590	1217630	server is not connected over wire. These
1217630	1220450	will be connected with a wireless technology. For example
1220450	1223750	our ZigBee protocol, Z-Wave
1223750	1226550	protocol. So, to test this
1226550	1229590	kind of protocol, we need some specific hardware
1229590	1232190	which will identify those frequencies. So, this
1232190	1235230	API motor is a gadget which can, which
1235230	1237790	allow you to perform a ZigBee test like
1238190	1241590	ZigBee packet injection, ZigBee packet replay attack.
1241590	1244270	So, you may see building lights, these are controlled
1244270	1247210	most of the lights are controlled by ZigBee.
1247770	1251350	And connectors, finally. Seriously, they are life.
1251990	1254350	Without connector, you cannot test IoT.
1254350	1257070	We need at least 1 extra LAN card, we need
1257070	1260070	at least 1 WAN card, we need an additional Bluetooth
1260070	1263590	adapter, we need 1 screwdriver set,
1263590	1266270	we need a Skira, because Skira is an all-in-one
1266270	1268290	connector. So, instead of spending for
1269830	1272070	individual connectors, if you can spend
1272070	1275090	that's fine, but instead of spending on this multiple
1275090	1278110	you can buy 1 Skira connector which supports
1278110	1281130	GPIO communication, which supports JTAG communication,
1281130	1284090	which supports UART communication and also
1284090	1287270	SPI communication. So, if you buy this 1 product
1287270	1289990	your all problems will get solved. And lastly
1289990	1293230	to hack the radio frequencies, we need a hack RF
1293230	1296230	device. So, this is the minimum
1296230	1299410	thing you need to get started with a IoT test.
1299410	1300250	Ok.
1301030	1302110	Now,
1303210	1306690	this is a basic setup. Now, what about advanced setup?
1307690	1308590	This.
1310510	1313510	You can buy endless stuff. As new
1313510	1316350	device will come, you need to buy something.
1316650	1319850	As new device may have
1319850	1322410	other way to communicate, you have to build your own
1322410	1325330	PCB boards to communicate with that device. So, there
1325330	1328210	was 1 device which is not directly connected over
1328210	1331150	USB, so there was a mediator chip in between.
1331150	1334150	So, you have to connect that device to that mediator chip. That
1334150	1337130	mediator chip was converting those signals into UART and
1337130	1340090	then UART to USB converter and that to laptop.
1340170	1343030	So, this was the complete setup. So, there is no limitation
1343030	1346690	for advanced setup. You can build up to whatever you want.
1347510	1350390	Now, we are done with the hardware part.
1350390	1353230	What about software? Which tools are required? Are those tools
1353230	1356170	are expensive? Are those tools are paid? Are those tools
1356170	1359570	are really too much heavy that one cannot afford?
1359570	1362390	No, this is not the case. This
1362390	1365410	I called as a weapons and these are the minimal
1365410	1369070	weapons which are needed for testing.
1369110	1371650	One is a BinWalk. So, BinWalk is a great
1371650	1374510	tool. You can do a firmware extraction.
1374610	1377630	BinWalk is basically give a firmware to BinWalk. BinWalk will extract you
1377630	1380230	if there is a uncompressed, sorry
1380230	1383510	unencrypted firmware. Ok. We need
1383670	1386610	a Firmadyn. So, Firmadyn is a collection of multiple
1386610	1390030	tools. The Firmadyn consists of BinWalk, QMove
1390030	1392750	and Postgres database and it's
1393810	1394390	a properly
1396350	1398670	it's a properly organized framework
1398670	1401330	for emulating the firmware. Ok.
1401410	1404390	So, we need a Firmadyn to emulate a device firmware
1404390	1407610	in case you don't have a device and you have only the
1407610	1409610	firmware and you want to test it.
1409810	1414470	I hope everyone is familiar with it. It is the great software tool we have.
1414470	1417490	And we need a Python because most of the tasks we have
1417490	1420430	to do it on repeated basis. So, to automate that stuff
1420430	1423330	Python is the great and easy to write language.
1423450	1426590	And lastly, IDA Pro. So, if you can't
1426590	1429710	afford IDA Pro, it's ok. You can buy IDA Community Edition
1429710	1432390	or you can use some open source
1432390	1435290	tools like Radare or NSA Ghidra also.
1435290	1438930	NSA Ghidra is also a great tool to reverse engineer.
1438930	1442210	But trust me, reverse engineering is the life.
1442210	1445390	Reverse engineering is the life and reverse engineering
1445390	1448470	is the most important aspect of device.
1448890	1451290	So, there are few things that comes
1451290	1454350	in the mind when someone asks why you
1454350	1457370	need to reverse engineer the binary. Hard-coded backdoor
1457370	1460290	account. Some devices, recently
1460290	1462970	when there is a news called on
1462970	1465790	I forgot the name of that router OS
1465790	1468850	but that router OS is having
1468850	1472230	7 major issues was recently
1472230	1475330	identified and most of it was a hard-coded
1475330	1478750	backdoor account. That too listening on a WAN interface.
1478750	1481090	So, let's say if your device is running
1481310	1483990	a telnet on WAN interface and if there is a backdoor account, you
1483990	1487850	never know how one can enter in your network.
1488310	1490050	So, this is one aspect.
1490050	1492490	Second is identifying a critical vulnerability
1492490	1495890	like remote code execution.
1495890	1498910	As in embedded device, there is very limited space.
1498910	1502590	So, you have to fit everything in that small space.
1502630	1504890	So, application logic and application
1504890	1508850	code is inside the web application binary only.
1509090	1510090	So,
1511030	1513050	to identify that binary
1513050	1516990	the best way is to reverse engineer that binary and get
1516990	1519890	assembly code out of it and then perform
1519890	1522970	assembly analysis to identify where the
1522970	1524850	native vulnerable calls like
1525830	1528430	sprintf or system call
1528900	1531890	fopen, popen kind of calls are in use.
1531910	1535190	So, to reverse engineer we need a IWP.
1536070	1537950	Now, let's move
1537950	1539970	towards, once you have set up everything
1539970	1544030	we start with the first stage is always the reconnection
1544030	1546590	of WAN testing. In IoT also
1546590	1549470	it's not exceptional. First stage is recon.
1549470	1552230	I split this recon section into two parts.
1552310	1555850	First active recon and second passive recon.
1555850	1558150	So, generally in
1558150	1561530	pen testing we perform active recon first and then passive recon. Here we have
1561530	1564470	to do reverse. Like first we have to identify, we have to do
1564610	1567670	a passive recon. Let's say if you got one device
1567670	1569770	for example this headset
1570430	1573450	and now the manufacturer of this headset is
1573450	1576790	saying that this device does not support a WiFi.
1576790	1579890	So, how can you ensure it? Just because he said
1579890	1582830	this doesn't support WiFi, you are going to believe that this
1582830	1585830	doesn't support WiFi. No. You have to read
1585830	1588930	their specifications. So, each device
1588930	1591170	have one unique FCC ID
1592090	1594570	and if you search that FCC ID
1594570	1597450	into the FCC ID database, it will
1597450	1600630	come up with all the specifications are
1600630	1603610	exist with the device. Ok. So, sometimes
1603610	1606430	vendor may lie to you that this functionality is not supported at
1606430	1609190	hardware level and they can disable it. Like
1609190	1612090	this happens with me with one product
1612380	1615690	that vendor was saying, Sir, this device doesn't support
1615690	1618630	WiFi. And on FCC ID device, they have
1618630	1621230	mentioned that this device supports WiFi.
1621410	1622790	So, we had a long debate and
1624070	1627590	lastly I ended up with creating custom firmware
1627590	1630510	which loads the WiFi driver. So, basically they just disabled the WiFi
1630510	1633990	driver. That's why WiFi is not coming up of that device.
1633990	1636970	Ok. So, first we have to do a
1636970	1640570	FCC ID analysis. Second,
1640570	1642930	documents. You should ask for as much
1642930	1645910	as possible documents.
1645910	1649210	So, like that document could be
1649210	1651990	a security architecture document. That document
1652310	1655070	could be a product data sheet.
1655070	1657230	That document could be a project description sheet
1657230	1660390	or could be a user manual of the
1660390	1663290	product. Ok. So, these are the things
1663290	1666330	that you should do first and then you should touch to
1666330	1669130	the device. And then
1669130	1672270	once you touch to the device, first thing is to know
1672270	1675290	your device. Right. So, if
1675290	1678310	I give you something like you have to
1678310	1681430	test this device, what you will do?
1681430	1684530	Like in web application, we see what technology
1684530	1687650	it is built on, like LAMP stack is there or
1687650	1691190	what are the directories are in use, what is the server.
1691230	1693530	So, same way in device security testing
1693530	1696590	or IoT pen testing, we have to identify the multiple
1696590	1699550	entry points to the device. For example,
1699710	1702710	a LAN port. In this device, there is a LAN
1702710	1705650	port, there is a console port or
1705650	1708250	there could be a WiFi this IP phone might be using
1708250	1709530	and some
1709530	1713970	like if device is running on Android,
1713970	1718170	there could be a
1718170	1721030	ADB running on it. Some
1721030	1724170	advanced devices that I told you about Narrowband
1724170	1725790	IoT, they could be using an
1726070	1729130	IDD interface to communicate with the server.
1729130	1732630	No IP network basically. No IP data delivery
1732630	1735730	network. Ok. And
1735730	1737690	then you can check for the UART, if
1737690	1740850	UART is present, console port is present, if Android
1740850	1743190	is there, then ADB is present. If
1743190	1746910	classic ports are there, then LAN port
1746910	1749870	is there, console port is there. So,
1749870	1752890	first thing is to know your device. How can you interact with that device?
1752890	1755850	How can your Linux, your pen testing machine can interact
1755850	1757930	with the device? And once
1759810	1761710	you know that you can interact
1761710	1764750	with device with specific way, you should go
1764750	1767530	through the documents. So, here are some
1767530	1770350	glimpse that will help you in identifying
1770350	1773330	why document review is important. So, here
1773330	1776770	in this document, vendor is saying that this device supports
1776770	1779470	SIP version 2 and RTP.
1779470	1783130	That means this device does not support SIP TLS.
1783130	1785510	SIP TLS. So, if someone
1785510	1788250	is able to sit in the MITM
1788250	1790730	attack, he could able to hear your
1791790	1794550	hear your traffic, hear your call
1794550	1797930	which you had word with. Here you can see
1797930	1800970	this device support TR-069. So,
1800970	1803830	most of the classic guys who is working on Windows,
1803830	1806550	on Linux, on network pen testing are not familiar with the
1806550	1809910	TR-069. So, TR-069 is the protocol
1809910	1812890	through which you can provision and reconfigure device
1812890	1815210	completely using
1815730	1817010	ACS server.
1819010	1821150	And here is a user
1821150	1824220	I am sorry.
1824750	1827370	Here is a user manual. That user
1827370	1830290	manual tells us that firmware of device is
1830290	1833350	upgradable, device have a password management,
1833350	1836210	device have a local and remote syslog, device
1836210	1839190	is having auto provisioning using PFTP,
1839190	1842430	HTTP and HTTPS. And also
1842430	1845270	multi-user level. So, if
1845830	1848350	owner of device have changed the password from
1848350	1851270	device to admin, admin to admin, admin
1851270	1854470	at 1, 2, 3. Still, though it's upgradable,
1854470	1857610	still there could be a multiple users like support,
1857610	1860430	like tech, this kind of user you may find
1860430	1863410	generally inside the product. And their password
1863410	1866450	will be same as the username. So, this you can identify
1866450	1870070	from the manual itself.
1870330	1872330	Now, this is one
1872330	1875370	algorithm. Algorithms, reviewing
1875370	1878210	algorithms is one of the most critical part in
1878210	1881390	IoT. You may be thinking what we have to do with
1881390	1884510	an algorithm. So, the practical example for this
1884510	1887390	is, let's say vendor X have decided
1887390	1890270	to produce a router. So, as per
1890270	1893250	the standard or minimal requirement, all routers
1893250	1896150	Wi-Fi SSID should be unique or Wi-Fi
1896150	1899070	SSID should be random or at least the password
1899810	1902510	to connect that SSID should be random.
1903050	1905690	So, how you think that for 1 crore devices
1905690	1908650	how you are going to do a password? You are going to write a C program
1908650	1911250	for that? No. Right. Or even
1911670	1914650	if you write, so you are going to maintain
1914650	1917610	the unique password for every device with you?
1917610	1920390	No. Right. So, what you are doing here is
1920390	1923870	you are using one algorithm to generate a SSID password.
1923870	1926650	So, basically first 4 digits of your
1926650	1929250	MAC address and last 4 digits of your
1930330	1932050	last 4 digits of your
1932850	1935770	serial number plus current date and time
1935770	1938630	could be a password for SSID. So,
1938630	1940810	if you search for the
1941670	1943810	Belkin password generation hack
1943810	1946850	password generation algorithm hack, you may
1947530	1950350	come up with a, you may get
1950350	1952990	what I am trying to say here. So, if
1952990	1955790	they design the poor algorithm
1955790	1959290	just by adding first 4 digits of MAC address
1959290	1962350	last 4 digits of serial number, anyone can generate a password
1962350	1965130	for any device. Right. Or MAC address plus
1965130	1967870	date on time. So, like you know that
1967870	1971170	if vendor X is generating a password based on MAC address
1971170	1974990	and date on time, so what you do is you set a
1974990	1977630	packet capture, you capture a beacon, you get
1977630	1979910	that MAC address first 4 digits and
1979910	1983010	you add a current DDMM format
1983010	1985850	and connect with the password to the SSID
1985850	1989030	if the SSID is on default password. Right.
1989370	1992090	So, to ensure that they are not doing such a silly
1992090	1994850	mistake, we have to review the algorithm
1994850	1998190	and lastly, the magic number.
1998670	2000730	So, what the magic number is? You know, you
2000730	2003910	found some fault in your device. For example,
2003910	2006950	set-top box or for example, in any
2006950	2009610	of your device, let's say router, if
2009610	2012190	you are a non-techy guy, you take that router
2012900	2015590	hey man, this router is not working, it's not showing up
2015590	2017570	you take that router to the
2018390	2021790	respective service center. That service center guy connects to
2021790	2024470	the router and enters some code
2025030	2027330	and in 15 minutes, he will give you that
2027330	2031230	sir, it is working again. So, how you think it is possible?
2031450	2033830	So, every device have some specific
2033830	2037030	additional access mode that we
2037030	2039950	called a, what we called it
2039950	2042450	developer mode or
2043230	2045310	debugger mode or
2045830	2048890	engineer mode. So, to access those modes, you
2048890	2051790	need to enter some secret code which is also generated
2051790	2054650	by algorithm. So, it calls a magic
2054650	2057850	number generation algorithm. So, you have to review it like
2057850	2060570	there was one USB which was supporting
2060570	2063530	which is locked to support with specific
2063530	2065950	ISPX for internet provide
2066310	2068710	for internet providing and let's
2069510	2072570	then, you want to unlock it and you want to use it
2072570	2075990	over other network. So, how you can do it?
2076530	2078470	You access the engineering
2078470	2081410	mode of that device, you remove that restriction
2081410	2084590	may be a PLM unlock is there, may be some MCC
2084590	2087610	MNC code or white listed inside that device
2087610	2090250	or it could be a single
2090250	2093730	like only name of ISP is written there
2093730	2096710	to latch on this network only if you find. So, you can
2096710	2099630	easily modify. So, to access this additional
2099630	2102450	modes, you need this magic number.
2102450	2105170	So, magic number generation logic should be
2105170	2108610	tough to identify. Otherwise, once this
2108610	2111170	logic is leaked, you are over.
2112070	2113350	Now,
2113350	2117070	this is the most
2117070	2119270	interesting aspect of the commentary.
2120290	2122650	Credentials to access the device.
2122770	2124950	Here, you can see funny part. Default PC
2124950	2128970	port connection type is bridge. Ok, that's fine.
2128970	2131050	Default username for user mode is admin
2131690	2134350	Sorry, for admin mode, it's admin.
2134350	2137370	Ok, that's ok. Default username for user mode
2137370	2140990	is user. Default password for web is null. Wow!
2140990	2143350	Like they set up a complete web UI
2143810	2146970	they set up a user, they set up a password policy
2147390	2149810	and now they are setting password to null.
2150010	2152810	That means all you need to do is you have to identify the
2152810	2155970	IP address. Once you identify the IP address, you type
2155970	2158950	admin, you are admin, you type a user and you are a user.
2158950	2162290	Isn't it so funny? And here is the default
2162290	2165430	web login port. So, they are giving you everything in their
2165430	2167850	documents. So, you should review those documents.
2167850	2170410	You should search for the word like
2170410	2174370	ENC. So, if there is an encryption logic, it will pop up.
2174370	2176530	You should search for the word SECU
2176530	2179630	like secure. So, security related stuff is there
2179630	2182730	it will pop up because sometimes user manual is of 400
2182730	2186010	to 500 pages. To quickly review it
2186010	2189110	as if you are a device tester, you may get
2189110	2191630	limited time of 5 to 10 days to
2191630	2194310	complete one device, a security test.
2194310	2198230	So, in that case, you need to follow such kind of tricks.
2199850	2200970	Now,
2200970	2203350	active recon of the device. So,
2203350	2206470	active recon here is not just the identifying
2206470	2209650	open port. But when it comes to open port,
2209650	2212770	you should do a port scan of all ports
2212770	2215930	for device because they always use non-standard port.
2215930	2218350	Here is one device which I scanned. This was
2218350	2221330	the IP address of it. On 2017,
2221330	2223950	I did scan on this device Monday
2223950	2227350	and I found this port was open 1380.
2227350	2230390	After reversing that binary which was associated to
2230390	2233410	this port, I was able to perform a remote code execution on
2233410	2236210	this device. And this is an end user device. So,
2236210	2238810	multiple users are having access. So, I could have
2239330	2241330	executed a code on
2242870	2246230	maybe 70,000 people in a city.
2246390	2248330	Same way, I discovered this
2248330	2251290	crash on 4046 port.
2251290	2254270	So, if I fired one command on random IP addresses,
2254270	2257310	wherever it connects to 4046, those devices will get
2257310	2260170	crashed and I could cause a disruptive
2260170	2263150	denial of service attack. And this was also an
2263150	2266470	interesting crash I identified
2266470	2270050	on 415654 after reversing that binary.
2270050	2272450	Oh, I forgot to hide this MAC address.
2272450	2275490	That's ok. So,
2275490	2278550	this is an active recon. But, we don't stop here
2278550	2281430	for recognition. We have to identify
2281430	2284730	what is the underlying OS of this device.
2285450	2287810	So, let's say you saw a
2287810	2290630	fine working Android TV. So, you know that underlying
2290630	2293370	OS is Android. Now, what about IP phone?
2293370	2296450	What do you think IP phone is running?
2296450	2299750	IP phone, most of the run, mostly all of this
2299750	2302690	embedded device runs on a Linux. And they use
2302690	2305710	BusyBox as a kernel and BusyBox to save the
2305710	2308770	space. Because, as I told you, we have a very short
2308770	2311830	space associated with it. So,
2312490	2314850	to save space, we have
2314850	2318210	these embedded devices uses BusyBox.
2318350	2321010	And why BusyBox is false in a recon?
2321010	2323310	Because BusyBox itself has some vulnerabilities.
2323750	2326830	So, if you search a CV details for BusyBox, you may end up with
2326950	2329630	a vulnerability. And underlying operating system
2329630	2331530	will tell you what are the
2332550	2335970	vulnerabilities are associated with that operating system.
2335970	2338890	So, basically, if the device is using
2338890	2341630	Linux kernel of version 2.10
2342490	2344890	to 2.15, then in this
2344890	2347750	5 versions, there could be lots of vulnerabilities which you can
2347750	2350850	exploit later. So, identifying underlying operating
2350850	2354510	system, identifying BusyBox version,
2354510	2356730	identifying all open ports, TCP,
2356730	2359970	UDP, and apart from
2359970	2361350	this, what we can do
2362610	2365830	is like accessible locations. Like, let's
2365830	2368610	say, if root console is running without
2368610	2371650	password, with the UART, all you need is to connect one cable
2372310	2374410	using UART to USB converter.
2374650	2377690	So, this is an active recon for embedded
2377690	2380790	devices. Now,
2380790	2383810	we will touch base some more aspects of recon
2383810	2386270	in our upcoming training.
2387710	2389270	Now,
2389780	2392270	the great part of device testing is
2392720	2395970	when you are testing device as a white box
2395970	2398930	approach, you may get
2398930	2401810	with a firmware. So, there are two types
2401810	2404610	of firmware basically. Encrypted firmware
2404610	2406430	and Compressed firmware.
2406530	2410590	So, agenda for this firmware analysis talk is
2410590	2413710	to identify what is firmware,
2413710	2416730	obtaining firmware, ways to obtain the firmware,
2416730	2419130	unpacking firmware, and finding vulnerability
2419130	2421450	inside the firmware.
2421970	2425530	So, here the best part of
2425530	2428510	device testing, if you are doing a white box, then you
2428510	2431690	get a firmware. So, that will help
2431690	2432870	you identifying
2432870	2437490	the directories or
2437490	2440570	entry points or network services running on it using the
2440570	2443750	firmware itself. So, you don't have to do just a brute force
2443750	2446830	using FFUF or you don't have to do a
2446830	2449790	content discovery in a very large way.
2449790	2453050	Like, you have to perform analysis here, not
2453050	2456110	a content discovery. So, that section, it really
2456110	2459770	skip from recon and here you
2459770	2462210	if this is a white box testing.
2462210	2464570	So, what is the firmware? Firmware is the file
2464570	2466870	which contains a file system
2467530	2470650	of device, a kernel for the
2470650	2472970	device and a bootloader.
2473090	2476810	And this firmware are of two types.
2476810	2479570	One is a full firmware, second is
2479750	2482550	a delta firmware. So, let's say you are using
2483130	2485450	a mobile, like I am using a Samsung mobile.
2485450	2488550	So, you are using a Samsung firmware version
2488550	2491470	1.1.
2491470	2494170	Now, there was a issue when you open
2495050	2497750	a dialer, it gets crashed. So, this is a
2497750	2500490	small issue, maybe developer messed it somewhere.
2500490	2503670	Now, Samsung want to send a update. So, do you think
2503670	2506350	Samsung is going to send you a 3 GB update
2506350	2509950	for complete operating system for one small patch? No.
2509950	2512970	What they will do is they perform
2512970	2515930	the respective changes at file system layer
2515930	2518450	if it's a file system level. Then that delta
2518450	2521670	part they will calculate of KBs and MBs
2521670	2524390	and that will ship to your device. So, that is
2524390	2527850	called a partial update. So, that is a delta firmware.
2527850	2530630	And that firmware you receive over the air to your
2530630	2534270	handset for update perspective.
2534310	2534970	Ok.
2535990	2539730	So, these are the types of firmware.
2539730	2542330	Now, what are the ways
2542330	2545490	to obtain the firmware? So,
2545490	2548250	here are few ways I listed down.
2548250	2551690	We are going to touch base on more ways in our training.
2551810	2554630	So, first is downloading from the website.
2554630	2557550	Like here you can see the firmware is listed on their website.
2557550	2561130	You can click on download, you will get a complete firmware.
2561290	2563870	Second is like you set up a bridge
2563870	2565830	like this is your device.
2566090	2569210	This is the LAN card of your PC.
2569330	2572550	This is your additional LAN card. You set up a bridge connection
2572550	2575330	and this is your ISP cable.
2575330	2578350	Now, on device end, click on check for update.
2578350	2581650	If there is a firmware available, start Wireshark capture
2581650	2584310	here on your bridge and click on download.
2584310	2586870	So, what happens? That capture
2587590	2590430	will get stopped here and you can
2590430	2593450	download the firmware from the update. Now, extracting
2593450	2596710	for a device. I told you like some device don't have
2596710	2601630	literally any way to connect with a
2601630	2605330	JTAG and you can dump the firmware using JTAG.
2605330	2607590	Then, Google Docs. So, like if you search
2607590	2610710	index of or FTP of a product name, you
2610710	2613430	may come with a firmware. And lastly, analyzing
2613430	2616370	device traffic. So, believe me, some devices
2617230	2618570	most of the devices
2619650	2622450	which we use like smart watch or
2623110	2626290	mobile phone gets a silent update.
2626370	2628650	So, what that silent update is, device
2628650	2631730	is checking periodically whether the firmware
2631730	2635010	update is available or not
2635010	2637970	with the respective vendor. So,
2637970	2640530	let's say it on one fine night
2641390	2643770	device checks for the update. Now,
2643770	2646730	that update requires restart and device is restarted. So,
2646730	2648750	I woke up with my phone and saying
2648750	2652550	why my phone is restarted as it was
2652550	2655430	charged full. How? So, these are the tricks
2655430	2659030	that vendor push the firmware silently. That is called silent update.
2659030	2661510	So, to obtain such kind of update,
2661510	2664530	you need to keep eye on device traffic. So,
2664530	2667650	basically, you can set up one interception server itself so that
2667650	2670370	all the devices which are at your home are
2670370	2673250	connected to that interception server and that server is
2673250	2674850	downloading everything from
2676470	2679570	you can have a track of all the things that
2679570	2681510	is getting downloaded at your home.
2681510	2684650	Ok. Now, you got a firmware.
2684650	2687290	What now? So, everyone knows that
2687290	2690690	binwalk-e can extract the firmware. No. That is the most
2690690	2693690	inappropriate approach to extract
2693690	2696290	the firmware. First thing you should do is an
2696290	2699670	entropy analysis. So, some firmwares are
2699670	2702890	compressed and some firmwares are encrypted.
2702890	2705490	So, if you run a binwalk on encrypted firmware,
2705490	2708390	it will create a garbage. It may literally fill
2708390	2711470	your GBs and TBs of data with garbage and you will
2711470	2714450	get nothing. So, first proper way
2714450	2717290	is to perform an entropy analysis on
2717290	2720490	firmware with binwalk-E.
2720690	2723570	It will generate a graph like this. As you can see
2723570	2725950	here, a line is completely
2725950	2729310	on the one. That means the firmware is very nicely
2729310	2732150	encrypted. But here you can see some part is here
2732150	2735230	is not encrypted. So, now what?
2735230	2738370	Now, we can run a DD on this part
2738370	2741030	and we can download this particular
2741030	2744390	information to our
2744390	2747310	device and we see what is there present.
2747310	2750070	So, believe me, once I found the private key to
2750070	2753210	decrypt that firmware in this part, once I
2753210	2756130	found the password, so that is a fun
2756130	2758970	to identify the firmware entropy.
2759310	2762830	And with that password, I was able to open that firmware.
2762830	2765150	Now, sometimes
2765850	2769210	in hexdump only you will see the password of firmware.
2769750	2772130	It happens to me. And then
2772130	2774590	you can perform a signature analysis.
2774690	2777970	So, if you are able to perform a signature analysis, you may come up with
2777970	2781130	knowing which type of file system
2781130	2784090	are in use. So, like in Windows, we have FAT
2784090	2787110	and TFS. In Linux, we have XT, XT1234
2787110	2789970	and Razer FS. And
2789970	2793290	same way, in device
2793290	2796410	you may never find this FAT and XT4.
2796410	2799030	You will find operative file system like
2799030	2802370	cramfs, ubfs, squashfs
2802370	2804630	squashfs is majorly I have seen till now
2804630	2807970	and yzfs. So, these are the
2807970	2810430	very small file systems are in use because
2810430	2813670	due to the restriction of space. Ok.
2814170	2817210	Now, once you are able
2817210	2819970	to extract the file system from the firmware.
2820150	2823150	Now, what to look inside it. Right. We are going to touch base
2823150	2826810	details aspect of this in our tomorrow's training.
2826970	2829270	But, as of now, what are the
2829270	2832050	most critical aspect that you should look. First, obviously
2832210	2834890	a passwd file to get a credentials and
2835850	2838750	decode that hash to login inside the device.
2838870	2841370	Second, you should look for the document root.
2841370	2844270	So, what are the web pages are there. Some hidden pages which is
2844270	2847650	not listed in GUI. Those hidden pages
2847650	2850470	may use to access a device
2850470	2853350	core functionality or execute a root
2853350	2856290	level command. Then, as I told you
2856290	2858650	in this application binary
2859070	2862150	and the docu application logic is built inside
2862150	2865090	the web binary. So, that binary should be
2865090	2868130	downloaded and reverse engineer
2868130	2871610	for the purpose of identifying vulnerability.
2871610	2874950	And lastly, this is the first command which I run on
2874950	2877230	firmware. Find slash name
2877230	2880630	dot sh with type of file
2880630	2883690	and having permission 777. So,
2885270	2886790	this is the most important
2886790	2889750	aspect. As you can see
2889750	2892110	there are cron jobs running with a root
2893650	2895530	and that was a shell script
2895530	2899250	and it was having a permission of 777. What you want?
2899250	2902330	You are root now. You can edit that shell script
2902330	2905470	put add user command and once
2905470	2907750	that script is run by cron
2907750	2911430	you get a add user. Your user is added
2911430	2914550	so you can backdoor that device. Or as it is 777
2914550	2917270	and having SS type so you can
2917270	2920010	execute it yourself. Right.
2920070	2923350	So, this kind of interesting stuff you can look what are the shell
2923350	2926250	script files are there. You can look up for
2926250	2929430	their email addresses. We are taking this in a little deeper
2929430	2932470	manner in tomorrow's training. So,
2932470	2935350	these are the crucial part of firmware you should look
2935350	2938270	for. Now,
2938270	2941070	here in document root you may
2941070	2944170	ended up a source code review of a web application
2944170	2947290	completely. And in application binary itself also
2947290	2950090	you can review a source code review
2950090	2953170	of the application binary to execute a command
2953170	2956790	from a web interface. Now, getting hands dirty.
2957290	2959070	First thing is like
2959070	2962130	obvious. You are running a port scan.
2962130	2965130	So, once you remember we
2965130	2968230	conducted a document review where we found a default credential is
2968230	2971290	admin. Now, I ran a port scan on
2971290	2974110	this one fine device. One fine
2974110	2977190	IP phone. It was an IP phone. And I found that
2977190	2980210	telnet was open. And simply connecting to
2980210	2983310	telnet and running admin admin. I got
2983310	2984150	this.
2985750	2989170	Here you can see UID 0, JID 0.
2989290	2992210	We got a root over this device just by typing
2992210	2995310	admin admin. Now, we see that
2995310	2998130	ATN 443 is running also. As we know that
2998130	3001350	web server is running on document. I found this two new
3001350	3004130	ports from port scan that 7547 is there
3004130	3007350	and 53 is filtered on the device. So,
3007350	3010450	generally this device don't have a capacity to host a DNS
3010450	3013550	server. So, they use a very fine utility called
3013550	3016690	DNS mask. Almost in every device you find
3016830	3019910	a DNS mask which is running on a port 53.
3019910	3022550	That DNS mask itself acts as a DHCP
3022550	3025450	server also in device. And I
3025450	3028810	found one new port that is called 7547 port.
3028810	3031510	So, after studying a lot I come to know that that is
3031650	3034270	a CWMPC port which was doing a device
3034270	3037390	management on 7547. And here you can
3037390	3040210	see operating system is Linux kernel 2.6.
3040210	3043210	Just Google about Linux
3043210	3045490	kernel 2.6 exploit.
3045970	3048950	I believe you may find a 5 to 6 pages
3048950	3052210	of CVE details with the exploit available on the
3052210	3055510	device. And here is a specific version 2.6.17
3055510	3058610	to 2.6.36. So,
3058610	3060990	you may find more critical
3060990	3063910	vulnerability. And now you have a deeper angle and you have
3063910	3066610	deeper aspects. So, all you need is to look into
3066610	3070370	17 to 18 exploits.
3070370	3073150	Like 18 versions and exploit for that
3073150	3075130	18 version only. So, you may
3075910	3078810	use it for a remote code execution if exploit is
3078810	3082290	supporting RC or you may end up with a
3082290	3085510	privileged escalation vulnerability.
3085510	3087970	Now, obviously, as we
3087970	3090190	seen in a port scan, the device is running
3090800	3093770	web server. I connected to that device and found this
3093770	3097110	index.asp. I entered username and password. Here you can
3097110	3099890	see username is travelling and password is
3099890	3102790	travelling. But what? I think
3102790	3106650	something is missing here. So, what is missing?
3106730	3108870	That missing part is nothing but
3109130	3112010	a XFrame option header. Now, you are thinking why
3112010	3115090	I am making a critical issue. Why I am asking this
3115090	3118910	as a critical issue. I will tell you in a next slide.
3119470	3121390	But keep in mind that we have
3121390	3124370	no XFrame option here. So, that means these devices
3124370	3127230	are vulnerable for click jacking vulnerability.
3127590	3130270	Then after further accessing
3130270	3132110	or after further obtaining
3132850	3135910	view from this device, I got to
3135910	3139150	this one request that this one request
3140770	3142050	could manage a
3142050	3145190	complete device. So, I can, with this one
3145190	3148030	request, I can manipulate every
3148030	3150230	parameter of device. Here you can see
3150230	3153750	user type is admin, username is admin,
3153750	3156290	admin password is admin, then
3157050	3159530	DBID, CLCD language is 0, management
3159530	3163310	use VPN 0, remote web login is 1.
3163310	3165990	That means remote web login is enabled
3165990	3169050	or disabled. Ok. So, you can change it
3169050	3172450	also as you have a, in one request only.
3172450	3175010	Wireless access 0, LAN port
3175010	3178110	is 80, DBID web port
3178110	3180710	is 80, DBID web SSL port is
3180710	3183450	443 and remote
3184050	3186930	web, remote legal IP is everything.
3186930	3189950	So, every remote web is
3189950	3192830	legal IP. Then remote telnet is 1, telnet
3192830	3195810	security code and telnet, local telnet
3195810	3199010	is 1, telnet port is 23. Telnet
3199010	3201930	remote legal IP is 0.0.0.0.
3201930	3204810	So, anything, any
3205450	3205870	any
3209630	3211230	any characters
3211230	3213870	anyone can connect
3213870	3216730	to device over a telnet. As this device
3216730	3220070	is listening on 0.0.0.0
3220070	3222890	and hostname was there, radius
3222890	3225910	access is there, IP
3225910	3228390	for instance, log, enable, device plan
3228750	3232010	So, as you can see here, everything is controlled in
3232010	3233830	just one request. Ok.
3234430	3237010	And can you notice something here?
3238050	3241390	So, this is an interactive session, generally.
3241670	3243470	I will tell you, there is no
3243470	3246690	uniqueness in this request. As you can see
3246690	3249530	apart from this cookies, there is no uniqueness.
3249530	3252850	So, that means this device is vulnerable for request forgery
3252850	3255570	also. Now, we have a click jacking vulnerability
3255570	3258870	and request forgery vulnerability.
3258870	3261810	So, we can do a cross-site request forgery to this device.
3262370	3264090	Now, let's look at
3264090	3266010	last part.
3266630	3268670	Here, these devices
3270430	3271790	have some
3272530	3274410	one page called diagnostic
3276330	3278550	to perform this kind of
3278550	3280730	operation, like to ping the device
3281350	3284270	or to see whether the device is properly
3284270	3288010	configured in a network. So, like, you can't do the SSH to the device
3288010	3290410	and ping for the device.
3290410	3294170	So, these guys generally give such kind of option in web UI.
3294210	3296410	And here you can see, here was a ping option.
3296410	3298910	I just put a ID command in backtake
3298910	3303310	and it returns me an ID. So, basically, we have a
3303310	3305590	remote code execution vulnerability or say
3305590	3308690	code execution vulnerabilities on the device.
3308730	3311820	Now, we have a click jacking,
3312270	3314350	we have a cross-site request forgery
3314350	3316890	and we have a code execution.
3317250	3320210	Now, if you put some logic that
3320210	3323630	this is an IP phone, it is connected
3323630	3326570	to the laptop. Now, laptop is directly
3326570	3329430	connected to IP phone. In most of the company,
3329430	3332530	wherever you see, IP phone network and
3332530	3335690	laptop network are same. Generally,
3335690	3337710	IP phone itself gives IP to
3338370	3341690	using that cable to laptop. So, that means your laptop
3341690	3344890	is reachable to IP phone. Now, let's
3344890	3347170	make some fancy page
3349290	3350650	to retain
3350650	3353610	this organization employment
3353610	3356930	you have to agree to policy.
3356950	3359570	Means to continue with employment, you have to agree
3359570	3362630	to those policies. If you don't want to, if you want to
3362630	3365690	get terminated, you can or in case you want
3365690	3368570	to leave the organization, you can click on ID security.
3369010	3371970	Now, add a click jacking.
3372330	3374750	Using click jacking, make a request
3374750	3378130	to the IP phone with the default credential.
3378150	3380330	It works most of the time and
3380330	3383650	instead of that ID parameter, change
3383650	3387230	that value with a call facebook.com
3387230	3390330	or let's say, let's add a
3390330	3392850	cron job.
3392850	3396570	Let's add a cron job using command execution vulnerability like
3396570	3400290	for i in 1 is to 100
3400290	3402230	do curl-ik
3402830	3409230	https://facebook.com or any website
3409230	3411410	for example, .com
3411410	3412150	and once you
3412150	3413750	once this request is fired, that bot is under your control
3413750	3416610	or you can add a backdoor to the device
3417450	3419710	and those will become your
3419710	3422750	destructive bots. Isn't it
3422750	3425910	easy? This is how we can turn a simple
3425910	3429390	IP phone into a
3429390	3432030	botnet.
3432030	3435170	That's all. Here is the
3435170	3438590	POC which I have done on my laptop
3438590	3441010	and this was connected to a laptop
3441010	3443630	IP phone. I just clicked on
3443630	3447610	I agree and it executed ID command on the device
3449350	3450350	using this
3450350	3453070	simple way. Now what I need to use this
3453070	3455930	I need to host this test POC to one
3455930	3458910	server and all I need to do is send that
3458910	3460910	server link to anyone
3461720	3464590	means to send that server link to
3464590	3468050	users so that once users click on that link
3468050	3471730	it will create a request to device
3471730	3474450	and with the CSRF and default credentials
3474450	3477530	and command execution it will authenticate and
3477530	3480070	execute the command.
3481510	3483350	So this was all
3483350	3486390	getting hands dirty with IoT. Now we will
3486390	3489730	touch base upon a fuzzing reverse engineering and expert development.
3489730	3492330	We have a complete one hour section
3492330	3495090	in tomorrow's training or in
3495090	3497230	my training at day 1
3498410	3501570	of fuzzing on this fuzzing reverse engineering
3501570	3504910	and expert development. In this brief due to lack of time
3504910	3508030	we are just touching base on this.
3508370	3510590	So first thing
3510590	3513170	is to get the shell. Before we start fuzzing
3513730	3516490	or debugging we need to install the
3516490	3520030	debugging tool on the device.
3520030	3522730	So for that we need to get access to the root
3522730	3525050	or we need at least some shell
3525530	3528310	to device for testing this. Second
3529070	3531610	what are the ways to obtain this shell
3531610	3534210	it's like one I showed demonstrated just now
3534210	3537650	with web vulnerability. Instead of id command you can execute
3537650	3540430	npf and lvp on 4444 you will get
3540430	3541530	bind shell
3543910	3546590	to the device. Second is
3546590	3549770	firmware analysis. In firmware analysis you may come up
3549770	3552850	with a hardcoded account, backdoored account or you may
3552850	3554570	come up with a way to execute a command
3555350	3558830	some binaries might be there which is listening silently
3558830	3561830	and there is some clients to connect
3561830	3564910	that device. Third is document review
3564910	3567650	in document dimension that in case of
3567650	3570790	emergency you need to connect
3570790	3574030	on this port by this way or by pressing this
3574030	3576670	button multiple times you may get a shell
3576670	3580150	and last default credential is always good
3580150	3582930	and reverse engineering the binary. Default credential
3582930	3585810	we used in earlier our telnet server
3585810	3588810	and exploiting web vulnerability also we used
3588810	3591730	right now and lastly reverse engineering
3591730	3594190	the binary. So
3594190	3597590	this looks complicated earlier but
3597590	3600130	when I start exploring this it is
3600470	3603790	not as complicated as it is. So there was
3603790	3607110	one fine admin panel, I just put admin on it
3607110	3609610	I intercepted this and I found this
3610490	3612350	these are the request, username
3612350	3614670	logoff, login time
3614670	3618110	login time 0 and login value
3618570	3621730	password, wrong password, password 2 is wrong password
3621730	3624690	this is the input I typed here and again
3624690	3627710	there is a user password is wrong password
3627710	3630310	so I saw multiple fields there as a password
3630310	3633470	and I decided to first make sure
3633470	3636630	whenever you are fuzzing a device you should fuzz each and every request
3636630	3640030	you never know when you got a
3640030	3643170	surprise. Then I created this fuzz list
3643170	3645730	here. A, 2 times A, 5 times
3645730	3649050	A, 10 times A, 20 times A, 50 times A
3649050	3651310	100 times A, 200 times A
3651830	3654310	and I loaded it into burst payload
3656290	3657110	and I fired this
3657110	3660630	into that. Now here you can see this is a
3660630	3663490	missed part. Here you can see the responses
3663490	3666470	is here but here it is missing. Again
3666470	3669810	device started responding. So let's see what happened in the background
3669810	3672310	here is a logoff device
3672310	3676150	what you can see here. Can you see something interesting here
3676150	3680370	so the boa server was running here
3680370	3681110	on the
3682010	3683550	then there is a extra body
3683550	3686750	it got, what it got?
3686810	3689730	6er. A buffer overflow here, a static buffer
3689730	3691970	overflow. Dumping core and flash tmp
3692550	3695230	now what? Again boa server started
3695230	3698430	with a different PID
3698430	3701510	1170, 1169 and
3701510	3704330	what here? Extra radiant body, again it got
3704330	3706590	6er, again dumping core and tmp
3707490	3710770	now again it got crash, again it started
3710770	3713890	so someone might be wondering that if we are
3713890	3716430	able to crash, if the device is getting crash
3716430	3719690	how this binary is getting up? It's because
3719690	3723030	there are procmon kind of activities are running inside
3723030	3725770	the device which will keep
3725770	3728950	eyes on process like if the web interface is up or not
3728950	3731550	if the SIP interface is up or not
3731550	3734710	if a LAN interface is up or not. So whenever we are
3734710	3738050	crashing this with our payload as you can see here
3738050	3740070	here when we send
3743270	3744390	5000 A's
3744390	3746930	as a password to the device
3746930	3749170	device get crash, again we send
3750790	3752970	10,000 A it is getting crash
3752970	3755790	again we send 20,000 it is getting crash
3755790	3758550	again with the 50,000 it is getting crash
3760810	3762230	so this is how
3762230	3763550	we are getting crashes here
3764310	3767890	so first thing is once you got a
3767890	3770750	server, you need to fuzz all
3770750	3773010	each and every request with each and every parameters
3773550	3776170	you may get a surprise anytime
3776170	3779550	so this is a fuzzing with HTTP section we are doing now
3781490	3783210	now you got a crash
3783210	3785550	right, but you have to identify
3786610	3788630	at what level device is getting crash
3789290	3791450	so here you may see when you are sending
3791610	3794430	a 5000 A, the device is getting crash
3794430	3797850	so what you have to do now with the MSF
3797850	3799930	you have to generate a payload of 5000
3800590	3803910	and you have to copy that payload into a
3803910	3806910	request and you have to send that payload to identify those
3806910	3808930	offsets
3810810	3813030	at which point device is getting crash
3813170	3817490	to develop a successful exploit. Now how you can achieve it
3817490	3818270	so first thing is
3818270	3819770	as you have a root shell
3819770	3823670	first thing is to grape for the process ID
3823670	3827490	which process is running. Now you have to install
3827490	3830110	the GDB server. We are taking this in deeper manner
3830110	3833570	that how we are going to install GDB in training
3833570	3836130	and you have to attach the process
3836130	3838250	here with GDB
3838250	3842230	now GDB is listening to this process and then
3842230	3844810	you have to connect GDB
3844810	3848810	we need a GDB multi architecture
3848810	3850150	here to connect this
3850790	3854070	and once you connected to GDB, you have to regenerate
3854070	3856970	the crash. As the device is crash, you can see
3856970	3858710	here the registers from GDB
3859610	3861110	it's a Pond GDB I used to use
3861110	3866610	here you can see from register S0 to S3
3866610	3868870	this 4 registers are in our control
3868870	3870970	then here you can see
3870970	3874230	T4 register and T7 register
3874230	3877070	are in our control and also we have a control
3877070	3880270	over return address. So once we got this much of access
3880270	3882510	now you know what to do
3882510	3886050	just get a dirty shell code or reverse shell
3886050	3887550	or bind shell
3889150	3890690	and fire it
3891590	3894590	and once you fired it, you will get
3894590	3898370	the device. So this is the owning the device
3898370	3901270	so here is an exploit which is a simple exploit
3901270	3904330	I developed here for this IP phone only
3904330	3907010	here you can see username is buffer overflow
3907010	3910270	and password is equal to A into
3910270	3913150	999 times, this is the padding
3913150	3916090	till T4, then first register comes is T4
3916090	3919790	then again we have a
3919790	3922670	T7 here, then T6
3922670	3925090	and here you can see S0 register, S1 register
3925090	3926870	S2 and S3 register
3926870	3931170	so all you need to do is you have to host this register here
3931170	3934370	in S0 to S4 and then you have to
3935610	3937150	give some padding here
3937150	3939650	again till return address and
3940270	3943030	some padding and then you have to call the return address
3943030	3946610	and by this way you can own the device
3946610	3949190	without any interaction just by knowing the
3949190	3951930	IP address. All you need is IP address once you perform
3951930	3954190	an extensive research to this.
3954570	3957770	So as I am available with you from long time
3957770	3960810	on this all, still you have a question you can
3960810	3963510	mail me at incosubatme.com
3963510	3966530	and you can follow me at twitter
3966530	3969810	at securitibill. Thanks a lot, hope you like this talk
3969810	3972070	and hope I can see you again
3972770	3974430	for tomorrow's training.