okay all right hey guys um thanks thanks
a lot for coming out here I know this is
a friday night and it's like 830 almost
nine so I'm really grateful that you
guys are here and really quickly big
thanks to Michael and everyone else is
putting on cyber comments and not to be
here and speaking you guys and also a
big shout out to on the Aegean and the
rest VAV guys because they helped me for
like an hour to troubleshooting these
issues before council began today so big
thank you to those guys but today today
we're going to be talking about ifp and
we're going to be giving few demos a hat
repellents you might want to keep it on
the presentation display because it just
went away when way yeah so you might
want to take back to thank you also
because apparently we didn't do anything
okay you guys dry run of your intro
that's great so recording or yes okay
well no silk thanks for those guys I
don't know I'll just I'll just roll
along with it I guess I'm just again
well can you go back to just the slide
view that that was displaying okay can
that is displaying ok so i guess for
best and i'm going to have to keep
another slide like this so that it will
record but again thank you guys for
coming out we're going to be doing a lot
academic today of some devices if you
had read the schedule you would have
seen that Mitt Romney was supposed to
present but unfortunately he wasn't able
to make it today so he asked me to step
in fill in form so my name is Josh or
domain I am an aspiring security guru I
love all things application tyranny and
reverse engineering while doing cts much
they have time and no i really i really
enjoyed mucking around with things
learning how they were saying where
their secure housing insecure I work
with Rick I'm an Associated studion with
that
demonstrate evaluators we are they
security consulting firm out of northern
Baltimore and we perform security
assessments for our clients we primarily
focus on application security so web
mobile native applications and we take
that approach is white box where we know
anything about it black box wherever you
know next to nothing about the
application to assess and generally
everything in between class today again
we're going to talk about IOT and how
insecure it is so I'm going to talk
about a little bit about the this whole
notion of what is IOT how it can be
dangerous never going to look at two
specific devices we have pumpkin router
and you have motorola focus on camera
we're going to show just how they're
vulnerable and then afterwards are going
to discuss a little bit about what can
be done to mitigate this sort of random
insecurities that you can manage so
let's pick up there to set back up on
back now so we here is deanna here
mentioned all the time but what is it
and the best way that I can describe it
is it's a notion that all these sorts of
devices whether they're no kitchen
appliances like refrigerators or
thermostats or just anything really it's
not you met everything can and for some
reason should be interconnected and be
willing to talk with each other right
that it's a good idea it's a good
concept it's very it's very know where
anything to try and implement this sort
of thing but there are a lot of dangers
to doing son if you all remember back in
October of last year 2016 done a very
big DNS provider it was it would match
it the office attack a distributed
malice or stack and it took a lot of
websites down for the better part of the
day sugar so this beat off the tap is
reformed by Mariah and it was found out
that this hot net
that was a collection of compromised IOT
devices everything from IP cameras the
baby monitors thermostats they're just
sitting out on the internet unsecured
and somebody found them and they found
them they were able to control them and
they were able to redirect a ton of
network traffic to die and effectively
deny them from serving DNS queries which
caused a lot of money to a lot of
healthy that day but it's it's more than
just that's only just one thing to be
seen this one danger but it poses I OT
and the insecurity and IOT poses quite a
few dangers to use it as well so we're
going to be taking a look at specific
points today as I said and first time
we're going to be talking about is its
Culkin rounded I have a fit so this
router is it's very small office home
office router it's very simple has a web
interface which you use to control most
of its functionality it has two bells
and whistles like they can connect back
to Falcon but otherwise it's your
standard route it but this router belkin
can implemented authentication in the
wrong way and I'm not trying to con
delfin recent example but they were
using client I authentication and what
exactly got any minute so normally when
your authentication application you
would want to send whatever password it
is to your account you're going to send
that over the network to the server and
the service on hash it using some
algorithm going to compare it with what
it has saved on the server and then it
goes to match they're going to log you
in and the most part that's kind of what
Falcon does except for some reason they
they only or they hash your password
before they send it and in the
JavaScript they have the save admin
password hash so might be a bit hard to
see up there but there's this variable
password
and it's cheap as yet and password hash
right there serve down the user image
obstinate so really quickly I'm going to
demo this for you guys and all right
maybe spoken okay so let's go to the
admin interface of the belkin very
simple let me make that there you go so
let's try and login I am set the
password to something that I have no
idea what it is so I'm not even going to
try and figure out what it is but
instead I don't need to figure out what
it is because I can just go into the
JavaScript i'm going to use Firebug
equip utility i'm going to go to this
page login fdm and i scroll down a
little bit that's your delicate area
based right here in the past or rather
the password hash so copy that and make
sure that I'm intercepting your classes
this isn't purchasing for that then I
don't know what the password is so I'm
just going to enter in some junk down
but birch Street will have captured my
request right here going to post to log
in WFC here it has whatever the I assume
a dummy pod not entirely sure or it has
some hash of whatever random string i
entered into it but I know this doesn't
work so instead i'm going to replace it
with the ash that was in the JavaScript
forward that request along and I go back
I am now logged in if admin on Crowder I
can control all settings I am able to
redirect traffic i have full control of
it and that's bad enough but i also use
this router is compromised
on your network I can get another
question may be secure so it's too big
problem right but the second device I
think it's a bit scarier the second
legend can be talking about this is IP
camera motorola focus 73 it's a very
interesting device so it's running any
embedded cuando clinic on the back end
and one of the tools that has been sold
its importance to us in this
demonstration at 50 knots installs that
can have a lot of common utilities it's
going to help us in our demo and it's
also its way we're going to go about
this it's running to webster's rather
turning the same web server on two
different ports one on standard port 80
no I'm scared HTTP but that's also
running that sing much over over port
8080 and this web server has a complete
lack of any notion of authentication
authorization so I can access all I can
access all pages I can access all Ajax
requests I can interface with the
entirety of the web application without
being authenticated or authorized the
user just so long as I can actually
access the IQ camera so long as I'm able
to connect to a network I can good web
server and run through it run control of
it but there are two other
vulnerabilities and they both happen in
the same core functionalities command
injection red and remote file inclusion
which work will lead to a compromise of
this IP camera so they both happen in
this process for the firmware upgrade so
the way that you're supposed to
interface with is in us through
Motorola's own mobile app and but it's
basically just a common interface for
the web application so you know you
would tell it to download chrome web
promotable
was servers and then it was score it on
your phone and then it would upload that
firmware to the camera directly from
your phone so but that's all just
happening over HTTP expanded request but
so I can access this firmware update
page and within the firmware update
process the way which we gain command
injection is through the filing right so
it's not doing any real check on the
primer call you provided something and
you get a check to see whether the file
is a natural primer file or any sort of
scripted alize it's just a simple power
archive but it's not doing any sorts of
checks on that and nor is it checking
the bombing that you provided it's not
doing any input validation so I'm just
going to show you the demo so alright so
very easily it's a firmware update page
and here at the ground like it's ended
anything it's not going to not going to
check whatever I sent but instead of
trying to manually browse through it we
have this strip that however magic poke
them at develops simply for this hall so
what it's going to do I'm going to run
it and I need to send pointed at the end
of my address
and what it's going to do is it's going
to send this malformed request we're
within the file name it's going to
become an obsession if we go back and we
look at the file nurses that are since
it was not okay so it's a bit hard to
see I apologize for that probably a be
so it's using has RL to form the CGI
scripts and hazards something I'd never
look for before looking at this Hannah
but it just takes basic Lula or bash and
it's using that as the back door it's
too formal the CGI request but in line 8
what it's doing is its injector it's
taking the file name that you gave it
its putting it directly into a shell
command so there we have command
injection we conform command
substitution get back kicks what will do
is it will take whatever's in the
sidekicks and then run that command
replaces the output Batman can be
anything and this is running as root so
the script that I just sent it is it's
going to overwrite the root cron job and
it's going to swan that Cataclysm so
very easily met cats into the virus okay
there's a box on the device see this
right here and since it's running or
since web servers on his roots I have
older controller of the device and not
only that but what I also think this on
you remember how I said you can access
the web server without any
authentication authorization we can
actually get a video all right so i go
to whoops
all I do is go to web server why should
you WI and part of the trip along with
just as in the video feed I can also
control the pan tilt zoom features so
we've meant that is harder script it's
just moving X quest so yeah I'd like to
use the camera let's move it up to the
top and just randomly read spooky okay
so I shown you guys that these two
devices up here at work really broken
right the manufacturers developers they
didn't really take scared Anand so i
have taken be very dangerous but there
are a few things that you guys can use
and I'm companies in particular to
protect themselves from this sort of
rampant in security makanda heads so
number one if you're going to be using
some of these devices in your network
make sure they said right make sure that
the report on their own subnet they're
separated from any other devices so if
for some reason they were to be
compromised that they can't be used to
then gain further address into your
system along with that you're going to
want to perform network traffic analysis
right so figuring out exactly what sorts
of network traffic is normal inside your
network and then anything which goes
against that norm you'll notice
something's up with drivers utilizes
also updating security policies so
mandating that these devices patch when
men if manufacturers rollout security
update
making shouldn't be flights these
devices are actually getting past those
updates managing credentials you're
going to want to make sure that policy
policies are there for those and also
commissioning utilizes so making sure
the place aren't just added to your
network without any sort of know how
making sure without anyone else knowing
i guess i mentioned i give you six
you're gonna want to start planning
ahead for that is that it's going to be
rolling out and some of these devices
that manage recent pat abilities and
finally this notion of camp trust making
sure that these devices that you get are
from reputable manufacturers ones which
have a good track record of not only
taking security in the mind of building
the devices but also issuing tiny
patches when they do find security
communities so and if you guys would
like to learn a bit more about what you
can do specifically to protect
yourselves come visit the is you know
it's written years before rest of
tonight at hypercom and we have a lot of
information shit so you guys have any
questions yes your the technology which
is that you cannot block the half
numbers and hassle patrick has oh it's
it's a way of forming cgi scripts it's
just it's different than PHP cover
something else I'm thank you then your
expert analysis I didn't use in my slip
them so the camera was using hazard at
the back in technology and she creates
the CGI scripts on the panel I mean I'm
not sure what their notion for choosing
applause but it just take like Lua or
bash scripts and use those with that
interpreter and line posted sure
it would be nice if I'm sorry he did
record ok Malcolm person that was very
sweet yeah you know if anyone's reverse
that hashed password I'm not sure it
reversible like not aware of my time
asking for it should be like but these
okay well not anymore questions again
thank you guys so much for coming out
and late on a Friday night hope you
enjoyed
[Applause]