We're going to be faced looking at the Buffalo station. Where this Mach number
is, cocked name is unhinging security on the Buffalo care safety pass. We'll find
out why it was ff9 second. I just the obligatory Who am I Section. My name is Ian
Sindermann. I work for tenant security evaluators..
Your security or application level security audits. I kind of grew up as a
traveling performer sort of thing. I live in a bus. I like to hack. I think our mission
at obscura, I like to share what I find. So again, ISC, so we do black box,
white box, security developer, secure development, all the good stuff.
More importantly, we recently came out with IC labs. Which is the research
division and we started the SoCo 2.0 project. Where we have refined our sofa,
sofa 1.0 project. Where we essentially took a little bit IP garbage and found
out what is how terrible it all is. So this time, we found over at CVS of so far and this
device was one we poked at. So the device itself does the interrogation
whatever model number that is, we'll find out in a second. The model number
there. It's kind of a soho, slash enterprise thing. They call it business
grade. It's rather expensive. Also, we don't call it business grade. Again we'll
find out first hand has an admin interface, give it a web application.
Is kind of my bread and butter, so it got my attention pretty quick. But, why do we
care? Like this IT garbage is all over the place.
The thing about this device, is that demonstrates a few key concepts all around.
More importantly, key concepts that apply to anyone looking to get into performing
application security assessments. We're just looking to break a IP devices and
move on for profit. Your choice' Something like approaching an unknown
place. How small mistakes you have very, very large impacts. An abstraction can
scare those mistakes, but as we shall know series over series, there's no security.
There's also recently the Maryland Democratic Party. Apparently they have
all the data on a parasation among Internet. And then pretty much every
other country counted. Some was in the news. Also, over it shells, district shells
and the defender responses. So then again, but we'll get there. So... we'll probably
really intrigued with this device, it was our first interaction. Where we encountered a
lot. So the NAS can be locked and it was easier than with it.
we didn't event so we had to do something about that so locks job is to
deny authorized access and it was doing quite well in its job is to allow a
little and easily acquired so what if we give they until up in hand turns out we
can just pop and drove in and completely bypassed a lock this kind of a set the
theme for this device so I guess we'll get to that done it and in but oh wow
looks like I brought something but you get the idea so where do I start
that's something that I hear surprisingly often my fuck we people
without the research that I've done research that I intend to do and a lot
of air holes regarding ite or application occasion security gentlemen
and the things that I have noted so far both from input from others finding
sources on the Internet in my own personal experience in so well and my
job in general might not see there are kind of three stages they're all pretty
intertwined some people great
in or or less but for me I like to see this appreciation
they're fun being gathering information start with finding manuals and known
vulnerabilities GPL source code can do quite well quite valuable and
downloading firmware especially for these devices sometimes they will have
you do SSH sometimes it will but having that
firmware oftentimes allows you to extract a very similar copy of the paws
system and perform static analysis error also for web applications but make a
slight now kind of go through so that is efficient push everybody report
everything you do so you can go back and trouble through that data to find
anything but inside and previous work is also quite you've worked your cover that
a little bit from there usually go into analysis active testing scanning static
analysis but I always come back and continue gathering information hasn't
we're talking about analysis the same thing they've got an expansion they'll
go through you'll find SSH or tell me I will give yourself a shell that's the
memory stop that's where you go back you gather more information go out more a
larger understanding of what it's looking like
and then expand gratz s5 more hands use those bones feet and one day thing that
I like to like to say to people is over the juicy bits first juicy bits I means
suffering populous database operations interactions its shell is anything they
can get you a very juicy payoff of path if you mind in issues and it's up like
in or even points a surprising number of devices have those and sometimes they
just forget the authorization of the thing on those inputs and there and go
further keep looking keep pushing and don't be
blinded by those views events because there could be some very fun
functionality abilities and stuff that doesn't immediate here
something conventionally juicy stuff like anything overly complex as
Chancellor the developers may be neither we can build an understanding finding
issues with it
but on that same note you could thought be simple it's your chance they have
some oversights there an abusive deviation from best practices all the
good stuff but some of it does come down to have following their death stuff like
you can see that someone is if they've implemented you know saying these guys
okay it just doesn't feel right here's there's usually a reason behind that the
other I follow that feeling one that said that that feeling usually requires
some experience and some knowledge but experience and knowledge and so
approaching the terror station itself this is kind of what I did but it's a
dig through and find all these issues along with my colleagues entities in
Sheen the initial section gathering green again flip every switch push every
button report everything news so you can fall through and while doing so I
determined there was no excitation functionality now for a lot of these
devices especially acids will have this attention so you can just log in and at
some sort of show sometimes you're sometimes not that can you do a very
good football for the rest of the assessment in this case we didn't have
that also we need to find replacement I also found that there was low EVPs work
on that central core I think messenger bottle who've died for
a few months but appears to be back up if it is up it's a great resource I
highly recommend going through it so let's take now to focus on acting gases
surprise surprise that's rather and then from there I delved into
analysis the firmware is available but it's encrypted NASA at work has all
video gription easily pull it out announces and the site map that has all
of our information in it and through that information I found some Peugeot
see if you have errors that included the location of the file an accomplice issue
so instead of having trouble through all of that file system for the firmware
packages take that error CEO send this location right in the source code they
showed there was actually crying Python however the Pegman was pretty much the
problem all so they ever worked with Python before you may know that when you
run a Python script you'll end up with a high C bottom we only have the icy
bodies which are created by our with Python it's extremely easy to eat a lot
of that or on compiled using something like on your class 6
we just ran that the unenviable called source code pretty much called it yeah
okay people I was reading with the most are being at a very real
first go to work and to exploring source and where there was expanding shell
trying five of the moment though these they can be able to access and their
foothold and stand our scope so we get the bottom line making did you find
abilities go to Ruby so one of the first ones that hang out there was see become
18 1 2 3 2 4 which means nothing it's alibi that's so what kind of
prompted this was that the Jason Martin see it get handles all station across
the entire devices one end one and that API uses a signatory my security IDs and
it was a lot of things such as performing actions that are our admin
privileges I looked into that it won't let me see Sir
that'd be providing again I do not like this it to go away
that's where buffalo is an urgency to payment so in this file
I'm almost immediately like this is the first two definitions in the viola there
is something rather interesting see skip off okay get out your word or consumer
so it seems that see bought that upscale office and find somewhere but not here
so we just search through the bottom you know in didn't / oh there's fun segment
where we see that it seems that they're using the HTTP POST environment variable
and that's mumbles then it's obviously wrong now if you're familiar with issue
be headers you might know this interesting no so if you think about
this from you know the developers point of view it makes a needs the interactive
was only having some form or another and all commutative him but does this so he
just built the whitelist over us so I series means that the host header is all
these logos in a little of us and snapper below what was in mine request
so host entered equal blows means it the whole of us straightforward
way truth yeah job done did he go the wholesalers mind control
so the host hair is all these locals even though it's never love
hey mom so those services so the posters means I was said with locals does that
mean and but I think causes this misconception is the idea that that
boasts hazard for is used for some sort of profit in both bounces this is
actually correct that was said there is used to determine where that was nice to
go tree but in any other situation that's not quite true
so hope centers of the application there I'll be around the decisions are made by
the way down the member but networking there so at most ever is maybe note nor
any of us where that bus - no no it's server the server to do something with
it so you have issues like this where you can just change so we have normal
repetitive we're trying to reboot system we have a jump SID and it says that our
session is without truly over that's legible so from here I figured you know
just replace posts with Lobos we still get merit which is disheartening but
it's a good in itself you see the air is rather different coming out before it
says that the parameters are invalid and that reboot I was given wandering
crackers doing parameters we gave it was secured ID so remove the security at
needs as the result was double then the Masters have make some meat Moses and
they're not fish is a carp not a good signing group and we're using the Vice
but for us a pre great so here we are the Jason our PC eight guys gets all
objects everybody HTTP POST editor is logos so it was there I can prove I'm a
good source for any news this those headers were close to getting sick
parameters fire it off and prove your app but memorize that there's no mistake
no shells yet what's the fun in that we have them out
with some English out onto the next part I was CBD 2018 one three degrees in one
just expose in two methods in a red little Frank so you get a body this word
strange though digging through that looking for those juiciness and any
danger I think the command line order hurt there were lavas and let's pay
attention everywhere and every license or I'm gonna feel that pretty was
something for me minutes so NZ guy there was no distinction from nature - 4
methods really snotty way that you've always seen on occasion they're looking
face studies at once there were no decorators five occasion I just didn't
sit right I didn't know a lot but it is something
that I want to investigate so I did not about me to do throw in or Olivia she's
not a baby the same type of model fourth server it has this massive terrible loop
essentially locusts in any function that module that's hollow is not premix
monogamous or out of spare comment at all of your kind of local bumpkins with
a understory victim of your public functions is an opportunity just like
that bit further decide you know it is of the functions you need they've a
nine-point makes loading a Cayenne point super easy but potentially a little too
easy see the thing about Python said happens
the importance in one of the songs this article I said was it doesn't several
others were bought it is intolerable so that
you have what we import from us sar anything that's called an LS it is
not because of others or becomes a down in point a lot of dangerous State at
once sadly there was sorry however some
models particular therapy bottles it in word everything from cognitive in this
case is WTFs hi I don't remember what it was but it's some modulus we've done
twice or some sort of back functionality all carefully comp you do anything there
as an end point so let's dig into that so we have to work with so how beautiful
exposes read comp and write common these are designed for interacting shell style
convinced essentially just key equals value
I don't know when it's outside that's a new source code so both of these
endpoints and nobody can get WTFs or both of these become n monks living TMS
because of important so this what happens if great pomp can pretty much
write arbitrary shell scripts anyone replace
sadly they're not executed so can just drop one of these shell spirits in in it
and then get shot whatever there is up we can overwrite things but most of
those aren't going to be a shell except for perhaps of trauma if you're not
familiar with prom it's this wonderful little utility that allows you to
schedule commands something that can run every day every hour on certain hours of
certain weeks and sort of fun stuff I can also run on every minute to be quite
nice for shell let me have something like this where we
just use our our old off bypass exploit we just tell WPI best are a comma to
modify routes from death take the original Quran down
just sticking this new one that executes element D with the snare on
48:33 with a new shell within - so it has a lot of location just start that
every minute and it just says dude whoa case seven with prong it's not going to
automatically free vote that part I usually get a gift to sync up it I could
be wrong but let you know that it will not just reload that bottle there's your
gluten thing we should do that is we bypass the king but anyway so just
reboot the system and make some fun beeps turns off Amazon and then it
starts flying shall ever enact just so happens to walk in it's about a gigabyte
so they run there a Pettis overkill everything on the net because it
catalytic functions a little too overzealous but really struck home
this device sir the TLDR the endpoints in modulus e needs to define any
function which functions prefix if another store or normally in terminal
just load Annie Hall go let's not do this
so a function in defining the module happy daily ones from exit with star the
DFS imports everything from detail bring calm any work whatever we like yeah
there you go but what struck home kind of the
terribleness of this device and just I became gentleman was the disclosure
timeline these are usually plenty try this one what most part is we try to try
to contact them regularly send emails to multiple locations
eventually we sent them the balls multiple revisions of the CV is multiple
locations still are nothing so we announced a public livestream
demoing long abilities as we release them
I did my demo livestream and be really certain abilities respond so I guess
they effectively briefly the link to 700 days and then thought it's not something
I expected to happen but having pre confused birth weeks I
guess eventually they realized that was a terrible thing to do intervene through
the idea one that happen but they deleted the they realized something was
terribly wrong so of course all of the Volvo v70 fix
part is over and work on the B hat by attackers I'm
not really sure why they haven't fixed anything but they have they think they
have to have known - something's wrong VW degree it's been almost eight years
since we initially tried to contact them a lot of checking availability last week
I decided to download some our Mars that they have so remember I said the model
number doesn't really matter if it's a terror station you can probably get
written is still including the like 17-grand ones that are their flagship
Moulton enterprises but that's our team except it's not moving I'm Fatima oh
well done so they said it was yeah so that was a that was quite the trip and
that's about all I have today probably wait that's Avengers but such as it is I
think that gives us a lot of time for some questions so if you having knows
the time they have all my resources with me so if
you want to poke anything diversity or anything other device as a time
it's not gonna take
you