Daniel Crowley So, The title of this talk is Home Invasion 2.0 and we are going to be
talking about smart home technology.
We envision that home invasion 1.0 is a guy breaking in your home and stealing a TV, you
know, standard sort of stuff. In home invasion 2.0, is what happens when you hook all sorts
of things up to the Internet that you really shouldn't, or that you really should think
about a lot more. Before we start talking about all the stuff, i'd like to take a moment
to introduce ourselves and explain just very briefly why you're listening to us, and not
some guy trying to sell you water on the sidewalk about these devices.
Daniel Crowley So, my name is Daniel Crowley AKA a unicorn furnace and I am a managing
consultant on the application security services team, of trust wave spider labs division
Jennifer Savage My name is Jennifer Savage, I am a software engineer and a security contact
for tabbed out we make a mobile app that lets you pay your bar tab with your cell phone
So, a bit of a hard space for security.
David Bryan I'm David Bryan senior security consultant with Trustwave spider laps. Penetration tester.
Daniel Crowley So why are we here? We're here to talk about smart home technologies
what I mean when I say a smart home technology is various devices in your home that are not
traditional network connected devices like laptops and smart phones and printers and
scanners and things like that More odd, non-traditional devices. So we're gonna talk about what some
of those devices are in a moment. Anyone here like science fiction? show of hands? Excellent.
So, my favorite kind of science fiction, is dystopian science fiction. For those of you
not familiar with the term, dystopian science fiction is about a world which has some sort
of technology that has gone awry.
So some dystopian science fiction is very serious, like "1984" Although, that's not
exactly science fiction, but some of them are very very tongue in cheek there's a movie
that we heard about from several people where you know, like, it's like a smart home and
it starts attacking and trying to kill the people in at like there's a scene with like
a garbage disposal , or something anyway we have yet to see it and if anybody knows the
name the movie I would love to know that cuz i really wanna watch it now. Anyway.
(audience member, inaudible) Daniel Crowley What is it?
it was, iRobot? Fair enough, okay yeah, I didn't wanna see that because it it looked
like they completely ignored Asimov's book. but anyway on so anyways. usually dystopian
fiction tries to serve as a warning for the future. because science fiction often become
science fact. all you probably have cell phones in your pocket if you are smart they don't
have the wi-fi or bluetooth-enabled and if you have a CDMA phone here, maybe it's smart
to just turn it off entirely.
But that was originally from the Star Trek communicator, so pretty badass right? but
science-fiction become science fact and dystopian science-fiction usually serves as a warning
to people who would make these technologies as to the considerations that they need to
take into account when making these devices.
Unfortunately the push to be the first to market with the device, with some new technology,
often gets in the way of listening to these warnings making the important considerations,
and this seems to be the case based on our research.
We took a look at the subset of the devices out there which connect to a network in your
home, were not going to be discussing every technology, because there are a lot of them
and some notable ones that we did not include in this talk.
There is an android powered oven, (laughter) because there's never been any problems with
android. And an Oven is perfectly safe.
Jennifer Savage Mom, I jailbreaked the oven.
( Laughter)
Daniel Crowley So, Smart TV's. There were some talks at Black Hat about Smart Tv's which
were kind of interesting. IP security cameras, but this is just a sample of these things,
but it's wide open. There doesn't seem to be a lot of review on this type of stuff,
but hopefully this talk will inspire you to go out and take a look at smart home technology,
if any that you have in your home or maybe your friends home.
Jennifer Savage So right now on the market, like dan was saying, we have locks, thermostats,
fridges, toleits, lights and toys. but in future we are going to have entire smart cities.
They're building one right now in South Korea. It's called Songdo. Cisco is involved in the
networking there but they're describing it as a place where you can walk up to a window,
the window is actually a screen you can interact with. You can call home, talk to your kids,
The city will schedule your day for you, it will schedule buses leaving and arriving and
everything. I would love to go to test that, I don't know about the rest of you, but I
think that it's an absolutely awesome place to go and hack, if we could get permission
to do that, right?
So, i'm going to talk today about a toy that was in my daughters room. I have a Daughter
whose name is Ada she is almost 2, she'll be 2 in a month and this is a toy I bought
when I was a very bust mom still breastfeeding not getting enough sleep and I wanted to be
able to go in the other room and check on her. And do it through my laptop and take
a nap and make sure she was still asleep in her crib and what not.
It has a camera in it and a microphone so you can do that with this. It also has a speaker,
ya know, you could program it to wake you up in the morning to tell you when it's lunchtime
all kinds of stuff. It has an RFID reader, and little RFID toys that she can run up to
the bunny and hold it up to the bunny, it will read the RFID it will do whatever you
program it to do through their online interface. Additionally, it has a USB port in the pack,
a little bunny tail usb and this is how you program it to connect to your wi-fi network.
It occurred to me, when I was no longer a sleep deprived mother, that I needed to test
the security of this device that was in my daughters room. And I found a lot of problems
with it. So, the first one is that in order to setup the wi-fi network you enter your
SSID and Password into their web interface, it's transmitted completely unencrypted, no
ssl to their servers, the API calls that are used in order to communicate, for instance
between the iPhone app and this Karotz servers and the Karotz itself, goes from the interface
to the Karotz servers to the Karotz , those API calls are completely unencrypted in SSL
as well, so you can eavesdrop on them.
The setup package that you download, you download again over an unencrypted connection, there
is code signing, so they did something right here. But the code signing, there is a way
to bypass it, using a technique I call python module hi-jacking, it's a little known attack
and I will teach it to you today. So, what you're looking at here is a request made through
the Karotz API for the video stream from the bunny. it has an authentication token, that's
one time use. It doesn't make sure that it's always being consumed by the same IP address,
so you can literally just copy and paste it out of burp suite for instance or anything
else, and put it into your web browser and spy on the video stream. That was the first
major problem. I would do things like go to the coffee shop, open up the iPhone app and
check on my daughter, make sure she's still asleep and i would use the coffee shop's wireless
without having tested to make sure that this connection was over ssl. So, if you're a parent,
you might be really scared to hear that was happening. I know it freaked me out, heres
an example of viewing the video stream just through the web browser.
So, if you happened to have a connection between the Karotz servers and the ability to be able
to eavesdrop on a connection between the servers and the person downloading the wifi setup
script from Karotz servers in order to setup their bunny and you can MITM that connection
you can replace the download of the setup script with your own setup script and in that
version of the setup script you can get around the code signing using something called python
module hijacking. So if you have ever done DLL hijacking or LD_PRELOAD Vulnerability,
basically python has something called python path and your python path is a list of places
that python will look for your modules that you import.
So the first place that it will look is always the same directory that the script is in.
This is a problem, because as an attacker I can place a python file that is the same
name as one of the modules that is used by your script in the same directory as your
script, if I have the ability to do that and your script when it runs will run under tha
same permission level my modules. so I can get it to run my code.
Daniel Crowley What's nice about this, is the setup script is signed using GPG and they
check the signature before they run it, but this doesn't technique doesn't require modifying
the code, as Jen said.
Jennifer Savage Right, so the code signing doesn't check the modules so that why this
gets us around the code signing. Now, interesting enough, auto run wifi script actually uses
a simplejson.py, it imports simplejson and it never uses it anywhere in the script. It
never uses anything from that library in the script, I don't know why it imports it. We
were able to just create a simplejson.py file that did what we wanted and throw it in the
same directory as the setup script we downloaded and we had a bunny break.
So, just to recap, an attacker could man in the middle the insecure connection to the
karotz server, replace the users download with their malicious version, use a vulnerability
to make the karats run their code, that's the module hijack we just went over, and potentially
have a bunny bonnet on their hands.
Daniel Crowley There is also potential for a tag and release attack where you get
the karots, buy the karotz from amazon or ebay, or whatever. Just buy a whole bunch
of these things, root all of them, because when you go through the setup process a second
time not everything changes it's not like you wipe the whole thing when you go through
the setup process, so you could own a whole bunch of these things and then sell them on
ebay or return them or something like that. So you've again... bunny botnet.
Jennifer Savage Right. So, I think that's a slower method tho. But, real quick were
going to display a video in which we eavesdrop on the video camera on the Karotz.
Karotz for the iPhone, Karotz controller app, I'm going to move the Karotz ears using the
app, this will send the request via the Karotz API to Karotz server and then the ears respond
by moving. Now, I happen to be eavesdropping on that request, over here. If I look at the
request itself, I can grab from it an authentication token it's a one time use token, but what
I found is that I can reuse this actually. And use it to capture video instead. So I
am going to grab the interactive ID and the onetime use token, copy it, go over here to
my web browser, paste it, and change the action. So here the action is ear moving, we are going
to change the action to webcam. It's going to be webcam action equals video, enter. and
now in the machine that I am using I can eavesdrop into the Karotz, I get a handy dandy welcome
feed. HI guys!! So, this is eavesdropping on the Karotz's toys webcam.
Suddenly, the bunny becomes really creepy, right?
(Laughter)
I thought it was cute before, my daughter still thinks its cute and we leave it in her
room unplugged and she runs up to it and hugs it and stuff and I'm like thank god it's unplugged.
I wanted to mention the fact that if you're eavesdropping there is a start and a stop
request that gets sent as part of the API calls.The token after the stop request gets
sent, the token is no longer reusable, however if you are MITM the connection you can drop
that stop request and instead continue to send something called a keep alive request.
At that point you just have control over the bunny going forward as long as you maintain
your keep alive.
Daniel Crowley So, this is a product called Belkin WeMo Switch. First of all,I'd like
to say that Belkin was real cool about all of this. We were going to contact Belkin and
tell them all about what we found, but they actually fixed everything before we could
even tell them about it. So, good on them for that.
(audience member inaudible) (Cheers )
Yes, thank you, and what's more is they actually sent guys to our Black Hat talk and they approached
us and they told us. Hey, thanks for finding this stuff, by the way we have a program where
if there is people finding security vulnerabilities in our stuff we can get them products for
free, so that they can do more testing. Because they recognize that we are doing free work
for them.
(Applause )
Yeah, so, thank you Belkin. But the Belkin WeMo Switch is a cool little thing. It's a
little box with a plug, male and female electrical plug, you plug the back end into the wall
and plug something into the front end and then whatever you've plugged in, you can turn
that on and off from a network using an iPhone application from Belkin. And the way that
this works is over a protocol called UPnP. Has anyone heard of UPnP before? Right. So,
UPnP was designed for network auto configuration, so as a result you can't have zero interaction
auto configuration, if you have to put in a user name or password. so UPnP as a protocol
does not require authentication, it doesn't involve authentication. So, that's interesting,
right?. So what this means because the interaction is via UPnP is that you can control the functions
of this device so long as you are on the same LAN as it. So Belkin doesn't have what I would
consider a proper fix for this yet, but what they do is in the iPhone app as soon as you
use it for the first time, it tells you hey, just so you know anybody on the same network
as you can control it, so be careful where you put it. So, it's not a proper fix but
they're at least giving enough information to the user for them to make some security
decisions or understand the potential risk that comes with being able to control this
without any authentication.
But on top of that, in an older version, they had a vulnerable Lib UPnP, library, which
meant remote no auth root. So, pretty cool stuff. and this is just a little linux box
it turns out. So you could turn this thing into a point of persistence on the network.
A friend of mine I was talking to about this, he was saying man this is funny stuff because
If you're a forensics dude and you're trying to investigate a breach you're probably not
going to look at this little box on the wall as the source of attacks. And this thing hooks
up to your wifi network so you could do maybe sniffing, depending on what kind of card is
in there. I haven't honestly found out, you could at least launch attacks from it, if
you were to compromise it. So, interesting stuff there. I'd like to show you a little
demo here, if it works.
So the demo gods really hate me.
Video So we're going to talk about the Belkin WeMO, we're going to show you how to turn
this on and off from your computer. So, the WeMo is an electrical outlet that you can
control over the network with a protocol involved called UPnP, so NMAP has a nice Nse Script
called broadcast UPnP info, which tells us all the hosts within multicast range that
will respond to UPnP query. So, it gives us the descriptor XML File for each one, so I'm
going to take that and feed that to a tool here. Called UPnP Request Generator, and that
goes through and enumerates all the devices, services and actions and organizes them into
various directories. So, We want the basic events service, because that has things that
we want like Set Binary State which turns the WeMo on and off. So we're going to set
binary state. (Inaudible)
The post request that the UPnP Request generator has made and were going to give that to Burp
Repeater so that we can make that request, and I need to change this to either to a 1
or a 0. See it's boolean here, and we can see by the fact that there is no illumination
(Video cuts off )
The demo gods hate me because this box broke two hours before my Black Hat presentation,
So I went to back up video demo and it stopped like this. I have the video, but well skip
that but we have more demos to show you.
Jennifer Savage So Sonos is a sound system and basically this is a bridge device all
these speakers connect to and your laptop or mobile phone connects they connect to the
bridge and it goes out to all the speakers over your house. So, pretty Handy and there
is an active community of people hacking on their own Sonos and the Sonos forums, and
it's a fun little community of people. The issue I have with the Sonos is it spills excess
active information about your controller so if your personal laptop has music on it and
you're using that that for anything, really, besides controlling the Sonos, all that information
is kind of ‑‑ here, I'll show you. So right now we're looking at a list of network
shares on my machine and there permissions level, their UID and group ID, and is this
Net Stat? . Why do I need to look ‑‑ why is the web interface exposed on the Sones
bridge showing Net Stat from my personal machine I installed the controller software on? Why
is it doing that? Everybody on my net can see this information. This is the process
list, I think. This is the process list from my personal machine. The list of users, I
think, from my machine IF config, and who am I, running as? You get the idea. It's excessive
and it's useful information for an attacker.
So we said they were smart toilets out there (Laughter.)
You called this one. So there is a toilet called the "Lixil Satis," it's a company in
Japan, name of the toilet is the "Satis" and it has an associated Android application which
controls this toilet blue tooth and there are several interesting functions on this.
You can open and close the lid, you can make it play music, you control the flushing function,
there is an air blow dryer from the underneath, there is a Bidet, and you can control all
of this from your smart phone. So, as it turns out there is no authentication within the android
application‑‑ we didn't buy a toilet and I would have loved to have make a bidet "spray"
on stage but it's $6,000, I'm not buying a $6,000 toilet. But we looked at the Android
application and there was no user name and password, there is nothing for setting up
a user name and password. We looked at diagram after diagram of information on the control
panel there is no place to enter anything, there is no keypad, there is a series of buttons
for things like flushing and also the app is weird! (Laughter.)
There is a default blue tooth pin of 0000 and there is a whole bunch of these. I understand
why it's a pooh, because it's a toilet and i understand why it's blushing because it's
Japan! (Laughter.) But I don't understand the police hat
(laughter). So this is a "Poohliceman" and there are several of these "poohlicemen" and
"Poohlicewomen" as well in this Android app. It's in a diary or a "log", of your bathroom
activity, the jokes write themselves, they really do.
I was trying to figure out how to slip this one in, but I can't so "fuck the Poohlice"
let's talk about the INSTEON hub. Let's say the toilet starts screaming at you and sprays
water up your bum.
David Bryan The Instion Hub. Purchased this product back in December of 2012, so
just last year, got it, set it up on my network and installed it and paired it to Instion
devices I have.
INSTEON is essentially a home networking Home control device, for home automation. Once
I got it set up in my network, installed the iPhone app, turned off the wifi on my iPhone
so it would go to the data networks, ran TCP dump on my firewall so I could capture the
traffic and what I discovered is very disturbing. A, it has no encryption, so anybody in between
me and the internet, which is a lot of people, could see technically see what I'm doing,
right? The other thing I discovered was that it has no authentication. Right? Out of the
box this thing allows you to pull up a web interface and talk to it without setting authentication
on it. What I did is e‑mailed support and I'm like, okay, here is this box, I can't
put any user name or password on this, how do I enable this? And they e‑mailed back
saying "you don't have to worry about that" you don't have to worry about that because
the cloud application takes care of that. You don't have to worry about that because
our cloud application takes care of that, no, fail!
The other thing that this device allows you to see is time zone because you have to know
when is sunrise and sunset because you have to turn on devices when it's dark out. That
was disturbing because I found people tend to name these with their address or last name.
I did Google searching after that in January and went, oh, this is creepy. The fact that
I could go to some city and basically find these devices and control people's home. This
is also a device that can connect to garbage door openers, door locks, alarms, motion sensors,
surveillance cameras, it's pretty creepy. They did fixed this in what I would call a
product recall because in March of this year I got not one email but two and shortly after
that they followed up and called me. Which I thought was weird. I've never had a vendor
call me and I said oh I suppose I'll take the new version so I did grab the new version
and about three weeks ago or two weeks ago I plugged in the device and started looking
through it and they at least have "auth" on it, but it still accesses cell. They have
hard coded a user name and password, it's base 64 encoded and it's the Insteon ID of
the hub which is the last three digits of the Mac address, anybody see a problem with
this? So I thought that was bad. Really, what you could do is from the internet because
all these systems in order to be able to control them from your iPhone when you're on the road
you have to port forward in that port so from the internet an attacker could easily run
an attack that runs several days trying 16 million combinations, that's not hard at all!
I actually attempted this with Burp suite and it doesn't have any back‑off so it kept
going, wrong pin wrong pin wrong pin.
Daniel Crowley Next we're going to talk about a little green and white box called
the VeraLite, it's similar to the Insteaon hub, it's another Home Automation gateway.It
hooks up your Ethernet network to your home automation network, either with z wave x10
or a mix of these and it allows you to control it. it's ‑‑ this is a neat device, you
can hook it up to a whole bunch of stuff, door locks, garbage door openers, carbon monoxide
sensors, flood sensors, HVac controls, all sorts of things. A lot of stuff! As it turns
out it's got a lot of problems. So just to start, there is no authentication on the web
console by default which means that any Tom, Dick, or Harry who can get on your home network
can control this with a web browser. You can set a user name and password put it has other
issues that make this irrelevant. First their authorization, user rolls. You have guest
user and an admin user and there is information only user which can see but not control devices,
the guest user can control devices but not make permanent changes and the administrator
has full control over the device. So as a guest user you can update the firmware. The
firmware is not signed! (Laughter.) It's in a squashed FS package, you can backdoor
it, rearchive it, and then backdoor it and the vendor said all of these things were features
until yesterday when they e‑mailed me after my Black Hat talk and they want to work with
me now! We saw your Black Hat talk and several news article and we would like to work with
you.
There is a settings back‑up option which you download an unencrypted archive from this
with several include files and in this imbedded version of Linux it contains the hashes, so
there is no shadow and you get the hashes for all users, including root so you can crack
the password and crack in as SSH in as root and you get the root for any passwords set
on the web interface and the passwords that you set on the local get synced with their
third‑party server, for remote access, so owning it locally means that you have control
over it, over the internet now. So that's lovely. You also have ‑‑ and this is
my personal favorite a little bit of functionality which allows you to test Lua code, so you
can run a little bit of Lua code on the device from the web interface as a guest, and can
anybody tell me what user account it runs as? Root! That's lovely.
There is path traversal, so you can pull any file you want. You can get password, crack
the hashes, SSHN as root. There is cross‑site request forgery so you can trick somebody
into performing the nasty functions on the web interface using cross‑sight request
forgery and on that note there is a UPnP interface which doesn't require authentication so you
can control all these things and there is a run Lua action on the UPnP interface and
when you're on the same network you have a way to control this thing to run code as root,
just straight up code as root using UPnP. No user name and password required even if
its required on the web interface. If that wasn't bad enough they have vulnerable
versions, that you can root. There is a server side request forgery problem, so there is
a script called proxy.sh, which takes the URL, visits it, grabs the response and gives
it back to you, so you can use it as a proxy. And that's not bad because who cares there
is all these other ways to compromise it and it's not a terribly big deal. It should be
fixed but its still not a terribly big deal. The way the remote access architecture works
is that each Vera Lite unit runs a third‑party connection run by the manufacturer and so
when you do that you port forward, it SSH's and parts forward on the forwarding server
back to each unit. Which means if you can bypass the firewall on the forwarding server
you can directly access the interface and which means ownage, and you can own every
VeraLite that is out there, that's not good, because firewalls are impenetrable, right,
guys? The proxy script that we talked about that allows you to use the vera lite as a
proxy also appears to exist, appears, and we can't test it because of the CFAA and we
don't like prison, we can't test it but there is a script called proxy.SH.PHP on the forwarding
server which takes the URL and guess what? Same thing ‑‑ proxy.SH. so there is a
good chance that this is just a wrapper around proxy.SH or just a recoding in PHP Which means
that they have the same vulnerability then you can talk to it and say I want you to fetch
whatever port, which means that you can by‑pass the firewall, accessing every vera lite. Now,
that's if they're the same and I'm not sure but it strongly looks like it. Just to summarize
we have three methods of authentication, we have seven methods to gain root, two attacks
are remotely exploitable because you can use CSRF in conjunction with the UPnP interface,
in order to launch attacks by getting someone to click a link and there is the potential
of the ownage of every single internet connected VeraLite so it's a bad scene and now we're
going to do some demos for you starting with the Karotz.
I am going to show you the bunny break I talked about earlier. It's loading Linux
and noticing that there is a USB drive in the back and it contains an auto run wifi
script and it needs to set up the wifi and it's going to announce that it thinks it's
about to set up your wireless connection and instead it's going to play a script I wrote
that plays LOL.Mp3.
Bunny "I'm going to connect to the internet." (Music Playing.)
(Applause.) We're going to hope that Burpsuite doesn't
crash today. We're going to talk about the Insteon hub, this is connected to a device,
we've got this light on stage and the hub basically is connected to our network here.
Can everybody see that? Hopefully a bit better. This is basically a raw "get" request. There
is no video on the screen? Don't unplug it, that made Burp Crash reliably.
(Laughter). Can you see it?
Yes. All right. We're not going to be able to
see the ‑‑ can you see what's on my screen? No, it's not mirrored.
Do you see something coming across? I have no clue what's on the screen.
Zoom out. Can you turn mirroring back on? Did you want me to just do it without showing
them the screen? We could do that. (Applause.)
Yeah, all right. So here is the raw get request, hopefully people can see that. Zoom
out? So basically what this is doing is sending to this three script some sort of code that's
turned on there, this request which contains this device ID. This is the device that is
sitting up on stage. So if we say "go" turns the light off, no authentication, right? Yea,
we won. Turn it back on and hand it over to Dan.
Jennifer Savage:Remember that can be connected to your lock.
DAN: Thank you, David. So they say if you put a gun on the table in act 1 you must fire
it by act 3. We have a lock on this table, we're going to lock and unlock the lock. I
can send a UPnP request here and there is no user name and password, anything in here
so I can hit go and this changes the state of the lock.
Jennifer This is through the Vera. (Applause.) Thank you. I have one more trick and I
need a volunteer from the audience. For those of you who don't know "Vis" this
is "Vis" choose a pin, any pin, let us know what it is and try to open the lock with that
pin. It's alive!
All right, yep. Locked.
What happens when you put in a pin that doesn't do anything, like 2355 nothing happens.
So what I'm going to do here is add an additional pin.
(Laughter.) You said 2355?
Yeah. So 2355 and I hit go. We will give it a
second or two to sync up with the lock there and what I want you to do is press the same
pin, press 2355, try this again. (Beeps. )
Try it again? 2355
(Beeps and unlocks) (Applause.)
All right. That does it. That's all our demonstrations. I hope you enjoyed the show.
Please tip your waitresses. Conclusion, all these are internet connected
and none of these manufacturers are doing the due diligence to put security into it.
That's a pretty bad thing. Belkin is doing all right, though.
Thank you. (Applause.)