Rapid7, Inc. · NASDAQ:RPD
Rapid7 — Technical Presentation (January 2016)
59 slides from Rapid7's technical presentation, January 2016
Slide 1: IoT Security: Consumer Devices and the Extended Corporate Network
IOT SECURITY: CONSUMER DEVICES AND THE EXTENDED CORPORATE NETWORK
Slide 2: Get CPE Credits for this Webcast
Get CPE Credits for this Webcast • Attendees of this Webcast are eligible for 1 CPE credit • Self-report on your organization’s website • Keep the email invitation as confirmation for possible future audits • More info: http://bit.ly/R7CPE
Slide 3: Speakers
Speakers Tod Beardsley Mark Stanislav Michael McNeil Research Manager Senior Security Consultant Global Product Security & Rapid7 Rapid7 Services Officer Philips Healthcare
Slide 4: Hacking IoT Baby Monitors
Hacking IoT Baby Monitors Mark Stanislav, Sr. Security Consultant
Slide 5: What Does an Internet-Connected Monitor Offer?
What Does an Internet-Connected Monitor Offer? • “Connected” Features (via a Web Site and/or a Mobile Application) • Viewing a live stream locally (the home’s Wi-Fi) or remotely (Internet) • Controlling the camera’s position via pan, tilt, and zoom functionality • Communicating audio through the mon
Slide 6: A Mess of Dependencies and Attack Surface
A Mess of Dependencies and Attack Surface • Many IoT baby monitors leverage third-party services, firmware, and software • Some vendors put a lot of trust in their supply chain without testing security • Implementation errors or failure to comply with best practices also occurs • Complex ecosystems
Slide 7: So, How Do We Hack These Things?
SO, HOW DO WE HACK THESE THINGS?
Slide 8: Via Dumping Firmware
Via Dumping Firmware Pomona SOIC Clip + Bus Pirate flashrom to Dump Flash binwalk to Extract Filesystems
Slide 9: Via Brute Force of Various Means
Via Brute Force of Various Means Hash Cracking with cudaHashcat Scouring Google for Useful Details
Slide 10: Via Serial Console (UART)
Via Serial Console (UART) JTagulator U-Boot Configuration (or Bus Pirate, Shikra, etc.) UART Scan & Connect
Slide 11: Via JTAG (e.g. Dumping Memory via GDB)
Via JTAG (e.g. Dumping Memory via GDB) Not a baby monitor… but you get the idea!
Slide 12: Via Mobile Applications
Via Mobile Applications Acquire Firmware with dex2jar + JD-GUI for Android View API Calls with mitmproxy (esp. SSL/TLS) Find API End-Points with Clutch + strings for iOS
Slide 13: Via Network Analysis
Via Network Analysis Uncover Network Services with nmap View Protocol Details with wireshark
Slide 14: Via Web Applications
Via Web Applications Hidden Administrative Web Interface XSS on Camera Cloud Web Service
Slide 15: The Baby Monitors
THE BABY MONITORS (ml OMA
Slide 16: A Variety of Vendors, Styles, Costs, & Features
A Variety of Vendors, Styles, Costs, & Features Amazon Two-Way Vendor Model Price Pan Tilt Zoom Wi-Fi Ethernet Rank* / Stars Audio Gynoii GCW-1010 $89.34 #56 / 3.8 ✓ ✗ ✗ ✗ ✓ ✗ iBaby M3S $169.95 #243 / 3.4 ✓ ✓ ✓ ✓ ✓ ✓ iBaby M6 $199.95 #31 / 3.7 ✓ ✓ ✓ ✓ ✓ ✗ Lens LL-BC01W $54.99 #149 / 2.8 ✓ ✗ ✗ ✗ ✓ ✓
Slide 17: The Findings
THE FINDINGS
Slide 18: Withings WBP01 - $204.60
Withings WBP01 - $204.60 RAPID
Slide 19: Disabled Doesn't Quite Mean What it Used To
Disabled Doesn’t Quite Mean What it Used To 20 Minutes Later… The Stream Still Works! After a stream exists, “disabling” it via the app doesn’t actually stop it…
Slide 20: When Obfuscation Goes Wrong, or, Not at All?
When Obfuscation Goes Wrong, or, Not at All? At first, this looks like a really poor attempt at an obfuscation method to “hide” the password for this web service account. On further review, however, the mchunk method simply returns at the start of the for loop, yielding the output from the input to
Slide 21: WiFi Baby WFB2015 - $259.99
WiFi Baby WFB2015 - $259.99 RAPID
Slide 22: Nothing Makes Sense to Me Any More
Nothing Makes Sense to Me Any More Unauthenticated Log With Stream Details Hardcoded SSL Cert … That’s Not Even Used …
Slide 23: UPnP Bugs: Alive and Well in Baby Monitoring
UPnP Bugs: Alive and Well in Baby Monitoring UPnP RCE Bugs, CVE-2012-5958 & CVE-2012-5959
Slide 24: Lens Peek-A-View (LL-BC01W) - $54.99
Lens Peek-A-View (LL-BC01W) - $54.99
Slide 25: If You Needed Some Free Cloud Storage
If You Needed Some Free Cloud Storage [redacted] An FTP Account Per Camera, Apparently Used for Configuration Backups
Slide 26: Backdoor Credentials Galore
Backdoor Credentials Galore Hidden Web Interface Credentials Cracking the Linux ‘admin’ Password This account has functional ‘root’ privilege due to ugly permissions The Live Stream Passes Credentials in URL over HTTP
Slide 27: Gynoii GCW-1010 - $89.34
Gynoii GCW-1010 - $89.34 RAPID»)
Slide 28: Unencrypted Web Services - Local and Cloud
Unencrypted Web Services - Local and Cloud Local Administrative API Calls Hidden Device Web Interface Vendor Cloud API Calls Third-Party Streaming Service None of these services or APIs use any encryption and often pass sensitive credentials and keys
Slide 29: TRENDnet TV-IP743SIC - $69.99
TRENDnet TV-IP743SIC - $69.99
Slide 30: 2-for-1 — Unencrypted Web Service + XSS
2-for-1 — Unencrypted Web Service + XSS [redacted] Either MITM a User or Just BYOJS to their DOM:)
Slide 31: A Remote Shell Waiting to Happen…
A Remote Shell Waiting to Happen… Username: root Password: admin Telnet Available, Just Not Default Pro Tip: Remove Remote Access Services, Don’t Just Disable Them!
Slide 32: iBaby M3S - $169.95
iBaby M3S - $169.95
Slide 33: Uncovering Backdoor Linux Accounts & Access
Uncovering Backdoor Linux Accounts & Access An nmap Scan Reveals Telnet :) Username: admin Password: admin Password is “Protected” by UNIX Crypt * FYI, there is no ‘root’ on here, only ‘admin’
Slide 34: iBaby M3S - A Historical Look at Software?
iBaby M3S - A Historical Look at Software? ✦ U-Boot: 1.1.3, released August 14th, 2005 ✦ OpenSSL: 0.9.8e, released February 23rd, 2007 ✦ Linux Kernel: 2.6.21, released April 26th, 2007 ✦ BusyBox: 1.12.1, released September 28th, 2008 ✦ UNIX Crypt: First appeared in 1979, limited to 8-character passw
Slide 35: Encryption! Just Not Great Choices For it
Encryption! Just Not Great Choices For it :) Encrypted Backups… with a Hardcoded Password? Stream Encryption… with XXTEA?
Slide 36: iBaby M6 - $199.95
iBaby M6 - $199.95 RAPID
Slide 37: Cryptography? Naw, They Are Just Babies…
Cryptography? Naw, They Are Just Babies… Unencrypted Web Service Login Telnet & Unencrypted HTTP on Device Unencrypted Mobile API Calls
Slide 38: This is the iBaby Cloud Web Site Today…
This is the iBaby Cloud Web Site Today… Login for Camera Owners …and What is Now Returned on Login…
Slide 39: But a Few Months Ago, Direct Object Reference!
But a Few Months Ago, Direct Object Reference! <—Proper Account “Attacker” Account—> No Authorization/Privilege Given to Our “Attacker” Account
Slide 40: Full Access to All Audio & Motion Alert Videos
Full Access to All Audio & Motion Alert Videos “Attacker” Account—> [redacted] [redacted] [redacted] [redacted] Don’t let the broken images fool you… there’s live data ready to be viewed! View Source -> Find AVI Filename -> Access Static CloudFront URL
Slide 41: Unauthenticated Access to Unencrypted Videos
Unauthenticated Access to Unencrypted Videos Mobile API Call for Alert Video Retrieval Example AVI Thumbnail File [redacted] [redacted] [redacted] Video Downloads via Amazon CloudFront [redacted] ✦ URLs are not requested via HTTPS ✦ No IAM credentials or signed URLs
Slide 42: …and Some Weirdly Exposed Web Applications?
…and Some Weirdly Exposed Web Applications? Apparently There’s a Private Wiki. What For? No Clue. …But an Admin Site? Now That’s an Interesting Find!
Slide 43: Philips In.Sight B120/37
Philips In.Sight B120/37 RAPID
Slide 44: Everything Old is New Again…
Everything Old is New Again… My IZON Research - 2013 My InSight Research - 2015 The question is… Did security issues fixed by one camera manufacturer ever trickle into devices also leveraging the same firmware?
Slide 45: A Quick Look at "Old" Security Issues Still There
A Quick Look at “Old” Security Issues Still There No SSL on Backend Web Service Insecure Firmware Upgrade Process Multiple Hardcoded Linux Accounts Telnet Enabled by Default (Until Recently) Shout out to Paul Price for his research into the In.Sight M100 which shares a few issues from my old Stem In
Slide 46: A Few Newer Issues. But Wait, There's More!
A Few Newer Issues. But Wait, There’s More! :) Backdoor Telnet Enablement Script Username: root Password: b120root Multiple XSS on Web Service Portal Predictable ‘admin’ Web Service Password
Slide 47: Unauthenticated Administrative Camera Access
Unauthenticated Administrative Camera Access Camera HTTP Reverse Proxy User Clear Text Clear Text Internet Clear Text Web Service Home Network HTTP/80 When a remote end user requests their camera’s stream, an HTTP reverse proxy is opened on a public host & port number, directly to the camera’s backe
Slide 48: Finding Exposed Cameras on the Internet
Finding Exposed Cameras on the Internet The reverse proxy is setup by the stream provider, Yoics, and has a finite number of enumerable hostnames, each with about ~30,000 possible ports that may be utilized. While this may seem like a lot, an attacker could test this entire range every minute to loo
Slide 49: Summer Infant Baby Zoom (28630) - $199.99
Summer Infant Baby Zoom (28630) - $199.99
Slide 50: Oh, Be Sure to Change Your Password…
Oh, Be Sure to Change Your Password… Default New User Passwords == Last name (truncated to 8 characters) + Group ID This is not required to be changed on first login and could be enumerated if someone knows that you have this device — simply iterate over group ID integers!
Slide 51: Adding a Privileged User to Any & All Cameras
Adding a Privileged User to Any & All Cameras Before… After! This HTTP call could be ran against all possible IDs
Slide 52: Coordinated Disclosure Timeline
Coordinated Disclosure Timeline Initial Vendor Disclosure July 4th, 2015 — Because America! CERT Disclosure July 21st, 2015 — 17 Days After Vendor Disclosure Public Disclosure September 2nd, 2015 — 60 Days After Vendor Disclosure
Slide 53: A Modest Baby Monitor Security Checklist
A Modest Baby Monitor Security Checklist Local API Cloud API No Remote No Hidden No Known No UART All Streams Vendor Model HTTP SSL HTTP SSL Shell Accounts Vulns Access Encrypted Gynoii GCW-1010 ✗ ✗ ✗ ✗ ✓ ✗ ✗ iBaby M3S N/A ✓ ✗ ✗ ✓ ✗ ✓ iBaby M6 ✗ ✗ ✗ ✗ ✗ ✗ ✗ Lens LL-BC01W ✗ ✗ ✓ ✗ ✓ ✗ ✗ Philips B120/3
Slide 54: Scoring Baby Monitors for Overall Security
Scoring Baby Monitors for Overall Security Penalty for Security Concern Description of Concern Missing Local API HTTP SSL All local web service/API calls should be encrypted, regardless of being on a LAN. -20 Points Cloud API HTTP SSL All Internet-facing web service/API calls should be encrypted, in
Slide 55: Baby Monitor by Security Score & Grade
Baby Monitor by Security Score & Grade Amazon Vendor Model Price Score Grade* Rank / Stars Baby is Unsatisfied Gynoii GCW-1010 $89.34 #56 / 3.8 75 F iBaby M3S $169.95 #243 / 3.4 160 D iBaby M6 $199.95 #31 / 3.7 0 F Lens LL-BC01W $54.99 #149 / 2.8 125 F Philips B120/37 $77.54 #N/A / 2.2 30 F Summer 2
Slide 56: …But Really?
…But Really? 1. The iBaby M6, Summer, and Philips all had what I would consider “critical” security issues that make them a deal breaker, despite their overall scoring. 2. Only the iBaby M3S had apparent encryption for all streaming of content and even then, it’s not exactly “industry standard” and
Slide 57: Conclusions
Conclusions 1. The status quo of security for “connected” baby monitors is deeply concerning. 2. Even the “best” cameras tested were well below what I’d consider “secure.” 3. Consumers are woefully unaware that camera security features such as end- to-end encryption of audio/video and well defined,
Slide 58: Not All Hope is Lost, However
Not All Hope is Lost, However :) BuildItSecure.ly: Initiative targeted at sharing technical resources with IoT engineering teams and pairing IoT vendors with pro-bono security researchers. OWASP IoT Top 10: Provides vendors a list of the top 10 areas of IoT security that should be focused on during
Slide 59: Thanks! Questions?
Thanks! Questions? Mark Stanislav [email protected] @markstanislav