(SACON 2020) Practical Exploitation of IoT Networks and Ecosystems workshop
0 likes466 views
The document discusses the security challenges and exploitation techniques in Internet of Things (IoT) networks, detailing aspects of wireless protocols such as Zigbee and Bluetooth. It emphasizes the inadequacies of current security practices in IoT products, along with strategies for improving device security through proper implementation of security development life cycle (SDLC). The document concludes by advocating for better hardware/software testing and increased awareness of existing vulnerabilities in consumer IoT devices.
(SACON 2020) Practical Exploitation of IoT Networks and Ecosystems workshop
- 1. Practical Exploitation of IoT Networks and Ecosystems Sanjay V & Nitin Lakshmanan DEEP ARMOR www.deeparmor.com @deep_armor
- 2. SACON 2020 Instructors Nitin Lakshmanan Senior Security Analyst Deep Armor Aujas Networks, Aricent/ Intel Sanjay V Security Analyst Deep Armor Deloitte
- 3. SACON 2020 Agenda • IoT Architecture & Intro to IoT Security • Security Paradigms for the Building Blocks • Wireless Protocols • Hands-on Exercises • Security Development Life Cycle (SDLC) for IoT • Fun Hacking Activities • Summary Hacking Zigbee-style Wireless Sensor Networks Breaking Bluetooth Security Attacking Consumer IoT Ecosystems AWS IoT Core & Cloud Services Hands-on Exercises
- 4. SACON 2020 Internet Of Things • Network of devices connected to Internet • Connect, Collect and Exchange • Part of the fast growing electronic culture • Revolution in all the fields Connected People Connected Fleets Connected Infra Connected Markets Connected Assets Connected Products Network Data
- 5. SACON 2020 Messy World of IoT Security • “Let me get the product out first” • “I’m paying a supplier for hardware/software. Security is their responsibility” • “We don’t store any confidential information” • “Let me worry about it if/when we get hacked” • “We are 100% secure (!)” • …
- 6. SACON 2020 Attacks on IoT products
- 7. SACON 2020 IoT Security & Businesses • Security is often seen as zero ROI • Impedes rapid prototyping and delivery (doesn’t have to) • Consumers will buy anyway • Poor awareness; Sometimes, lack of options • Liability laws are almost non-existent • Few that exist don’t hold water
- 8. SACON 2020 Range / Power of protocols for IoT Protocol Power Range WiFi High Long Zigbee / Z-Wave Low Short to Mid BT / BLE Low Short LPWAN Low Long
- 9. SACON 2020 Zigbee • Low data rate wireless applications • Smart energy, medical, home automation, IIoT • Two bands of operation: 868/915MHz and 2450MHz • Simpler & less expensive than Bluetooth • 10-100m range • Zigbee Alliance
- 10. SACON 2020 Zigbee Security Model • Open Trust model (Device Trust Boundary) • Crypto protection only between devices • All services employ the same security suite
- 11. SACON 2020 Practical Exploitation of IoT Wireless Sensor Networks (WSN)
- 12. SACON 2020 Agenda • IEEE 802.15.4 (Layer 1 & 2 definitions for Zigbee) • Tools • Setup • Attack and Defense • Packet Generation • Sniffing and Injection • Packet Manipulation • Security Hardening
- 13. SACON 2020 802.15.4 • IEEE standard for low-rate wireless personal area networks (LR-WPANs) • 6LoWPAN for IPv6 over WPANs • Zigbee extends 802.15.4 (wrapper services) Application Presentation Session Transport Network Data Link Physical Logical Link Control Media Access Control ZigbeeSpec
- 14. SACON 2020 Attacking WSN • IoT product simulator • 802.15.4-based network • Packet sniffing, manipulation and injection • Goals: • Understanding basic packet header formats • Security models for protecting communication • Hardware and software tools for packet sniffing & injection
- 15. SACON 2020 Challenges • Insufficient security research and documentation • Few testing/debugging platforms • Reliable ones are very expensive or obsoleted • Beta quality hardware at best • Took us weeks, studying blogs, asking questions, trial- and-error, … • Lots of future work possible. Wanna collaborate?
- 16. SACON 2020 Generating & Analyzing IEEE 802.15.4 WSN packets (MAC Layer)
- 17. SACON 2020 WSN Internals Payload DASRC SEQ NUM PAN ID DST Payload D A SRC SEQN U M PA NID D ST Attacker Gateway
- 18. SACON 2020 Impact • Compromise integrity of sensor data • Spoof all legit devices in the network • Logistics & Asset Management - think Vaccine Transportation! • Medical Use Cases - Hospital monitoring • Security and Surveillance • Rapid emergency response for Industries • CVSSv3 Score: 9.3
- 19. SACON 2020 Hardening the WSN
- 20. SACON 2020 Approach • We care about: • Integrity of data transmitted (bi-directional) • Confidentiality (sometimes) • Device attestation in the WSN • Crypto • IoT Platform Constraints • RAM and flash memory are often in KBs • Traditional crypto is way too intensive • Libraries — Few and proprietary
- 21. SACON 2020 • Protecting data integrity is (should be) a key security objective • Use Crypto • Challenges • Need for HW Acceleration • Key provisioning and exchange • Traditional Public Key Crypto is often unacceptable • Nonce-based approaches are easy but insecure • We did not discuss: • Device Security Measures (Secure Boot, Secure FOTA, etc.) • Out of the box provisioning, device mapping and reuse • Key Management Summary
- 22. SACON 2020 Consumer IoT Security & AWS-IoT Topics
- 23. SACON 2020 Agenda • Consumer IoT • Case Study: “X” Fitness Band & “X” Wearable Technology device • Weaknesses in Smartphone Platforms <—> Wearables channels • Hands-on hacking of Bluetooth and BLE protocols • Hardening BLE • AWS IoT Core • Secure by Design and SDLC for IoT Platforms
- 25. SACON 2020 Introduction • Wireless protocol for short range data exchange • BT: 1-100m • BLE: 10-600m • BLE is Light-weight subset of classic Bluetooth with low power consumption • RF range: 2.4 - 2.485 GHz • Maintained & Governed by the Bluetooth Special Interest Group (SIG) • Popular use cases: wearable devices, smart pay systems, healthcare, smart security systems etc
- 26. SACON 2020 Bluetooth 5 Feature Bluetooth 5 Bluetooth 4.2 Speed Supports 2 Mbps Supports 1 Mbps Range 40m indoor 10m indoor Power Requirement Low High Message capacity 255 bytes 31 bytes • Latest version of BT and BLE Spec • Improvements to BLE • Aimed at IoT (especially consumer)
- 27. SACON 2020 Bluetooth LE security Secure Simple Pairing (SSP) • Just Works: very limited/no user interface • Numeric Comparison: devices with display or yes/no button • Passkey Entry: 6 digit pin as the pass key • Out Of Band: Out of the band channel for key exchange to thwart MITM attacks • Network traffic is encrypted with AES-128
- 28. SACON 2020 Practical Exploitation of BLE Systems
- 29. SACON 2020 Attacking Wearable - Mobile Ecosystems Section A
- 30. SACON 2020 Section B BLE Packet Analysis using Wireshark (“X” Popular fitness tracker)
- 31. SACON 2020 Section B: Sniffing with Ubertooth
- 32. SACON 2020 Summary • BT/BLE network packet analysis is easy • Market-available HW and SW • Many products do not enable the existing encryption mechanisms offered by the BT spec • At the very least, enable LTK-encryption
- 33. SACON 2020 Section C Attacking BLE LTK Encryption
- 34. SACON 2020 Section D Hardening BLE
- 35. SACON 2020 IoT Cloud Security
- 36. SACON 2020 Agenda • IoT Services from Modern Cloud Vendors • AWS IoT Core • Setting up IoT Core with device simulators • Secure configuration • AWS Cloud Security Checks
- 37. SACON 2020 • Managed cloud service for connected devices to interact with cloud applications • Amazon FreeRTOS — open-source OS for MCUs (low power & memory) • Connect and manage devices • Secure the communication • Process and Act • Monitor What is it?
- 38. SACON 2020 Unshackling from Traditional SDLC
- 39. SACON 2020 Security Development Life Cycle Security Architecture, Privacy Requirements Threat Modeling, Attack Trees & Data Access Reviews Focused Security Code Reviews & Privacy Planning Fuzzing, Penetration Testing, Privacy Sign-off Fix verification, Incident Response Planning Delta Security Assessment, Security for Continuous Integration/ Delivery Program Conception Design Implementation Pre-Launch Deployment Maintenance Reviews Reviews & Reports Reports Resolution & Sign-off Reports Device Mobile Cloud
- 40. SACON 2020 Privacy • Why worry? • Global Markets • Country-specific guidelines • Ecosystems and overlapping policies GDPR!
- 41. SACON 2020 Summary • Plethora of protocols & standards make IoT security messy • Make hardware & software for IoT comms undergo penetration testing • RZUSBStick works great. Also, ApiMote • Not much else • BT/BLE sniffing is very sketchy • Cloud Services giants & increasing number of IoT services • SDLC and Shift-left Ecosystem Protocols Integration Interoperability
- 42. SACON 2020 www.deeparmor.com | @deep_armor | services@deeparmor.com SDLC Vulnerability Assessments Security Consulting Trainings