{"id":8518,"date":"2015-04-24T09:30:24","date_gmt":"2015-04-24T13:30:24","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=8518"},"modified":"2019-11-15T23:00:19","modified_gmt":"2019-11-15T12:00:19","slug":"internet-of-crappy-things-2","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/internet-of-crappy-things-2\/8518\/","title":{"rendered":"Internet of Crappy Things, part 2: RSA conference edition"},"content":{"rendered":"<p>SAN FRANCISCO \u2014 It\u2019s an utterly played out platitude that the security industry is largely failing at its mission to protect computers and networks and all the nearly infinite data transiting the Internet.<\/p>\n<p>It\u2019s inarguable that properly securing traditional and general computing devices is a massive challenge. For the better part of the last decade, <a href=\"https:\/\/www.kaspersky.com.au\/blog\/best-of-mwc2015\/\" target=\"_blank\" rel=\"noopener\">mobile has presented the industry with a new and similar set of challenges<\/a>. It\u2019s probably not a stretch to say that the fight to secure traditional and mobile computers is tipped severely in favor of the attackers, ethical, malicious and otherwise.<\/p>\n<p>Walking the show floor at the RSA Conference in San Fransisco\u2019s Moscone Center presents an absurd and ironic reality. There is some unknown number of millions of dollars invested in vendor booths, the purpose of which is to hawk of a multitude of security products and services to an equally multitudinous hoard of security professionals. Meanwhile, despite the vastly larger investments required to develop these products, people like <a href=\"https:\/\/www.kaspersky.com.au\/blog\/hacking-the-airport-security-scanner\/\" target=\"_blank\" rel=\"noopener\">Billy Rios, who famously gave an airport security hacking presentation last year<\/a>, and David Jacoby are delivering hacking demos in which they wrest total control of home automation systems, networks and consumer devices.<\/p>\n<blockquote class=\"twitter-pullquote\"><p>Internet of (crappy) Things: documenting #IoT insecurity live at #RSAC<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2Fy11D&amp;text=Internet+of+%28crappy%29+Things%3A+documenting+%23IoT+insecurity+live+at+%23RSAC\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>To be fair, much of the business going on here at RSA is business to business. This is not a consumer security conference by any stretch. Still, recent headlines and the relentless torrent of global security conferences pretty clearly demonstrate that computers are insecure, whether they\u2019re in your home or in your office. Despite this, the broader tech industry is aggressively pursuing the bright idea to connect more and stranger things to the Internet on an exponential scale. This is the so-called \u201cInternet of things,\u201d and it\u2019s not secure either.<\/p>\n<p>Therefore it comes as little surprise that <a href=\"https:\/\/twitter.com\/XSSniper\" target=\"_blank\" rel=\"noopener nofollow\">Billy Rios<\/a>, founder of the security firm Laconicly, exploited a two year old vulnerability in a Vera smart-home automation device, which in turn offered him total access to that device\u2019s network and all the computers attached to it.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">So <a href=\"https:\/\/twitter.com\/XSSniper?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@XSSniper<\/a> is going to demo a home automation hack at <a href=\"https:\/\/twitter.com\/RSAConference?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@RSAConference<\/a>, using Pac-Man to illustrate it: <a href=\"http:\/\/t.co\/LJW27SsAWJ\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/LJW27SsAWJ<\/a><\/p>\n<p>\u2014 Kelly Jackson Higgins (@kjhiggins) <a href=\"https:\/\/twitter.com\/kjhiggins\/status\/588849908259631104?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Rios exploited a cross-site forgery request vulnerability in the Vera home automation system and forced it to accept a modified firmware update. More specifically, Rios used a phishing scheme in which he compelled his (hypothetical) victim to visit a malicious website with a bit of embedded malvertising.<\/p>\n<p>The Vera device\u2019s firmware update mechanism is then turned off, and Rios uploaded his own firmware, which, in this case, was a playable copy Pac-Man. His \u201cmalicious\u201d firmware is fun, but the point is that he could upload whatever he wanted to a device designed to control hundreds of other IoT devices, like smart locks, thermostats, lights, alarm systems and garage doors to name a few.<\/p>\n<p>Kelly Jackson Higgins of Dark Reading is <a href=\"http:\/\/www.darkreading.com\/vulnerabilities---threats\/popular-home-automation-system-backdoored-via-unpatched-flaw\/d\/d-id\/1320004?_mc=sm_dr_editor_kellyjacksonhiggins\" target=\"_blank\" rel=\"noopener nofollow\">reporting that Vera will fix the bug<\/a> with a yet to be released firmware update.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Nice wrap up of <a href=\"https:\/\/twitter.com\/hashtag\/IoT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#IoT<\/a>-related talks at <a href=\"https:\/\/twitter.com\/hashtag\/TheSAS2015?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TheSAS2015<\/a>: \"Internet of Crappy Things: <a href=\"https:\/\/t.co\/ORygHSJs9W\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/ORygHSJs9W<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/568726530391543809?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 20, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>One day later, Kaspersky Lab senior security researcher, <a href=\"https:\/\/twitter.com\/JacobyDavid\" target=\"_blank\" rel=\"noopener nofollow\">David Jacoby<\/a>, deployed a mixture of malicious code, exploits and phishing techniques to compromise a network storage device attached to his home network in Sweden. His presentation is part of <a href=\"http:\/\/https:\/\/www.kaspersky.com.au\/blog\/how-i-hacked-my-home\/\" target=\"_blank\" rel=\"noopener nofollow\">a larger home hacking project<\/a>, which the Kaspersky Daily has documented at length.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Researcher <a href=\"https:\/\/twitter.com\/JacobyDavid?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@JacobyDavid<\/a> on home hacking at <a href=\"https:\/\/twitter.com\/hashtag\/RSAC?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#RSAC<\/a>: <a href=\"http:\/\/t.co\/InHS8GcBhj\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/InHS8GcBhj<\/a><\/p>\n<p>\u2014 Securelist (@Securelist) <a href=\"https:\/\/twitter.com\/Securelist\/status\/590931391568814080?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 22, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Jacoby probably put it best he said that most of the vendors making these products simply do not care about the various security vulnerabilities he reported to them. Network segmentation, he said, is likely the best mitigation for these holes. Unfortunately, network segmentation is a fairly complicated fix for your average users.<\/p>\n<p>About 20 minutes after Jacoby\u2019s talk, <a href=\"https:\/\/twitter.com\/jinyier\" target=\"_blank\" rel=\"noopener nofollow\">Yier Jin<\/a>, a hardware hacker and assistant professor at the University of Central Florida, showed us a backdoor in Nest\u2019s wildly popular smart thermostat devices.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">A few demos generated by a customized toolchain on the Nest Thermostat is released. <a href=\"https:\/\/t.co\/KCg3Wdy8gV\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/KCg3Wdy8gV<\/a><\/p>\n<p>\u2014 Yier Jin (@jinyier) <a href=\"https:\/\/twitter.com\/jinyier\/status\/499275862286811136?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 12, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Jin found a backdoor in Nest devices which allowed him to install malicious firmware on those devices. In addition to that, he found ways to monitor the gobs of data that Nest devices relay to Nest\u2019s cloud servers. This, he explained, is often sensitive data. If properly monitored, an attacker could make all sorts of determinations about when a Nest user is or is not home. On a more principled level, there is no way for the user to opt out of this data collection. If that wasn\u2019t enough, Jin\u2019s root access could allow him to pivot to other devices on the same network, brick the Nest device, see plain-text network credentials and more.<\/p>\n<p><strong>TL;DR<\/strong> \u2014 Despite hundreds of billions of dollars in security investment, traditional computers, let-alone the so-called <a href=\"http:\/\/https:\/\/www.kaspersky.com.au\/blog\/internet-of-crappy-things\/\" target=\"_blank\" rel=\"noopener nofollow\">Internet of (crappy) Things<\/a>, remain hopelessly exposed to attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The annual RSA Conference in San Francisco, California of Internet-of-things insecurity and how no amount of money can fix computer security<\/p>\n","protected":false},"author":42,"featured_media":8522,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[82,658,794,1072,1073,97],"class_list":{"0":"post-8518","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"tag-hacking","9":"tag-internet-of-things","10":"tag-iot","11":"tag-rsa-conference","12":"tag-rsac","13":"tag-security-2"},"hreflang":[{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/internet-of-crappy-things-2\/8518\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/internet-of-crappy-things-2\/4773\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/internet-of-crappy-things-2\/5682\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/internet-of-crappy-things-2\/5895\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/internet-of-crappy-things-2\/7612\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/internet-of-crappy-things-2\/8518\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/internet-of-crappy-things-2\/4484\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/internet-of-crappy-things-2\/7450\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/internet-of-crappy-things-2\/7612\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/internet-of-crappy-things-2\/8518\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.au\/blog\/tag\/hacking\/","name":"hacking"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/8518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/comments?post=8518"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/8518\/revisions"}],"predecessor-version":[{"id":24776,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/8518\/revisions\/24776"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media\/8522"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media?parent=8518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/categories?post=8518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/tags?post=8518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}