More IoT failures, intercepting proxies

Intercepting proxies reveal IoT defects

When I’m having trouble finding a topic for a blog post, I often look for articles about recent security failures in IoT (Internet of Things) products. I’m rarely disappointed. For example,

  • A moderately complicated vulnerability in a digital signage product that consumers typically connect to the Internet without changing the default password. This is a privilege escalation vulnerability that gives the attacker full administrative access to the device. The vendor is apparently in the process of addressing the vulnerability, but it’s almost certainly up to the consumer to apply a firmware update. Many of the people who bought this device probably won’t apply, or even be aware of, the update.
  • INTERNET-CONNECTED HOT TUBS. Yes, a company made what was probably a last-minute decision to add a remote control feature to their hot tubs. But, predictably, they didn’t secure the feature, so it’s possible for your neighbor to operate your hot tub via Wi-Fi. They could run it at full blast and leave you with an unwelcome electric bill, or they could make the temperature so low that you won’t want to use it. There’s even a way to do those things remotely through the tub’s internet connection to a cloud service (although the attacker wouldn’t know whose hot tub they’re controlling).

The one that was most interesting to me was about some GPS-enabled smartwatches for children, products that are supposed to give parents a sense of security. The researcher found a serious vulnerability by using software called an intercepting proxy. An intercepting proxy is software that you run on your computer, and if you configure your web browser to send its traffic through the proxy, you can use the proxy to alter any part of the web traffic. This is very useful for identifying vulnerabilities in web applications. ZAP and Burp Suite are great examples of intercepting proxies. I use both of them in my own work.

In the case of the smartwatches, the researcher used a proxy (looks like he was using burp) to inspect the requests to the web application a parent might use to control their child’s smartwatch. The researcher found that a parameter of a web request corresponded to the user’s access level. When he used the proxy to change that parameter from a 1 to a 0, the web application gave him administrative access, as though he were a high-ranking employee of the company that produces and markets the smartwatch. The researcher found that he could view and alter the data of tens of thousands of other consumers of the product. This vulnerability was especially troubling, because children were the potential victims. The vendor has since addressed this problem.

Exploiting this particular vulnerability wasn’t quite as easy as changing something in the URL visible in the address bar of the user’s browser, but it was close. The web application gave too much trust to the request coming from the browser without verifying that the user was authorized for that level of access. This kind of programming error is easy to make, and it is potentially devastating.

If you’re looking for a believable bit of jargon for a story you’re writing about a security researcher, you could say that she used an intercepting proxy to discover an authentication control defect in a web application.

 

Advertisement

More document forensics

Naked Security has a great story about a couple whose real estate fraud was revealed by some document forensics. The couple produced documents as evidence of real estate deals in 1995 and 2004, but the documents used fonts that only became available in 2007.

This reminds me of the story of the NSA contractor who got caught leaking classified information, because invisible dots on pages she printed identified her printer.

Both stories are fascinating to me, because they show how much extra information shows up in our documents, and we don’t even realize it. These would make great twists in a story if a character needed to disprove a document or identify its owner.

Mid-January 2019 news roundup

Here are a few interesting items that have come through my news reader recently.

uPNP abuse

Universal Plug-and-Play (uPNP) is a feature that is enabled by default in most home routers. uPNP allows a network-enabled device on your home network to tell your router to allow external connections back to the device, like a gaming console or a media server.

While this feature might be useful in some cases, it has a history of security-related problems. A recent example involves tricking chromecast and other google-friendly devices into playing a video promoting someone’s youtube channel. You might enjoy reading that article if you want an idea of how a character in your story could get a victim’s TV to show a video of your character’s choice. Imagine getting someone’s TV to show a forged emergency broadcast system alert, for example.

You might also want to consider disabling uPNP on your home router.

Non-technical cyberwarfare

Gizmodo has an article reminding us that sometimes you don’t need mad skills to crack a network. The FBI was able to acquire evidence against drug kingpin El Chapo by persuading his sysadmin to give them the keys to decrypt encrypted voice-over-IP conversations. If your story’s character needs to compromise an otherwise secure computer network, bribing or blackmailing an insider might be a good alternative.

Biometrics v. photography

Have you ever seen a movie where someone is only able to enter a lab or operations center after putting their palm on a handprint scanner? Apparently that’s a real thing: the scanner looks at how the user’s veins are arranged. It turns out that a photograph FROM SEVERAL METERS AWAY reveals enough detail to create a wax hand that will fool some of these scanners.

I recently watched Die Another Day (2002), and I think they used a severed hand to get through one of these things. So, that kind of messy unpleasantness isn’t even necessary any more!

And if you’re a Bond villain with a lair under a volcano that you access with a handprint scanner, think about wearing gloves in public.

2018 absence

I knew it had been a while since I’ve posted here, but I hadn’t realized that it’s been over ten months. Lately it’s been hard to prioritize this blog when the world seems like a burning clown car hurtling toward a sinkhole filled with angry, ravenous bears. I’ll try to do better in 2019. In the meantime, Naked Security is running a series of blog posts about securing social media accounts. So if, like me, you haven’t quite managed to lop off these gangrenous appendages, these might be worth your time:

 

Netgear router update

If you use a Netgear router for your home network, please log on to your router and use the upgrade feature to apply an important security update. That feature is probably located under the Advanced and/or Administration sections of the router’s web-based menus.

This update addresses several vulnerabilities, some of which are remotely exploitable. The linked page indicates which vulnerabilities affect which routers, and I found that my router was affected by one of the vulnerabilities.

If a character in a story you’re writing needed to exploit this kind of thing against a target, it’s not a great stretch of the imagination. If your character emailed her target an email with a link to a web page she controls, and if the target clicked the link while on a computer at home, she’d have the target’s IP address (she could get that from looking at server logs). Once she knew the target’s IP address, she could interrogate the address herself with readily-available network tools, or she could use something like shodan to try to identify the kind of router her target uses. If the target has remote administration enabled (which may be a default settings in some router models), she could use publicized vulnerabilities like the ones linked above to break into her target’s home network.

You should probably run updates on your home router even if it isn’t made by Netgear.

Flash Player Zero-Day

A zero-day vulnerability is a software defect that doesn’t yet have a patch from the vendor. One of these currently exists for Adobe Flash Player, and it is being actively targeted by a working exploit. This particular defect (CVE-2018-4878) is a use-after-free vulnerability which allows remote code execution. This means that Flash Player tries to read instructions from a memory address that is no longer valid, and that the exploit is able to put malicious code at that memory address, causing Flash Player to execute the malicious code introduced by the exploit.

South Korean security researchers say that North Korea developed this exploit and have embedded it in Microsoft Word documents in an effort to attack South Koreans doing security research on North Korea, and that this has been going on for two or three months.

This zero-day started making news on 1 February, and Adobe says it’ll release a patch the week of 5 February. As in this case, it can take the vendor a while to address a defect like this. So if your character needs to compromise someone’s computer, she might search Dark Web forums for a recent zero-day like this and send it to her target in a phishing email, especially if she knows that her target is not diligent about keeping their computer up-to-date.

And if you use Flash Player, make sure you apply the patch when Adobe releases it. Version 28.0.0.137 is the affected version.

Grand theft auto? Kidnapping? Murder? There’s an app for that.

This is a summary of three articles from the Sophos Naked Security blog that might be of interest to writers of stories involving cybercrime.

Break into a car in seconds

Many new cars come with an electronic fob on the keychain. The fob uses radio signals to tell the car to unlock. In a development which should surprise absolutely no one, criminals have found a way to abuse this feature. Looks like it takes two devices: one to record the fob’s signal and send it to the second device which opens the car door. This appears to work even if the fob is inside the owner’s house.

Your story’s character may not want to steal a car, but she might want the laptop the owner left sitting in the trunk.

Smartwatches are dumb

Does your story have a villain who’s not above kidnapping? He might use an insecure smartwatch to locate his target.

Smart pumps are also dumb

Does your story’s villain need to deliver a lethal does of morphine to a hospital patient? He could potentially do so from a safe distance if the patient is being treated with a device that regulates the IV drip. The vulnerabilities in the linked article are admittedly very difficult to exploit, but they’re indicative of the sloppy development of devices like this. The vendor says they’ll release an update this month to address the problem. It’s probably a firmware update. How many overworked hospital IT workers do you think will go around applying that update to every affected device?

Data breach at US Department of Homeland Security

The Department of Homeland Security (DHS) suffered a “privacy incident” involving a database with personal information on nearly a quarter million people employed by DHS during 2014. This breach also affects an unspecified number of people who were associated with DHS investigations between 2002 and 2014. This latter group includes the subjects, witnesses, and complainants of DHS investigations.

DHS says that this wasn’t the result of a cyber attack. Sounds like a former DHS employee helped themselves to a personal copy of this database. This database contains names, social security numbers, dates of birth, and other information useful for identity theft. It isn’t clear how far this information was disseminated.

So if you think you may be affected by this data breach, click the above link for information about enrolling in 18 months of free credit monitoring. And if you’re an author with a character who wants secret information about a company or organization, have your character start running phishing attempts against current and former employees of the company/organization. She might identify these employees by running searches in social media sites like LinkedIn. Gaining access to an employee’s personal computer or Dropbox account might be very fruitful, because there’s no telling what that employee might have taken home with him.

Equifax breach

The data breach at credit bureau Equifax has gotten a lot of attention in the last week. It seems that the company has been guilty of at least two significant blunders: unpatched software and default authentication credentials.

Unpatched software

Equifax has at least one web application built on Apache Struts, a category of software called a web application framework. Web developers use frameworks to build their applications, because the frameworks provide components common to many web applications, components that do things like handling input typed into a web form, generating HTML for web pages, etc. Frameworks allow web developers to skip over routine tasks and focus on the business logic specific to the application.

Like any software, frameworks have versions and updates. Equifax was using a version of Struts that had at least one serious and widely-known security vulnerability. When the Struts developers (not Equifax, but the people who make the Struts framework) became aware of the vulnerability, they released an update to the Struts framework. The Struts developers released this update months prior to the Equifax data breach. For whatever reason, Equifax didn’t update Struts on their site.

Default authentication credentials

Equifax hosts a web application that their Argentinian employees use to manage credit report data. That web application had a poor choice of authentication credentials: the username was admin, and the password was also admin. Logging in with those credentials allowed an attacker to retrieve the usernames and passwords of Equifax employees, which would in turn allow the attacker to retrieve Equifax customer information.

How does this happen?

Why didn’t Equifax apply the Struts update? A few possibilities come to mind:

  1. The didn’t know about the update. Equifax must have developers, system administrators, and security analysts. Maybe they were all blissfully ignorant of the update for over four months.
  2. Maybe the update was incompatible with the web application they built on the Struts framework. If that were the case, they should have identified and fixed the problem and then run the update. That might take days, but it shouldn’t take months.
  3. They probably have change control processes that delay an update. They wouldn’t immediately run the update on their live production servers. First they’d load it in a test environment, and then they’d test their application after applying the Struts update. But that should take at most days, and probably hours, especially with an update that addresses serious security vulnerabilities.

None of these is an excuse for waiting months to run the update, and there’s really no defending the admin/admin thing at all.

What this might mean to you

Brian Krebs has been a long-time advocate for security freezes, and I’m considering doing this. The only reason I haven’t done this yet is that it just seems like one more pain in the ass when my day job, the current political climate, and other stuff leave me wanting to do little more than read a book or sit in front of the TV binge-watching The Flash and Supergirl (which is why I haven’t been posting on this blog much lately).

The implications of the Equifax breach to a story-teller are obvious enough. If your character needs to break into a web site or computer network, she should look for out-of-date software or default authentication credentials. This sort of thing isn’t supposed to happen to a big company that should know better about how to protect the personal information of millions of people. But it does happen, which can make it a plausible plot device in your fiction. I see that nmap has a test to look specifically for the Struts vulnerability found on the Equifax site, and there are plenty of open-source tools to run brute-force password attacks.

The implications of the breach on a computer user are obvious, too. This is why it’s so important to run software updates on everything. Criminals are well aware of security vulnerabilities and are actively exploiting them. We all need to be running updates:

1. operating system and application software updates on our computers and mobile devices

2. firmware updates on the routers we use for our broadband internet connections

3. updates to self-hosted blogging software like wordpress (plugins, too)

And we need to be picking good passwords for everything. Did you ever change the password on your broadband router? Does “facebook” appear in your facebook password?

CrashPlan discontinuing home plans

I’ve used Crashplan as an offsite backup solution for several years and have really liked it. Today the company announced that they are transitioning to being an enterprise-only solution, and that they are ending support for personal and family plans.

This is pretty disappointing. It’s been a good product at an affordable price, and now I have to find something else. The company is going about this in a nice way: they’re giving their users 14 months’ notice. I’ll post about this again when I figure out what I’m going to do. And I’m certainly open to suggestions.