Io IoT Goes Nuclear: Creatin ing a Zig igBee Chain in Reactio - - PowerPoint PPT Presentation

▶
io iot goes nuclear
SMART_READER_LITE
LIVE PREVIEW

Io IoT Goes Nuclear: Creatin ing a Zig igBee Chain in Reactio - - PowerPoint PPT Presentation

Dec 04, 2023 178 likes •1.11k views

Io IoT Goes Nuclear: Creatin ing a Zig igBee Chain in Reactio ion Eyal Ronen , Colin O Flynn, Adi Shamir, Achi-Or Weingarten Typical IoT devices: Philips Hue Smart Lights Typical IoT devices: Philips Hue Smart Lights Mature

slide-1
SLIDE 1

Io IoT Goes Nuclear: Creatin ing a Zig igBee Chain in Reactio ion

Eyal Ronen, Colin O’Flynn, Adi Shamir, Achi-Or Weingarten

slide-2
SLIDE 2
slide-3
SLIDE 3

Typical IoT devices: Philips Hue Smart Lights

slide-4
SLIDE 4

Typical IoT devices: Philips Hue Smart Lights

  • Mature technology and standards, a relatively simple system
slide-5
SLIDE 5

Typical IoT devices: Philips Hue Smart Lights

  • Mature technology and standards, a relatively simple system
  • A high end product with high end security, but…
slide-6
SLIDE 6

Creating a lightbulb worm

  • We have proven the possibility of creating a worm

which spreads using only the standard ZigBee wireless interface

slide-7
SLIDE 7

Creating a lightbulb worm

  • We have proven the possibility of creating a worm

which spreads using only the standard ZigBee wireless interface

  • Taking over a preinstalled smart light
slide-8
SLIDE 8

Creating a lightbulb worm

  • We have proven the possibility of creating a worm

which spreads using only the standard ZigBee wireless interface

  • Taking over a preinstalled smart light
  • Spreading everywhere
slide-9
SLIDE 9

The underlying ZLL protocol

slide-10
SLIDE 10

The underlying ZLL protocol

  • Each installed light is connected to a central controller using the ZigBee

Light Link (ZLL) wireless protocol in a Personal Area Network (PAN) Zigbee Personal Area Network

slide-11
SLIDE 11

The underlying ZLL protocol

  • Each installed light is connected to a central controller using the ZigBee

Light Link (ZLL) wireless protocol in a Personal Area Network (PAN)

  • The bridge is connected to a secure home/ office network, and is

controlled by a smartphone app via IP IP

slide-12
SLIDE 12

The underlying ZLL protocol

  • Each installed light is connected to a central controller using the ZigBee

Light Link (ZLL) wireless protocol in a Personal Area Network (PAN)

  • The bridge is connected to a secure home/ office network, and is

controlled by a smartphone app via IP

  • It enables each authorized user to turn each light on or off, to change

the light intensity, and to set its color

slide-13
SLIDE 13

Starting the attack

slide-14
SLIDE 14

Starting the attack

  • Write a full python based ZLL stack, using Eval Board

as RF transmitter

slide-15
SLIDE 15

Starting the attack

  • Write a full python based ZLL stack, using Eval Board

as RF transmitter

  • Buy many lamps, sniff traffic, and break (physically)

some lamps

slide-16
SLIDE 16

Starting the attack

  • Write a full python based ZLL stack, using Eval Board

as RF transmitter

  • Buy many lamps, sniff traffic, and break (physically)

some lamps

  • Start connecting wires
slide-17
SLIDE 17

Philps Hue Lamp Teardown

slide-18
SLIDE 18
slide-19
SLIDE 19

Boot sequence debug printout

slide-20
SLIDE 20

Challenges in taking over a preinstalled smart light

slide-21
SLIDE 21

Challenges in taking over a preinstalled smart light

  • ZigBee Light Link standard uses multiple

cryptographic and security protocols to prevent misuse

slide-22
SLIDE 22

Challenges in taking over a preinstalled smart light

  • ZigBee Light Link standard uses multiple

cryptographic and security protocols to prevent misuse

  • In particular, uses a proximity test to make sure that

the only way to take control of an already installed Hue lamp is by operating it within 10-20 cm from its new controller

slide-23
SLIDE 23

Protocol Session Outline

Controller Lamp

Scan Request(Transaction ID) Scan Response Network Start (Transaction ID) Reset to Factory New (Transaction ID)

Proximity Test

slide-24
SLIDE 24

Protocol Session Outline

Controller Lamp

Scan Request(Transaction ID) Scan Response Network Start (Transaction ID) Reset to Factory New (Transaction ID)

Proximity Test

slide-25
SLIDE 25

Protocol Session Outline

Controller Lamp

Scan Request(Transaction ID) Scan Response Network Start (Transaction ID) Reset to Factory New (Transaction ID)

Proximity Test

slide-26
SLIDE 26

Protocol Implementation Bug

slide-27
SLIDE 27

Protocol Implementation Bug

  • We want to cause the light to Reset to Factory New
slide-28
SLIDE 28

Protocol Implementation Bug

  • We want to cause the light to Reset to Factory New
slide-29
SLIDE 29

Protocol Implementation Bug

  • We want to cause the light to Reset to Factory New
  • Can’t set a valid Transaction ID due to proximity test
slide-30
SLIDE 30

Protocol Implementation Bug

  • We want to cause the light to Reset to Factory New
  • Can’t set a valid Transaction ID due to proximity test

Non-Zero

slide-31
SLIDE 31

The case of ZERO (day)

slide-32
SLIDE 32

The case of ZERO (day)

  • How is the Session data is saved in memory?
slide-33
SLIDE 33

The case of ZERO (day)

  • How is the Session data is saved in memory?
slide-34
SLIDE 34

The case of ZERO (day)

  • How is the Session data is saved in memory?
  • What is default values in the struct?
slide-35
SLIDE 35

The case of ZERO (day)

  • How is the Session data is saved in memory?
  • What is default values in the struct?
  • Well surely it is

checked on access…

slide-36
SLIDE 36

The case of ZERO (day)

  • How is the Session data is saved in memory?
  • What is default values in the struct?
  • Well surely it is

checked on access…

slide-37
SLIDE 37

The case of ZERO (day)

  • How is the Session data is saved in memory?
  • What is default values in the struct?
  • Well surely it is

checked on access…

  • Just on Scan Request

message

slide-38
SLIDE 38

Protocol Attack Outline

Controller Lamp

Factory Reset (Transaction ID=0)

slide-39
SLIDE 39

We bought a cheap and lightweight commercial Zigbee evaluation kit:

slide-40
SLIDE 40

ZigBee WarFlying - Taking over a building’s lights

By launching a drone carrying a fully automated attack equipment 400 meters away

slide-41
SLIDE 41

second warflying video here

slide-42
SLIDE 42

Spreading everywhere

slide-43
SLIDE 43

Getting software updates

  • No software update for Atmel based lamps
slide-44
SLIDE 44

Getting software updates

  • No software update for Atmel based lamps
  • So lets impersonate to an older model and version
slide-45
SLIDE 45

Getting software updates

  • No software update for Atmel based lamps
  • So lets impersonate to an older model and version
  • Looked for posting on upgrades on the Internet (mainly Reddit)
slide-46
SLIDE 46

Known upgrades (From Internet Posts) 66009663 -> 66013452 65003148 -> 66013452 (recorded with type 100) 66010820 -> 66012457 (recorded with type 104) (GU10) 65003148 -> 66012457 (recorded with type 104) (GU10) 65003148 -> 66013452 (recorded with type 103)

Getting software updates

  • No software update for Atmel based lamps
  • So lets impersonate to an older model and version
  • Looked for posting on upgrades on the Internet (mainly Reddit)
slide-47
SLIDE 47

Light impersonating

  • Write impersonating code, to identify as old models
slide-48
SLIDE 48

Light impersonating

  • Write impersonating code, to identify as old models
  • Sniff OTA updates on Zigbee and on bridge
slide-49
SLIDE 49

Light impersonating

  • Write impersonating code, to identify as old models
  • Sniff OTA updates on Zigbee and on bridge
slide-50
SLIDE 50

Light impersonating

  • Write impersonating code, to identify as old models
  • Sniff OTA updates on Zigbee and on bridge
  • They are encrypted
slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54

Correlation power analysis

slide-55
SLIDE 55

Power Analysis Example Setup

slide-56
SLIDE 56

CPA for RE

slide-57
SLIDE 57

CCM

slide-58
SLIDE 58

Block Cipher Encryption Ciphertext (CTM) Nonce (unknown) Counter (m) CBC State m -1 (CBCM-1) Block Cipher Encryption Plaintext (PTM) CBC State m (CBCM) Block Cipher Encryption Ciphertext (CTM+1) Nonce (unknown) Counter (m+1) Block Cipher Encryption Plaintext (PTM+1) CBC State m (CBCM+1)

New CPA attack on CCM

slide-59
SLIDE 59

Block Cipher Encryption Ciphertext (CTM) Nonce (unknown) Counter (m) CBC State m -1 (CBCM-1) Block Cipher Encryption Plaintext (PTM) CBC State m (CBCM) Block Cipher Encryption Ciphertext (CTM+1) Nonce (unknown) Counter (m+1) Block Cipher Encryption Plaintext (PTM+1) CBC State m (CBCM+1)

New CPA attack on CCM

Jaffe 07 Requires 2^16 blocks

slide-60
SLIDE 60

Block Cipher Encryption Ciphertext (CTM) Nonce (unknown) Counter (m) CBC State m -1 (CBCM-1) Block Cipher Encryption Plaintext (PTM) CBC State m (CBCM) Block Cipher Encryption Ciphertext (CTM+1) Nonce (unknown) Counter (m+1) Block Cipher Encryption Plaintext (PTM+1) CBC State m (CBCM+1)

New CPA attack on CCM

O’Flynn & Chen Chosen Nonce

slide-61
SLIDE 61

Block Cipher Encryption Ciphertext (CTM) Nonce (unknown) Counter (m) CBC State m -1 (CBCM-1) Block Cipher Encryption Plaintext (PTM) CBC State m (CBCM) Block Cipher Encryption Ciphertext (CTM+1) Nonce (unknown) Counter (m+1) Block Cipher Encryption Plaintext (PTM+1) CBC State m (CBCM+1)

New CPA attack on CCM

ECB - modified key

slide-62
SLIDE 62

Block Cipher Encryption Ciphertext (CTM) Nonce (unknown) Counter (m) CBC State m -1 (CBCM-1) Block Cipher Encryption CBC State m (CBCM)

New CPA attack on CCM

slide-63
SLIDE 63

Block m Const Block Cipher Encryption Ciphertext (CTM) CBC State m (CBCM)

New CPA attack on CCM

slide-64
SLIDE 64

Modified Key Block Cipher Encryption

Ciphertext (CTM) CBC State m (CBCM)

New CPA attack on CCM

slide-65
SLIDE 65
slide-66
SLIDE 66
slide-67
SLIDE 67
slide-68
SLIDE 68

https://www.youtube.com/watch?v=hi2D2MnwiGM Or: http://www.oflynn.com

slide-69
SLIDE 69
slide-70
SLIDE 70

Creating An Explosive Infection:

slide-71
SLIDE 71

A New Type of Attack:

slide-72
SLIDE 72

A New Type of Attack:

  • A hacker can infect all the smart lights in the whole

city, provided that the density of smart lights is above a certain critical mass, which can be calculated with percolation theory techniques

slide-73
SLIDE 73

A New Type of Attack:

  • A hacker can infect all the smart lights in the whole

city, provided that the density of smart lights is above a certain critical mass, which can be calculated with percolation theory techniques

  • For a city such as Paris whose area is 105 square km,

the critical mass is about 15,000 randomly located smart lights, which is surprisingly low

slide-74
SLIDE 74

A New Type of Attack:

  • The attacker can start the attack by just plugging in

a single infected lightbulb anywhere in the city

slide-75
SLIDE 75

A New Type of Attack:

  • The attacker can start the attack by just plugging in

a single infected lightbulb anywhere in the city

  • The attack proceeds entirely via the ZigBee radio

frequencies and protocols, which are not currently monitored, so its hard to locate the infection source

slide-76
SLIDE 76

A New Type of Attack:

  • The attacker can start the attack by just plugging in

a single infected lightbulb anywhere in the city

  • The attack proceeds entirely via the ZigBee radio

frequencies and protocols, which are not currently monitored, so its hard to locate the infection source

  • It does not use any TCP/IP packets, and thus cannot

be stopped by standard internet security tools

slide-77
SLIDE 77

What the Attacker Can Actually Achieve:

slide-78
SLIDE 78

What the Attacker Can Actually Achieve:

  • Widespread Blackout
slide-79
SLIDE 79

What the Attacker Can Actually Achieve:

  • Widespread Blackout
  • The attacker can permanently brick all the smart lights
slide-80
SLIDE 80

What the Attacker Can Actually Achieve:

  • Widespread Blackout
  • The attacker can permanently brick all the smart lights
  • The attack can simultaneously turn all the city’s smart

lights on or off, possibly affecting the electricity grid

slide-81
SLIDE 81

What the Attacker Can Actually Achieve:

  • Widespread Blackout
  • The attacker can permanently brick all the smart lights
  • The attack can simultaneously turn all the city’s smart

lights on or off, possibly affecting the electricity grid

  • Cause epileptic seizures in photosensitive people
slide-82
SLIDE 82

What the Attacker Can Actually Achieve:

  • Widespread Blackout
  • The attacker can permanently brick all the smart lights
  • The attack can simultaneously turn all the city’s smart

lights on or off, possibly affecting the electricity grid

  • Cause epileptic seizures in photosensitive people
  • The attacker can disrupt WiFi communication since

WiFi and ZigBee share the same frequencies

slide-83
SLIDE 83

Responsible disclousre

slide-84
SLIDE 84

Responsible disclousre

  • We contacted Philips and disclosed the

vulnerabilities prior to publication

slide-85
SLIDE 85

Responsible disclousre

  • We contacted Philips and disclosed the

vulnerabilities prior to publication

  • The protocol implantation bug was fixed and an

update was rolled out

slide-86
SLIDE 86

Responsible disclousre

  • We contacted Philips and disclosed the

vulnerabilities prior to publication

  • The protocol implantation bug was fixed and an

update was rolled out

  • The software update process remains vulnerable
slide-87
SLIDE 87

What went wrong?

slide-88
SLIDE 88

What went wrong?

  • Without really thinking about it, we are going to

populate our homes, offices and neighborhoods with billions of tiny transmitters/receivers

slide-89
SLIDE 89

What went wrong?

  • Without really thinking about it, we are going to

populate our homes, offices and neighborhoods with billions of tiny transmitters/receivers

  • These new IoT devices have ad-hoc networking

capabilities built in, which has the potential to create a new communication medium, in addition to the traditional mediums of telephony and the internet

slide-90
SLIDE 90

More information and videos

Paper site - iotworm.eyalro.net Eyal Ronen - eyalro.net Colin O’Flynn - colinoflynn.com

slide-91
SLIDE 91
slide-92
SLIDE 92