Living in a fool’s wireless - secured paradise Stefan Kiese
Topics • Wireless (consumer) alarm systems • Hardware • Software • Hacking it ;) 2015/10/02 Stefan Kiese 2
About me • Security Analyst @ ERNW • Heidelberg, Germany • Interested in hardware hacking, SDR, IoT • Beard ;) www.ernw.de • Twitter: @net0SKi www.troopers.de www.insinuator.net 2015/10/02 Stefan Kiese 3
Wireless (consumer) alarm systems • Cheap ($10 - $250) • Easy to get • Easy to install • WIRELESS • Mostly, you get what you pay for 2015/10/02 Stefan Kiese 4
Hardware Tools 2015/10/02 Stefan Kiese 5
SDR: Logic Analyzer: HackRF One Intronix LogicPort LA1034 Yardstick One All-rounder: Scope: JTAGulator Tektronix MSO2012B Bus Pirate Pix ‘ sources: HackRF+YS, greatscottgadgets.com LogicPort, pctestinstruments.com MSO2012B, tek.com JTAGulator, jtagulator.com Bus Pirate v3, dangerousprototypes.com 2015/10/02 Stefan Kiese 6
Software Tools 2015/10/02 Stefan Kiese 7
GNU Radio Companion: Other useful tools: • E.g. minicom (for use of JTAGulator and BP) • Sigrok or other LA-soft • Baudline • Rfcat • Python Audacity: 2015/10/02 Stefan Kiese 8
Usual attack vectors • Hardware: • Over the air: • • UART (Debug info, Wifi console) • Bluetooth • SPI (e.g. r/w EEPROM) • Proprietary protocols • JTAG (e.g. r/w flash, reprogram µC) • I²C (e.g. comm. w/ components) 2015/10/02 Stefan Kiese 9
Comparison of the alarm systems AS 1 AS 2 AS 3 • Many • JTAG + UART • No interfaces unidentified exposed as TP exposed TPs exposed • Also simple • Rolling Code • Simple implemented record&replay record&replay • Costs also • EEPROM • Costs about about $100 • Costs about $100 $60 2015/10/02 Stefan Kiese 10
Alarm system 1 Loooong transmissions … 2015/10/02 Stefan Kiese 11
Alarm system 1 1. Let‘s start with a simple 3. „ Synthesizing “ signal in record&replay attack GNU Radio successful successful 2. Trying to regain the RF 4. Manipulating messages transmission unsuccessful 288 Bits x 90, Manchester encoded 2015/10/02 Stefan Kiese 12
2015/10/02 Stefan Kiese 13
2015/10/02 Stefan Kiese 14
Alarm system 2 You shouldn‘t be allowed to issue this CMD, dude! 2015/10/02 Stefan Kiese 15
Alarm system 2 1. Record&replay again … 3. JTAGulating UART successful 2 UARTs exposed, no „valid“ output on 2. Motion Detector is common baudrates allowed to disarm the base 4. JTAGulating JTAG Just bruteforce the unsuccessful Device ID 2015/10/02 Stefan Kiese 16
2015/10/02 Stefan Kiese 17
Alarm system 3 Keep on rollin ‘, baby! 2015/10/02 Stefan Kiese 18
Alarm system 3 1. Record&replay again … 3. Some interesting unlabelled ICs on PCB unsuccessful acc. to russian board 2. Trying to regain the RF one for signal horn transmission 4. EEPROM 65 bits x 6, two- parted Rolling Code Connected to µC via SPI; no results yet 2015/10/02 Stefan Kiese 19
2015/10/02 Stefan Kiese 20
What could vendors do better? • Use Rolling Code • Use anti-tampering techniques • Remove IDs from ICs • Send keep-alive packets • Use two-way communication • Use encryption • Be aware of the comm. protocols 2015/10/02 Stefan Kiese 21
Any questions? 2015/10/02 Stefan Kiese 22
Thanks for your … … and have a nice day! 2015/10/02 Stefan Kiese 23
Recommend
More recommend
