hello everyone and welcome to my talk
with this pretty long title
my name is alexey and here are just a
few things to introduce myself
i'm an ex-software developer who is now
a full-time application security
engineer
and these acronyms but for what it's
worth i don't consider myself to be a
hardware hacker and today i'm going to
talk to you about hacking
devices so let's dive in a common
perception
is that application security and
internet of things
are two separate domains but is this
really the case
consider these two examples on the left
hand side i
have a classic web application displayed
in the browser
and on the right hand side i am looking
at web ui
from my home router but from the user's
perspective
these two are actually the same there's
some code that runs in the browser
and there's some code that runs on the
server side
and who cares where the server is
in terms of requirements in order to run
an application or a device
we need a processor and memory we need
some network so we can send and receive
data
we need our operating system and
commonly these days devices run linux
just like many other servers in the
cloud
we might need some services that will
help us do whatever we need to do
and libraries that we can build upon and
programming language that we can use
to write custom software and software
developers
who use programming language and
libraries to create
great things that will run and do
whatever
we need them to do in terms of security
many of us
are familiar with a wasp top 10 which is
the list of the top 10 security risks in
the web applications
and also a couple years ago was
published at iit top 10 and although
these two lists are not exactly the same
there is some correlation like broken
authentication and hard-coded passwords
and components with outdated components
with no vulnerabilities
and data exposure because of insecure
data transfer
and some insecure defaults and so on
but i'd like to focus on just couple of
things on the right side
hand side the number two in iot top 10
refers to software that runs on the
device itself
and number three refers to the software
that runs elsewhere but it's part of the
ecosystem so so the device could
function and do
useful things and as software these two
things can have any
of these awas top 10 issues and more
so in reality in my opinion a proper
diagram should look like this
and i know some of my absec friends and
colleagues
are not going to like it but i think
this is
the case at least from the attacker's
perspective
one can attack a device either through
an application that runs on it
or through some other vectors
okay who remembers march 2020 of course
we all do
that's when many businesses all over the
world started
closing their doors because of the
global pandemic and many
organizations and companies had to make
very quick changes
to go online and some of these
organizations decided to try this new
thing for them
that was live streaming so
they could broadcast whatever they
needed to broadcast
and stay connected with their users
and i volunteered to help one non-profit
organization
set up live streaming but
first of all let's discuss what live
streaming is in a nutshell
basically you have your video stream and
audio stream
in some digital form and what many
people do is they build a general
purpose computer with
certain software on it very popular one
is obs studio
and this software just converts you know
those streams to proper format
um like h.264 and sends
that stream to one of many of these
services in the cloud
so that's what i initially built but the
people at that nonprofit organization
are not very technically savvy
and this computer was kind of a weak
spot you know
it requires requires maintenance it
requires somebody to operate it
and so on so i asked myself a question
is it possible to replace this computer
with something else that maintenance
free
and the answer is yes i did some
research and i found
that there are these hardware hdmi
encoders that are not very expensive
and i went ahead and bought one and came
in it had hdmi port audio port
and lan connectivity and it had this
nice web interface where i could set up
different video settings and also
specify this url
for the youtube ingest server that i
wanted to stream to
and everything worked beautifully like a
charm
and this was uh actually the final setup
that i built here's my audio mixer and
bunch of cables
and this little box here with the red
light
is that is that video encoder
and it worked great like i said and
everybody was happy and that's the end
of
this presentation no not really i
quickly realized that
i was missing some settings in the
device and
in particular my camera that i was using
did not
had a very did not have a very good
automatic color balance
so i was wondering if it's possible to
modify balance on the device and i
looked in the advanced settings and
although there was a lot of them
and nothing documented i couldn't find
the color balance settings so i thought
okay maybe
this device has some hidden
functionality that is not exposed
through the ui um now let me
look inside so i opened the
box and i looked at this circuit board
and
it didn't say anywhere plug here for
a free shell so i just closed it again
i'm not a hardware hacker i don't know
what to do with this generally speaking
so i decided to approach this as
a software server so i quickly ran and
the port scan and it found you know http
server rtsp and rtmp are the video
streaming services that you can use from
the device itself
it also had open telnet port
um i tried a few obvious passwords like
root root admin admin
and none of them worked all right
i also you know explored that web ui a
little more and there was a
a section for firmware upgrade and not
only it had firmware upgrade it also had
firmware backup and when i pushed on
this button
it sent me this rar file which is an
archive and i placed it on my disk
and i unpacked it and extracted a bunch
of files
this raw archive was made on windows 32
doesn't matter and here's the here's the
content
it had some configuration files some
libraries nginx server
the web directory had a bunch of
static files like html and css and
javascript
it had some common utilities
it also had password file but the
largest file
in this firmware is this one box.v400
underscore hdmi
and this file happens to be and
a compiled executable and i thought well
um
if nothing else matches that this is
probably the one
that actually runs on the device and
controls everything
and i was right but first i need to get
on shell to get a shell
so the question is how do i get there so
i looked at this password file that was
in the firmware backup
and it had a one-way hash
and i tried to crack it i i used some
simple password lists but i couldn't
find a match quickly
and i thought well that's not actually a
problem because what i can do
is i can replace this password file with
my own password file
and upload the new firmware and have
my own password to log into the device
and that's exactly what i did i used
openssl pro
utility to generate hash for password
root
i used windows rar utility to
repackage the firmware i uploaded it to
the device
rebooted it and beautiful thing i
am in on the device as
root by the way great now that i'm on
the device as a super user i can do a
lot of recon
so i looked at like for example what
linux version it runs
and it runs the linux from high silicon
high silicon happens to be a subsidiary
of huawei that specialize on video
surveillance devices and system and
chips
like ip cameras and different kinds of
like video processing equipment
and they have their own linux
distribution i also looked at open ports
nor surprises here the same ports that i
saw with nmap
but most of these ports are owned by
this box executable which confirms that
this
is actually the workhorse that kind of
does everything
i also looked at the processes and i
quickly reverse engineered the boot
sequence
that started couple of scripts and then
at the very end this last step it
started this
box executable so i wanted to have like
a
like a clean device when i log in
without this application
running so i modified the boot so this
application doesn't run so i could run
it myself and play with it and let me
show you how it looks
so here is the um oh by the way i need
to connect it first
so here's one of these devices that i
acquired it's not the original one
um i had several of these and here is
the inside pretty pretty neat
but i don't really need it i just need
to connect ethernet port
ethernet cable sorry and give it some
power
lights up it's going to take a few
seconds to boot i'm going to put it
aside because we don't need to touch it
anymore
um and let me try to tell that
okay it booted
i'm in now i go to tmp directory where
this box executable lives after
after the boot so not only can i start
this application
on the console it also prints a lot of
useful information on the console for
which is very helpful for
for debugging okay what else do we need
okay let me go to the browser
and go to this encoder
of course i need to provide my
credentials
and i'm in and i see that it spit out a
lot of
information in the console
here is the web interface um cool
what else do i need i would like to see
all the requests and responses
going between back and forth between the
browser and the device
and so i'm used to burp suite
this is a tool to intercept http
requests
so that's what i used here and here is
one of such requests
to get the the root page
which just returns some html but you can
see that it's using
a certain authentication scheme which is
called digest authentication
uh keep that in mind and
yeah i can also run curl against it
but curl did not return anything so let
me look at the headers that i returned
and it actually says unauthorized of
course because i did not provide my
credentials for the current command
so we'll do it later now
let me go back to the slides
okay now that i have console i'm on the
device i also want to take a look at
this
executable and it's binary and binary is
not very easy to work with
so we need to reverse engineer it and
this tool
came out was released by nsa a couple
years ago
and i wanted to give it a try since then
and i thought this was a perfect
opportunity for that
so i got this tool called kidra
i ran it i gave it that executable file
it analyzed it and it showed me
disassembly and on the right hand side
it shows you
the decompile which is basically
some c code and um
it's it's a lot easier to read than
assembly
so you can make a lot more sense out of
it
okay
and by this time i was no longer
interested in
modifying settings on the device some
voice inside me told me that i should
look for vulnerabilities and i have no
idea how i got there
but yeah i started looking for those
vulnerabilities and the first issue i
found
was a backdoor in the application i
decided to
start attacking it through
authentication function
since i knew that the authentication was
using
admin for the username and you could not
change it it must have been hard coded
and it was not in any configuration file
so i
did a string search in gibra and i found
exactly one occurrence of string
admin and it's referenced in several
in a couple of functions and one of them
is here and it does look
like the authentication so we compare a
parameter against
admin and then we compare the second
parameter against
a string and this string looks really
strange
what is this and it immediately looked
at me
as and said hey i'm the back door
so first of all let me rename this
function to box authenticate that's what
gitra
lets you do by the way it's very useful
you can refactor on the fly
so um we first compare uh the password
to new
new orange and bunch of eights and then
if if there's no mag if it
if there's a match we succeed and return
if
no if not then we compare it to the real
password um to confirm my assumptions i
entered this password in the browser and
it didn't work
and i thought okay that's interesting it
should work right here
i also noticed when i was looking at the
admin string
in the data section there was another
string called basic
and i thought maybe this application
also supports basic authentication
um and my assumption was right i did
a little bit more investigation and
i was able to use basic authentication
like with this curl command great so now
what if i try this password with basic
authentication
and it worked cool so it's definitely
backdoor
now i just got some html but it's not
very helpful
another function that i could launch
is called get sys getsys returns a bunch
of
system parameters including the plain
text
password and you can just take this
password and use it in the browser
and get into the device as administrator
so that's a big issue another big issue
is on some devices the same password new
orange and much of aids
can be used to telnet into the device
on other devices it's a different
password or rather
a couple others which are also pretty
trivial
so that's another kind of like a back
door into the device
the next serious issue that i found was
path traversal that could be used to get
any file from the system
let's take a look at where this box
authenticator is called from and it's
called from
this particular function that i renamed
to process request because i realized
that it was actually processing all the
http requests
and in this function we see this huge
if statement that mentions these
file extensions basically it compares
the string
against um it searches for these
extensions in the string
so it it does file matching um
and if you follow the logic you'll
realize that if
if if a file matches one of these
extensions
then it would be served without
authentication so let's give it a try
i'm gonna go back to burp suite and pick
a file
send it to repeater
and first of all let me remove all the
unnecessary headers
just to make it look cleaner and it
still has the authorization header
so it's authenticated now let me remove
the authorization header
and resend it and it still works great
but it's a static file there's nothing
really wrong with that
it's not a secret uh of information of
any kind
but in on the console when it reported
the file name i also noticed this double
slashes
which suggested that the developer was
using some kind of a sloppy string
concatenation so i decided to play with
this a little bit
like removing the slash and the slash
disappeared from here
so it looks like the this input is just
concatenated
with tmp slash web or whatever
which means we can do things like
traversing so we can build a relative
path that would return us the same
result so we can go all the way back to
tmp slash tmp
slash web yeah now can i get something
more interesting like the password file
no i cannot i get 401 unauthorized and
that's because
password file does not match one of
these extensions okay
let's take another look here and notice
that
they use the method find and method find
of the basic string
is looking for a substring anywhere in
the string not just at the end
so they're basically using the wrong
method which
means that if there is a one of these
substrings anywhere on the path
like say here it would match
so let me try this and instead of
unauthorized we get not found
because such file does not exist
well if only i had a directory with one
of these patterns in its name
then i could traverse from the directory
anywhere and get any file and
apparently on devices from one of these
vendors
there is such a directory so let me open
another
telnet session and look for
search for directory
with jpeg
and its name and here is such a
directory
and this is the only one that matches
now
using this i
can build a relative path
all the way back to the root and
descend down to any other file and now
if i take this
to my http request i should be able to
get any file from the system
and it totally worked i could get the
password file from the
uh from the system unauthenticated yeah
but it's not the most interesting file
on
this box the more interesting one is
called box.ini
which among other things contains
plain text administrative password which
you could use
and and then for for the
admin access on that device
let's continue playing with this device
or rather with this
application the next issue i identified
was unauthenticated file upload
that would lead to remote code execution
going back to gitra i decided to
just review the entire function that's
processing request to see if there's
anything else interesting
and right off the bat at the very top of
the function i saw this compare
against multi-part form data and again
if you follow the logic here we would
see that if there is a match
then the the the function would be
called that would process
multi-part data and just return http
okay
so yeah that looks like another
unauthenticated process
so i'm going to rename or refactor
this function to box multipart for
convenience
um cool now
where is form data used let me go back
to my burp history
and
search for multipart
there is a couple of post requests here
and the first one of them
is a logo upload here that's what i
tried
on the device what happens is on this
device you can upload a logo
that would be overlaid on top of your
video stream
it could be like maybe your company logo
right
let me let me try it real quick
upload successful and here is a message
and
on the console cool
now my suspicion is that this is
unauthenticated so i'm going to send it
to repeater again
uh and remove the authorization header
and press send and let's return http
20 200 okay okay well this is really
unauthenticated
um well cool you can upload logo and
do some harm but what else can you
upload and the other thing that you can
upload
is actually a firmware update believe it
or not
so the app.bin or updatrar is can also
be sent completely unauthenticated
so that's a pretty serious issue you can
basically create your malicious firmware
push it on
device without any credentials and have
it run it
now the problem is in order for this
firmware to
uh to run somebody needs to reboot the
device
and uh well like administrator pushing
that button in the web
web ui and that's not what something the
attacker would want attacker would want
to execute the code right away
let's take a look and see what else can
be uploaded
maybe there is more i see in on the
console this message
with file name column and i'm going to
go to my
favorite string search in gydra
and search for the string and it does
find
an occurrence of it and it's referenced
in this function
i'm going to call this function
box upload
because that's the function that
processes file upload as you can see
it's called from box multi-part which
in turn is called from box process
request all authenticated again
now if i when i scroll down
this function kind of looking at what's
interesting here i see
a list of these different compares we
see our
familiar load file bugs.ini and some
others
so this is basically a white list of
allowed file names
that uh one could upload to the device
and one of them
is uk.rar or uk.bin
and it's not the up.rar
not the original firmware upload upgrade
it's something else
so let me see where ukrar appears
in this executable and
it is mentioned in another place
that reads uh as
as soon as the file is uploaded to the
device
it's unpacked and then uk.txt
that's supposedly present in this file
gets executed by
shell so that's your uh in
instant code execution that we actually
need
so in other words we need to build a uk
that rar
with uk.txt inside that has some
malicious code
and that's what we're gonna do right now
so i have this
file uh uk.txt that has a single command
with netcat listener by the way netcat
is present on the device
on the device very convenient for a
hacker
okay and make sure i
use the correct raw command i need to
use the version to downgrade the
archive version okay now i have this
rar file and i'm gonna send it to the
device
using curl so i'm sending a curl command
which is a form with a single parameter
with content of this file
to encoder and executes the file gets
extracted
and ideally technically
i should have the process and i do have
the process that's running on the device
listening for incoming connections and i
can totally connect to it
and i'm a root on the device and i own
it
i can do whatever i want and that's
basically it
for this vulnerability now the device is
going to reboot automatically but that's
okay
going back to my presentation
but this is not all uh another distinct
issue with this file upload is command
injection
let's see what else happens there if we
go back to see
how ukr is processed you'll see that
it's not the only file that gets special
treatment
png files are also processed in a
certain way
we build a command to run this utility
to convert png to bmp
and one of the parameters here just
accepts user input which is the file
name
and this file name comes from the http
request
from here by some trial and error i
found out that this name has to begin
with logo and end with png
but it can have anything in between like
um
i don't know whatever including
semicolons
and if you put a semicolon here it
should become part of the command
that runs and execute it
and you'll see that foo is not found of
course it's not but what is found
on the device as we know is netcat
and we can totally execute it and now
if i look at the processes on the device
i'll see that my netcat listener
is here and alive and this is actually
the full command that got generated with
our
injected input and now again i can
connect to the device using netcat and
do whatever i want
up until now i was not looking for any
specific vulnerability
types i just happened to find some
backdoors and
injections and so on but there is a
certain category that i wanted to
specifically target
in this application with c and c plus
programs if you're not careful it's very
easy
to cause a buffer overflow and i thought
there must be at least one buffer
overflow
in this application and did i find one
well yeah i was looking
for functions like s printf which takes
input and combines it into a string and
puts the result into a buffer
with this kind of functions if you're
not checking all the length it's very
easy to get buffer overflow
and i found several occurrences of these
issues
and this is just one of them there is a
bunch
but in this particular case we are
dealing with
building a response for our tsp rtsp is
a video streaming protocol
so you basically connect can connect
your video player to this device and get
video right off the device it's a
text-based protocol just like http
and it's using a sequence number here
but in this case the device this
application does not really care about
the sequence number it just appends
whatever the user gives
to it and to back to the response and
reflects back to the user
let me show you how it looks since this
is a
text-based protocol i can just telnet
to proper port which happens to be 554.
i had to study this particle a little
bit
to build this proof of concept so this
is just one command
tear down and the sequence number is one
and i just get one but if i give it
anything else including any string
i will get that any string back
because buffer overflow i
built this request tear down command
with c sequence number of
with very long value but before i send
it to the device
i want to do something else when we are
debugging
stuff like buffer overflow it's very
helpful to have a debugger
and the beauty with linux is
you can use all the standard tools
including gdb
so i have uploaded a gdp server to this
device
and i'm going to run it it attached to
this the process of my application and
listening on port
2345 now
in another another window and i have to
copy and paste these commands because
they're pretty long
i'm starting my debugger on local
machine
after i started i need to connect to
that remote server
and i have all the nicely colored
information here
as you might have noticed i am not using
vanilla gdb i'm using jeff
extension and that's a pretty cool thing
to have if you're doing
reverse engineering
it just makes things a lot more easier
cool now i have debugger i can
see what's going on and i'm going to
send that
huge request to the application
and something happened here i got
segmentation violation
and as you can see those a's that were
in the sequence value
are placed all over the place across
multiple registers
so there's it's definitely buffer
overflow that that can cause
the application to malfunction and to go
different route
it definitely causes a crash so the big
question is
can i get code execution with this
because
because with many overflows you can and
i went into a very deep rabbit hole and
after several nights i concluded that it
was not possible in this case mostly
because of aslr
and at the time you get overflow the
application is very unstable and is
likely to just
reboot and or crash and you could not
try
multiple things to get around aslr
but if you combine this with the file
disclosure
you can get your base address to go
around aslr
through file disclosure so that's a
possibility
but even without that the sole purpose
of these devices
is to serve video reliably and if an
attacker can
crash it easily then
then that's a big issue um that's um
that's basically denial of service
in summary we have several
vulnerabilities that i'd like to put in
three categories
red green and yellow the two issues in
the red category
are the intentional vulnerabilities so
somebody actually programmed that back
door on purpose
and somebody decided to leave the telnet
open with a trivial password
this is not good and completely
unacceptable the issues in the green
category
are coding mistakes without any
malicious intent
we all make mistakes and that's okay
we just need to learn and don't repeat
those mistakes again
now this issue with unauthenticated
firmware
upgrade it is possible that it's a bad
coding
but it's also possible that it was there
on purpose
so the vendors could update firmware
without any credentials
i don't really know but these devices
are behind knight and firewall right
well hopefully most of them are but
showdown
finds almost a thousand of such devices
on the open internet
when i did my research initially about a
year ago
showdown found only between three to
four hundred of these
and now the number has tripled it's not
a huge number
but it is significant and many of these
devices could be
still vulnerable i decided to disclose
my findings
to vendors and i got all sorts of
interesting communication with them
from no response to some automated
response
to misunderstanding like somebody
telling me that their devices
are meant to be used by home users and
not security companies
and even some people thought that i was
trying to damage their company's
reputation
and they mentioned legal action against
me
and that's that was not something that i
was interested in
so i was pretty discouraged by this
and i talked to my ex-co-worker who had
some experience with third-party
disclosures and he
suggested that i get in touch with sword
coordination center
at carnegie mellon these guys help you
with third party disclos
with coordinated disclosures they do a
lot of leg work contacting the vendors
following up with them
um building you know publication and
everything so it was great
uh overall i identified 11 vendors
and i confirmed the three of them were
vulnerable i had those devices
and could test them eight others
were likely vulnerable based on the
information i could find online
unfortunately only two vendors responded
to
our initial requests um too sad but okay
meanwhile i i've got six cds assigned
and eventually
this got published couple days later
huawei
issued this statement saying that they
produce sdk
and chips and sdks and all user space
programs
are built by downstream vendors
meanwhile the register picked up the
story and published the article
and couple of weeks later one of the
bigger vendors for these devices opry
published this advisory and they
acknowledged all the issues and told the
said that they're going to fix them and
they also mentioned the name of the
developer for the application new orange
remember what the backdoor password was
right it was new orange and bunch of
ways totally makes sense
i also like how they use the word
maintenance instead of backdoor
of course it's all maintenance fast
forward to july 2021 i went ahead and
ordered a few of these devices
again to see if the issues have been
resolved i got
these encoders from three different
vendors this time the first one that
came in
was from jtag digital and it had the
telnet port closed
good but the application was not fixed
at all it still had all these
vulnerabilities
i went to the vendor's website and
downloaded firmware and it was still the
old one with all the issues
the two other vendors ura and icv
actually had the application fixed but
the telnet was open
with the trivial password i don't know
why they
decided to keep that open other vendors
i did some online research i did not
have the devices but i
downloaded some firmware where it was
available
some of that was fixed other still had
obvious issues
but it's difficult to tell how many uh
got the fixes out
and some of them didn't even have
anything for download
so it's a mixed bag but for the most
part i believe that
the developer for the software
new orange they address the issues it's
just a matter of pushing
those fixes downstream to all these
different vendors
takeaways from this presentation iot
devices are computers
and computers run applications and
many of us here know how to make
applications more secure how to find
vulnerabilities and address them
so let's do it because remember the
reality is this
you can apply your knowledge to other
areas and make the world
more secure
the complete write-up for this research
is available on my website
and also if you have any of these
devices and wanna do
run a quick test the exploit scripts are
on github and exploit db
i would love to hear from you whether
you like this presentation or not
if you have any questions or suggestions
or need help
please let me know i'll be happy to chat
thank you
very much for attending this talk and
good luck