3 ms·

Can someone fill me in on this IOT hacking phenomenon. Surely the vast majority of devices sit behind a NATted router with a firewall on consumer premises, they

by drcross 10y ago

Can someone fill me in on this IOT hacking phenomenon. Surely the vast majority of devices sit behind a NATted router with a firewall on consumer premises, they don't have dedicated IPv4 addresses and don't touch the internet unless they are requested to (or already have a bad binary on install). How is this hacking happening?

s_q_b 10y ago
Generally the devices poke holes in the firewall with UPnP. There are also other vectors (ZeroConf, STUN, CWMP). The problem is that, once past the firewall, many of these devices have weak to no security, e.g. open telnet daemons, root:root default user/password, and other trivial vulnerabilities.
- rudolf0 10y ago
  The real confusing part is why this didn't happen earlier. Or, more likely, it did happen earlier but the attackers weren't properly weaponizing or "botkilling" / patching the devices?
  - s_q_b 10y ago
    There were some worms spreading through IoT devices, lots of foreshadowing. The Hajime and Mirai worms, combined with the utter lack of response, were a pretty good indication some shit was about to go down. I've been Cassandra yelling into the wind on this one for a while, so there is some schadenfreude involved for me.
gh02t 10y ago
Also consider the hubs. To take a well known example, Phillips Hue lightbulbs don't connect to the net directly and don't have any significant computational resources to speak of. They are just an 8-bit Atmel microprocessor with a Zigbee radio to talk to the hub ( https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-hue-led-lightbulb-with-zigbee-and-atmega2564-avr-iot-iotuesday/ https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-h... ). On the other hand, the Hue hub is running a full embedded Linux distro (which has even been rooted, though it requires physical access http://colinoflynn.com/2016/07/getting-root-on-philips-hue-bridge-2-0/ http://colinoflynn.com/2016/07/getting-root-on-philips-hue-b... ). A lot of the "real" smart home gadgets are using this model and they will gleefully punch a hole in you firewall, so it comes down to the security of the hub(s). From what I know, Mirai is mostly hitting stuff that isn't what I think of as IoT - stuff like routers, security cameras and DVRs. Seems like it's being misrepresented, though that's not to say that an attack on something more in line with what I think of as IoT/smart home isn't possible. I have no doubt that tons of refrigerators with Wifi and connected coffee makers are vulnerable. Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit ("Mirai" means "future" in Japanese).
- s_q_b 10y ago
  >Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit. I would wager that is correct. I certainly took it that way, especially after the source code dump. [0] That seemed to be almost out of frustration. [0] https://github.com/jgamblin/Mirai-Source-Code https://github.com/jgamblin/Mirai-Source-Code

by drcross 10y ago

s_q_b 10y ago

Generally the devices poke holes in the firewall with UPnP. There are also other vectors (ZeroConf, STUN, CWMP). The problem is that, once past the firewall, many of these devices have weak to no security, e.g. open telnet daemons, root:root default user/password, and other trivial vulnerabilities.

rudolf0 10y ago
The real confusing part is why this didn't happen earlier. Or, more likely, it did happen earlier but the attackers weren't properly weaponizing or "botkilling" / patching the devices?
- s_q_b 10y ago
  There were some worms spreading through IoT devices, lots of foreshadowing. The Hajime and Mirai worms, combined with the utter lack of response, were a pretty good indication some shit was about to go down. I've been Cassandra yelling into the wind on this one for a while, so there is some schadenfreude involved for me.

gh02t 10y ago

Also consider the hubs. To take a well known example, Phillips Hue lightbulbs don't connect to the net directly and don't have any significant computational resources to speak of. They are just an 8-bit Atmel microprocessor with a Zigbee radio to talk to the hub ( https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-hue-led-lightbulb-with-zigbee-and-atmega2564-avr-iot-iotuesday/ https://blog.adafruit.com/2016/06/14/teardown-of-a-philips-h... ). On the other hand, the Hue hub is running a full embedded Linux distro (which has even been rooted, though it requires physical access http://colinoflynn.com/2016/07/getting-root-on-philips-hue-bridge-2-0/ http://colinoflynn.com/2016/07/getting-root-on-philips-hue-b... ). A lot of the "real" smart home gadgets are using this model and they will gleefully punch a hole in you firewall, so it comes down to the security of the hub(s). From what I know, Mirai is mostly hitting stuff that isn't what I think of as IoT - stuff like routers, security cameras and DVRs. Seems like it's being misrepresented, though that's not to say that an attack on something more in line with what I think of as IoT/smart home isn't possible. I have no doubt that tons of refrigerators with Wifi and connected coffee makers are vulnerable. Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit ("Mirai" means "future" in Japanese).

s_q_b 10y ago
>Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit. I would wager that is correct. I certainly took it that way, especially after the source code dump. [0] That seemed to be almost out of frustration. [0] https://github.com/jgamblin/Mirai-Source-Code https://github.com/jgamblin/Mirai-Source-Code