7 ms·
Casino high-roller database stolen through a thermometer in the lobby fish tank
- leonroy 9y agoYou’d think these companies would use VLANs or at a minimum a router or layer 3 switch to segregate camera, critical services and fish tank IoT network traffic.
- logicallee 9y ago>You’d think these companies would use VLANs or at a minimum a router or layer 3 switch You assume way too much. I bet half the fish in that tank never even got a background check
- mysterypie 9y agoThe original source[1] claims that the casino did take some precautions (a VPN) but still doesn't clearly explain how the failure occurred: "A North American casino recently installed a high-tech fish tank as a new attraction, with advanced sensors that automatically regulate temperature, salinity, and feeding schedules. To ensure these communications remained separate from the commercial network, the casino configured the tank to use an individual VPN to isolate the tank's data. However, as soon as Darktrace was installed, it identified anomalous data transfers from the fish tank to a rare external destination. Communications took place on a protocol normally associated with audio and video." [1] https://www.darktrace.com/resources/wp-global-threat-report-2017.pdf https://www.darktrace.com/resources/wp-global-threat-report-...
- fjsolwmv 9y agoNote that the "source" here is an ad for an "AI-enhanced" network monitor. There's no information to vet their claims, and a little weird that their client would happily subject themselves to public embarassment like that.
- Spooky23 9y agoThey problably do. Sounds like in this case the thermometer was able to hit a phone or videoconferencing network.
- closeparen 9y agoRegulation to try to prevent weak links in a still perimeter-security-based design is hopeless. We need to stop substituting network of origin for real authentication and authorization systems.
- hueving 9y agoBut don't go too far and substitute authentication for network isolation. Vulnerabilities are a thing.
- behringer 9y agoNo kidding, who puts a valuable database on the same network as their HVAC system? The sysadmin should be fired.
- konschubert 9y agoAND that database presumably wasn't password protected?
- y0ghur7_xxx 9y ago> But don't go too far and substitute authentication for network isolation. Vulnerabilities are a thing. I don't know if I still agree with this. One of my most important and private services is exposed on the web - the most untrusted network on the planet - and it's using application layer authentication, and no network isolation. I don't need a vpn to get access to my gmail, my web banking or my nextcloud instance. I can access all those services over the most untrusted network of the world with a username and a password (and maybe a second factor auth token). I think network layer isolation is overvalued. In the end, you still have to secure all your local lan resources anyway, because trusting your lan clients is never a good idea. So if your lan is untrusted like the wan network, and you secure all your stuff in your lan like you would secure them if they where exposed on the internet, there is no need for network level isolation at this point. Sure, it's an other layer of security and all that, but that comes with a high cost, that not always is worth paying for.
- greglindahl 9y agoI have a friend who works in a casino, and the industry standard is to put untrusted devices on a segregated network. Even trusted devices are segregated by vendor.
- icefox 9y agoIt would be nice if at home routers made this easy to do too
- StavrosK 9y agoTomato makes this very easy. I've set up an "untrusted" network, devices in which can't connect anywhere, neither to local nor to remote machines (only I can connect to them).
- wil421 9y agoYou can get Home routers that setup VLAN. Ubiquiti Edge Routers will do almost anything you need to do.
- flyinghamster 9y agoI have one of those (but no Internet of Shit devices to segregate). Still, it's nice to know I can do so if I need to. Unfortunately, all is not rainbows and unicorns. Ubiquiti's GUI doesn't treat IPv6 as a first-class citizen; if you want IPv6 you need to head for the CLI and hope you hit upon the right recipe to enable it for your provider - and make sure you set up your firewall rules to only open IPv6 addresses/ports you want open.
- danesparza 9y agoThis is also a feature on Pfsense, or just about any high end router, switch, or firewall. The article asserts, "It expands the attack surface and most of this isn't covered by traditional defenses", which is bogus. It's just another device that doesn't need to be on the same network as critical services.
- itakedrugs 9y ago
- woliveirajr 9y agoOld news: this is from 2017 [0] It's just that the attack was part of a new article, and the headline used it to make it sexy. [0] https://www.forbes.com/sites/leemathews/2017/07/27/criminals-hacked-a-fish-tank-to-steal-data-from-a-casino/ https://www.forbes.com/sites/leemathews/2017/07/27/criminals...
- mysterypie 9y agoI studied the photo to see if I could spot the Internet-connected thermometer, and then finally noticed that the caption said "Ethan Miller/Getty Images", and only after that saw that it also said, "An aquarium at a casino — not the one in question." Forbes who wrote an earlier story did the same thing, but with a Shutterstock photo[1]. At least the original source of the story (the cyber defense company) used an illustration so it was obvious that it wasn't the real thing[2]. [1] https://www.forbes.com/sites/leemathews/2017/07/27/criminals-hacked-a-fish-tank-to-steal-data-from-a-casino/ https://www.forbes.com/sites/leemathews/2017/07/27/criminals... [2] https://www.darktrace.com/resources/wp-global-threat-report-2017.pdf https://www.darktrace.com/resources/wp-global-threat-report-... (see page 8)
- shaunol 9y agoAt this point I wouldn't be surprised if the high roller database itself were stored on its own IoT device linked to some "high roller analysis as a service" platform.
- 21 9y agoOr maybe just in an unpassworded MongoDB instance somewhere in Amazon, because agile.
- DubiousPusher 9y agoCongratulations! We are happy to present you with this year's award for most appropriatly cynical comment about computer security. You may choose a one time use "you don't know what you're talking about" card that let's you bypass pedantic password requirements for any major website. Or there is a lovely little token you may spend to tell off anyone who asks for your social security number without actually needing it, free of any consequences. Note: telling off may include any applicable expletives.
- IncRnd 9y agoMaybe the fish tank shouldn't be on the same network as high value assets. That way, vending machines could be accessed by the fish tank but not the mission critical data.
- freeloop10 9y agoIt's likely that was the protocol, but it wasn't followed. It usually comes down to actions of a Pointy Haired Boss rather than some glaringly obvious hole in their security plan.
- deleted 9y ago[deleted]
- matte_black 9y agoHow do you verify a database you stole isn’t a decoy with dummy data?
- RandallBrown 9y agoHow does a hack like this work? Is the device somehow connected to the Internet, the attackers take over the device, then since that device has access to the casino network, the attackers could then see anything that wasn't secured on the network?(basically anything that relied on the network being secure for their security?)
- codyb 9y agoThat was my guess as someone who has worked places where database access is restricted to a whitelisted set of ips that includes the internal network. Take over the thermometer and you can send requests to the database as a whitelisted ip.
- blincoln 9y agoI don't know exactly what happened in this case, because they're not sharing details, but I've done similar things in a lot of pen tests. Your assumption is pretty accurate. Whatever internet-facing device is compromised is then used as a gateway onto the internal network, and a conduit for getting data back out if necessary. With access to the internal network, it's usually much easier to find things like systems with default/weak passwords, exploitable services, and so on. It usually takes a couple of steps, like hopping from the initial system onto something that has interesting credentials stored/cached on it, and from there on to the things that are actually of interest. Every once in awhile, I'm lucky, and the initial point of compromise has super-privileged credentials on it, but that just makes things easier.
- codedokode 9y agoIf vendor's website has a vulnerability like CSRF (which are very common because browsers allow cross-domain GET/POST requests by default and developers often don't realise they should block such requests) then the attacker can gain control over IoT device if they make an employee visit their page.
- sooper 9y agoWhile not exactly the same, this write-up does give an example of the steps invovled: https://docs.google.com/document/d/1XWzlOOuoTE7DUK60qTk1Wz1VNhbPaHqKEzyxPfyW4GQ/edit# https://docs.google.com/document/d/1XWzlOOuoTE7DUK60qTk1Wz1V...
- codedokode 9y agoWhat the article doesn't mention: IoT devices are harmful not only because they are vulnerable. They can be used to collect data on users. Every enterprise aims to get as much profit as possible; collecting users' data and selling them later obviously gets you more profit than not collecting. Why would a thermometer need to connect to the Internet in the first place? It is absolutely unnecessary. The software could be installed on a server in a local network or even inside the thermometer itself. I think the reason why these devices require an Internet connection is that vendors just want to lock user to their servers and collect "anonymous statistics" from them.
- zdragnar 9y agoIt could just be ease of maintenance; if a server on AWS goes down, you can fix it from anywhere, or fall back on blaming Amazon. If an on-site server goes down, odds are you might need to go on site, especially if the whole thing is separated from the internet to avoid leaking "anonymous statistics."
- codedokode 9y agoThose IoT devices are getting more and more computing power. They can run the server software (like Web UI) on the device itself. For example, they can serve static SPA that would connect back to the device via Websocket. So you don't need a sophisticated web server and can do most computations in a browser.
- jjeaff 9y agoBut then it can either only be accessed within the same subnet, or you are going to have to do some port forwarding. Which is too much to ask for 99% of users.
- zdragnar 9y agoIt's not terribly useful for each fish tank thermometer (or whatever) to run its own server and webui, since what you're probably interested in is "are all of my things behaving as expected". Having that data be centralized- on site or off- is where a web UI can be most useful. A friend of mine rolled his own version of this for his house, helping him optimize how the furnace / ac units operate, etc. It would've been way more painful to go to each devices UI individually.
- ohNoesCasinos 9y agoBut, like, seriously. Fuck casinos. Fuck 'em right in the ear.
- bitwize 9y agoRight now /r/movies is having a laugh about a scene from Rampage where a character hacks a corporate network through a thermostat. Much as I love a good chuckle at "Hollywood hacking", this is a thing that can actually happen.
- abricot 9y agoI think the big difference between reality and a lot of Hollywood hacking is 1. the time it takes 2. how elaborate it always have to be 3. the fact that during the initial exploration they would most likely find an even easier point of attack.
- advaitruia 9y agoThis is such a clickbait article. It doesnt mention any details of how the data was actually stolen using the thermometer. It doesnt even explicitly say that the thermometer was an IOT device. "Hacked through a thermometer" could mean so many things
- gruzh 9y ago"S" in "IoT" is for Security
- sbassi 9y agowhat is a high-roller database?