4 ms·

How does a hack like this work? Is the device somehow connected to the Internet, the attackers take over the device, then since that device has access to the ca

How does a hack like this work? Is the device somehow connected to the Internet, the attackers take over the device, then since that device has access to the casino network, the attackers could then see anything that wasn't secured on the network?(basically anything that relied on the network being secure for their security?)

codyb 9y ago
That was my guess as someone who has worked places where database access is restricted to a whitelisted set of ips that includes the internal network. Take over the thermometer and you can send requests to the database as a whitelisted ip.
blincoln 9y ago
I don't know exactly what happened in this case, because they're not sharing details, but I've done similar things in a lot of pen tests. Your assumption is pretty accurate. Whatever internet-facing device is compromised is then used as a gateway onto the internal network, and a conduit for getting data back out if necessary. With access to the internal network, it's usually much easier to find things like systems with default/weak passwords, exploitable services, and so on. It usually takes a couple of steps, like hopping from the initial system onto something that has interesting credentials stored/cached on it, and from there on to the things that are actually of interest. Every once in awhile, I'm lucky, and the initial point of compromise has super-privileged credentials on it, but that just makes things easier.
codedokode 9y ago
If vendor's website has a vulnerability like CSRF (which are very common because browsers allow cross-domain GET/POST requests by default and developers often don't realise they should block such requests) then the attacker can gain control over IoT device if they make an employee visit their page.
sooper 9y ago
While not exactly the same, this write-up does give an example of the steps invovled: https://docs.google.com/document/d/1XWzlOOuoTE7DUK60qTk1Wz1VNhbPaHqKEzyxPfyW4GQ/edit# https://docs.google.com/document/d/1XWzlOOuoTE7DUK60qTk1Wz1V...

codyb 9y ago

That was my guess as someone who has worked places where database access is restricted to a whitelisted set of ips that includes the internal network. Take over the thermometer and you can send requests to the database as a whitelisted ip.

blincoln 9y ago

I don't know exactly what happened in this case, because they're not sharing details, but I've done similar things in a lot of pen tests. Your assumption is pretty accurate. Whatever internet-facing device is compromised is then used as a gateway onto the internal network, and a conduit for getting data back out if necessary. With access to the internal network, it's usually much easier to find things like systems with default/weak passwords, exploitable services, and so on. It usually takes a couple of steps, like hopping from the initial system onto something that has interesting credentials stored/cached on it, and from there on to the things that are actually of interest. Every once in awhile, I'm lucky, and the initial point of compromise has super-privileged credentials on it, but that just makes things easier.

codedokode 9y ago

If vendor's website has a vulnerability like CSRF (which are very common because browsers allow cross-domain GET/POST requests by default and developers often don't realise they should block such requests) then the attacker can gain control over IoT device if they make an employee visit their page.

sooper 9y ago

While not exactly the same, this write-up does give an example of the steps invovled: https://docs.google.com/document/d/1XWzlOOuoTE7DUK60qTk1Wz1VNhbPaHqKEzyxPfyW4GQ/edit# https://docs.google.com/document/d/1XWzlOOuoTE7DUK60qTk1Wz1V...