Sabin POTÎRCĂ works as Technical Project Manager in the Experimental Research Unit at Bitdefender.

Remote Attacks against IoT

Most hacks against smart devices require either proximity or some other form of direct access (port forwarding/UPnP). That being said, what if devices could be hacked up to full remote code execution and root access without direct access and from the other side of the world? And what if the number of devices susceptible to this attack could be large enough to be the next big IoT botnet?
It’s already a well known fact that IoT is currently a gift that keeps on giving when it comes to producing security papers. You can blindly walk into a store, buy a device at random and in 2 weeks you’ll be exchanging emails with the manufacturer to plug their holes. Most hacks against smart devices require either proximity or some other form of direct access (port forwarding/UPnP).

That being said, what if devices could be hacked up to full remote code execution and root access without direct access and from the other side of the world ? And what if the number of devices susceptible to this attack could be large enough to be the next big IoT botnet ?

In this talk we’ll describe the methods and tools used in IoT vulnerability research and our findings on a very popular smart plug: breaking their so-called encryption to capture sensitive data, remote control of the plug and full remote code execution by exploiting the mobile app <-> cloud <-> smart plug synchronisation protocols. All this while the plug is “safely” in a home, behind NAT.

The talk will include

– An updated overview on the tragi-comic state of IoT

– Some stats from our honeypots

– Quick intro to the device and company in question

– Tools and methodology used during the research

– Demo on how trivial is to break their “encryption”

– Demo on full RCE from across the world

– Fun stuff from the present, after the manufacturer produced “a fix”