the connected world has been disconnected: survival · pdf fileproof-of-concept....

SESSION ID:SESSION ID:

#RSAC

Denis Makrushin

The Connected World has been disconnected: Survival Guide in IoThreats Era

SBX2-W5

Security ResearcherKaspersky Lab@difezza

Presenter’s Company

Logo – replace or

delete on master slide

#RSAC

Internet-of-Things or Internet-of-Threats?

3


Logo – replace or


#RSAC

You a Hero. And it’s not a Game.

4


Logo – replace or


#RSAC

My home is my castle, isn’t it?

5


Logo – replace or


#RSAC

My home is my castle, isn’t it? Show me.

6

Nope: “port:554 has_screenshot:true”


Logo – replace or


#RSAC

The cup of Smart Coffee

7


Logo – replace or


#RSAC

Cyber Jungle start right here: BMS

8


Logo – replace or


#RSAC

9

If you're going to San Franciscoooo…oops


Logo – replace or


#RSAC

10

Public terminals vulnerability assessment

PROOF-OF-CONCEPT


Logo – replace or


#RSAC

Parking terminal: the full screen app

12

The Full Screen Application contains

Google Widget without any

customization.

Let’s try to escape.


Logo – replace or


#RSAC

How did you do it, David Blaine?!

13

The Street Magic baby:

1) Browser Properties

2) Control Panel

3) Virtual Keyboard

4) whoami :)


Logo – replace or


#RSAC

Keep calm and save the World!

14

Developer/Administrator:

Customize all third-party components

Don’t use Administrative privileges

Restrict access to Internet

Default Deny all non-whitelisted

User

Run from the terminal! Don’t trust the public device.

Anyway don’t input your personal/payment data

Found a bug? Send the report.

#RSAC

The End. Thank you!

https://twitter.com/difezzahttps://[email protected]


Logo – replace or


#RSAC

One month later

16


Logo – replace or


#RSAC

Post-exploitation scenario

17

1) Application dump with Client’s data and transaction

logs

2) Social Engineering (phishing, advertising,

“Congrats, you’ve won the money, send us a SMS…”)

3) Botnet for DDoS-attacks, bitcoin mining,

extraterrestrial civilizations search


Logo – replace or


#RSAC

A little more smart touch

18


Logo – replace or


#RSAC

A little more smart touch… worldwide!

19


Logo – replace or


#RSAC

A little more smart touch… worldwide! (video-demo)

20


Logo – replace or


#RSAC

How to live with that

21

Developer/Administrator, think out of the box:




User

Run from the terminal! Don’t trust the public device.


Found a bug? Send the report.


Logo – replace or


#RSAC

Getting the road devices’ data

22


Logo – replace or


#RSAC

“Somebody’s watchin’ me” (c) traffic cameras

23

1) Traffic volume data

2) Car patterns data

3) Geo Location


Logo – replace or


#RSAC


24

Developer/Administrator:Encrypt all wireless connections




User:Found a bug? Send the report. (In the case, if this is interactive device)



Logo – replace or


#RSAC

Connected Medicine

25

DiagnosticDevice #2 (CT)

DiagnosticDevice #1 (MR)

DiagnosticDevice #3 (Cardiograph)


Logo – replace or


#RSAC

26

“DICOM port:104”. Show me.


Logo – replace or


#RSAC

27

“DICOM port:104” returned 1,344 results


Logo – replace or


#RSAC

28

Information for Targeted Attack

“medical port:445”

Reconnaissance stage for targeted attack against medical institute provides answers for

the questions:1. What host in the medical

infrastructure is most interesting?

2. What hotspot could be an entry point to sensitive data?


Logo – replace or


#RSAC

29

Where PACS is, there patient’s data is


Logo – replace or


#RSAC

30

PACS front-end as an entry point

It shouldn’t be online, but:

1) It is

2) It has public vulnerabilities

3) It’s open for everyone


Logo – replace or


#RSAC

31

What about medical device?

There are two types of medical devices

Very ExpensiveExpensiveHOST-ORIENTED

CONNECTIONNETWORK-ORIENTED

CONNECTION


Logo – replace or


#RSAC

32

No Ethernet port - no problems, right?

NOPE:

1. Compromised perimeter still contains medical workstations…

2. It has vulnerabilities and backdoors

3. And it has special medical software and drivers


Logo – replace or


#RSAC

33

What adversary can do with Analyzer.exe*

Steal all medical information received from the device

Spoof all medical information received from the device

Change the operating parameters (for ransom purposes?), that would entail a costly calibration procedures

Analyzer.exe* is a software for a diagnostic medical device

Notify you and help you to fix the issues ;)


Logo – replace or


#RSAC

34


Developer/Administrator:

Don’t store data on medical device and organize easy restore point of the software (ransomware mitigation)

Isolate all medical data storages (DICOM-devices, PACS/NAS/FTP-servers, even DICOM-viewers) in a separate segment

Backup, encrypt, backup…

User:

Be healthy.


Logo – replace or


#RSAC

35

We still have a “human factor”

#RSAC

Keep calm and save the World!Thank you!https://twitter.com/difezzahttps://[email protected]

the connected world has been disconnected: survival · pdf fileproof-of-concept....

Documents