Is Security on Your Nerves?
summary
A Raspberry Pi 3 running Nerves controls a physical stoplight and pairs to an iPad app over HTTP; initial demo shows plaintext credentials captured and state flipped via a man‑in‑the‑middle (Charles proxy, curl, even an SSL kill switch on a jailbroken iPad). HTTPS hides Eve but not Mallory, so the solution is application‑level authenticated key exchange: Raspberry Pi 3 running Nerves with Elixir and Cowboy, replaced pairing with SRP‑based sRPC with mutual authentication, which successfully prevents replay and MITM in the demo.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:36Scenario
- 2:09System Overview
- 8:52HTTP Issues
- 9:49Add Security
- 15:25HTTPS Issues
- 16:09Diffie-Hellman
- 20:14RSA (simplified)
- 25:45Structure
- 27:53Man-in-the-Middle
- 29:54CIA Document
- 33:27SRP (simplified)
- 37:15SRP & ALS
- 42:46Key Exchange Options
related talks
36mHTTPS Is Not Enough
21mSecurity is Everyone's Responsibility
40mKeeping secrets in your opponent's hands
46mPrivacy, Security, Convenience; when it comes to home automation, can we pick all three?
50mBreaking Payment Points of Interaction (POI)
22mKeynote: Hacking is Child’s Play, Literally!
37mSecurityPI: IronClad your Raspberry PI
23mProtecting Sensitive Data in Web Apps