Outside the box: pwning IoT devices through their applications
summary
Findings: unauthenticated firmware backup and unauthenticated firmware upload lets an attacker push uk.rar with uk.txt and gain a reverse shell via uk.rar; hardcoded maintenance/backdoor password exposes web and telnet login; unauthenticated multipart logo upload enables command injection via a png conversion utility; RTSP input triggers a stack buffer overflow causing denial of service; tools used: nmap, firmware unpacking, Ghidra, Burp, curl and netcat; disclosure yields six CVEs and reports on 11 affected vendors.
AI-written summary · about
chapters (32)
- 0:00Intro
- 0:32Common perception
- 1:35Requirements
- 2:10IoT Top 10
- 3:18The proper venn diagram
- 3:38March 2020
- 4:28What is live streaming
- 5:59Hardware encoder
- 7:20Fixing color balance
- 8:55Port scan
- 9:27Firmware backup
- 11:07Password file
- 11:48Password hash
- 13:50Demonstration
- 18:35Application Security Assessment
- 19:14Authentication
- 20:49Backdoor
- 22:35HTTP Request
- 23:06Code Review
- 25:55Find
- 28:20Multipart data
- 31:11File upload
- 34:06PNG upload
- 36:08Buffer overflow
- 36:57RTSP
- 38:06Denial of service
- 39:25Showdown
- 39:44Responsible disclosure
- 40:21Cert Coordination Center
- 41:19Huawei
- 42:18Ten months later
- 43:43Summary
related talks
39mNight of the living vulnerabilities
44mNight of the living vulnerabilities
32mCommon Attacks on IoT Devices
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
41mfirmWar: An Imminent Threat to the Foundation of Computing
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
44mExposing Critical Threats In Millions Of Connected Devices