Abusing the Internet of Things

Table of Contents

1. Foreword
2. Preface
   1. Who This Book Is For
   2. How to Use This Book
   3. Conventions Used in This Book
   4. Using Code Examples
   5. Safari® Books Online
   6. How to Contact Us
   7. Acknowledgments
3. 1. Lights Out—Hacking Wireless Lightbulbs to Cause Sustained Blackouts
   1. Why hue?
   2. Controlling Lights via the Website Interface
      1. Information Leakage
      2. Drive-by Blackouts
      3. Weak Password Complexity and Password Leaks
   3. Controlling Lights Using the iOS App
      1. Stealing the Token from a Mobile Device
      2. Malware Can Cause Perpetual Blackouts
   4. Changing Lightbulb State
   5. If This Then That (IFTTT)
   6. Conclusion
4. 2. Electronic Lock Picking—Abusing Door Locks to Compromise Physical Security
   1. Hotel Door Locks and Magnetic Stripes
      1. The Onity Door Lock
      2. The Magnetic Stripe
      3. The Programming Port
      4. Security Issues
      5. Vendor Response
   2. The Case of Z-Wave-Enabled Door Locks
      1. Z-Wave Protocol and Implementation Analysis
      2. Exploiting Key-Exchange Vulnerability
   3. Bluetooth Low Energy and Unlocking via Mobile Apps
      1. Understanding Weaknesses in BLE and Using Packet-Capture Tools
      2. Kevo Mobile App Insecurities
   4. Conclusion
5. 3. Assaulting the Radio Nurse—Breaching Baby Monitors and One Other Thing
   1. The Foscam Incident
      1. Foscam Vulnerabilities Exposed by Researchers
      2. Using Shodan to Find Baby Monitors Exposed on the Internet
      3. Exploiting Default Credentials
      4. Exploiting Dynamic DNS
      5. The Foscam Saga Continues
   2. The Belkin WeMo Baby Monitor
      1. Bad Security by Design
      2. Malware Gone Wild
   3. Some Things Never Change: The WeMo Switch
   4. Conclusion
6. 4. Blurred Lines—When the Physical Space Meets the Virtual Space
   1. SmartThings
      1. Hijacking Credentials
      2. Abusing the Physical Graph
      3. SmartThings SSL Certificate Validation Vulnerability
   2. Interoperability with Insecurity Leads to…Insecurity
      1. SmartThings and hue Lighting
      2. SmartThings and the WeMo Switch
   3. Conclusion
7. 5. The Idiot Box—Attacking “Smart” Televisions
   1. The TOCTTOU Attack
      1. The Samsung LExxB650 Series
      2. The Exploit
   2. You Call That Encryption?
      1. Understanding XOR
      2. I call it Encraption
   3. Understanding and Exploiting the App World
      1. Decrypting Firmware
      2. Cursory Exploration of the Operating System
      3. Remotely Exploiting a Samsung Smart TV
   4. Inspecting Your Own Smart TV (and Other IoT Devices)
      1. Say Hello to the WiFi Pineapple Mark V
      2. Capturing credentials and stripping TLS
   5. Conclusion
8. 6. Connected Car Security Analysis—From Gas to Fully Electric
   1. The Tire Pressure Monitoring System (TPMS)
      1. Reversing TPMS Communication
      2. Eavesdropping and Privacy Implications
      3. Spoofing Alerts
   2. Exploiting Wireless Connectivity
      1. Injecting CAN Data
      2. Bluetooth Vulnerabilities
      3. Vulnerabilities in Telematics
      4. Significant Attack Surface
   3. The Tesla Model S
      1. Locate and Steal a Tesla the Old-Fashioned Way
      2. Social Engineering Tesla Employees and the Quest for Location Privacy
      3. Handing Out Keys to Strangers
      4. Or Just Borrow Someone’s Phone
      5. Additional Information and Potential Low-Hanging Fruit
      6. AutoPilot and the Autonomous Car
   4. Conclusion
9. 7. Secure Prototyping—littleBits and cloudBit
   1. Introducing the cloudBit Starter Kit
      1. Setting Up the cloudBit
      2. Designing the SMS Doorbell
      3. Oops, We Forgot the Button!
   2. Security Evaluation
      1. WiFi Insecurity, Albeit Brief
      2. Sneaking in Command Execution
      3. One Token to Rule them All
      4. Beware of Hardware Debug Interfaces
   3. Abuse Cases in the Context of Threat Agents
      1. Nation-States, Including the NSA
      2. Terrorists
      3. Criminal Organizations
      4. Disgruntled or Nosy Employees
      5. Hacktivists
      6. Vandals
      7. Cyberbullies
      8. Predators
   4. Bug Bounty Programs
   5. Conclusion
10. 8. Securely Enabling Our Future—A Conversation on Upcoming Attack Vectors
    1. The Thingbots Have Arrived
    2. The Rise of the Drones
    3. Cross-Device Attacks
    4. Hearing Voices
    5. IoT Cloud Infrastructure Attacks
    6. Backdoors
    7. The Lurking Heartbleed
    8. Diluting the Medical Record
    9. The Data Tsunami
    10. Targeting Smart Cities
    11. Interspace Communication Will Be a Ripe Target
    12. The Dangers of Superintelligence
    13. Conclusion
11. 9. Two Scenarios—Intentions and Outcomes
    1. The Cost of a Free Beverage
       1. There’s a Party at Ruby Skye
       2. Leveraging the BuzzWord
       3. The Board Meeting
       4. What Went Wrong?
    2. A Case of Anger, Denial, and Self-Destruction
       1. The Benefit of LifeThings
       2. Social Engineering Customer Support by Caller ID Spoofing
       3. The (In)Secure Token
       4. Total Ownership
       5. The Demise of LifeThings
    3. Conclusion
12. Index