Friday, August 28, 2020

How To Secure Your Home Against "Internet Of Things" And FUD

TL;DR, most of the security news about IoT is full of FUD. Always put the risks in context - who can exploit this and what can the attacker do with it. Most story only covers the latter.

Introduction

There is rarely a day without news that another "Internet of Things" got hacked. "Smart" safes, "smart" rifles, "smart" cars, "smart" fridges, "smart" TVs, "smart" alarm systems, "smart" meters, "smart" bulbs, NAS devices, routers. These devices are getting hacked every day. Because most of these devices were never designed with security as a goal, and some of them have been never tested by security professionals, it is no surprise that these things are full of vulnerabilities.





Independent security researchers find these vulnerabilities, write a cool blog post or give a presentation about the vulnerability and the exploit, and the media forgets the constraints just for the sake of more clicks. "We are all doomed" we can read in the news, but sometimes the risks are buried deeply in technical jargon. Please note I blame the news sites here, not the researchers.

http://www.slideshare.net/danielmiessler/iot-attack-surfaces-defcon-2015

There are huge differences between the following risks:

  • Attackers can directly communicate with the router (or camera) from the Internet without authentication and exploit the vulnerability. This is the worst-case scenario. For example, an automated ransomware attack against your NAS is pretty bad.
  • Attackers have to position themselves in the same WAN network (e.g. Sprint mobile network in the case of Jeep hacking) to exploit the vulnerability. This is still pretty bad.
  • The vulnerable code can not be triggered directly from the Internet, but tricks like CSRF can be used to exploit it (details later in this post). 
  • The vulnerable code can not be triggered directly from the Internet, and it uses a protocol/port which prevents Cross Protocol Scripting. Attackers have to access the local network before exploiting this vulnerability.
As it is the case with the worst scenario, one can find a lot of devices connected to the internet. You can always find funny stuff at http://explorer.shodanhq.com/#/explore , or use the nmap screenshot script to find your own stuff :)


Network exposure

Most devices are behind an IPv4 NAT device (e.g. home router), thus can not be reached from the Internet side by default. Except when the device configures the firewall via UPNP. Or the device has a persistence cloud connection, and the cloud can send commands to the device. Or the device uses IPv6 tunneling (e.g. Teredo), thus it is reachable from the Internet. But not every vulnerability on your home network is accessible directly from the Internet. As more and more devices and networks will support IPv6, this scenario might change, but I hope most home routers will come with a default deny configuration in their IPv6 firewall module. On the other hand, scanning for IPv6 devices blindly is not feasible due to the large number of IPv6 addresses, but some tricks might work

If attackers can not access the device directly, there is a way to hack it through the user's browser. Just convince the victim user to visit a website, and via CSRF (Cross Site Request Forgery) and brute-forcing the device IP, it is possible to hack some devices (mostly through HTTP - if the exploit can fit into simple GET or POST commands.

If attackers can not attack the device vulnerability through the Internet directly, or via CSRF, but have connected to the same network - the network exposure shrinks significantly. And when attackers are on the same network as you, I bet you have bigger problems than the security of the IoT devices ...

Recommendations for home users

Don't buy **** you don't need

Disconnect from the power cord the IoT devices you don't need to operate 7*24. 

Disable cloud connectivity if it is not necessary. For example, I have a NAS device that can be reached through the "cloud", but I have disabled it by not configuring any default gateway for the device. I prefer connecting to my network via VPN and reach all my stuff through that.

Prevent CSRF attacks. I use two tricks. Don't use the 192.168.0.x - 192.168.10.x network at-home - use an uncommon IP range instead (e.g. 192.168.156.x is better). The second trick is I configured my Adblock plugin in my primary browser to block access to my internal network. And I use another browser whenever I want to access my internal devices. Update: On Firefox you can use NoScript ABE to block access to internal resources.


Check your router configuration:

  • disable UPnP
  • check the firewall settings and disable unnecessary port forwards
  • check for IPv6 settings, and configure the firewall as default deny for incoming IPv6 TCP/UDP.

Change default passwords, especially for services connected to the Internet. Follow password best practices.

Run Nmap to locate new IoT in your home network :) 

Run a WiFi scan to locate new WiFi access points. Let me share a personal experience with you. I moved to a new house and brought my own WiFi router with me. I plugged it in, and forget about WiFi. Months later it turned out I had two other WiFi devices in my house - the cable modem had its own integrated WiFi with default passwords printed on the bottom, and the Set-top-box was the same - default WiFi passwords printed on the bottom. And don't forget to scan for ZigBee, Bluetooth, IrDA, FM, ...

Update your devices - in case you have a lot of free time in your hand.

Don't allow your guests to connect to your home network. Set up a separated AP for them. Imagine your nephew stealing your private photos or videos from your NAS or DNLA server.

With great power, comes great responsibility. The less device you own in your house, the less time you need to maintain those.

Read the manuals of your devices. Be aware of the different interfaces. Configure it in a secure way.

Disable Teredo protocol in case you don't need IPv6.

Stop being amazed by junk hacking.

Update: Disable WebRTC: https://www.browserleaks.com/webrtc , in Chrome you can use this extension: https://chrome.google.com/webstore/detail/webrtc-network-limiter/npeicpdbkakmehahjeeohfdhnlpdklia

Update: Prevent against DNS rebind attacks via configuring a DNS server which can block internal IP addresses. OpenDNS can block internal IP, but this is not a default option, you have to configure it.

Recommendations for vendors

For vendors, I recommend at least the followings:

  • Implement security during Software Development LifeCycle
  • Continuous security testing and bug bounties
  • Seamless auto-update
  • Opt-in cloud connectivity

Recommendations for journalists

Stop FUD. Pretty please.

The questions to ask before losing your head

  • who can exploit the vulnerability?
  • what prerequisites do we have about the attack to successfully exploit the vulnerability? Is the attacker already in your home network? If yes, you have probably bigger problems.
  • what can the attacker do when the exploit is successful?

And last but not least, don't forget that in the case of IoT devices, sometimes users are the product, not the customer. IoT is about collecting data for marketing purposes.


Related posts
  1. Hacking Tools Hardware
  2. Hack Tools For Games
  3. Pentest Tools Nmap
  4. Nsa Hacker Tools
  5. Hack Tools Mac
  6. Hacking App
  7. Pentest Reporting Tools
  8. Hacking Tools Software
  9. Hacking Tools For Pc
  10. Hacker Tools For Pc
  11. Hacking Tools 2019
  12. Pentest Tools Nmap
  13. Hacker Tools List
  14. Pentest Tools
  15. Hacker Tools Github
  16. Hacker Security Tools
  17. What Is Hacking Tools
  18. Pentest Tools Bluekeep
  19. What Is Hacking Tools
  20. Hacking Tools For Windows
  21. Hacker Hardware Tools
  22. Pentest Tools Port Scanner
  23. Hackrf Tools
  24. Hacking Tools Github
  25. Hacking Tools Github
  26. Hacker Search Tools
  27. Hack Tools Pc
  28. Hack Tool Apk No Root
  29. Pentest Tools Port Scanner
  30. Ethical Hacker Tools
  31. Termux Hacking Tools 2019
  32. Hack Tool Apk No Root
  33. Pentest Tools Github
  34. Hack Tools
  35. Install Pentest Tools Ubuntu
  36. Hacking Tools For Windows Free Download
  37. Hack And Tools
  38. Hack Tools Github
  39. Hack Tools 2019
  40. World No 1 Hacker Software
  41. Pentest Tools For Android
  42. Free Pentest Tools For Windows
  43. Tools Used For Hacking
  44. Github Hacking Tools
  45. Hacking Tools 2020
  46. Top Pentest Tools
  47. Hacking Tools Mac
  48. Pentest Automation Tools
  49. How To Install Pentest Tools In Ubuntu
  50. Hacker Tools Apk Download
  51. Pentest Tools
  52. Hack Tools For Games
  53. Hack Tools Pc
  54. Tools Used For Hacking
  55. Hack Tools Github
  56. Tools 4 Hack
  57. Pentest Recon Tools
  58. Pentest Tools For Ubuntu
  59. Hacker Security Tools
  60. Hacking Tools 2020
  61. Game Hacking
  62. World No 1 Hacker Software
  63. Hacking Tools Mac
  64. Hacker Tools 2019
  65. Hacking Tools Windows 10
  66. Hacker Tools For Ios
  67. Hacker
  68. Hacking Tools Kit
  69. Hacker Tools Online
  70. Hackrf Tools
  71. Ethical Hacker Tools
  72. Tools Used For Hacking
  73. Hack Tool Apk
  74. Pentest Tools
  75. Hacker Tools List
  76. Hacking Tools
  77. Pentest Tools Nmap
  78. Hacker Tools Free Download
  79. Hack Tools For Mac
  80. Hacker Tools Software
  81. Hacker
  82. Hacker Tools Software
  83. Install Pentest Tools Ubuntu
  84. Pentest Tools Nmap
  85. World No 1 Hacker Software
  86. Hacking Tools Software
  87. Pentest Box Tools Download
  88. Hacking Tools Mac
  89. Hak5 Tools
  90. Hacker Hardware Tools
  91. Hackers Toolbox
  92. Hacking Tools Windows 10
  93. Hacking Tools 2020
  94. Kik Hack Tools
  95. Hacks And Tools
  96. Github Hacking Tools
  97. Hacker Tools Free Download
  98. Hacking Tools For Beginners
  99. Pentest Recon Tools
  100. Pentest Tools
  101. Pentest Tools Subdomain
  102. Hacking Tools Usb
  103. Pentest Tools Nmap
  104. Hacking Tools
  105. Hack Website Online Tool
  106. Hacker Tools Free
  107. Pentest Tools Url Fuzzer
  108. Hacker Tools For Windows
  109. Hacker Tools Github
  110. Pentest Tools Windows
  111. Android Hack Tools Github
  112. Hacker Tools Software
  113. Hack Tool Apk
  114. Hacking App
  115. Hacker Tools Apk
  116. Hack Website Online Tool
  117. Hacking Tools Name
  118. Pentest Tools For Mac
  119. Hacking Tools For Mac
  120. Hacking Tools For Kali Linux
  121. Beginner Hacker Tools
  122. Free Pentest Tools For Windows
  123. Hacker Tools
  124. Hack App
  125. Hacker Hardware Tools
  126. Pentest Tools Download
  127. Nsa Hack Tools Download
  128. Hak5 Tools
  129. Pentest Tools Kali Linux
  130. Hacking Apps
  131. Hacking Tools For Games
  132. Pentest Tools Open Source
  133. Hacker Tools Mac
  134. Pentest Tools Url Fuzzer
  135. Hacker Tools Online
  136. Pentest Tools Open Source
  137. Hacking Tools Mac
  138. Hack Tool Apk No Root
  139. Hack Tools For Ubuntu
  140. Pentest Tools Review
  141. Pentest Tools For Ubuntu
  142. Hacker Tools Windows
  143. Pentest Reporting Tools
  144. Hacker Tools List
  145. Pentest Tools Windows
  146. Pentest Tools Download
  147. Hacker Tools For Windows
  148. Nsa Hack Tools Download
  149. Tools 4 Hack
  150. Hacker Tools For Mac
  151. Pentest Tools For Windows
  152. Nsa Hack Tools
  153. Pentest Tools Windows
  154. Hack Tools Pc
  155. Hacking Apps
  156. Pentest Box Tools Download
  157. Ethical Hacker Tools
  158. Hacker Tools Free
  159. Hak5 Tools
  160. Hacking Tools 2020
  161. Pentest Tools Android
  162. Hacker Tools Software

No comments:

Post a Comment