*35C3 preroll music*
Herald: And I have one last announcement before we begin this talk. This is a personal
announcement to whoever slapped this sticker saying "for rectal use only" onto
my microphone. *loud laughing*
Microphones are not supposed to be used this way.
*applause*
Please trust me. I am very familiar with microphones.
*laughing* I know how they are supposed to be used.
However our next speaker is going to tell you about things that are supposed to be
used this way and about how to secure and protect those things. So please welcome
the honor and the talk you all came here to see. The Internet of dongs. A round of
applause. *applause*
Okay so hello everyone. My name is Werner. I'm working for a SEC consult as an IT
security consultant. And besides penetrating all the things at the SEC
consult's vulnerability lab, I have been studying information security for the last
five years at the University of Applied Sciences St. Pölten back in Austria and
about a year ago I was facing a massive challenge. Some people might know this
challenge This challenge was to select a proper topic for my master's thesis.
*loud laughing* You might know there are always those
predefined topics by the universities. Some of them are quite interesting. They
are taken - yeah - most of the time quite fast by the other students and you are
left with the boring topics and I thought to myself, I don't want to stress myself I
just want to define a topic by myself. And that was the challenge. So the first thing
I did to get a better overview of the topics was to take a look at the topics my
colleagues have chosen and created a word cloud out of that. So we have basically
all the interesting topics there we have bitcoins, we have GDPR, we have cyber
cyber cyber, we have DevOps management, malware. But some of you might have
allready noticed it. There is one topic missing at my colleagues thesises which is
very very important in the year 2018 and that's the Internet of Things. So I guess
I don't have to explain here at the Congress what the Internet of Things is.
It's basically the interconnection of all the devices which were analog a few years
ago, with each other and even worse over the Internet. I thought maybe I can
combine the knowledge gathered at SEC consult and conduct a penetration test in
this Internet of Things. The problem here is still there are like millions of
products and I just have to write one thesis, so I have to select one
subcategory in this Internet of Things to conduct a penetration test on. Of course
the first thing which came to my mind where smart home devices we already had a
lot of interesting talks about smart home devices. There are like smart coffee
machines, smart lawnmowers, light bulbs, thermometers and stuff like that. But this
category has two problems. So, first of all there is already a lot of research
done. And the other problem is the impact. So, I don't want to downplay the
vulnerabilities which were found there, but when there are vulnerabilities found I
mean, yeah, if there is a DDoS on your lawnmower you can just go out through your
garden and mowe the lawn yourself. It's not that big of a deal. So I thought I
have to select a subcategory where the impact is a little bit more critical. And
I came up with the following devices. So, for example: Smart dolls. There was this
doll Kyla. Some of you might know it. Someone found out that it has a built in
microphone and the data was sent to some dubious service in some dubious countries
and it was even declared as an illegal telecommunication device. It had to be
destroyed. Or there is a lot of interesting research at baby monitors. A
colleague of mine wrote a very interesting blog post, you should take a look at it.
Or devices which affect our body. So, for example smart pacemakers. They were
developed by St. Jude Medical, that's the biggest manufacturer of pacemakers in the
world. And they built a pacemaker which is programmable via Bluetooth. But yeah, they
forgot authentication, which is quite a big of a problem when everyone is able to
reprogram your pacemaker. So as we can see, at this categories the impact would
be quite critical but there is again a lot of research done. So the deadline was
coming closer and closer. I had to hand in some kind of topic for my master thesis. I
was doing a lot of brainstorming with myself and then suddenly it came to my
mind. There is one category out there where the impact would be very critical.
And there is not a lot of research done and that's the Internet of dildos. So
that's basically the integration of sex toys into the Internet of Things where we
interconnect the dildos with each other and over the Internet. But before I'm
going to show you what I've found in this internet of dildos, we have to talk about
history, because you might think now that's something new. But that's not true
because the Internet of dildos as we know it is existing for about 50 to 60 years.
And as always when there are new inventions or interesting ideas, they
first appear in movies and that also applies to the Internet of dildos. So,
those are quite old movies, we have for example Barbarella or Flash Gordon or
Orgazmo. And in those movies, those are real movies - it's not a joke.
*laughing* The Internet of dildos appeared first in
this movies. So for example at Barbarella the evil guy used a device called the
Orgasmotron to cause so high levels of arousal in humanity, to kill people. So
basically the Internet to dildos was in the 60s and 70s a weapon of mass
destruction *loud laughing*
and not the weapon of mass pleasure, as it should be. So a few years later a whole
research area was formed. This research area is called teledildonics and that's
also not a joke again. *laughing*
And it was first mentioned by Ted Nelson. He is a technical philosopher and he coins
quite well-known terms like Transclusion, Virtuality and Intertwingularity and
Teledildonics. And he mentioned this term at first in a book called Computer
Lib/Dream Machines. Very interesting book by the way. You should read it. And in
this book he did interviews with people who had yeah innovative and interesting
ideas for the time but the technology was not just ready yet. He did an interview
with a guy called How Wachspress and How Wachspress developed a device or had the
idea for a device called auditac. When you Google for auditac you find quite an
ancient website called auditac.com. And when you dig a little bit deeper you can
find out that he's still looking to find a manufacturer to sell his sonic stimulator.
Sounds already quite interesting and even has a patent and a small graphic for it.
So it's basically a radio with one input and two outputs. One input of course the
antenna and the two outputs are one for the headphones and the other output is for
this sonic stimulator, which is inserted from below in the human life-form.
*laughing* You even can find the patent on Google
Patents and he writes there in his abstract: Random or controlled
electronically synthesized signals are converted to sound waves that are directly
coupled to the skin of a life form, yeah such as a human body for example, to
stimulate the skin or internal portions of the life-form. So as we can see the ideas
were there, but the technology was just not ready in the 1970s and 1980s, but now
we're in the year 2018 and we are definitely ready for a penetration testing
the Internet of dildos. And before I'm going to talk about the test devices and
the vulnerabilities, I'm going to make a promise now. I will try to keep this as
serious as possible. I will try to keep the, I will call it the IPM stimulendous
per minutes as low as possible. Yeah, and now I just want to talk about the test
devices because those are very important. So I selected three test devices for my
master's thesis. On the right side we have the - that's not a joke again -
Vibratissimo Panty Buster. That's the real name.
*laughing* In the middle we have the MagicMotion
Flamingo and on the left side we have the RealLove Lydia. So the devices on the left
side and in the middle have one thing in common. They are manufactured in China.
The device in the red right side is manufactured in Germany. So, I have to
admit I was a little bit biased because I thought I am going to take a look at the
Chinese devices first, because there will be a lot of low hanging fruits. Question
to the audience now: Who believes that I found most of the vulnerabilities in the
Chinese devices? Raise your hand. *laughing*
Who believes that have found most of the vulnerabilities in the german device? Who
believes that have found vulnerabilities everywhere?
*loud laughing* Yeah you're basically all right. But when
I took a look at the German device, I found so many really really critical
vulnerabilities that I immediately stopped there and wrote my whole thesis about the
Panty Buster. *laughing*
Okay, so the Panty Buster itself is just one product out of a whole product line. I
just bought the Panty Buster because it was the cheapest one. They are basically
using all the same backends, the same iOS and Android apps. And yeah, the Panty
Buster is basically a device which is connected via Bluetooth to a smartphone
and it can be used for example for long distance relationships. But there is way
more behind those apps, because there's like a whole social media network built
in. You can make group chats *laughing*
You can create image galleries, you can maintain friends lists.
*loud laughing* Yeah, that's real. That's real. It's not a
joke. *applause*
Yeah. And now we're going to analyze this Panty Buster and take it down to the last
parts. Yeah we're going to analyze the software. I'm going to tell you a little
bit about the transport layer and the hardware of course. So I'd like to start
with the software. So, the first vulnerability we have to talk about this
is so-called information disclosure. So you might think nah boring, just some
random version numbers. Yeah that's true most of the time information disclosures
are boring. But in this case it's really critical because I found a so-called
.DS_STORE file the web root. A .DS_STORE file is basically a meta data file which
is created by the MacOS finder and it contains a lot of metadata, like files and
folder names. So when you find such a file in a web root you have basically a side
channel directory listing. This .DS_STORE file has a proprietary format but as for
all problems in life, there is a Python module to decode it. Yeah. And I decoded
that .DS_STORE file and I was presented with the following contents. So it's
basically a side channel directory listing of the web root. There are a lot of
interesting files and folders so for example: old page example, I have no idea
why it's there in the productive environment. There is a database folder
but the most interesting folder is the config folder. So whenever we get to the
config folder, there was real directory listing enabled and there was one file in
there and it was called config.php.inc with the following contents. So basically
I had now access to the database hostname, the database names usernames and
passwords. The problem now was that as we can see the database host is just
localhost, there might be a chance that it's not directly reachable via the
Internet. And we have to find the so- called exposed administrative interface to
connect to the database. Yeah of course the first thing I did was to do a
portscan. *laughing*
*applause* A lot of interesting ports. Sadly no SQL
ports. But some of you might remember this, let's call it weird brown orange web
application, called phpMyAdmin and I found a subdomain which contained the phpMyAdmin
installation and I was able to use those credentials to connect directly to the
database and get access to all the data. *applause*
So I basically had access now to the real life addresses, to messages in clear text
which were exchanged, images, videos and a lot of other stuff. So, yeah. And what
hurt me the most was the following slide, because the passwords were stored in clear
text and that's really not necessary in the 21st century. Okay. So in real life
about 30 minutes have passed by *loud laughing*
and I tried to do a write up as fast as possible and submitted to the german CERT-
Bund. And yeah a few minutes later, I got a really interesting call from the german
CERT-Bund. They told me that the already informed the manufacturer and they're
already trying to fix those problems. So my problem was now that I still had to
write my master thesis and I just have content for about 30 pages now and I need
like hundred pages. So I did a little bit of more research and found way more
vulnerabilities of course. And the next vulnerability I'm going to talk about is
the so-called insecure Direct Object reference. Sounds cryptic, but it isn't.
It's basically always a vulnerability which is consisting of two sub problems.
So the first problem is, when someone uploads resources to a backend those
resources are most of the time renamed, to like a random string which shouldn't be
guessable. The first problem would be if it would be guessable. But the second
thing is, there should be authorization checks in place. So if someone is able to
guess those unique identifiers, there should still be some like process which
should check if the user should even be able to download these resources. And in
this case, yeah, it was just really easy to guess the identifiers and there was no
authorization whatsoever. And I had to learn this the hard way, literally. There
is a feature in the smartphone apps, called galleries. So you can create
galleries, you can set the visibility to no one is able to see it, just your
friends are able to see it , everyone is able to see it. You can even set a
password on those galleries. Yeah. And just for a test I created a gallery with a
few cats and when you request the gallery, you see the following request. It's
userManager.php blah blah blah username password and some ID. And I thought maybe
I should change this ID. And I was presented with a dick pic.
*laughing* Yeah, the problem behind this is quite
easy. Everything which is stored on the server is renamed to a global counter. The
global counter is incremented by one after every upload. And there are no
authorization checks whatsoever, because the images are just stored in a server, so
it doesn't matter if you set a password or set the visibility. That's just nonsense
to do. OK. So the next vulnerability. Yeah I call it improper authentication. To be
honest it was just a weird authentication. At SEC consult I saw already a lot of
different ways of implementing authentication. Some are good some are
bad, but it can be fixed. But in this case it was just weird, I've never seen
something like that. It's basically like HTTP basic authentication but a little bit
worse. *laughing*
So normally authentication works as follows. You're sending a username and
password to a server and if this process is successful you get some kind of
authorization information like a cookie or an API token. You can use this cookie or
API token to authorize all the other requests. In this case every request
contains just username and password and clear text to authenticate through
requests. That's just weird to be honest. And also if your password is compromised,
it will also mean that you have to change your username because it's part of the
authentication information. So weird, weird implementation. Okay the next
vulnerability is called the remote pleasure version 1.0. It's 1.0 because
there is a 2.0 . *laughing*
There is a feature in those apps where you can create remote control links. They can
be sent via SMS or email and everyone who is in possession of those links can
directly control the devices. There is no extra confirmation needed. We'll take a
look at the email now. There is a button in the email called Quick Control and
there is an ID again. Yeah the thing is it's just a global counter again. And what
an attacker can do now is download the app, create his own quick control link,
decrement the ID and pleasure just random strangers on the Internet.
*applause* Okay I will show you guys a video now,
where I'm doing exactly that. *laughing*
So when the video is going to start... It's going to start, perfect. On the right
side we're going to see an attacker device which is just connected to the normal
mobile network. And the attacker creates his own quick control link and decrements
the ID. On the left side we can see another smartphone which is connected to
Wi-Fi, to have Internet access and via Bluetooth, to the smart sex toy. This
attacker device should now be able to control - yeah, you can see that now, in a
few seconds. That's just what I explained. *silence*
*laughing* There is no confirmation whatsoever so you
can directly control all the devices. Okay, I have to stop talking about
software now. There is a lot more like cross-scripting, HTTPs problems, outdated
software, but there is not enough time left now so we have to talk about the
transport layer. Before I'm going to tell you something about the vulnerabilities I
have identified, I will tell you something about Bluetooth low energy in general, the
security basics and how authentication and encryption works on a very high level. So
you can imagine that Bluetooth Low Energy basically works like a web API. So it's
very high level explanation. You have API endpoints. Those are the service
characteristics and you have properties where you can read and write to. So for
example the device name can be read or written to change the device name. There's
also a lot of other characteristics which will be very important when it comes to
remote pleasure version 2.0 a little bit later. So that's a very high level
explanation, i know, but we don't have enough time left. Talking about the
security basics Bluetooth Low Energy is using AES-CCM that's counter CBC with Mac.
That's basically considered secure but as we know, security also depends on the key
material and the key exchange. At Bluetooth Low Energy the key exchanged is
defined as the pairing methods. For Bluetooth Low Energy we have five pairing
methods. We have just "No Pairing". So yeah we basically throw packets into the
air and if a device is nearby it tries to do something with those packets. We have
"Just Works", we have "Out of Band Pairing", "Passkey" and "Numeric
Comparison". I don't have to tell you the details now. You all know those. It's
numeric comparison, where we compare numbers to exchange the key material. You
have the Passkey, which is yeah like always 0000 or 1234. We have Out of Band
Pairing, where the key material is exchanged via NFC for example and we have
just works, that's really secure, where the keys just set to zero and can be of
course be brute forced with ease, but it just works of course. So out of those five
methods, what does the audience think the sex toy is using? Is it using no pairing?
Raise your hands. Is it using any of the other more or less secure methods? Yeah.
It's using no pairing. *laughing*
That means that the Android and iOS apps just throw the packets into the air and if
a device is nearby, it starts to vibrate *laughing*
and that's of course easily exploitable you can just sniff the real traffic and
repeat it. I did exactly that using a so- called Bluetooth Low Energy sniffer. I
used a bluefruit device, it works very well and I placed it between the sex toy
and the smartphone app. I sniffed the traffic using wireshark and I found some
interesting end points or handles. There is the 1F handle which is like an
initialization handle and there is the handle 25, where you can send values from
00 to FF to set the vibration intensity. Yeah and now it's time for a little bit of
War-dildoing. I wrote a small Python proof of concept which basically scans the air
for Bluetooth low energy devices. If it finds a device. It tries to or tries to
find out if it is a sex toy and if yes. Yeah it basically turns it on to 100%, to
FF. *laughing*
So the next thing I want to talk about is not that funny. So please don't laugh now
because when we released this, a lot of people on Twitter asked "Is this rape?",
so serious topic. For example the evil attacker is using my War-dildoing script
in the metro, in the U-Bahn in Vienna. And he would just pleasure random strangers.
Is this rape? In Austria we have two different things. We have rape and sexual
assault and they have two preconditions. So that's violence - eh three
preconditions. We have violence, threats or deprivation of liberty, which is just
not the case in this scenario. But we have a special paragraph called, phew that's
really hard to translate that. It's called the Po-Grapsch paragraph. I know that's a
little bit different in Germany and I'm not a law expert so it just kept the
Austrian laws which could be verified by tourists. According to this paragraph this
would be an unwanted sexual act, via a third party object. So it's not rape, but
it's an unwanted sexual act. Okay. The hardware. Last but not least. The biggest
problem is that firmware updates are not possible. That was confirmed by the
manufacturer. The problem here is a lot of vulnerabilities can just be fixed by doing
firmware updates and the manufacturer came up with the idea, that the end users can
send in their smart sex toys to do a firmware update and I'm quite sure that
nobody's sending in their used devices to conduct a firmware update. The other
problems are debug interfaces. They just forgot to remove it or deactivate their
serial interfaces on the sex toys. It's just really easy to extract the firmware
and do a little bit of more research on the firmware. Okay. So you might now think
I still want to use smart sex toys. What can I do? Yeah the tin foil is not
working. *loud laughing*
*applause* But there are a lot of interesting open
source projects out there. So first of all the most famous project is the Internet of
Dongs project. There is a really interesting person behind that. He's
called RenderMan. You can find him on Twitter. He invented this project to make
this whole Internet of Dongs a little bit safer. And he's doing like penetration
tests and stuff like that and he's even handing out DVS. So that's the equivalent
to CVS. Then we have buttplug.io and metafetish. They are developing open
source firmwares for a lot of different sex toys and they're independent from all
the manufacturers. And there is also something called Onion Dildonics
*laughing* which has the goal of rerouting all the
smart sex toy traffic over the TOR network to make it a little bit more safer.
*applause* OK. There is one more thing. I had a lot
of calls together with the manufacturer and the german CERT-Bund. And one call was
outstanding because we were discussing the remote pleasure vulnerabilities. And we
tried to explain the manufacturer that it's not good that you can basically out
of the box pleasure everyone on the Internet or if you're nearby. We told them
that it should be at least like an opt in feature, where you can switch on this
feature in the apps, but the manufacturer said no that's not possible because, at
least they believed that, most of our customers are in swinger clubs and you
don't know beforehand who is in the swinger club. So there is just no optin,
in a swing club, because you're basically always in. Thank you.
*applause* Herald Angel: Secretary of Education you
are now taking questions. We have five microphones two in the front and three in
the back. So please line up and ask whatever you want. So apparently people on
Twitter are engaged in a drinking game where they were drinking every time you
said penetration testing. *loud laughing*
*applause* Herald: In the meantime we have a question
from microphone number two. Question: Did you come across anything
with the patent trolls in teledildonics? Answer: I came across what sorry?
Q: patent trolls. There is a issue with the teledildonics patent and some
companies have been threatened to go out of business because of frivolous lawsuits.
A: Yes. Yes there was the I guess it was called the teledildonics appreciation day
in August because the patent ended. So you can basically use the term wherever you
want. Herald: Thank you. Microphone number three
please. Q: So this was very funny obviously. And
you showed us the really low hanging fruit. On the website in the database you
would have been able to see the social graph of the users. I don't know if you
have managed to look at other devices. Can you elaborate a little bit more on
something that I believe more serious. Which is the profiling of users behavior,
social networks and so on? A: So of course it didn't take a look of
all the data because it was so critical in my opinion, that I directly contacted the
CERT-Bund. So I can't give you any information about the data of course. I
also took a look at like things like tracking and stuff like that and in this
case there was not a lot of tracking going on at the german sex toys. But when you
compared it to the Chinese sex toys, there is way more tracking and stuff like that
going on. But I didn't took like a detailed look into that.
Herald: Thank you. Thank you again for the educational and entertaining talk
and hopefully a lot of rounds of applause.
*applause*
*35c3 postroll music*
subtitles created by c3subtitles.de in the year 2019. Join, and help us!