Smart Megalopolises. How Safe and Reliable Is Your Data?

Size: px

Start display at page:

Download "Smart Megalopolises. How Safe and Reliable Is Your Data?"

Lynne Edwards
5 years ago
Views:

1 SESSION ID: TECH-T09 Smart Megalopolises. How Safe and Reliable Is Your Data? Denis Legezo Global Research and Analytics Team, Kaspersky SAC

2 Megalopolises are changing fast 2

3 The plan for today Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 3

4 Why cities need all this stuff? Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 4

5 Why do cities have be smart? Investments Staff Infrastructure Data centers Operation center 5

6 Raw data for planning 6

7 And for traffic management Possible to use for the traffic lights Counting vehicles number and change timings Counting pedestrians as well 7

8 Radars are the source of such data 8

9 The first phase Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 9

10 Appearance is a great help 10

11 ..Any IDs you can get are also MACs Names Any IDs 11

12 What we are gathering? Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 12

13 Look, interfaces 13

14 And a lots of data on-board 14

15 What's inside the data? Vehicle type Number of vehicles Median speed Station occupancy 15

16 The Holy Grail Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 16

17 Can we add some functions? Through interface Debugger? Commands? What is format? 17

18 Format looks like ihex or SREC 18

19 But for which controller is it? 19

20 LinkedIn isn't only for HR 20

21 ..but it happens anyway For me in a blackbox mode it looks like dead end But does it means dead end at all? Of course not! 21

22 Even with the stock firmware.. Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 22

23 Reconnaissance first I started with script + C Bluetooth tools adb to get GPS from phone C code for sending What to send? 23

24 Commands are partly known 24

25 So we can automate 25

26 Sensor will answer 26

27 What about the small DDoS? Driving by, changing settings Time: all traffic at night Types: all traffic trucks 27

28 Python + PostgreSQL seems better 28

29 Resolve vendor and address offline 29

30 What to do further and else? Smart cities: Sensors' role Reconnaissance: Vendors, locations, etc. Sensors' functionality: Interfaces and data Firmware: The Holy Grail of embedded Automation: Let's send some bytes Smart cities: Outside sensors 30

31 Side effects Gather Wi-Fi data and filter it with Postgres views MACs can be anonymous WEP is still alive 31

32 Where is always place for fuzzing Where are undocumented commands 32

33 So much other stuff 33

34 ...even speeding penalties Smart cities security perimeter if huge So is the surface of attacks Different authorities are in charge of the infrastructure 34

35 ...And tools 35

36 What to apply? Change appearance and default names Don't rely only on standard authentication Cooperate with third-party researches Think a little bit like malefactor or hire someone who can I know embedded devices vendors with generous bug bounty program. Respect Cities also could participate 36

37 Summary Smart city infrastructure is visible due to ID Kudos to vendor, firmware is strong Automation is possible with change of any settings Interesting side effects with wireless protocols Go further! 37

38 Denis Legezo

LIGHTING & INVESTMENT: SMARTLY CONNECTED

LIGHTING & INVESTMENT: SMARTLY CONNECTED A smart city is. a city or group of cities that use innovative information technologies and the involvement of its inhabitants to sustainably develop its built