Backdooring the Front Door

Transcription

1 Backdooring the Front Door

2 About me Software Engineer by trade Hacker by passion Lock picker for fun The best puzzles are not meant to be solved All opinions are my own, and may not reflect those of my past, present, or future employers

3 Internet of things

4 August smart lock

5

6 August's marketing team

7 "Unlike physical keys which can be duplicated and distributed without your knowledge" Source: august.com (August 17th, 2015)

8 Source: august.com (September 14th, 2015) "Safer than codes that can be copied."

9

10

11

12 Security claims Perfectly secure Guest access can be revoked at any time Guest permission can be limited to a schedule Guest can not Use auto unlock Invite or remove guests or owners View activity feed View Guest List Change lock settings Keys can not be duplicated or distributed Track who enters and exits your home

13 Mapping out the API

14 WiFi HTTPS BLE

15 MitM proxy

16

17 Certificate pinning crap...

18 Solution: ios Kill Switch 2 (

19 Disabling SSL/TLS system wide at Defcon?

20

21 Better solution

22

23

24

25

26

27

28

29 No Jailbreak

30 Certificate Pinned!!!

31 Security claims Perfectly secure Guest access can be revoked at any time Guest permission can be limited to a schedule Guest can not Use auto unlock Invite or remove guests or owners View activity feed View Guest List Change lock settings Keys can not be duplicated or distributed Track who enters and exits your home

32 After mapping out api Postman collection created (see github repo)

33

34 Not anonymized

35

36 Creepy

37 Let's fix this

38 MiTM can modify traffic

39 Fix Don't forward log data to August, and tell app logs were received

40

41

42 What else can we do?

43 Guest to admin?

44 Guests can not use Auto-Unlock Guests can not control lock settings

45

46 Replace "user" with "superuser"

47 Guests can change lock settings!

48

49 Security claims Perfectly secure Guest access can be revoked at any time Guest permission can be limited to a schedule Guest can not Use auto unlock Invite or remove guests or owners View activity feed View Guest List Change lock settings Keys can not be duplicated or distributed Track who enters and exits your home

50 Mapping out the BLE API

51 WiFi HTTPS BLE

52 Enumerate BLE services

53

54 Intercepting BLE Solution: Ubertooth

55

56 Better solution

57 Tap

58 Replace

59 Plaintext BLE traffic in log files!

60 No Jailbreak

61 How August's authentication works

62

63 Requesting firmware as a guest

64 This is weird

65

66 "Safer than codes that can be copied." "Unlike physical keys which can be duplicated and distributed without your knowledge, an August lock..."

67 70F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D F4F853E330BAEC27BF2724F39D1471

68 Key material in logs

69 Security claims Perfectly secure Guest access can be revoked at any time Guest permission can be limited to a schedule Guest can not Use auto unlock Invite or remove guests or owners View activity feed View Guest List Change lock settings Keys can not be duplicated or distributed Track who enters and exits your home

70 Don't give guest access to someone you would not give a key to.

71 Code on github github.com/jmaxxz/keymaker

72 Demo

73 Mistakes made Mobile app logs include sensitive information Lock does not differentiate between guest and owner Firmware not signed No apparent way for average users to discover backdoor keys Guest users can download key material System relies on guests self reporting unlock/lock events Vendor claims two factor auth when really two step auth No rate limiting of password reset attempts (fixed) Mobile app includes bypass for certificate pinning Secure random not used for nonce or session key generation (fixed) Key material not stored on ios keychain

74 What was done correctly August has been very responsive Mobile apps attempt to use certificate pinning Protocol makes use of nonces CBC Not reliant solely on BLE's just works security model

75 Hackers needed Consumers are not able to evaluate security claims made by companies We need more researchers investigating security claims made by companies on behalf of consumers. What can be asserted without proof can be dismissed without proof.

76