speaking of kakalaki
con in its uh previous history also so
Daryl Highland principal security
researcher at rapid 7 uh there's no
sense in wasting time on me that's
boring so let's go ahead and move into
the talk so we're here to talk
about iot technology and cellular
technology within iot specifically so
this is a project that I started about a
year or two ago it was like as we see
this growth both in cellular technology
and iot uh either used in like home
security systems for back hul
Communications we also see it in uh
remote camera devices uh the device I'm
actually going to be using in demo today
is a trail camera battery operated trail
camera as an example and as I've started
looking at these devices and trying to
observe them I'm going to try to
share a lot of different topics in this
area and I think it's kind of fun and
exciting and I hopefully you enjoy it
too uh if you have any questions uh it
isn't like we got such a large a
audience feel free to like raise your
hand uh if you have something to say or
a question to ask about it so so first I
want to start off with intro to Cellular
technology not all cellular technology
but what we typically see utilized in
iot isn't like cell phone cell modules
which uh way more bandwidth you know
you're you you're downloading in your
internet you're taking pictures there's
just all kinds of crazy things going on
iot based technology usually uh is quite
different when you talk to Cellular so
uh the whole group is maintained by this
uh uh this group called 3gpp I think
tells what it is there uh that group
actually doesn't run the standards but
it runs all the organizations that run
the standards so they kind of see
oversee the whole picture uh and what
you think about an iot based saor three
General areas you're looking at things
are size smaller has go into a smaller
device in some cases we're also looking
at Cost obviously if it cost $200 for a
cellular module in some cheap crappy
piece of iot it's never going to be
there so it has to be cheap and then we
get into power power consumption is
always an issue because you're dealing
with devices that may be battery
operated so if you want to do
transmission of data if you consume a
lot of power you're going to drain the
batteries quickly so these devices fall
into those categories two general type
of devices we call mbot and LTM there's
couple different versions each one of
those uh real quick on the
nbiot this kind of functions in several
different modes you have LTE and band
which is communication goes in the
actual LTE bands you have a guard band
so when you start looking at the
channels or the bands in the LTE signal
range there's gaps between them those so
a device can actually communicate out of
those or in between those two bands it's
known as gar band area and then you get
Standalone Standalone they actually
utilize like um G uh earlier standards
for the most part and it's usually
focused to specific functions and
services uh they often have two types of
power controls in them discontinu
reception obviously you don't want to
consume power so if you're not
transmitting anything
you don't keep signaling reduce the
power consumption the other is power
saving mode and you'll actually see it
happen on this device this device will
come up running it'll do a bunch of
Transmissions it'll turn around and
it'll power the module down and you'll
see that and that's done to actually
improve power consumption on these
devices so uh there's two main ones when
you get into nbiot nbit one and two and
you can see the download Peak speeds
very low we also notice they're half
duplex again these are just passing
Telemetry data so you're not going to
move Voice or SMS messages or anything
like that it's pure Telemetry data it's
a quick measurement hey you know this
thing has this much pressure and off it
goes or it's going to be this little
piece of data and off it goes it's
basically Telemetry data moved on
these and then we get into LT LTE M M1
M2 uh or cat one M1 M2 whatever how you
want to call it different names are used
it's higher complexity May more features
functions capabilities we also see lower
latencies obviously in this case you're
moving more data so you don't want or
more critical data in some cases there
so you don't want to have the excessive
latency associated with it it does only
inband LTE Communications it doesn't do
the other two weird things and then we
get into Power you still had the same
power consumption issues again these
devices that are on this device I think
it's an M2 uh communication type device
so it actually does the same power
things to keep the reduction because
this device that we're actually looking
at playing with is battery operated
obviously I'm not running batteries on
it because it'll take 12 volt input also
but if you want to put it in the field
it's going to be battery
operated again main two standards on
those and you see the different down
Peak rates and Uplink rates much more
data you you can actually make voice
calls over these uh two devices so I've
actually seen I've actually taken not
this device but I've taken other
devices uh that are iot devices that had
one function and actually have made
voice calls with them but hooking into
it and connecting up and actually making
voice calls with iot device to prove
that it could be done having done that
with this one we're going to do some
other similar stuff so you can see how
to control the device in an iot device
to get it to do other things you may
want it to
do and again you look down here and uh
as you can see the speeds full duplex it
could do half or full duplex so he's
signaling in both ways better
performance
for more bandwidth type data that you
need to use camera you're moving images
you're moving video things like that you
have to be able to have that full duplex
to be able to get commands into it to
send data up all that type of
stuff any questions
so now you know everything there is to
know about iot based cellular Tech also
there's some new release
versions so I spent some time looking at
these going is there anything really
seriously impactful that we need to
address today not really so you get
better efficiency in network operations
they've improved in that uh Access
Control small sales support basically
small sale is a micro environment for
cellular where you have a higher density
of devices and be able to support higher
densities within those areas uh let's
say let's say you want to put in some
kind of control systems within a large
hotel where you actually have hundreds
or several hundred devices you may want
to set up a small cell type environment
to be able to handle that density uh and
bandwidth associated with again they
actually made more power improvements I
don't know what that means I just know
without reading a lot of the standards
and everyone knows reading standards is
somewhat painful uh and of course 5G
services and features were added into
some of these uh releases I think in the
later releases I think it came out in uh
15 or 16 and then obviously more
improvements that we moved to release 17
of that so now we've covered all that so
let's dig into the dirt now uh so let's
look under the
hood so when you start thinking about
modules we've seen in devices these are
the typical manufacturers quit tell
ublock Sierra whatever uh teite and
Centon actually merged here last
year I like the Centon devices and I
I'll tell you why I like them often if
you want to get a development kit for
one of these devices for every one of
their modules you have to have a
development kit gets kind of expensive
saton came out with one that had a
socket you could buy two sockets for one
development board cover every module
produced
big savings it costs a little more than
most of the devices but again I can test
and enact with all other devices using
one $700 purchase versus you know a 300
300 300 300 to get through their whole
uh series of devices uh I was out at CES
this year and I end up talking to
quicktel and U blocks and I I actually
spent most of the conversation scolding
them on cheating me on development
boards and why aren't they doing what
canton's doing and they were they
admitted man what they're doing is
really cool we should do that so
hopefully hopefully they took that back
and do something with it uh if you look
under the hood of these devices every
one of them have uh Qualcomm chipsets
that is the standard throughout is there
any exceptions to that I have not found
it yet uh but I have come across devices
that had cellular capability that did
not use modules they cooked their own
solution actually on the main control
board boards uh in those cases I saw
qualcom and some other devices also used
within those
environments so uh let's go through a
tear down often when I pick up a new
module or a device has a certain module
I want to dig in a little deeper go a
little further how's this thing work uh
I've actually been paid to do this in
the past uh by certain vendors and what
I do is we start taking it apart so in
this case we've actually unpacked it and
these devices are packed in Tights so
you're looking at a fairly small device
and you can see how small these devices
are here uh and you can see how T packed
the components are so literally I go out
and buy the cellular modules first thing
I do is I throw it in an
oven I heat it up and then I scrape all
the components off of it I want the
circuit board I want to know what's
going on with that circuit board so when
you think about these these devices
they're just they're just another
circuit board and then those are
attached to the the the board within the
iot technology and the connections under
the underside of it instead of being
like ball grid array they're known as
LGA land grid arrays uh they're larger
Square pads
typically so if a vendor certain
services or functions on this if a
vendor puts a device on their box on in
their device there's certain things I
may want to look at and they're not
always easily accessible so I always
want to say hey can I attack these from
the surface and dig into them so that is
like a land grid array for this which I
think it is the
91 and we start looking at the layout up
here after it was clean that's where the
flash memory sets um and that is a BGA
multi-chip package which we're going to
get into a little deeper here and the
other part is the actual CPU so I'm
always curious can I get J tag on there
it's not always easily available on
these devices so what we do is uh take
the chip apart if I can get a data she
sheet I try to identify all the JTAG
connections and then I trace it out on
the circuit board so the best way to do
that as if there's no components on the
circuit board so that's why I strip it
clean and those are messy I if you went
into my lab and you walked out and
actually look at the bottom of your feet
you probably find all kinds of micro
resistors and components stuck to your
feet uh it it's kind of it's kind of
insane I always tell my wife don't bring
the dog in here because I don't want
these components all over the house uh
so it can get really messy but we can
dig into it so the next thing I want to
look at is memory chip we saw the memory
chip was on there these memory chips
even
though the ball grid array structure on
this 162 balls it's about a qu
millimeter approximately each one of the
pads uh this is an mCP which is very
different than an e mCP these are
multi-chip package meaning they came
contain flash memory usually an an flash
memory and RAM on the same chip
body so when I first saw one of these
things and I didn't have a data sheet my
first thing is this just an em you know
emcp which is an embedded controller
those have an embedded controller on
them so if you find an emcp there's
readers that you can buy for like a
hundred bucks you just drop the chip in
plug it in plug it into your box to the
USB it'll Mount up the entire file
system for you automatically because it
has a build-in controller you're not
lucky with that here
also if you want to take it any further
chip sockets for these are horribly
expensive when they first started using
them on a larger scale a couple years
ago to buy a chip socket for a flash
memory reader was upward over $2,000 for
a
socket uh and that happened to be a
socket based on the dimensional size of
the chip not all chip dimensions are
going to be the same some of them be 11
by 11 by1 I've seen them 10 by 10
they'll be uh uh 9 by 11 all different
measurements well the sockets have come
down now they're only like6 or
$700 uh unfortunately most of the
reasonably priced chip
readers can't read these okay they don't
have this particular devices in it you
can buy chip readers that do you're
paying into the thousands three four
five 6,000 for a high-end chip reader to
be able to do that and then you're
dropping another
two to4 th000 for sockets to be able to
read these well I'm cheap but I'm not
lazy so what we do is we find out that
the 162 ball grid array of these devices
is identical doesn't matter who the
manufacturer is so if you can get a pin
out design for any one of these you can
identify key components so if you look
up the top where the the upper green or
or turquoise looking one RS that's the
flash memory location
there's a paper that I put out or
actually a Blog I put out where I detail
the process here of actually deadbugging
these so the way we dead buug these and
make it
easy well I think it's easy I think
everyone should think it's easy so go
look at my block so what we do is we
identify these map it out on the Chip
And then I ball the thigh I actually add
.25 mm balls or3 mm balls based on the
size of the pad and I flow them onto
there as a landing point and then what
we do is we hand wire them up
so so uh so if you looked at my badge
soldering you
go he's not capable of doing that I do
that under a
microscope when I was doing the when I
was doing the uh B badge in the other
room the lighting uh these typical type
of lighting makes it nearly impossible
to do good soldering and then you take
into the fact I'm an old man um it
deteriorates quite rapidly uh I still
soldered it and I looked at it real
close and it came out pretty good for
somebody who couldn't see
anything I usually want to patch this
around so you can get a closer look at
it thing is here so what we do with that
then is I build basically a zip socket
breakout
board and I use these for dead bugging
so I'm pass this around so you can see
the the chip and the wires this was one
off the eg9100
of chips don't create new chip silicon
for everything underneath the Sun what
they do is they just put it in a
different package no different from this
so then you have to figure out what of
all the chips that they produced is most
likely to be what's underneath the hood
of this one and you do that with no data
sheets because most of these don't have
data sheets uh but it's fairly easy you
can you have uh cell slicks on these
things it tell you things like hey it's
8bit so many bytes it's a uh you know
it's a a different structure size and
you get that information and you just
search to that manufacturer's list of
chips I typically like to look for ones
that are t-a 48 or 48 pin chips that
would potentially have that same silicon
underneath them and then what I do is I
wire this thing up like it's a t-t 48
plug it into my socket and pick one of
their things and this particular case uh
when you read when you read this in a
Flash Reader two things will happen
either It'll recognize the chip ID
because the first thing it does is it
checks for the chip ID if the chip ID
matches it'll read it out to you turned
out this one actually matched the chip
ID so my first pick was right on the
first time and that's amazing
considering these places produce
hundreds of different types of flash
memory chips if it is wrong and you know
the data of this flash memory matches
the data of what you're looking like the
voltage and all that type of stuff just
tell the chip reader to
ignore uh the actual chip ID and it'll
still read all the data out of it clean
uh and I've done this with dozens of of
different chips many times on these
particular chips I haven't run into this
but I've run into uh certain weird BGA
chips where I was able to do the same
attack uh on those recently about a year
ago uh one of the guys on team go I got
this chip I don't have a socket for it I
don't know what it is they just drop it
in an envelope and ship it to me uh I
get the chip I analyze it I do this type
of attack to it uh and it turned out I
did find a data sheet of the pin outs on
the back side of it enough for that
information and was able to match it up
to a t-o for the Silicon one thing it
kept throwing me it wouldn't read it
wouldn't read wouldn't read so I went
back to not the data sheet but the pin
out the structure it showed it and it
actually lists VC V C1 vcc2 vdd1 vd2
turned out even though the voltages in
the ground were typically uh acceptable
common they were not common inside the
chip body so I actually that's where
those jumpers are on that particular one
so I just jumped it out on my chip
reader to lie to it and add it to two
two new wires for each side of that uh
to to make that
happen so interacting with Hardware yes
is that
separatec power ground is that because
it's a multi chip pack no no no the one
I seen it on wasn't multichip it was
purely a nand flash I just bring that up
because it bit me in the ass on
something else and more than likely if
you're doing this type of stuff you're
going to come across that eventually um
so it was different different Power
different Power different ground they
were split on the chip I don't know why
absolutely no why
uh but it turned out as soon as I
corrected that the chip read instantly
uh in that case I did not have a match
for the tsop style uh silicon but I just
totally just ignore that and it dumped
everything
fine uh and again that paper that paper
that blog I put out goes through the
whole process yes is this the uh
firmware for the whole device or just
the cellular modem itself just the
cellular modem So today we're not
actually going to look at anything on
the device other than the cellular data
and look at that uh the actual get into
the CPU and that flash memory U if
you're doing an overall assessment of a
device you're going to pull that to uh
and look at it but in this case I want
to talk purely cellular how's that
impact these devices what can you look
at how do you interact with
it so extracted firmware uh interacting
with Hardware we're going to dig into
this a little bit so this is not this
particular device but I wanted to share
this kind of approach this approach will
work
on any kind of Hardware you're messing
with and the way it works is so we have
this device they're multi-layer boards
but we have two lay at least two layers
that have V visible components on it how
do we figure out and track things down
so what we do is we
transpose so as you can see we can
transpose both sides on each other and
from there we can identify relationships
between one side of the board and the
next side of the board to help us figure
out where the possible communication
lines are coming from the cellular
module and then we overlay a grid off
the cellular module on top of that
because often not always often if you're
looking at something you go hey here's
art you know or hey here's USB where do
you think that could come to the surface
it's probably not going to do it on this
side it's not going to do it on that
side more than likely it's going to do
it on the side that that data's at one
of the things you think about I don't
even know if I have a picture when
you're looking at these
devices is that and every one of the
cellular modules I've looked at talking
about iot devices that MB iot and the
cat M1
M2 most of the important stuff are
always going to be along the outer edge
of the
Chip And I want to talk about something
but we'll we'll get through this right
now so so we knew where the
communication lines were potentially at
and uh so you can see so if we even go
back
further and we see on this side we see
the wires I've attached to it that's
actually attached to the uart
communication on this particular
device this device wasn't used in USB
for communication it was doing all with
uart with this particular chip but we
wanted to map that out so we get around
to doing
that and uh we need to wire up to it and
if you saw my talk last year where we're
were talking about interchip analysis
uh interchip communication analysis on
iot devices uh one of the things I like
to do especially when we're dealing with
art can't do this with USB but with uart
we can actually cut the runs so what I
do is I cut all the runs between the
main processor and other communication
devices communicating with and
then let's come back here and then I
bring it out to a breakout board and
then from the breakout board has on
andof switch you'll see a one later on
in here from that device there that
gives me the ability so if I want to
inject data into the U communication on
a device if it's fully in circuit you're
not going to be able to do that it's
just going to ignore that the way to do
it is break the connections you let the
device come up the full operation you
throw the switches you have your devices
hooked to it now I can inject data in
and control
components or send other communication
to the through or to the
device so circuit board Communications
so let's kind of break that down so when
we're dealing with
cellular the iot cellular devices now
this may be different on higher end
devices but on these devices you have
two typical Communications you have USB
you have uart they almost always have
two uarts I want to mention that one of
them is a debug art so you can plug into
the debug art it's mostly available and
you can watch the chip boot up it has
some kind of embedded operating system
and you can actually see it boot up the
device I have on the board over there EG
91 comes up with actual log on problem
so if you can get a password you can
actually literally log onto the uh
cellular module when you get into USB
interchip comms there's three standard
types of uh USB Communications there's
what's known as high-speed interchip you
have e USB I've encountered us e USB on
devices that may communicate USB from
one board to another board because
obviously sometimes when you get into
more lower power USB Communications
length is an issue e USB gives you the
ability to do that uh you can go from a
standard board um
USB to an actual uh real USB over a
regular cable back into inner circuit
USB or high-speed NB it's usually called
ESU USB I've seen this actually used on
Communications and solid state drives on
uh certain embedded type devices where
the solid state drive was on a another
board or another system and that was the
first time I came across
ESB uh and then you have standard which
is low speed fast speed and high speed
uh the super speeds I have yet to see
these on an iot
device there's rarely a reason for it um
also the one thing to think about usb
and in chip could easily be a
substandard so high-speed interchip will
be a substandard of 20 so when USB comes
up it basically Cory's out says how many
devices are out there because you can
have multiple devices on USB 2.0 we're
looking at an embedded device you will
not have multiple devices on USB so
sometimes that functionality will not
even be executed because it already
knows the identifi is one because
there's only one device on the bus
U any
questions is this all making sense you
know I do I do live a dark room so
sometimes I always communicate with
humans all the time
so so let's get into USB
Communications so the device I'm using
is a beagle this is not cheap it's about
a $1,300 device I looking for somebody
producing an open source the problem is
if you go out and look at USB sniffers
they're all inline USB sniffers that
means data in data out the back side of
it if you're doing intership
communication which travels 3 cm you
can't stick a device in between plus
it's usually a lower power level so
you'll instantly drain the circuit down
and it quit working all together this
particular vendor and I hunted for a
while this vendor claimed in one of
their data sheets or from a question
from somebody else that you could do
this so I'm like okay I'm willing to G
gamble $1,300 on that it's my company's
money anyways um so I bought one of
these only like a month about two months
a go and I finally got to look at it
like 3 weeks ago so about 3 weeks ago I
was looking at this Final Phase of this
uh and this particular case you see uh
you see these devices sorry I'm going
get in here so you see this hooked up
right
here it turns out for uh the USB sniffer
to work it has to detect V uh uh the
basically has to detect
vbus so normally on USB cables you have
ground you have vbus 5 volts and then
you have have D minus D+ which is the
data lines when you look on the chips uh
vbus is never brought to the surface
it's underneath the chip so you can't
even tap into it most of the time uh not
easily uh I may mention another method
here in a little bit uh to potentially
get access to it so you just lie to the
Beagle so I set up a 5volt power supply
in this case I just used a a 5vt power
supply you little when you plug in and I
just hook five volts to it so it says
yeah there's a device there of course uh
it works pretty
good so but to connect to it you can't
connect right to the USB lines you'll
instantly overwhelm it so the vendor
says you need to put a 20 to 40 Ohm
resistor in there so the best way to do
that was let's just wire it onto the
board so I went ahead and I soldered in
so this is the bus here and it had two
resistors in line was interesting so I'm
looking at that I'm like hey there's two
resistors in line I've seen that before
those resistors measure at zero
ohms so I'm not sure what their purposes
in this particular case um maybe it was
to just disconnect the circuit all
together at one time and that was just
being used as jumpers uh so I add it to
33 33 ohm resistors in there and I wired
the device up to it hooked the device up
to it hooked it into my device now let's
go ahead and do a demo so we can see
this thing working so this is a live
demo
no chickens lost their life in this
process so I'm not sure if it's going to
work uh but we'll
see looks like I'm gonna have to end the
show
okay okay what we got here this will be
small but I'll blow it up as we start
getting real data so we're actually
connected to it right now and you'll see
some stuff take place so uh this is the
rig I have right here uh and it happens
to be one of these it's a cellular uh
field camera that we got hooked up and
let's see if I turn it on whether it'll
come on oh yes it did come on so we
starting to see things happen here got
to wait up the USB is actually doing
this game uh as it Powers up and the CPU
Powers up and it starts communic ating
with the device and boom we're actually
communicating the device so if we come
over here and I
select um filter only on data now we get
to communication
data so we can see there's a a lot going
on here um we can see it past this data
right here
um so we can see it sending Bill mode
information upgrade information is
checking all this stuff out to the
actual device now this device will
actually connect out to Amazon S3 Cloud
um this may take a minute it's set up to
detect motion but it's kind of odd and
slow at it hey you know it is a field
camera isn't a smartest thing in the
world but
uh but we can see the data continue
flowing uh billing and you see a lot of
commands here um data being passed
different commands and C status let me
find one that's more
interesting
um here we go this is actually the
modem uh validating connections to the
actual Services out there um so we got
that and interesting some of it's boring
but uh there's a lot of data in here and
you get to see the entire functionality
of this device communicating between the
primary CPU let me see if we can find
something else that makes sense okay
here we go we can see this this is
actually um and you'll know this is the
actual service MCM i. us like you would
call Verizon this is calling out to this
service
here so there's a bunch of data in here
and uh and we're going to get into some
interesting things in a minute let's see
if this thing I'm hoping it'll actually
take an image but it never does it when
I want it to so we're going to move on
with the presentation and then we're
going to come yes so I have several
question number one what tool is that
that you're using this tool is the one
put out by the uh what's the name of the
company total total phase it's for their
products uh multiple products will
actually work in this but uh does it C
to like hand Shades right now and can
you save up yes so you can save all this
data out in in comma delimitate format
for parsing later uh you can also uh I
read a reference where one of the guys
had he didn't share it but he wrote a
script to convert this data into pcap
structure and then import it into wi
shark so it would be possible uh to do
that and potentially pull the graphic
images or uh the videos or things out of
the actual Communications so you have
that data so we're going to talk about
some attack vectors that I have not done
um that are potentially there as we kind
of move on but let me see if I can get
the slide deck back up if I can figure
out where it's
at and we can uh slideshow uh play from
current slide and we're going to let
this run um and kind of move on and come
back to this I'll be back over in a
second doing something else so the next
thing I want to talk to you about is how
do you control as You' seen you saw in
that picture how do you control a
cellular modem you control it with modem
commands AT commands uh they're very
customized uh so they're not the old
Haze modem ones at least not all of them
there may be some like that in there and
it it varies based on the product and
the vendor and stuff like that um you
could do file Services you could do
firewall and socket services on these
FTP Services mqt
HTTP we're actually going to take this
field camera and we're actually going to
download a web page with it here in a
few minutes by passing commands yes sir
is there a relationship between the AT
commands and the like three digigit
numeric commands that go with a with a
star or pound sign that maybe can get
various data out of your cell phones
controller I'm not familiar with that no
sorry I haven't seen that this whole
listic command so uh I will be I will be
releasing so I'm working on a paper
right now where we document some of
these processes and thought patterns and
stuff like that hopefully before Defcon
at the same time I'm going to be
releasing some Python scripts that you
can use on these devices so one of the
things we found out and and like on this
device what we did was we took all the
at manuals that were available online I
need to double check we got them all we
downloaded those and parsed all the AT
commands out of those and put it in a
automated python script so you can
actually if you want to know what the
command structures are you can read the
manuals or go online and search but if
you want to know what's available you
can actually make
requests with with basically this Python
scripts to the device and it'll test
every one of the commands and give you
the command structure back so you can
ask what the structure of the command
should be it'll give you that data um
and you can also run it to actually pull
the data that's actually stored on the
cellular modem off and we've kind of
automated all that to give you
everything and then we also created uh
some some weird fuzzing script so
basically you can go you can type in the
name of the command and it'll actually
query the device tell you what the
command structure is you can say all
that's four variables you say I want to
fuzz four variables or I want to fuzz
and it'll go which ones you want to fuzz
and you go I just want to fuzz one and
three and then it'll let you fill in
everything uh with the data you want and
then you can feed a fuzz file into it to
just start dumping data into a
particular uh command structure um we
haven't found anything interesting doing
that but we haven't really sented any
real fuzz any really workable fuzz data
it was just proof of concept let's see
if we can even do this usually I just
overwhelm the modem and crash it um so
you have to put timing in there and
figure out what the timing is to make it
work better uh we're going to talk about
some other stuff so let's uh so uh
you're an injection so to be able to do
this uh what we did was as I mentioned
before yes so about the fuzing um what
kind of fuzzing do you do do you just
use more um already existing messages
yeah it would be it would be the command
structure this this fuzzing here we're
talking about is using the command
structure that's available at command
structure that's available in the modem
yeah we can set it up to automate so
we've automated all that and say hey
this particular variable or value for
this command we want you to feed all
this data into it one after another and
record the response back so we record
all the response back and put it out
into a file um again the data we were
sending into it was not interesting fuzz
data it was just a test file with junk
in it uh just to make sure we get the
process working so uh Ur injection
commands so in this particular case we
did we we traced out the runs from the
module we went ahead and we uh cut the
runs cut the actual runs here routed it
out to a breakout board where we
actually have the circuit turned off uh
the cool thing with this device now when
you encounter these devices there's two
ways for it to take data or Comm and
commands you'll never have them do them
both it's either
USB or It's
uart the weird thing with this is the
first device I've seen that had USB but
the uart was still connected even though
it wasn't using it so since the CPU
really wasn't communicating anything we
just break the circuit but the modem
would still respond back over the UR and
tell us when it's ready or any commands
we send to it and all that stuff by
cutting the runs it give us the ability
to get in there if for
chance it isn't connected which is
common if it's all USB the uart may not
be connected so getting commands in is
more problematic so how would you do
that um if underneath the chip
body it was those those connections were
not connected Well turns out like I
mention all of those exist around the
outer edge and we found out through
testing and it'll be in the paper where
I show this on
smaller devices like we looked at like a
BG 95 as an
example those land runs were closer to
the edge and we were able to insert um
acupuncture needles underneath the chip
B body to gain access to those circuits
that weren't available to us and it
worked now we tried it on the larger 91s
it's more problematic because it was 3
mm in about 3 millim in before the land
grid started and the chip the way it was
slightly bowed so it was closed and we
couldn't get to it now I did attempt to
method of actually side drilling right
where the two meet but I couldn't get
any kind of real Precision with that and
all I did was just maim bunch of boards
and chips and wasn't successful I wasn't
about to try plugging stuff up to this
because I did way too much damage to it
using pin VI with with uh uh with drill
bits that were really small and no
matter what they still tore things up
too much I need a more finer hole to be
able to make this successful because
because we also test it Tak taking the
needles and actually coating them with
um um with solder mask and UV in them so
that they wouldn't short out as an
example too uh total fail yes sir I
wonder if a high power laser might work
to Blade away two laser right in the
right spot blast yeah so the big thing
is you got a multi-layer board so you
got to be careful about hitting one of
the layers in there and then you have
typically the ground planes sitting
there uh also on the main board and you
got to worry about that now for the ones
where we were just able to enter the
needle we use Captain tape covered the
board with Captain tape and then slid
the needle AC cross that and we're able
to put it in without shoren out the
components so let's go ahead and look at
this oh we're running out of time this
getting close to finishing up but I want
to talk about some of the
stuff
okay let's end this show
again so we should be hooked
up okay so I'm hooked to the uart so
you've seen the thing go ready power
down power down is the power management
system kicking in powering it down on
its own but I can bring
this back
up oh it's back up already there it goes
start back up uh and I just wanted to
run a couple commands to show that we're
able to do that don't do that to
me okay so it's ready so now we can just
enter at commands on this device uh
comes back okay we we can actually send
data there we can get information about
the band that's connected to uh on the
device uh let me see if I get this
smaller there we go um let's come over
these commands get what's that is are
these commands going through the UR yes
they are these commands are going into
the art we're able to attach to the art
let me shrink this thing down because
I'm not typing these commands um what
speeds are typical for the
UR uh I you know I've seen I've seen 9
600 uh actually used remember a lot of
these devices that just use the uart
aren't moving massive amounts of data
it's just cimin data so they'll do it
low but almost always
115200
um and let's let's let's look at another
one
so another command see if it hasn't shut
down yet hasn't shut down that one gave
me an error because I copied a t in
there so
at plus uh c g d
c o n and this basically I don't know
why it's turning back in air on that one
that's kind of odd uh let's go ahead and
try it it's possibility something ain't
working on it but we'll check so um so
uh with that we can send all the AT
commands available this device had a
bunch of commands that weren't in the
actual
manual um so what we're going to do is
uh let's see if this will work if we can
get it before it shuts down on us
so we're going to actually connect it
out we're actually going to point it to
a
website okay and
then now we can do this before it goes
to power
down U there we go HTTP
get there we go so we're actually able
to take this
[Applause]
device so we can do we can do FTP
connections with this um let's uh real
quick let's jump back over to the actual
um this device here
and asky data and I want to look
at
bucket I'm hoping actually move some
data yes it did so now we move some data
so now if we come down here look at this
is that one it is that it here we go
let's look at this one I'm not going to
look at all the data because that would
like give you all my freaking Keys um so
you can see we're actually connecting
out we have a client ID so now we know I
my client ID secret access
keys that we have there well let's uh
kind of go up to the other one one let's
see if this one will give it to me no
that won't one of
these well I don't want to give you all
my keys but as you can see we actually
connected out I thought this would show
me the
uh hold up a
second no let's come over here but it
should show U you can get more of my
keys you got it all yet so we can get
all the keys but it actually connects
out to the S3 bucket um and it
it's all the data so that gives us a lot
of information from a security
standpoint if we want to be able to test
uh actual
devices and we're going talk about that
before I get shut down here in 10
minutes play from current slide because
this so we have some things so we know
we can get this device to connect out uh
and do some stuff there but the truth is
and I haven't done this yet because I
haven't had time
one of the things in this particular
guys I could get to anywhere on the
internet okay often what we run into
with some of these devices or some of
these Services they actually have
private vlam connections on the cell
okay that means the backend data cloud
data or or private clouds are not
accessible from the Internet only from
these devices I've seen devices doing
that it's not uncommon that's this is
cheap Chinese stuff so they don't care
so what can can we do so from an
attacker perspective or a security
tester perspective because that's the
direction I come from if I'm testing a
product's overall
ecosystem how do I get to those backend
systems by doing what we did now we're
on that modem I can send commands to it
and potentially gain access into that
private VLAN through the device its
actual self and one of the things I
haven't tested yet completely is this
particular device also has this qio open
where I can set up
sockets so when I get back home I
already started the Python program for
this we're actually going to turn this
into a port scanner where we tack into
the uart and we can port scan the
backend virtual
environment it'll be slow as hell trust
me but the goal is is if I'm being paid
to assess your security of your overall
products ecosystem I want to look at the
whole ecosystem and I want to make sure
certain things so what would I be
thinking about to look for one those
keys that were being set up to gain that
access are they unique or is the same
key and authentication into that service
identical across multiple products and
then the only identifier is you know the
individual device number or if the
device can connect out even with
different Keys how much that virtual
environment
shared you know because is it a real
private VLAN per device some
manufacturers do that I've seen I know a
couple of them that actually do that and
do it right but if they AR doing it
right and it's a shared back in
environment instantly it's a risk
because now I could purchase your device
use that as a tunnel and then this is
nothing but a cell
modem okay on a device there's nothing
saying I can't pull the SIM card off
that pull the data we just seen go out
plug all that information basically into
a development board set up uh USB net
this device actually uses USB net to set
up a connection for the underlying
operating system to be able to pass data
it's just not none of it's encrypted so
we're able to see it all but it's
Network actual data um so you could
easily do that basically turn a
development board into a network
interface card using all this data and
then I have full access via the network
that is for devices that pass large
amounts of data and follow the USB net
setup function if they don't do that and
just move Telemetry data the attack
Vector becomes more complex smaller
devices may not have all these functions
but if there's any functions that you
can control to set up on that modem you
can turn that into a port scanner the
FTP can be turned into a port scanner
cuz because all we want to know is go
hey am I getting a live connection
doesn't matter if it gives me any useful
data if it times out and gives me no
connection we know there's nothing there
so it's all based on back error messages
and timeouts I can literally port scan
an entire environment doing this no
matter what features are available if
there any communication features that I
can
control so here's some references um the
paper on intership Communications I
released last
couple years ago I spoke here last year
on that check out the paper I think it's
a great write up on how that all works
and we were released a proof of concept
called a care and proxy which basically
gives us the ability to cut art
connections route them out to a breakout
board and turn and set a proxy on top of
it we can control all the flow capture
data replay it and inject your own data
automatically or actually replay data
and have it say you see this bit
sequence replace it with this be bit
sequence um and again it's still a proof
of concept so any questions because
we're kind of like at the
end yes have you looked
Ates
usell this no I have not you know anyone
will give me
some in five years I will give you one
okay okay yes sir so maybe I didn't
catch it so apologies in advance if and
I'm asking again I saw your board and
how you have very tiny wires and how you
did the soldering with Precision under
microscope uh how fin tip did the
soldering iron have to be to be able to
work at such a small scale mine's 0. 2
millimeters 2 millime 2 millimeters I
have a I have a my rig's like $1200 rig
so it has a micro iron for doing that
stuff the the Saving Grace I've done it
with a hackos it'll work the balls that
I put on there is the winning part so
what I do is I take the wires I put
solder on it and I run the wire in those
wires are covered with lacquer I burn
the lacquer off and Tin them then I clip
it under a microscope so I'm left with
just like a0 mill1 millimet on there and
I stick it against the ball and then
just tap it with an iron and it
instantly sets up and then I hold it in
place with uh E6000 flexible glue plb
the soer on the wire and then you kind
of he up the you don't have to do that I
do that just to avoid some issues
because I want to make it quick so when
you're when you're working you've seen
the chip when you're working with
something that small and you hold an
iron on there for more than a couple
milliseconds who knows what damage and
if you want to get good at it I always
tell people do what I do drink like
three or four big things of coffee
before you start and when you learn to
control your hands in that condition you
got it mastered
well I'm almost out of time uh also I
want to point out what we demoed today
is not a disc against this product
manufacturer now I haven't put the
product out there told you what the
product is but they have really I have
not looked at them from a security
standpoint nor tested their product from
the security standpoint this is p purely
a functional demonstration of how
technology works and how you can
leverage the normal functionality of
technology for a potential method for
attacks or security testing so uh don't
go out there and say oh these
manufacturers are doing it wrong you
know most of them are not they're doing
it based on how the technology works and
us as hackers what's our job to take
that technology and use it to our
advantage so thank you very much I
appreciate