hey everyone
ryan here again with the cactus con crew
and this is actually
our last talk of the conference so this
is the last
q a session i'm here with tracy who just
gave an awesome talk tracy hello and
thank you for being with us
hey thanks for having me heck yeah
i am going to run a couple of our
giveaways real quick for folks
and then we'll get to your talk
all right so here's a little giveaway
for cactus con 8 hardware badges we have
two of them available
and they are going to
burman and walmart i had to chuckle on
that name
and walmart all right and next up we
have the complete
boot rogue strategy guide we have two
more of those available
we did because now they're gone and they
are going to
oh how do you pronounce that serrano
tama
sure i'm sure i butchered that and i
won't even try that one
says bully awesome
so congrats to those folks we have one
more thing to give away and that was the
final two copies
of the physical signed ted demopolis's
infosec rockstar book and those are
going out too
well look at that we have a repeat
winner from the very last giveaway
i just did serena tama that's how i'm
gonna pronounce that
oh cleaning up shop all right cool and
then spike
roach or spike roche one of those two uh
thank you everyone uh who put in for
those giveaways keep in mind we have
another giveaway
we have two more actually coming up in
our closing ceremonies please be there
we'll be giving away that free sans
course
so tracy uh where did you get the idea
for this talk what like originally
kicked it into you're like this this is
what i want to present on
uh so if anyone has been kind of
following me
on twitter you'll know that iot is a bit
newish to me
um so i kind of crash-landed into iot so
a lot of this was when
i started doing iot secure analysis i
wanted to think like a hacker and the
thing that any hacker knows is you want
to go for your biggest blast radius with
your lowest amount of effort
and mqtt is really interesting in that
way because if you guys remember the old
hub and spoke networks
it's very much like that you have a very
central vulnerability because you have
one central server that does a lot of
things
to a lot of things and so i started
looking into how to attack mqtt
and more importantly for my job how to
secure it um and i got to
talking to some other folks that i know
that have been veterans in this industry
and they said what's an mqtt
and i thought well i bet if they don't
know it there's some other folks out
there that don't know it
and so i made a talk and here we are
i love that you mentioned that because
as we were talking about offline i saw
your tweet recently
where you basically were saying i'm
paraphrasing your your own words so
maybe i
just added but you know when you're
saying i normally wouldn't do talks in
the past but
i've been at conferences or i've heard
people asking questions and essentially
realize well i know about that and if
they didn't know about that why
can't i just present on that so i love
that attitude awesome
awesome well and you know i
i i started running a con here in
seattle and that actually
changed my perspective on a lot of
things i think i always thought that
in order to present at a con i had to be
the person coming out on def con
stage dropping oday you know like the
latest of the elite
the only thing i was it was me and god
who knew that specific you know
vulnerability
and then i actually started thinking
that there's a lot of space in infosec
for folks that
aren't doing advanced research aren't
doing o days are doing you know
pretty normal stuff every day and those
are the talks that actually influence
my work the most because i don't do
advanced research
detection or advanced you know malware
development that's not what i do
i like that you say that too because
like personally i tell people all the
time i'll
i don't think i'll ever personally be on
the defcon stage um i got to do a defcon
workshop and that's because i realized i
can just do a workshop
i teach people i train people all the
time like that's what i just wanted to
live and breathe
right but the fella or the gal or the
person dropping o days that's that's not
me so i love that i mean you and i think
very similarly in that like let me just
show you this cool stuff that
i i learned um i've also sometimes in
the past
submitted talks for things i didn't know
how to do and then just so that when
they accept it i'm like all right well
i need to learn now time to learn
we had a pretty good question in the
chat that came up and
the question was are there any apts that
are targeting iot devices
on nqtt and then a reference essentially
after that to the mirai botnet
yeah so the interesting thing is most of
the mqtt
botnets and i'm going to use that term
in a very squishy way
um go after denial of service because
mqtt one of the easiest things to do is
to overwhelm the broker
there hasn't been like a ton
of what i would call super advanced
level like let's go after mqtt
and make all your light bulbs explode um
like things like that but i mean if you
can kind of wargame it out that is the
potential that we see in front of us
right like
you have a bunch of mqtt brokers that
are poorly configured
a bunch of iot devices that are also
poorly configured it's just kind of a
recipe for disaster
i like it working as an ir consultant we
often
run into exactly you know the blast
radius trying to get the
biggest bang for your buck you know it
makes me think of general like exploit
kits and mouse bam campaigns and just
throw it out there and just you know see
what happens so i i like
the overall idea of how you approach it
think like a hacker
right and that's how you're successful
in researching and or
thwarting a lot of the stuff so you
mentioned you haven't been along into
iot what got what really got you into
iot was there a specific
thing or inventor um you know it's
really funny
um pure coincidence i think and i'm
sorry my cat just broke into my office
so i guess you're gonna drive
for q a um sorry she's very
not okay with being left out of anything
so um
so i kind of fell into q a or to iot
sorry
um this job opened up and i had done
um missile defense systems which is sort
of like the pre-iot
if you will like back before there was
the internet of things there was just
the industrial
internet of things um and so i had some
experience with that but i'd spent most
of my career doing
um more traditional apsec i worked for
microsoft doing
office msrc work i worked doing tooling
i've done a bunch of different things
but um this opportunity kind of
cross-sected my life and i thought why
not um
i can in fact i went in and i told all
my friends i said i'll probably screw
this up and i'll probably get fired in
the first six months but
in six months i will know more than i
did six months ago so
i like it i like that a lot it shows
that uh it's just become a passion
out of you know in general curiosity
kind of got
you and folks like us to really jump
into the deep end you know
uh here's a good question can our
community convince the manufacturers of
the iot devices
to recommend network segmentation to
their customers
can we can we recommend it sure um i
think there's a lot of body regulatory
guidance out there that already
recommends it um
i think though that i mean this is the
same fight
i always tell people being in it iot is
a lot like being in i.t
in like the mid-2000s um where
everything was just sort of
a clown rodeo and it was like no
passwords on anything
and no you know nothing was segmented it
was a completely flat network i mean
it's very much
it's almost deja vu like and so it's
very much an evolution
of maturity and engineering cycles
and you know getting these devices that
are
manufactured at sometimes a couple
dollars apiece
getting them to include security
features is a hard sell because
consumers won't pay the difference and
they just won't historically
they won't so that falls back on
providers of cloud services providers of
connectivity services
to make it easier for those
manufacturers to do the right thing to
do the secure thing
and keep the cost to a way that they can
still be profitable
you know i purchased uh i guess i won't
say the company i won't bust them out
but i purchased that
unit uh eight or twelve camera we had
some break-ins at my our previous
residence we first moved in we were
greeted 30 days in we had our door
kicked in like that's cool
welcome to the neighborhood and uh i
installed the camera system
after we installed it all and then hit
the receiver and all this
stuff we then found out the password
was can only be only there were no other
options
but to have a six digit password that
was the only option
so it didn't really matter what
permutation i chose it was insecure is
all
the remote capability to it was always
enabled if it was
internet connected whatsoever and i'm
like cool so
so i can watch my house while i'm at
work to feel secure
but so can everyone else like yeah
um and i do this for a living and this
was sort of one of those
dope moments that i had everyone knows
you should segment your iot right like
you shouldn't have it on the same
land as like your computers and
everything else sorry
you are annoying i don't know if you
know this um
so i you know in the best of
intentions i should probably get around
to doing that
and uh started in my google home
wi-fi and realized that you have guest
wi-fi
and not guest wi-fi and those are your
two options that's it
so you know it's we don't make it easy
for consumers to
do this we don't make it obvious what to
do or how to do it
um and like we i was talking to another
engineer on my team the other day he had
restricted udp outbound on his on his
home router
and his smart plug stopped working why
because it had a uvp keep alive beacon
that homed back to shinzon
that said hey i'm still here keep me
alive he's like i don't know what it's
doing or what they're getting from it
but it will not work unless i allow
udp outbound and it's you know there's
just so much in the network that we
don't know about
and i think for not security people
it can be almost overwhelming that was a
really long answer to a very
very short question i apologize you're
you're perfectly fine but what you just
made me think of as a potential attack
if they have an in
a udp based packet coming in with
whatever data that basically
says you're okay to continue running
what would stop someone from sending one
that says you're not
okay to continue running exactly and
then saying that and then
all anyway you know yeah exactly and
that's
but that's you know now if you
extrapolate that out to
manufacturers who use the same you know
if you listen to the talk you'll hear me
say a lot about using certificate based
auth and tls
and that's great except you'll find that
many manufacturers use the same
certificate
for hundreds of thousands of devices and
and they put it in non-protected memory
so i can buy
you know camera a and camera b and steal
the certificate off it
and pretend like camera b is now camera
a and it's virtually indistinguishable
yeah that that uh gives me the warm and
fuzzy i mean we're fine everything's
fine
everything's fine everything's fine it's
fine yeah i think the
the scary thing for me is like the
future in terms of
how much more prevalent iot is going to
become
i mean you look at it now right if we
held we have shoelaces that connect to
the internet at this point
come on what so anywho tracy thank you
very much for your time thank you for
your talk
thank you for hanging out with me here
to do our q a and we're going to
uh kick off now anything you want to end
with
uh if you want to give a shout out to
your conference
oh yeah uh for folks that
have followed me on twitter
that defend con has gone now for three
years we took
2020 we're trying really hopefully in
meet space whenever
everything is over but check us out at
defendcon.org or you can follow us on
twitter at defence
or you can follow me on twitter at
securitychick and you'll get all the
information
on i think a really cool con here up in
seattle which is actually how i met jess
who is part of the cactus con crew so
and i learned about cactus con because
of jess
also jess is a very important staff
member in terms of just general
networking so very cool thank you very
much again
and hey appreciate it thanks for having