The Internet of Things is made of circuit boards with hardware operating systems called firmware. Many of these devices are just the basic chipset and were not conceived to connect to the Internet—hospital monitors, remote telemetry units– yet they are being made to do so today in increasing numbers. Even the devices designed to connect to the Internet—closed-circuit cameras, baby monitors–have their flaws. Consistent in almost all is the ability to accept rogue firmware updates without question.
Presenting this week at the annual RSA Conference held in San Francisco, Ang Cui and Salvatore Stolfo, both of Red Balloon Security, announced multiple vulnerabilities in the Avaya ONE X Voice over IP (VoIP) phone system. Exploitation, they said, can lead to general mayhem, including turning the phone into a listening post, propagating malware to other phones, and then propagating malware to other embedded devices that the phone can reach on the network such as printers or routers.
Cui and Stolfo presented similar VoIP vulnerabilities found within the Cisco 7900 series phones at the Amphion Forum San Francisco in 2012. For that attack one first needed to physically attach a dongle to the phone. Once compromised, the phone would then eavesdrop on conversations within the room — even when the phone was not off the hook.
For this new attack, the pair said they could remotely compromise devices as well as other devices on the corporate network. For example, a Fortune 500 company might receive a maliciously coded resume over the Internet and — in the time it takes the hiring manager to print that document — fully compromise the corporate network with rootkits on various embedded devices. In other words not only has the printer been compromised in this attack, but also other embedded systems devices on the corporate network such as vulnerable VoIP phones on desks throughout the office.
Cui described the exploitation of one of the Avaya vulnerabilities as simple, almost trivial. “I can fit the entire attack information on a Post-It note,” he said. “The barrier to entry here is very, very low. So the probability that no one has found this vulnerability in my opinion is very low, right. But we’re the very first people to have actually publicized this one. In my mind it’s entirely plausible that someone has exploited this vulnerability before.”
Cui said he’s been disclosing details of the vulnerability to the vendor and not the public. In an email, Deborah Kline, Corporate Communications, North America and Global Technology PR for Avaya confirmed “We are aware of the issue and committed to delivering a fix no later than March 1, 2014.”
The malicious resume example above allows the attacker to gain a foothold in the corporate network by creating a reverse IP tunnel. With that the attacker may now send remote commands to the printer such as scanning MAC addresses to identify specific known device vulnerabilities. When the attacker attempts to SSH into a vulnerable phone, the attacker could then use ARP poisoning to convince the phone that the compromised printer is able to provide it firmware updates. Using a second reverse IP tunnel on the printer, the attacker would then use Trivial File Transfer Protocol (TFTP) to install a rootkit on the desktop phones within the Fortune 500 office.
Once a device or series of devices have been compromised, how would an attacker exfiltrate the data?
Cui said he’s found a way for any device to broadcast data in a surreptitious way. “We came up with this technique that essentially turns a very standard PC circuit boards that you find in all kinds of embedded devices into improvised radio transmitters,” he said. “So I’m not using the wireless chip set, I’m not using anything that’s meant to be an RF transmitter. I’m using code, software that basically forces the existing circuit board to act like an ad hoc transmitter. And this is something that an attacker can use to transmit a signal out the window, for example, and sneak all sorts of sources of data out. It’s very difficult to detect at the moment.”
In fact, proactive detection is a big problem because of the random nature of these attacks. The attacker could be using any part of the electromagnetic spectrum to broadcast the data. This easily defeats current methods of protection and detection.
“The way we’re doing this isn’t by using any traditional means like network penetration,” Cui said. Citing TEMPEST, a National Security Agency codename for methods used to spy upon others and also to shield equipment from leaking unintentional radio or electrical signals, sounds, or vibrations in the glass of an office building, Cui said he’s reversing that by intentionally causing printers, VoIP phones, and routers to emanate data as one way for a bad guy to exfiltrate data. A single injection of rather trivial code, he said, could turn an ordinary chip into something that can broadcast data remotely—even through brick walls. Because the electromagnetic spectrum is large, network admins wouldn’t know where to look to detect the leak.
But Salvatore Stolfo said Cui and his team weren’t just attacking printers and VoIP phones for fun at RSA, they were also attempting to drive home seriousness of attacking the IoT infrastructure, whether its printers in the office or monitors on a SCADA network.
At RSA Red Balloon showed the resume attack as described above but then repeat that attack with a security solution known as <a href=”http://www.redballoonsecurity.com/technology.html”>Symbiote</a> created by his company in place on the device. Symbiote is special code included within the vendor’s firmware and it basically protects a device against rogue updates. If the vendor ever wants to ship a new feature set via firmware, then a new piece of Symbiote is included with that update.
As for getting the device to broadcast without a radio transmitter, Stolfo said there could be benefits to that, too. “If you think of all the SCADA devices that are already distributed through plants and what not– the cost of wiring all that stuff would be enormous for any kind of a monitoring infrastructure,” he said. “So simple broadcasting would be a dramatic reduction in costs.” A utility worker could swipe the device and know its status instantly.
But just how prevalent are these attacks if they are so simple? To find out Cui and Stolfo also announced at RSA their Advanced Embedded Security Ops (AESOPs), a program designed to monitor how prevalent these attacks might be in the real world.
“What we’re going to do,” Cui said, “is supply equipment to one of our strategic partners, place it in their network—albeit a phone, a printer or a router—and we will sense over some period of time whether or not they’ve been exploited without them knowing it. It’s very likely that there’s lots of exploitation going on in the wild that no one’s aware of. We have been easily spotting all these vulnerabilities and the bad guys have too. They’re not ethical researchers who will report these to the vendor, they’re going to use them. And so we want to place these sensors at particular locations both in government and in large enterprises to determine whether or not our thesis is correct: that there are a lot of embedded devices out there that are under attack continuously.”
Originally appeared in DeviceLine
