![Page 1: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/1.jpg)
Dr.$Samuel$Liles$
Digital$forensics$and$the$$Internet$of$Things$
Associate$Professor$
![Page 2: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/2.jpg)
Who$am$I?$$
• Nobody$special,$Nobody$important$– Purdue$Professor$and$Dr.$of$DFIR$– NonCtradiDonal$career$track$(Marine,$Cop,$IT/IR,$Higher$Ed,$next?)$
• Blog:$hPp://selil.com$$
• TwiPer:$@selil$
• Goal$I$just$want$to$have$a$conversaDon$
Slides$located$at$hPp://selil.com$
![Page 3: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/3.jpg)
Forensics$
• RelaDng$to$or$denoDng$the$applicaDon$of$scienDfic$methods$and$techniques$to$the$legal$process.$
• The$applicaDon$of$science$to$the$finding$of$fact$for$use$in$a$court$of$law$or$by$the$state$to$compel.$$
• My$students$and$I$do$forensic$analysis$of$stuff$classified$as$the$Internet$of$Things$
Slides$located$at$hPp://selil.com$
![Page 4: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/4.jpg)
Technology$
• Technology,$the$study$of$the$art$and$craY$of$doing$work$with$tools$
• Technologist,$a$person$who$enhances$the$quality,$efficiency,$or$capability$of$work$through$tools$
• Mission!$Study$the$art$and$craY$of$doing$forensic$analysis$on$the$Internet$of$Things$with$bePer$quality,$efficiency,$and$enhance$the$capability$of$the$forensic$community$
Slides$located$at$hPp://selil.com$
![Page 5: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/5.jpg)
Internet$of$Things$
• The$next$big$thing?$• Baloney?$• What$was$all$that$TCP/IP$connected$stuff$called$before$IoT?$
• The$peeping$Tom$in$your$thermostat?$
$Dear$Abby,$my$thermostat$is$asking$a$Chinese$ZeusBot$for$relaDonship$advice$with$my$refrigerator.$Should$I$intervene?$
Slides$located$at$hPp://selil.com$
![Page 6: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/6.jpg)
Internet$of$Things$
• RFID$• Sensors$• Actuators$• Devices$• Mobile$phones$• Tablets$• Medical$devices$• GPS$devices$• Auto$entertainment$
systems$• Auto$driving$assist$or$control$systems$
• Industrial$Control$Systems$
• Autopilot$collision$avoidance$systems$
• Need$not$be$a$physical$instanDaDon$
Slides$located$at$hPp://selil.com$
![Page 7: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/7.jpg)
Source$the$Internet$
Slides$located$at$hPp://selil.com$
![Page 8: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/8.jpg)
Controlling$the$edge$
• Generally$open$architectures$and$connecDon$types$
• Sensors$and$actuators$represent$the$real$world$connecDvity$via$the$digital$domain$
• Localized$behaviors$are$globally$connected$• Protocols$are$oYen$“esoteric”$
Slides$located$at$hPp://selil.com$
![Page 9: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/9.jpg)
ICS/DCS/BCS$
• “You$guys$over$in$IT$really$don’t$get$industrial$control$systems.”$$
• MODBUS,$DNP3,$other$ICS$protocols$are$found$in$Wireshark,$Metasploit$and$other$“hacker”$tools.$$
• Nessus$and$NMAP$have$detecDon$rules$
• “We$found$your$SCADA$system$on$the$Internet”$–$xoxo$Shodan$
Slides$located$at$hPp://selil.com$
![Page 10: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/10.jpg)
Slides$located$at$hPp://selil.com$
![Page 11: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/11.jpg)
IoT$risk$is$not$necessary$predicted$by$the$previous$paPern$of$informaDon$technology$risk.$That$being$said$what$did$that$look$like$as$the$technology$was$adopted?$$
Slides$located$at$hPp://selil.com$
![Page 12: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/12.jpg)
MITRE$CVE$1999$to$2011$
12$Slides$located$at$hPp://selil.com$
![Page 13: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/13.jpg)
Just because somebody always wants to blow stuff up"
Slides$located$at$hPp://selil.com$
![Page 14: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/14.jpg)
April 22, 1992 Guadalajara explosions"
• Gasoline explosions in the sewer systems over 4 hour period destroys 8 km of streets"
• 252 people killed, 500 injured"• Zinc coated iron pipes built next to steel pipes
resulted in corrosion"• Sewer designed to evacuate fluids, but not
gasses (fumes)"
Slides$located$at$hPp://selil.com$
![Page 15: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/15.jpg)
That can’t happen!"
Do$I$hear$an$IoT$fudasDc$story$about$to$happen?$$
Slides$located$at$hPp://selil.com$
![Page 16: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/16.jpg)
16$
![Page 17: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/17.jpg)
Slides$located$at$hPp://selil.com$
![Page 18: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/18.jpg)
Discussion"• Wireless"• Physically accessible"• Minimal security"• Replicable"• Requirements for operation
contrary to security"
Slides$located$at$hPp://selil.com$
![Page 19: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/19.jpg)
![Page 20: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/20.jpg)
Reality?$
• You$need$moDve,$means$AND$opportunity$to$do$something$bad.$
• Just$because$it$is$possible$does$not$mean$it$is$probable.$
• Can$does$not$mean$will$happen.$• At$the$individual,$personal,$family$level…$– Risk$is$money,$privacy,$and$safety$not$incidents$of$naDonal$significance$
Slides$located$at$hPp://selil.com$
![Page 21: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/21.jpg)
Money..$
• Not$all$Internet$connected$devices$are$for$your$benefit.$
• Currently$ATM$card$skimmers$are$a$great$way$to$steal$both$the$card$data$and$PIN$you$uDlize$
• Watch$for$the$sideways$aPack….$$hPp://krebsonsecurity.com/2010/02/atmCskimmersCpartCii/$hPp://consumerist.com/2009/04/19/heresCwhatCaCcardCskimmerClooksClikeConCanCatm/$hPp://www.geek.com/chips/criminalsCstartCusingC3dCprinDngCtoCmakeCbePerCatmCskimmersC1567392/$
$$
Slides$located$at$hPp://selil.com$
![Page 22: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/22.jpg)
Money…$
Image$Source:$hPp://www.bootsnall.com/arDcles/10C04/atmCskimmersChowCtoCprotectCyourself.html$
Slides$located$at$hPp://selil.com$
![Page 23: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/23.jpg)
Money…$
• Everybody$likes$money$$
• Credit$card$related$breaches$are$in$the$news$• Credit$cards$work$exactly$as$they$were$designed$• As$they$get$smarter$they$join$the$IoT$world$$
• The$issue$is$not$with$the$credit$card$so$much$as$it$is$with$the$system$of$using$credit$cards$
• Any$significantly$complex$system$can$be$used$exactly$as$designed$for$nefarious$purposes$
Slides$located$at$hPp://selil.com$
![Page 24: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/24.jpg)
Slides$located$at$hPp://selil.com$
![Page 25: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/25.jpg)
Privacy…$
December$21,$2011$“Chinese$hack$into$US$Chamber$of$Commerce,$“….$At2one2point2the2penetra5on2of2the2Chamber2of2Commerce2was2so2complete2that2a2Chamber2thermostat2was2communica5ng2with2a2computer2in2China.”$ABC$News$$
hPp://abcnews.go.com/InternaDonal/chineseChackCusCchamberCcommerceCauthoriDes/story?id=15207642$
Slides$located$at$hPp://selil.com$
![Page 26: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/26.jpg)
Safety…$
• Your$cell$phone$is$a$walking$bundle$of$sensors.$• It$contains$radios$(Cellular,$Wifi,$Bluetooth,$Near$Field$CommunicaDon,$GPS,$FM)$
• It$contains$sensors$for$light,$microphone,$camera,$magneDsm,$heat,$touch,$shock,$gyroscope.$
• It$knows$when$you$are$awake,$eaDng,$walking,$running,$sleeping,$being$lazy,$and$your$most$inDmate$secrets.$$
• And,$you$take$it$into$your$car$
Slides$located$at$hPp://selil.com$
![Page 27: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/27.jpg)
Slides$located$at$hPp://selil.com$
![Page 28: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/28.jpg)
So$my$students$and$I$rented$a$car…$$
• The$car$was$a$newish$Ford$Flex$with$infotainment$system$
• We$forensically$processed$the$car$for$evidence$$
• We$looked$at$both$digital$and$physical$evidence$
• What$we$found$was$interesDng$
• It$was$a$learning$experience…$$
Slides$located$at$hPp://selil.com$
![Page 29: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/29.jpg)
Slides$located$at$hPp://selil.com$
![Page 30: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/30.jpg)
Slides$located$at$hPp://selil.com$
![Page 31: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/31.jpg)
Slides$located$at$hPp://selil.com$
![Page 32: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/32.jpg)
Slides$located$at$hPp://selil.com$
![Page 33: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/33.jpg)
Slides$located$at$hPp://selil.com$
![Page 34: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/34.jpg)
REDACTED$FOR$PUBLICATION$
Slides$located$at$hPp://selil.com$
![Page 35: Associate$Professor$selil.com/wp-content/uploads/2014/09/Digital... · April 22, 1992 Guadalajara explosions" • Gasoline explosions in the sewer systems over 4 hour period destroys](https://reader034.vdocuments.site/reader034/viewer/2022050517/5fa123d013200619886ffb01/html5/thumbnails/35.jpg)
Your$stuff$is$watching$you$$$$$
Don’t$worry$we$are$here$to$help$
Slides$located$at$hPp://selil.com$