Download - Let's Hack a House
I’m supposed to scare you.
Distance
Ratio
Physical Access Same WiFi Darkest Peru
One-to-One
One-to-Many
When is a WebCam not a WebCam?
Coffee Cup Ambush
WebCamCompliance
Security
A consumer sees… Peace of Mind
WebCam
Linux Server
Network Access
Microphone
Camera
A geek sees…
WebCamAbility to inject data
Eyes and ears inside
Attack platform
A bad actor sees…
Variations on a theme…
Let’s hack some stuff!
Pro Tip: You’ll probably break something your first time. Plan accordingly.
UART
This adapter just lets my laptop’s USB talk to other devices
} I’ll do all this stuff when I’m booting up.
Coffee Cup Ambush
Eyes and Ears Inside
• See who comes and goes • Listen to conversations
Ability to inject data
• Edit live video • Delete video
Attack Platform
• Scan internal networks • Distribute malware • APT toe-hold
Bedtime Reading
Key Takeaway:
Everything is just parts connected to other parts.
Distance
Ratio
target-centric 1:1 ratio
physical access { }
vulnerability-centric 1 : many ratio remote access{ }
Forget Alice.
Any Brady will do.
Enumerate the Widgets.
That’s funny…Your URL: https://FG-59301.iotco.com
S/N = XX-00000
26 * 26 * 10 * 10 * 10 * 10 * 10
67.6 Million Possibilities
67.6 Million Possibilities
3,380,000 active hosts
That’s funny…
123456
password
12345
12345678
qwerty
Nope.
Nope.
Nope.
Nope.
Nope.
Nope.
Nope.
Nope.
Nope.
We’re in!
Nope.
Nope.
Nope.
Nope.
Nope.
We’re in!
Nope.
Nope.
Nope.
Nope.
123456789 LOCKED.
Common Passwords
Average Success Rate: 3-5%
Think sideways
That’s (not so) funny…3,380,000 Active Hosts
1% Success Rate
33,800 Compromised Devices
The one-offs are enough to make the news.
Bedtime Reading
Key Takeaway:
Statistically, if I know who your users are, you’re gonna have a bad time.
So What?• We’ve seen all of these attacks before, at scale
• Learn from the lessons of fraud
• Every once in a while, get your hands dirty
Thanks!
