Although attacking mobile phones and computers has been a habit of hackers for many years, with the popularity of smart hardware, the depth of interaction between many products and users has been far greater than that of traditional consumer electronics such as mobile phones and computers. This trend has also attracted the attention of many security teams and hackers.
Because the vast majority of smart hardware has roughly the same design modules as mobile phones and computers, many manufacturers have invested little in preventing security vulnerabilities. Therefore, at a time when smart hardware is rampant, device security can be said to be quite serious.
“All smart homes in the world are basically vulnerable,” Wang Qi, CEO of the well-known security team KEEN, told Jiemian reporters. On the one hand, smart hardware is launched by small and medium-sized manufacturers, and more of their resources will be devoted to how to make products more popular, rather than investing in security. On the other hand, today’s smart hardware technology is developing too fast, and security technology tends to lag behind.
The perseverance of hackers for ordinary smart hardware products can be seen from a competition. For example, in the GeekPwn World Hacking Competition hosted by the KEEN team, many teams do not choose to break into low-end smart hardware products in order to obtain high bonuses. Instead, they often research into breaking into highly difficult smart safes, smart routers, and products from well-known companies.
Yang Kun, founder of domestic security team Changting Technology, said that taking routers as an example, this kind of equipment is basically found in every household, and all smart devices need to go through this device before they can be used. If the entrance to the network is breached, the information of all devices in the home is not guaranteed, and many encrypted information can easily be tampered with.
According to Yang Kun, the process of cracking smart hardware is basically the same as that of mobile phones and computers. Many of their chips use ARM, and the WIFI and Bluetooth modules are all from Texas Instruments. After getting a piece of smart hardware, you need to first obtain the device's software through official website firmware downloads, the manufacturer's debugging interface and other channels to conduct preliminary research to understand what software and services are enabled by the device and what attack surfaces are exposed to the outside world. Then the team will write a vulnerable application, complete the vulnerability exploitation process, and finally obtain permissions.
On May 12, the World Hacking Competition GeekPwn was held in Macau. More than a dozen mainstream routers, smart remote controls, smart cameras, anti-hacker safes and other smart software and hardware products were breached one by one.
Surface Pro 4
Tencent Computer Manager Network Attack and Defense Team successfully breached Surface Pro 4. The method is by exploiting vulnerabilities in Windows and Adobe, and players from the Tencent Computer Manager attack and defense team fully control Surface. The "hacker" sends a malicious PDF file to the victim over the network. When the victim opens the PDF file, the victim's computer is controlled by the hacker, and the camera is controlled by the hacker. This attack exploits two 0day vulnerabilities and is a Pwn2Own level challenge to obtain system Kernel permissions.
According to team member Deng Xin, the kernel vulnerability used by Tencent Computer Manager Network Attack and Defense Team in the project has been around since WIN2000 and has a history of 15 years. It can kill all windowsws operating system, the research results of this technology were also publicly acquired by zerodium (formerly vupen), a well-known foreign network arms dealer, for US$80,000.
Mingde Cloud Smart Safe
This smart safe can be connected to a mobile phone via WIFI, and users can set passwords and unlock the safe through their mobile phones.
The person in charge of Guangzhou Chenchen Network Technology Company does not need to bind his mobile phone to the safe. He only needs to connect to the WIFI network where the safe is located and wait for the user to open the safe normally. This can bypass the encryption algorithm of the safe, various binding and verification protection mechanisms, and open the safe at will.
Cisco, Huawei, Xiaomi routers
Even companies with deep technology accumulation such as Cisco and Huawei cannot completely prevent vulnerabilities. According to Chaitin Technology's demonstration, hackers can simulate the WIFI environment in which the router is installed. After an Android phone is connected to a vulnerable router and uses a regular software market to download an application, the regular software will be replaced with a backdoor malicious program implanted with a Trojan horse. The hacker can remotely obtain the highest permissions of the router, that is, a shell with root permissions.
The consequences of being attacked are that the attacker can send, receive and view the victim's text messages, control the phone's phone functions, call the phone's camera, etc. In addition, Chaitin Technology also discovered that the vulnerable ASUS router service was exposed on the Internet, allowing attackers to launch remote attacks from anywhere in the world, with tens of thousands of routers affected.
"Violent" hijacking of communications equipment anywhere in the world
Cao Yue, a doctoral student from the University of California in the United States, demonstrated a remote hijacking by exploiting vulnerabilities in the TCP/IP protocol stack that can be called "network infrastructure." In the early days of the development of the Internet in the 1990s, Kevin Mitnick implemented "arbitrary Internet session hijacking technology" using the then-immature TCP protocol and became famous in one fell swoop. Today, Cao Yue's team has dug out such a heavyweight vulnerability in the modern TCP protocol that has been continuously improved, which undoubtedly has great reference significance for the world's information security research.
Cao Yue demonstrated his "magic" at the GeekPwn competition: after an attacker learns the IP address of a victim anywhere in the world, he or she can remotely hijack their communications. In the demonstration, a fake login page suddenly popped up on the news page the victim was browsing on his computer screen. After entering his account and password as prompted, the same content appeared on player Cao Yue's computer. Unlike the common cybercrime tactics in the news (such as Trojans, phishing, and fraud), the victim does not need to make any mistakes to fall prey to the attacker.
The security cornerstone of the TCP/IP protocol is that there are more than 4 billion possible sequence numbers and more than 60,000 possible port numbers. The combination of the two creates unpredictability. However, Cao Yue has implemented a technology that can detect the port number and serial number of a TCP connection in a short period of time. This means that almost all Android and Linux systems on the Internet can be attacked and communications hijacked at any time and at any location.
Although many well-known smart hardware products have been hacked by hackers, many manufacturers are not exclusive from GeekPwn. Because for manufacturers, this model can not only discover vulnerabilities for free for early prevention, but also organizers can treat disclosed vulnerabilities responsibly. Tencent Security, JD Smart, Xiaomi, and Huawei are all paying great attention to the growth of white hat hacker talents. For this GeekPwn Macau site’s special awards, JD Smart, Xiaomi, and Huawei provided bonus support respectively.
GeekPwn's disclosure process for security issues discovered by registered players is as follows: two weeks before the GeekPwn event, the GeekPwn organizing committee will notify the manufacturer by email that its product has become a registration item for GeekPwn players. Manufacturers can sign up for the GeekPwn event to learn about the process of breaking security issues on site. In response to security issues submitted during the GeekPwn Macau event, the GeekPwn organizing committee will submit the details of the security issues to relevant manufacturers within two weeks. Within one week after receiving the safety problem report, the manufacturer needs to give official confirmation whether the safety problem objectively exists. During the confirmation process, the GeekPwn organizing committee will provide technical support.
