Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

A Monitor Darkly: Reversing and Exploiting Ubiquitous On-Screen-Display Controllers in Modern Monitors by Ang Cui, Jatin Kataria, Francois Charbonneau.

Abstract:

There are multiple x86 processors in your monitor! OSD, or on-screen-display controllers are ubiquitous components in nearly all modern monitors. OSDs are typically used to generate simple menus on the monitor, allowing the user to change settings like brightness, contrast and input source. However, OSDs are effectively independent general-purpose computers that can: read the content of the screen, change arbitrary pixel values, and execute arbitrary code supplied through numerous control channels. We demonstrate multiple methods of loading and executing arbitrary code in a modern monitor and discuss the security implication of this novel attack vector.

We also present a thorough analysis of an OSD system used in common Dell monitors and discuss attack scenarios ranging from active screen content manipulation and screen content snooping to active data exfiltration using Funtenna-like techniques. We demonstrate a multi-stage monitor implant capable of loading arbitrary code and data encoded in specially crafted images and documents through active monitor snooping. This code infiltration technique can be implemented through a single pixel, or through subtle variations of a large number of pixels. We discuss a step-by-step walk-through of our hardware and software reverse-analysis process of the Dell monitor. We present three demonstrations of monitoring exploitation to show active screen snooping, active screen content manipulation and covert data exfiltration using Funtenna.

Lastly, we discuss realistic attack delivery mechanisms, show a prototype implementation of our attack using the USB Armory and outline potential attack mitigation options. We will release sample code related to this attack prior to the presentation date.

This hack is surprising only in that discussions of the insecurity of the Internet of Things (IoT) have failed to mention the mini-Internet of Things sitting on our desktops.

The video of the presentation isn’t up on the BlackHat YouTube channel, yet. But check back.

Pro-tip: If you write about this hack, don’t say it uses “…unnoticeable sound waves…” to connect to a radio receiver. Radio waves != sound waves. Radio waves are electromagnetic radiation and sound waves are mechanical waves.

Will sex toys provide the incentive for a safer Internet of Things (IoT)?

Robert Abel reports in Bad vibes: Researcher hacks sex toy of a live demonstration of a hack on a sex toy.

Robert also reports that no user personal information was disclosed by this particular hack, the same may not be true for all IoT sex toys or hacks.

Is sex toy privacy enough of an incentive for better IoT security? 😉

The Facts Are In: Ambulances vulnerable to hackers

From the post:

Reports from multiple sources lead to a horrible conclusion. Almost all ambulances are vulnerable to hacking.

There are many compelling reasons for ambulances to be connected and computerized. Emergency responders can take advantage of connectivity to learn more about patients and use that info to deliver better emergency care. And patient status can be communicated to emergency rooms to better prepare for response. This is a life-saving capability.

But you can tell what can go wrong, right?
…

The Threat Brief calls out three reports that all reach the same conclusion: ambulances can be hacked.

The details remain an exercise for readers but that is likely just a matter of time.

Easy to imagine an online vulnerability store where you enter year, make/model and you are supplied with the latest hacks for that vehicle.

I wonder if the DARPA Improv competition will have many of these?

Controlling vehicle features of Nissan LEAFs across the globe via vulnerable APIs

From the post:

Last month I was over in Norway doing training for ProgramUtvikling, the good folks who run the NDC conferences I’ve become so attached to. I was running my usual “Hack Yourself First” workshop which is targeted at software developers who’d like to get up to speed on the things they should be doing to protect their apps against today’s online threats. Across the two days of training, I cover 16 separate discrete modules ranging from SQL injection to password cracking to enumeration risks, basically all the highest priority security bits modern developers need to be thinking about. I also cover how to inspect, intercept and control API requests between rich client apps such as those you find on a modern smart phone and the services running on the back end server. And that’s where things got interesting.

One of the guys was a bit inspired by what we’d done and just happened to own one of these – the world’s best-selling electric car, a Nissan LEAF:

What the workshop attendee ultimately discovered was that not only could he connect to his LEAF over the internet and control features independently of how Nissan had designed the app, he could control other people’s LEAFs. I subsequently discovered that friend and fellow security researcher Scott Helme also has a LEAF so we recorded the following video to demonstrate the problem. I’m putting this up front here to clearly put into context what this risk enables someone to do then I’ll delve into the details over the remainder of the post:
…

Troy Hunt, located in Australia, controls a Nissan LEAF located in Norther England via a web browser.

Heater on/off, driving (trip) history), nothing more serious but worldwide accessibility via a VIN number is an odd design decision.

You won’t be able to try this on as Nissan is reported to have taken the service offline as of 25 February 2016.

Don’t be too disappointed. Bad design and implementation decisions are repeated over and over again. Perhaps you will find the next one first.

Internet of Things security is so bad, there’s a search engine for sleeping kids by J.M. Porup.

From the post:

Shodan, a search engine for the Internet of Things (IoT), recently launched a new section that lets users easily browse vulnerable webcams.

The feed includes images of marijuana plantations, back rooms of banks, children, kitchens, living rooms, garages, front gardens, back gardens, ski slopes, swimming pools, colleges and schools, laboratories, and cash register cameras in retail stores, according to Dan Tentler, a security researcher who has spent several years investigating webcam security.

“It’s all over the place,” he told Ars Technica UK. “Practically everything you can think of.”

We did a quick search and turned up some alarming results:
….

Just so you know, the images from webcams are a premium feature of Shodan.

As the insecure IoT continues to spread, coupling the latest face recognition software with webcam feeds and public image databases could be a viable service. Early warning for those seeking to avoid detection and video evidence for hoping for it.

Similar to detective agencies but on a web scale.

There are less obvious digital cameras with IP than the ones from Wowwee:

But most of them still scream “digital camera” in white with obvious lens, etc.

Porup reports that the FTC is attempting to be proactive about webcam security but penalties after a substantial number of insecure webcams appear won’t help those already exposed on the Internet.

50 Predictions for the Internet of Things in 2016 by David Oro.

From the post:

Earlier this year I wrote a piece asking “Do you believe the hype?” It called out an unlikely source of hype: the McKinsey Global Institute. The predictions for IoT in the years to come are massive. Gartner believes IoT is a central tenet of top strategic technology trends in 2016. Major technology players are also taking Big Swings. Louis Columbus, writing for Forbes, gathered all the 2015 market forecasts and estimates here.

So what better way to end the year and look into the future than by asking the industry for their predictions for the IoT in 2016. We asked for predictions aimed at the industrial side of the IoT. What new technologies will appear? Which companies will succeed or fail? What platforms will take off? What security challenges will the industry face? Will enterprises finally realize the benefits of IoT? We heard from dozens of startups, big players and industry soothsayers. In no particular order, here are the Internet of Things Predictions for 2016.
…

I count nine (9) statements from various industry leaders on IoT and you have to register to see the other forty-one (41).

I don’t have a prediction but do have a question:

Will an insecure IoT in 2016 cause enough damage to motivate better hardware/software engineering and testing practices?

I ask because 2015 was a banner year for data breaches, Data Breach Reports (ITRC), December 31, 2015, reports 169,068,506 records exposed in 2015.

Yet, where is the widespread discussion about better software engineering? (silence)

Yes, yes, let’s have more penalties for hackers, which have yet to be shown to improve cybersecurity.

Yes, yes, let’s all be more aware of security threats, except that most can’t be mitigated by those aware of them.

Apparently the exposure of 169,068,506 records in 2015 wasn’t enough to get anyone’s attention. Or at least anyone who could influence the software development process.

Odd because just the rumor of Ebola was enough to change the medical intake procedures from hospitals, to general practices to dentists.

When is the Ebola moment coming for software engineering?

For years the Chicken Little‘s of infrastructure security have been warning of nearly impossible cyber-attacks on utilities and other critical infrastructure.

Despite nearly universal scorn from security experts, once those warning are heard, they are dutifully repeated by a non-critical press and echoed by elected public officials.

Despite not having been insecure originally, the Internet of Things is catching up to infrastructure and making what was once secure, insecure.

Consider Mark Stockley‘s report: Industrial gas detectors vulnerable to a remote ‘attacker with low skill’.

From the post:

Users of Honeywell’s Midas and Midas Black gas detectors are being urged to patch their firmware to protect against a pair of critical, remotely exploitable vulnerabilities.

These extremely serious vulnerabilities, found by researcher Maxim Rupp and reported by ICS-CERT (the Industrial Control Systems Cyber Emergency Response Team) in advisory ICSA-15-309-02, are simple enough to be exploited by an “attacker with low skill”:

Successful exploitation of these vulnerabilities could allow a remote attacker to gain unauthenticated access to the device, potentially allowing configuration changes, as well as the initiation of calibration or test processes.

…These vulnerabilities could be exploited remotely.

…An attacker with low skill would be able to exploit these vulnerabilities.

So, how bad is the problem?

You judge:

Midas and Midas Black gas detectors are used worldwide in numerous industrial sectors including chemical, manufacturing, energy, food, agriculture and water to:

…detect many key toxic, ambient and flammable gases in a plant. The device monitors points up to 100 feet (30 meters) away while using patented technology to regulate flow rates and ensure error-free gas detection.

The vulnerabilities could allow the devices’ authentication to be bypassed completely by path traversal (CVE-2015-7907) or to be compromised by attackers grabbing an administrator’s password as it’s transmitted in clear text (CVE-2015-7908).

That’s still not a full picture of the danger posed by these vulnerabilities. Take a look at the sales brochure on the Midas Gas Detector and you will find this chart of the “over 35 gases” the Midas Gas Detector can detect:

Several nasty gases on the list, Ammonia (caustic, hazarous), Arsine (highly toxic, flammable), Chlorine (extremely dangerous, poisonous for all living organisms), Hydrogen cyanide, and Hydrogen flouride (“Hydrogen fluoride is a highly dangerous gas, forming corrosive and penetrating hydrofluoric acid upon contact with living tissue. The gas can also cause blindness by rapid destruction of the corneas.”)

Bear in mind that patch application doesn’t have an encouraging history: Potent, in-the-wild exploits imperil customers of 100,000 e-commerce sites

Honeywell has put the detection of extremely dangerous gases, at the mercy of script kiddies.

Suggestion: If you worn on-site where Midas Gas Detectors may be in use, inquire before setting foot on the site if they are using Midas Gas Detectors of the relevant models and whether they are patched?

Bear in mind that the risk of “…corrosive and penetrating hydrofluoric acid upon contact with living tissue…” is your in some situations. I would ask first.

Move Past the Rhetoric and Focus on Success

A recent missive from Booz Allen on the Internet of Things.

Two critical points that I want to extract for your consideration:

…
New Models for Security

The proliferation of IoT devices drastically increases the attack surface and creates attractive, and sometimes easy, targets for attackers. Traditional means of securing networks will no longer suffice as attack risks increase exponentially. We will help you learn how to think about security in an IoT world and new security models.
…
[page 4]

You have to credit Booz Allen with being up front about “…attack risks increas[ing] exponentially.” Considering that “Hello Barbie” has an STD on her first Christmas.

Do you have a grip on your current exposure to cyber-risk? What is that going to look like when it increases exponentially?

I’m not a mid-level manager but I would be wary of increasing cyber-risk exponentially, especially without a concrete demonstration of value add from the Internet-of-Things.

The second item:

Interoperability is Key to Everything

IoT implementations typically contain hundreds of sensors embedded in different “things”, connected to gateways and the Cloud, with data flowing back and forth via a communication protocol. If each node within the system “speaks” the same language, then the implementation functions seamlessly. When these nodes don’t talk with each other, however, you’re left with an Internet of one or some things, rather than an Internet of everything. [page 4]

…

IoT implementation, at its core, is the integration of dozens and up to tens of thousands of devices seamlessly communicating with each other, exchanging information and commands, and revealing insights. However, when devices have different usage scenarios and operating requirements that aren’t compatible with other devices, the system can break down. The ability to integrate different elements or nodes within broader systems, or bringing data together to drive insights and improve operations, becomes more complicated and costly. When this occurs, IoT can’t reach its potential, and rather than an Internet of everything, you see siloed Internets of some things.
…

Haven’t we seen this play before? Wasn’t it called the Semantic Web? I suppose now called the Failed Semantic Web (FSW)?

Booz Allen would be more forthright to say, “…the system is broken down…” rather than “…the system can break down.”

I can’t think of a better way to build a failing IoT project than to presume that interoperability exists now (or that it is likely to exist, outside highly constrained circumstances).

Let’s take a simpler problem than everything and limit it to interchange of pricing data in the energy market. As you might expect, there is a standard, a rather open one, on that topic: Energy Market Information Exchange (EMIX) Version 1.0.

That specification is dated 11 January of 2012, which means on 11 January 2016, it will be four years old.

As of today, a search on “Energy Market Information Exchange (EMIX) Version 1.0” produces 695 “hits,” but 327 of them are at Oasis-open.org, the organization where a TC produced this specification.

Even more interesting, only three pages of results are returned with the notation that beyond 30 results, the rest have been suppressed as duplicates.

So, at three years and three hundred and thirty days, Energy Market Information Exchange (EMIX) Version 1.0 has thirty (30) non-duplicate “hits?”

I can’t say that inspires me with a lot of hope for impact on interoperability in the U.S. Energy Market. Like the work Booz Allen cites, this too was sponsored by NIST and the DOE (EISA).

One piece of advice from Booz Allen is worth following:

Start Small

You may actually have IoT implementations within your organization that you aren’t aware of. And if you have any type of health wearable, you are actually already participating in IoT. You don’t have to instrument every car, road, and sign to have an Internet of some things. [page 10]

Building the Internet of Things for everybody should not be on your requirements list.

An Internet of Some Things will be your things and with proper planning it will improve your bottom line. (Contrary to the experience with the Semantic Web.)

Every day brings new reports of digital data breaches. Security for the Internet of Things (IoT) is being discussed, but in light of the drum roll of breaches, there is very little confidence the IoT will be any more secure than present IT systems.

That being the case and by way of forewarning, unplug your webcam when you are not using it.

Insecurity in the Internet of Things (IoT) will geometrically increase the amount of $free porn on the Internet.

Amateur porn to be sure but instead of being people you are unlikely to meet, this could be the couple next door, or down the block, your doctor or pharmacist, perhaps even your spouse.

If you don’t believe me, check out: Cyber hacker hijacked webcams to spy on people having sex by David Wells.

From the story:

A cyber criminal hijacked computers to spy on people having sex through their webcams, the National Crime Agency (NCA) has said.

Stefan Rigo, 33, used malware called Blackshades to give him control over strangers’ cameras and spent five to 12 hours a day watching what they were doing in front of their computers.

The NCA said he was addicted to monitoring his victims, some of whom he knew and some who were complete strangers.

Rigo was given a 40-week suspended prison sentence, placed on the Sex Offenders Register for seven years and ordered to do 200 hours of unpaid work by magistrates in Leeds after he admitted voyeurism at a previous hearing, the agency confirmed.
…

Well, there’s a deterrent, “200 hours of unpaid work.” 😉

Looking forward to cellphone apps for finding vulnerable webcams, streaming them live to public or private accounts, just a tap away from $free porn.

Of course, you may also see people doing things that are illegal in your jurisdiction and not just sexually illegal things.

Wondering how the police will react to major drug deals being caught via an “ISpy” app for a cellphone and streamed to the Internet?

For those of you who have never deliberately disconnected anything from the Internet, I include this illustration:

Yep, that’s how its done.

You do have to remember to “reconnect” (another new word) it.

The upside is that you will be safe from strangers watching you have sex and/or commit crimes or indiscretions in the privacy of your own home.

They may be able to hear or monitor you through one or more other IoT devices but they won’t have video. If that makes you feel any better.

You saw Code.org Facebook post last January referring to Drones Will Be Everywhere Watching, Listening, and…Planting Millions of Trees? as “1.001 uses for drones.”

Here is use #1,002:

How Drones Can Find and Hack Internet-of-Things Network Things From the Sky by Mohit Kumar.

From the post:

Security researchers have developed a Flying Drone with a custom-made tracking tool capable of sniffing out data from the devices connected to the Internet – better known as the Internet-of-things.

Under its Internet of Things Map Project, a team of security researchers at the Texas-based firm Praetorian wanted to create a searchable database that will be the Shodan search engine for SCADA devices.

Located More Than 1600+ Devices Using Drone

To make it possible, the researchers devised a drone with their custom built connected-device tracking appliance and flew it over Austin, Texas in real time.

During an 18 minute flight, the drone found nearly 1,600 Internet-connected devices, of which 453 IoT devices are made by Sony and 110 by Philips. You can see the full Austin map here.
…

The map of Austin is way cool! What IoT map do you want to create?

Which reminds me, how do you defend against the intrusion of a drone? According to the Wall Street Journal, your options are limited and expensive.

I didn’t see the IoT scanning drone at Praetorian in either finished or kit form.

But I expect IoT scanning drones on the virtual shelves of online retailers long before the holiday season of 2015.

You will be able to spot popular holiday shopping venues by the clouds of drones sniffing for vulnerable automobiles.

PS: Give the military a couple of years to get into the IoT. Flying an IoT sniffing drone over the Pentagon should be a real hoot.

Analysis of a MICROSOFT WORD INTRUDER sample: execution, check-in and payload delivery by Yonathan Klijnsma.

From the post:

On April 1st FireEye released a report on “MWI” and “MWISTAT” which is a sort of exploit kit for Word Documents if you will: A New Word Document Exploit Kit

In the article FireEye goes over MWI which is the short for “Microsoft Word Intruder’ coded by an actor going by the handle ’Objekt’. MWI is a ‘kit’ for people to use for spreading malware. It can generate malicious word document exploiting any of the following CVE’s:

• CVE-2010-3333
• CVE-2012-0158
• CVE-2013-3906
• CVE-2014-1761

The builder, named MWI, generates these documents which call back to a server to download malicious payloads. Together with the MWI builder the author has also released MWISTAT; a statistics backend and optional downloader component for MWI documents to track campaigns and spread of the documents.

…

This post prompted me to look for malware kits for the Internet of Things (IoT).

I didn’t find any with a quick search but did find several IoT malware stories that may be of interest:

The Internet Of Things Has Been Hacked, And It’s Turning Nasty by Selena Larson.

From the post:

Don’t say we didn’t warn you. Bad guys have already hijacked up to 100,000 devices in the Internet of Things and used them to launch malware attacks, Internet security firm Proofpoint said on Thursday.

It’s apparently the first recorded large-scale Internet of Things hack. Proofpoint found that the compromised gadgets—which included everything from routers and smart televisions to at least one smart refrigerator—sent more than 750,000 malicious emails to targets between December 26, 2013 and January 6, 2014.
…

The Botnet of the Internet of Things by Waylon Grange.

From the post:

Last month we released our report on the Inception Framework and as part of that report outlined how a nation-state level attack compromised over 100 embedded devices on the Internet to use them as a private proxy to mask their identity. Since the release of the paper we have further discovered that the attackers not only targeted MIPS-el devices but also had binaries for ARM, SuperH, and PowerPC embedded processors. In light of this the 100 devices that we knew about is most likely only the tip of the iceberg and the total count was much, much more.

This network of proxies was managed by a central backend that tunneled attacks through an ever-cycling list of compromised devices, thus changing the IP address their attacks came from every few minutes. The whole system for tracking which compromised devices were available and managing the change in proxies at regular intervals had to be a fairly complex system, but the benefit to the attackers was clear. No one entity would have full insight into their attacks, only portions of it and it is hard for investigators to put together a puzzle with only a handful of the pieces.
…

This year your refrigerator may be a spam-bot and next year your toaster?

Don’t know how I will feel getting a spam email with return address: Joe’s Toaster.

Unfortunately, people who are concerned about IoT security, aren’t the ones building devices to become part of the IoT. Strict liability for losses, spamming, etc. due to IoT devices would go a long way towards generating concern among IoT device manufacturers.

I didn’t find any malware kits for the IoT but I will keep looking. Until the IoT becomes more secure, I’m not sharing network access with my refrigerator or toaster.