Security Research

Home » Security Research

Attacks On Routers and IoT

in Incident Response, Malware, Network Visibility, Security Research by Patrick Kelley Comments are off
Here at PacketSled, we live on the forefront of technological innovation.  Our deployed platform captures multitudes of attacks each day against devices that have just barely made it into the market. To keep up with attacks against “bleeding edge” IoT devices is no small feat.

To understand how to best protect these new assets, it’s best to understand what brought them here.  The adoption of IoT and BYOD has increased with the intent of streamlining technology for the user and easing adoption in the marketplace..  Apps in IoT can become seamless, removing the barrier that a user used to have in determining if they were sharing information with a co-worker or with the Internet.  The more covert we make these transactions, the more risk we are accepting (think tap to pay, passwords transferred through nfc, and magic links as Slack likes to call them).  

Without a clear understanding of standards and services, it’s a challenge to determine how to best approach securing them. In fact, it’s such a challenge that Gartner has claimed that nearly all security vendors will fail at this task. 

Personally, I agree.  

Security budgets are rarely earmarked for efforts around IoT and business scenarios require a delivery mechanism that can also grow and keep pace with security requirements in monitoring, detection, and access control.  Despite this, users continually add more devices to the enterprise network, due to ease of doing so.

Fortunately, PacketSled has been thinking about IoT for quite some time.  Our team has spent many years of focused research on the most common IoT attacks.

One of the most common attacks we witness is authentication bypass. This could be due to poor session handling with predictable IDs or backdoors using hardcoded credentials. Regardless of the means, the outcome is the same – unauthorized access to sensitive information.

A quick search of Shodan will likely provide access to nearly any device, including devices in your infrastructure, an attacker would be interested in. In fact, we need not look further than a recent IoT attack which was seen with Mirai. It worked by scanning the Internet for devices with default credentials and enrolling them into the command and control platform. Once done, all of these devices can be remotely controlled and used to perform nearly any action conceivable. These attacks occurred across a wide spectrum of devices from smart TV’s to routers to really anything with the “smart” monicker attached.

Packetsled is here to help protect by proactively building detections in our platform to look for these behaviors, but our recommendation is to make sure your organization is covering the basics.

Where should you begin? 

Start with the CIS Critical Security Controls with emphasis on the 1st six. 
  1. Inventory of Authorized and Unauthorized devices
  2. Inventory of Authorized and Unauthorized software
  3. Security configurations for hardware and software on mobile and IoT devices
  4. Continuous Vulnerability Assessment and Remediation
  5. Controlled user of administrative or root privileges
  6. Maintenance, Monitoring, and Analysis of Audit Logs
  

With these basics addressed, you will have a more clear understanding of what devices and accounts are in use on your network and how you should expect them to behave.  

Among the many detections that PacketSled provides, you should look for unencrypted credentials present on the network, by issuing the following query in the investigator:

last 24 hours cluster password on [password]



This simple query will provide you with every password observed on the network in the last day.  This list is exportable and can be used to aid in the mitigation of these vulnerabilities.

We also provide extensive support for newer IoT protocols, along with our raw TCP and UDP analyzers, which will allow you to see inside network flows, even when a specific protocol analyzer isn’t available. 

Along with our security platform and the recommendations outlined above, we suggest signing up with each vendor for updates related to security patches, firmware updates and any available alerts provided from the devices, themselves.

 
Written by Patrick Kelley and Chris Mitzlaff 

It’s 10 PM. Do you know where your data is?

in Security Research by Patrick Kelley Comments are off

I’ve had the fortune of working in Information Technology for over 20 years.  In that time, I’ve realized that this industry is constantly evolving. However, the recent and rapid adoption of cloud-based services has caused a disruption at a magnitude that I had not yet seen.  Unfortunately, it is also happening at a rate that isn’t properly allowing Information Security groups to properly gauge the security ramifications. 

When I first entered this industry, networks were far easier to secure.  We had differentiating operational goals, but what we secured were largely single, flat, and enormous networks with only a handful of entry points.  All data and assets lived within that one or two physical environments with their own dedicated controls.  When we built our enterprise networks, we would build them to support the maximum resources needed to support the assets and needs within that single environment.  It was very linear and, in comparison, far easier to scope and manage than the networks we support today.  Much like today, our worst enemy was downtime, but the rules of engagement has changed, as have the margins for error.

What do users want?  Everything right here. Right now. Oh yeah, we want it to be as cost-effective as possible.

With the benefits of cloud computing including quicker market entry, flexible costs and capacity, larger and more robust network fabric, allowing greater uptime, improved mobility and collaboration, and more fluid merger and acquisitions, it’s easy to understand why there has been such a major push into the IaaS and SaaS space. 

This also means that the “Crown Jewels” live in many new places, around the globe.  Several within the corporation’s complete control, many which does not.  Currently, AWS operates in as many as 13 distinct locations around the world.  That’s a lot of entry and exit points for your data to move.  With the rate of migration and architectural change, most Information Security groups haven’t had the time or resources to assure that proper monitoring is taking place in these new realms.

Let’s face it… It’s a pretty rough day when you experience a breach or network outage in your own network, but it becomes far more complicated when it occurs in your partner’s network.  In reality, the headlines read largely the same. 

Additionally, as compliance oversight and governance won’t go away with the introduction of cloud-services,neither will the requirements for monitoring, reporting, and coordinated incident response with resolution. In addition our research shows that firewall configuration complexity is leaving companies exposed. The technology to keep your networks safe exists, but it’s nearly impossible to manage properly. This is where PacketSled comes in.We build feature-rich, security platforms, which easily enable the aggregation of packet-level, network analysis from multiple IRES sensors deployable around the globe.  

Specifically, PacketSled sensors can live at multiple points throughout your core network, but also live within your cloud-environments. To ease management, we provide a centralized user interface that works for your team, wherever they are in the world.  With an increasing amount of technology partnerships and APIs being developed by Packetsled staff, we also play well with others. 

We understand that innovation is happening and at a rapid pace. With the ease of deploying Packetsled sensors, you can rollout new network coverage in a defined, lockstep approach to make sure you don’t miss an attack on your new infrastructure or initiative.  Best of all, you can launch new sensors when you need the coverage, not months or years beforehand. 

With our service, you always have the most recent detections, protocol analysis, and sensor technology, located in a Data Centre that will adhere to your governance and regulatory compliances.  We perform all of the research and development; you reap all of the benefits.

Wherever your business is today and headed tomorrow. Let us reduce your worries about moving into the cloud. With the Packetsled platform, we’re here to help.

-Patrick Kelley, Sr. Security Researcher

TIME TO DIE – Bricking An iPad Over the Air

in Security Research by rrhyne Comments are off

Research from PacketSled and Patrick Kelley, CISSP, CEH, MCP at Critical Assets proves it possible to remotely brick iDevices over-the-air. The team built the exploit based on Zach Straley’s research which exposed a flaw in iOS when a user to manually set the date of an iPhone or iPad to January. 1, 1970.



Using a custom Raspberry Pi setup built by Kelley, a wifi access point resembling a commonly trusted network spoofs Apple’s NTP servers to pass the 1/1/1970 date to the device. This starts a chain reaction of software instability resulting in a observed temperatures up to 54°C… which is hot enough to brick a device.

rpi
The rPi that killed the iPad


The team reported the exploit to Apple who released the update 9.3.1 to address the issue.


Read more on Krebs: krebsonsecurity.com

© 2017 PacketSled, Inc.