How to hack an IoT device

Attacking something like an IP camera would be scarily similar to attacking an Iranian nuclear facility, for instance, using something called a Stuxnet virus, a form of a malicious computer worm, or a German steel mill, Shepherd explains. The latter is an example that was targeted a couple of years ago. In 2014, unknown hackers reportedly inflicted serious damage on a German steel mill by breaking into internal networks and accessing the main controls of the factory, according to a report by the German Federal Office for Information Security.

“It could be a large device or a small device, a camera in someone's house, the process is really similar. All devices that are on the internet need to talk to each other. If you want the most secure device in the world, you would just lock it down, but then you would lose its main use”, he says.

Shodan’s founder, Matherly, is not as convinced that the risk is quite the same. With regards to exploiting these systems, it could be significantly more difficult than hacking an IoT device or webcam "because they are systems that the average developer has never interacted with. IoT products would operate largely using the same technology as servers - Linux, Node.js - whereas infrastructure control-system devices are in an entirely different world that requires specific domain expertise to make sense of", he said.

Nonetheless, more and more of these industrial control systems would pop up on Shodan. The number on the internet grew by nearly 10 per cent year-on-year since Shodan started to measure, says Matherly. “We've provided the data to relevant organisations to help fix the problem, but it's been tough”.

In March 2019, Shodan extended its service reach and announced the launch of 'Shodan Monitor', a new service designed to help organisations keep track of systems connected to the Internet.

Devices talk to each other via opening ports, virtual ports. Web browsers talk to port 80. If you want to talk securely to a web browser, you would ‘talk’ on port 443, a port for https or SSL traffic, Shepherd says. There are lots of other ports available. “The first thing you do to hack them, let's take my home network as an example, you would use a tool to scan my network and to tell what is out there. The utility will come back with a list of IP addresses. Based on these IP addresses, I would know what ports IOT devices are 'listening' on. Straight away, I would get a device that is part of my network and which is listening on port 80. It must be some type of web service, which is brilliant for the sort of task we are after”.

Many people would try to change the port that their devices listen to and assume when they let them listen to other ports, not a standard one, that this would resemble a valid disguise.

Now all one needs to do is to try and connect to it as a web service via a browser, for instance. It would come back, at once, and require a username and password. Then you could look at the source code and discover the username and password and the Apache Services 2.0, for example.

Shepherd explains that as an attacker, one would then Google 'vulnerabilities in Apache 2.0', for instance, and access lists of vulnerabilities in the particular device model and version of interest. “Here you could see, for example, that this version should have been patched to version 3 last year'”, he says.

To keep code current and up-to-date would be one of the biggest issues, says Shepherd. Consumers of IoT devices could simply not keep up with maintaining their own code to stay up to the challenge. How could they? They are not experts. 

The sheer power and scale can be seen with recent attacks, such as the WannaCry ransomware attack which spread in 2017. It proliferated through those vulnerabilities. One major vulnerability was introduced when Microsoft issued a patch - a software update comprised of code inserted into the code of an executable program - nearly 12 months earlier. “If you are a hospital with 5,000 devices that you would need to upgrade, you are not going to do this in five minutes flat”, Shepherd jokes. Hackers would rely on the fact that users will not update their code as quickly as the vendors would like. "This leaves thousands of devices vulnerable to already well-known vulnerabilities", he says.

"You just find those devices on the internet, find out what service they are listening to, work out what version of the service and then Google for vulnerabilities. And then you just launch that vulnerability. It's child's play", he says.

Other places where hackers presently search and often find a vein of gold - many times strategically harvesting users' foolishness - would be code sharing platform Github, the filesharing company bought by Microsoft in 2018. Developers would unknowingly leave default password and API keys and similar sensitive information in the code and would upload 'secrets', for anyone, including hackers, freely visible. Automatic tools, similar to those previously mentioned, would support hackers' operations - little would be done manually.

The problem is the impact of this evolution. “Let's face it, who is going to scan their own devices? Who can even be even bothered to check on upgrades? When I asked my father-in-law - who has an internet-connected doorbell that, when it rings, sends a picture to the web - 'When did you update it?', he would wonder how to even do that”, Shepherd says.

Technical barriers to performing upgrades would still be very high. It is hard enough for businesses to expect active consumers to do that kind of stuff, let alone unaware consumers, he says. You have devices now that can track peoples' movement, that can stalk people, that can take pictures of your children, turn off your diabetes alarm, turn off your electric smart meter. The threats as we get more connected "grow exponentially", he says.

To counteract hackers' operations, regulation for devices sold to the government would increasingly account for things like built-in vulnerabilities. This alone won't be enough. “There is a dual responsibility here. One lies with the manufacturer, including secure code and being up to date”. The US governments would increasingly enforce this now, under the Cybersecurity Improvement Act of 2019. If a company wants to sell to the States, a minimum level of security is required. One of them is that the device needs to update automatically and ship with default usernames and passwords. Other precautions are also part of it, but for consumers there remain huge gaps.

Shepherd says that in the UK a proposal was made for a code-of-conduct suggesting that new online products and services should be made secure by default, although this will remain voluntary until 2021.

E&T reported in May 2019 about the UK government's intentions to consult on plans to label all internet-connected devices with information about how resilient they are to cyber attacks. 

Being in the shoes of consumers, Shepherd says it is more about 'what you get is what you paid for'. When looking at an IPTV camera, the question is whether consumers dare (or not afford) to opt for the cheap Chinese clone or the well-respected company that has a service-wrap around the product, where software code remains updated and secure, he says. “If you buy an Alexa home hub, it is going to update itself overnight. The same is the case with cameras”.

Shepherd contacted the company responsible for the camera he bought (the one with the security password and username in the code). “They make cameras for airports. They are a fairly big company. I asked whether they have a responsible disclosure program? I found something, I didn't think I was supposed to find it. I found also some evidence in some forums. They responded that they did know about the vulnerability that I found, but this was part of their consumer camera arm, which they sold off to a company called Hikvision a year ago”.

E&T also reported about the rumors which surfaced that Hikvision, the largest suppliers of video surveillance products in the world, could be blacklisted by the US government. 

“I thought, great, I am now at home with a camera with a default username and password where the controlling stake is owned by the Chinese government”, he says. 

The upgrading issue has always been a problem, since the first appearance of IoT devices. The issue now is that the sheer number of devices is so great and users' ability to handle and update them adequately is diminishing out of all proportion.

Shepherd asks: "How many of your friends had a smart TV five years ago, compared to now? Everybody has one now because no-one wants to settle for a separate box for Netflix, one for Amazon and Sky: they just want a smart TV they do it all, plug it into their Wi-Fi and forget about it. They don't care about how it upgrades, whether it has access to your microphone or to the camera on your TV. They just want it to work. This is what exacerbated the problem. An influx of technology and people's conformability".

The more well-known brands, in order to protect their reputations, would go the extra mile to push updates. The problem lies with the white-label or cheap products, says Shepherd. It is those products that appear benign - the internet-connected fridge, or the cheap camera that you bought off eBay, of a brand you have never heard of, or the smart TV that you bought from a supermarket chain, that may not be part of a bigger brand - that will likely see the frequency of updates dwindle and vulnerabilities, known all over the web, causing mayhem.

There are different strategies to hack public systems, Shepherd explains. Contrary to the previous approach, to hack a system would require to think and act backward. Hackers would look at which devices are presently available. Again, tools are your friend if you are an attacker. A website called CVE.mitre.org, short for Common Vulnerabilities and Exposures, would list all the vulnerabilities on a single publically accessible website that names models and their identification numbers.

You can search in the CVE database by vendor, website or by type. "Let us assume there is a really nice vulnerability for one webcam model. It only affects the webcam version 2.1. Once I know this and that it only affects a certain version, I would then scan through Shodan and find all the web-cameras of this model and version 2.1. The list might amount to a few hundred”.

Boglarka Ronto, head of technical at Commissum, a cyber-security company, explains to E&T that because the time-to-market for IoT devices is often really short, vendors aim to get products out as soon as possible in order to be the first to dominate the market. As a result, they often compromise on security.

Shepherd says the next thing an attacker would do is to use the collected set of hundreds of targets connected to the internet that all run on a very specific version and suffer a very specific vulnerability flaw.

“I would use a tool like Metasploit - a free tool which advertises itself as a tool that can ‘help security teams do more than just verify vulnerabilities, manage security assessments and improve security awareness’, where hackers would insert a vulnerability number. A target is selected to be attacked and an IP address is provided. Metasploit will then run the vulnerability against the targets and will offer the attacker control over it. It comes with a hacking distribution called backtrack, or Kali Linux as it is now called, explains Shepherd.

In May 2019, an internet-wide scan revealed almost one million devices vulnerable to BlueKeep, the Windows vulnerability that has the security community on high alert this month, where Metasploit also came into force. 

In short, "you would find vulnerabilities first; then you scan the web to garner your targets; then you use a distribution tool to launch attacks. Out of hundreds of addresses initially gathered, a smaller number might actually work", he says. Then an even smaller proportion might actually be of interest for the hacker, diminishing the number to a few.

However, the attack on the right few could have a detrimental impact. If you want to access a system, what you would hope for is that at least one camera would sit in a large bank, for instance. The images of the camera would all of a sudden become less interesting. Instead, access to the camera would aid with access the server via administrative privileges, because the camera would internally talk to the server. “I now have laterally traversed my attack and I would try to gain access to the server. And once I have that, I could gain access to the Swift banking systems, for example - it is that weakest link, the path of least resistance, hackers are after”, he says.

The first thing hackers do is to test and ask the person in front of a computer to provide credentials themselves, usually via a phishing email. If that does not work, they go after the system itself and access a camera, open to the web, as shown above.

“People are foolish, they hook up to the internet their phones, their watches, they plug them into their laptops to get updates. All those activities increase the 'attack surface'”, he explains.

A lot of times, they don't even need to expose a website with an interface where someone can physically log in. One of the popular ways for devices to communicate with each other is via an API channel, where a machine talks to a machine.

System engineering may not even consider building in authentication procedures because they are not expecting anyone to access that channel because it lacks that nice look-and-feel login interface – it would consist of merely some JavaScript/JSON communication. "If you can find out what that API channel is and you can infiltrate what is being sent back and forwards, that is enough to hack it".

Given that at some point we are all expected not to be able to withstand the attraction of IoT devices, already so ubiquitous around the world, Shepherd prescribes first and foremost buying from a reputable brand: “You want a company to invest money into research and development to push updates; the more often, the better". Avoiding IoT devices that are out-of-date tomorrow is crucial to avoid. Buying from big brands should carry weight in the decision.

Alternatively, you might want to test your own device, in the same way as Shepherd did. If the search on Shodan and Google yields hundreds of results, be cautious: “If you come up with 50 or 100, try another vendor”, he advises.

Not everyone knows about Shodan, Shepherd says. It will help to drag such tools out of the shadows into the mainstream domain. If they are more generally known and used by the public - as opposed to now, where they are largely only known amongst the wrong kind of people – it could present opportunities to subvert a large part of the simpler kind of attacks. “Using Shodan is no harder than using Google. If you want to buy a certain camera, research it on Shodan the same way you would on Google. If it shows you red flags, be critical in your purchase decision”, Shepherd says.

Matherly from Shodan says that he had a few wins in reducing security risks. Most notably the number of Lantronix devices – which in some instances showed larger security gaps - has dropped significantly thanks to Shodan’s research and follow-up work with affected organisations, he says.

Matherly says that it’s true that embedded systems are sometimes used as a pivot into the rest of the local network, as IT probably didn't expect the coffee machine in the breakroom to be infected with malware.

“I think that is slowly changing, as people realise that a modern refrigerator has more processing power than your desktop from a decade ago. Enterprise organisations have also become better at protecting from internal attacks whereas before it was mostly about keeping an eye on the perimeter”, he says. 

His advice to anyone buying an IoT device is simple: “Don't put it on the public internet. If you need remote access to the webcam, then put it behind a VPN to ensure only trusted sources are able to see it”.

This would apply to all devices that one would like to access remotely. As an individual, it would also be important to make sure not to make any changes to the router and instead use the cloud-streaming app that many webcams offer nowadays.