Let's Hack a House

Let’s hack a house.

Tony Gambacorta

tony@synack.com

I’m supposed to scare you.

Distance

Ratio

Physical Access Same WiFi Darkest Peru

One-to-One

One-to-Many

When is a WebCam not a WebCam?

Coffee Cup Ambush

WebCamCompliance

Security

A consumer sees… Peace of Mind

WebCam

Linux Server

Network Access

Microphone

Camera

A geek sees…

WebCamAbility to inject data

Eyes and ears inside

Attack platform

A bad actor sees…

Variations on a theme…

Let’s hack some stuff!

Pro Tip: You’ll probably break something your first time. Plan accordingly.

UART

This adapter just lets my laptop’s USB talk to other devices

} I’ll do all this stuff when I’m booting up.

Coffee Cup Ambush

Eyes and Ears Inside

• See who comes and goes • Listen to conversations

Ability to inject data

• Edit live video • Delete video

Attack Platform

• Scan internal networks • Distribute malware • APT toe-hold

Bedtime Reading

Key Takeaway:

Everything is just parts connected to other parts.

Distance

Ratio

target-centric 1:1 ratio

physical access { }

vulnerability-centric 1 : many ratio remote access{ }

Forget Alice.

Any Brady will do.

Enumerate the Widgets.

That’s funny…Your URL: https://FG-59301.iotco.com

S/N = XX-00000

26 * 26 * 10 * 10 * 10 * 10 * 10

67.6 Million Possibilities

67.6 Million Possibilities

3,380,000 active hosts

That’s funny…

123456

password

12345

12345678

qwerty

Nope.

Nope.

Nope.

Nope.

Nope.

Nope.

Nope.

Nope.

Nope.

We’re in!

Nope.

Nope.

Nope.

Nope.

Nope.

We’re in!

Nope.

Nope.

Nope.

Nope.

123456789 LOCKED.

Common Passwords

Average Success Rate: 3-5%

Think sideways

That’s (not so) funny…3,380,000 Active Hosts

1% Success Rate

33,800 Compromised Devices

The one-offs are enough to make the news.

Bedtime Reading

Key Takeaway:

Statistically, if I know who your users are, you’re gonna have a bad time.

So What?• We’ve seen all of these attacks before, at scale

• Learn from the lessons of fraud

• Every once in a while, get your hands dirty

Thanks!