Exploiting Cloud Synchronisation to Mass Hack IoTs

It's already a well known fact that IoT is currently a gift that keeps on giving when it comes to producing security papers. You can blindly walk into a store, buy a device at random and in 2 weeks you'll be exchanging emails with the manufacturer to plug their holes. Most hacks against smart devices require either proximity or some other form of direct access (port forwarding/UPnP). That being said, what if devices could be hacked up to full remote code execution and root access without direct access and from the other side of the world? And what if the number of devices susceptible to this attack could be large enough to be the next big IoT botnet?
..more
In this talk we'll describe the methods and tools used in IoT vulnerability research and our findings on a very popular smart plug: breaking their so-called encryption to capture sensitive data, remote control of the plug and full remote code execution by exploiting the mobile app <-> cloud <-> smart plug synchronisation protocols. Al this while the plug is "safely" in a home, behind NAT. The talk will include - An updated overview on the tragi-comic state of IoT - Some stats from our honeypots - Quick intro to the device and company in question - Tools and methodology used during the research - Demo on how trivial is to break their "encryption" - Demo on full RCE from across the world - Fun stuff from the present, after the manufacturer produced "a fix".
This talk will focus on the EDIMAX smart power outlet. Vendor notified. Patch issued. Nobody applied it (not a vulnerability in itself but their update UX is unusable). Vulnerabilities outlined in a few words - All communication with the power outlets is relayed by the EDIMAX cloud and the credentials are a hardcoded password (1234) and the device MAC address.
- Providing the MAC address to the EDIMAX cloud anyone can turn the power outlets on and off (for starters)
- The setup process asks the user for email credentials for e-mail notifications. Yes, in 2018 they don't have their own SMTP server and they want to use yours. When the power outlet synchs with the cloud it also synchs its settings including your e-mail credentials and instead of encryption they're using a proprietary protocol on port 9001 and the cleartext stream is bitflipped by 6 bytes. Long story short, it's obfuscation, not encrypted and an attacker on the wire can get the user's settings, including e-mail creds
- A command injection vulnerability (the power outlet uses a system command to validate the provided password). Telling the edimax cloud to change the password of a device (again, the identifier is the MAC address) to blah;command will make the power outlet execute md5sum blah;command. From that point to connect-back shell from a fully natted device with no port forwarding is just one step and it makes for a really really cool attack ;)