Attacks Against Top Consumer Products
Zack Fasel and Erin Jacobs demonstrate reverse engineering and exploiting widespread connected consumer devices, revealing critical design and firmware vulnerabilities.
Summary
Architecture and Background
This is not just another "I found a problem in a single IOT device" talk. Focusing on attacking three major consumer product lines that have grown rapidly in the past years, Zack and Erin will review flaws they’ve discovered and weaponized against home Windows installs, DIY security solutions, personal fitness tracking devices, and digital notification devices. We’ll review the security of these popular products and services in a ‘consumer reports’ style walkthrough, the attack methods against the 21 devices reviewed, release some tools for the lulz, and highlight the threats facing similar products.
Vulnerability Analysis
It's time to Fight for the Users. END OF LINE. Zack Fasel and Erin Jacobs are Partners at Urbane Security, a solutions-focused vendor-neutral information security services firm focusing on providing innovative defense, sophisticated offense and refined compliance services.
Exploitation and Demonstrations
Heading up Urbane's Research and Security Services divisions, Zack brings his years of diverse internal and external experience to drive Urbane's technical solutions to organizations top pain points. His previous research and presentations at conferences have spread across numerous domains including Windows authentication flaws, femtocells, open source defensive security solutions, cloud security, and unique network and application attack vectors. When not selling out, he can be found lost in the untz unce wubs, dabbling in instagram food photography, or eating scotch and drinking gummy bears (that's right, right?).
Remediation and Defensive Strategies
More information on Zack can be found by searching for "zfasel" and on Urbane Security at UrbaneSecurity.com. Leading the charge of Urbane’s Compliance and Enterprise Risk Management divisions, Erin brings her years of executive level experience coupled with deep and diverse technical knowledge to help organizations accurate prioritize and address the security and compliance risks they face. Her prior talks and research have spread across numerous domains, including technical solutions for compliance requirements, OSX reversing, diversity in tech, and IOT. More information on Erin can be found by following @SecBarbie on twitter.
Related talks
IoT Village·44 min
Daniel Wegemer
We will show how the Fitbit ecosystem works based on the Fitbit Flex and Fitbit Charge HR as well as the Fitbit Ionic smartwatch. We also show how we modified the firmware of the Fitbit Flex and discuss several vulner...
Main Stage·43 min
Zack Fasel · Erin Jacobs
A consumer reports style walkthrough exposing systemic security flaws across 21 consumer products including DIY home security and fitness trackers.
IoT Village·44 min
Rick Ramgattie
Internet of Things (IoT) devices have always been vulnerable to a variety of security issues. In 2013, Independent Security Evaluators (ISE) performed research on IoT devices that showed how rich feature sets could be...