Home Invasion 2.0: Attacking Network-Controlled Consumer Devices

Architecture and Background

Home Invasion 2.0 - Attacking Network-Controlled Consumer Devices DANIEL "UNICORNFURNACE" CROWLEY MANAGING CONSULTANT, SPIDERLABS, TRUSTWAVE JENNIFER "SAVAGEJEN" SAVAGE SOFTWARE ENGINEER DAVID "VIDEOMAN" BRYAN A growing trend in electronics is to have them integrate with your home network in order to provide potentially useful features like automatic updates or to extend the usefulness of existing technologies such as door locks you can open and close from anywhere in the world. What this means for us as security professionals or even just as people living in a world of network-connected devices is that being compromised poses greater risk than before. Once upon a time, a compromise only meant your data was out of your control. Today, it can enable control over the physical world resulting in discomfort, covert audio/video surveillance, physical access or even personal harm.

Vulnerability Analysis

If your door lock or space heater are compromised, you're going to have a very bad day. This talk will discuss the potential risks posed by network-attached devices and even demonstrate new attacks against products on the market today. Daniel (@dan_crowley) (aka "unicornFurnace") is a Managing Consultant for Trustwave's SpiderLabs team. Daniel denies all allegations regarding unicorn smuggling and questions your character for even suggesting it.

Exploitation and Demonstrations

Daniel has developed configurable testbeds such as SQLol and XMLmao for training and research regarding specific vulnerabilities. Daniel enjoys climbing large rocks. Daniel has been working in the information security industry since 2004 and is a frequent speaker at conferences including DEF CON, Shmoocon, and SOURCE. Daniel does his own charcuterie.

Remediation and Defensive Strategies

Jennifer (@savagejen) is a software engineer that cares about secure development. In her professional life, she has been tackling some of the harder questions surrounding security and privacy in the mobile payments industry. In her spare time, she has been hacking home electronics. David has more then 10 years of computer security experience, including pentesting, consulting, engineering, and administration. As an active participant in the information security community, he volunteers at DEFCON, where he designs and implements the firewall and network for what is said to be the most hostile network environment in the world. In his spare time he runs the local DEFCON group, DC612, is the president of The Hack Factory, and helps to run Thotcon as an OPER. Materials: