Inside the Mind of a Hacker: How a Light Bulb Almost Stopped Christmas

### Overview In this RSA presentation, Joseph Carson, Chief Security Scientist at Thycotic, walks through a real-world ethical penetration testing engagement against a global shipping management company. The engagement was prompted by a surge in piracy attacks off the coast of Somalia and the Gulf of Aden targeting vessels scheduled to deliver holiday goods from Asia to Europe. Carson shares how his red team pivoted away from planned social engineering when physical reconnaissance uncovered an unexpected entry point: smart light bulbs.

### Key Topics - **Evolving Attack Surfaces and IoT Risks**: How single-purpose connected devices (IoT) function as full-fledged networked computers that introduce overlooked entry points into enterprise environments. - **The Failure of Traditional Perimeter Security**: Why static network perimeters, firewalls, and DMZs fail against stolen credentials and mobility, especially when attackers mimic trusted insiders. - **Reconnaissance and Social Engineering**: Techniques used to build digital blueprints from public footprints, alongside common phishing lure themes (urgency, speeding fines, delivery notices). - **RF and Physical Reconnaissance**: Using software-defined radios (SDR), antennas, and Raspberry Pis to identify radio frequencies, MAC addresses, and wireless assets around a facility perimeter. - **Living off the Land and Lateral Movement**: Bypassing detection by utilizing native administration tools and customer software rather than noisy off-the-shelf exploitation toolkits.

### Technical Details - **Reconnaissance**: While preparing a phishing campaign from a rented apartment near the target's headquarters, a red team member conducted a perimeter walk equipped with a backpack, antennas, Raspberry Pis, and software-defined radios (SDR) to analyze Wi-Fi, Bluetooth, and GPS signals. - **IoT Discovery**: Analysis of captured RF traffic revealed a recurring MAC address that mapped back to an IoT smart light bulb vendor. The team purchased identical units, tested known vulnerabilities, extracted the Wi-Fi credentials, and configured a Raspberry Pi to masquerade as a light bulb. - **Initial Access**: The hijacked light bulb credentials provided initial access to the organization's guest Wi-Fi network rather than the corporate LAN. - **Privilege Escalation and Lateral Movement**: Exploring the guest network in promiscuous mode revealed an unpatched conference room presentation PC containing four years of vendor presentations and financial files. The machine shared its local administrator password with employee corporate laptops. Employees routinely connected corporate laptops to the guest Wi-Fi during meetings to bypass corporate filtering. The red team compromised an employee laptop, installed a remote access tool, and maintained persistent access when the user reconnected to the internal domain network.

### Takeaways - **Risk Assessments for IoT**: Every IoT device introduced to an organization must undergo a formal risk assessment addressing functionality, maintenance, and patching. - **Rigorous Network Segmentation**: IoT devices, guest access, and internal corporate assets must be isolated so that compromise of a peripheral device does not expose client machines. - **Patch Management Beyond Core Servers**: Peripheral systems like conference room PCs must be patched and maintained just as strictly as production servers. - **Eliminating Password Reuse**: Unique local administrator credentials must be enforced to prevent immediate lateral movement across disparate machines. - **Security Culture**: Organizations must treat employees as frontline detectors rather than security liabilities.