![Page 1: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/1.jpg)
#watitis2017
![Page 2: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/2.jpg)
#watitis2017
u w a t e r l o o . c a \w a t i t i s@ w a t i t i s c o n f
RISE OF THE
MACHINESU N D E R S TA N D I N G A N D H A C K I N G T H E
I N T E R N E T O F T H I N G S
Terry Labach
![Page 3: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/3.jpg)
#watitis2017
READ ALL ABOUT IT!
![Page 4: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/4.jpg)
#watitis2017
THIS IS NOT A HEATER
![Page 5: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/5.jpg)
#watitis2017
THIS IS NOT A HEATER
• It is a computer
• A heater happens to be attached to it
• We’ll come back to this later
![Page 6: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/6.jpg)
#watitis2017
WHAT IS THE INTERNET OF
THINGS?
• aka IoT
• Devices, other than computers (or what we
think of as computers) connected to the
internet
• Started with:
Routers
Industrial control systems
Coke machines
![Page 7: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/7.jpg)
#watitis2017
THE INTERNET COKE MACHINE
• Connected by 1982!
• Carnegie-Mellon CS department Coke
machine
• Let users remotely determine inventory and
temperature
![Page 8: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/8.jpg)
#watitis2017
THE INTERNET OF THINGS
• Now includes
Webcams
Printers
Network attached
storage
Children’s toys
Televisions
Light bulbs
Door locks
Appliances• Vacuum cleaners
• Refrigerators
• Toasters
• Electrical outlets
And more, and
more, and more!
![Page 9: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/9.jpg)
#watitis2017
THE INTERNET OF THINGS
• IoT devices more likely to be able to sense
their environment in some way
• Can collect data from their environment
Video
Audio
GPS
Temperature
• Can share this data
![Page 10: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/10.jpg)
#watitis2017
THE INTERNET OF THINGS
• Devices could be hard-wired, or connected
to a network using Wi-Fi
• Could be wirelessly accessible using
Bluetooth
• May be controllable from remote locations
![Page 11: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/11.jpg)
#watitis2017
THIS ISN’T SKYNET (YET…)
• People still make the decisions to implement
and IoT devices
• Our decisions need to be informed
![Page 12: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/12.jpg)
#watitis2017
THE INTERNET OF HACKABLE
THINGS
• Some call this a more accurate description of
the IoT
• Security is an afterthought
• Focus on novelty and convenience
![Page 13: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/13.jpg)
#watitis2017
WHAT ARE THE RISKS?
• Privacy
Devices can spy on you
• Theft
Compromised devices could allow physical
access to property or leak passwords
• Access to or misuse of your devices
IoT devices have been used in botnet attacks
• Using your data for financial gain
• Loss of control of your devices
![Page 14: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/14.jpg)
#watitis2017
WHAT IS “COLLECTING USAGE
DATA”?
• Mining your details to sell to advertisers
• Roomba robotic vacuum cleaners create a
map of your home
Who could make use of that?
(Hint: advertisers)
• Company would like to “share” customer
data
![Page 15: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/15.jpg)
#watitis2017
THE GOOD, BAD, AND THE GOOFY
• A roundup of some IoT devices
![Page 16: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/16.jpg)
#watitis2017
GOOD
• Searching for good IoT devices…
![Page 17: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/17.jpg)
#watitis2017
BAD
• Companies are looking for new products and
new markets to drive new sales
• What can we connect to the Internet?
![Page 18: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/18.jpg)
#watitis2017
YOUR TELEVISION WATCHES YOU
![Page 19: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/19.jpg)
#watitis2017
YOUR TELEVISION WATCHES YOU
• March 2017 Wikileaks disclosure of CIA
hacking tool called “Weeping Angel”
• Made Samsung Smart televisions appear to
be off when they were on
• Could control built-in microphone and
camera
![Page 20: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/20.jpg)
#watitis2017
CAYLA THE DOLL
![Page 21: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/21.jpg)
#watitis2017
CAYLA THE DOLL
• “The Bright-Eyed Talking Doll That Just
Might Be a Spy”
https://www.nytimes.com/2017/02/17/technology/
cayla-talking-doll-hackers.html
• Records sound
• Transmits over an insecure Bluetooth
interface
• Banned in Germany
![Page 22: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/22.jpg)
#watitis2017
INTERNET DISHWASHERS
• Miele Professional PG 8528
• Network-enabled
Not supposed to be accessible from the Internet
But some did connect and were visible, and
controllable, from anywhere!
Large capacity dishwasher used in hospitals and
labs
Embedded webserver could be subverted
What could you do with a back door into a lab?
![Page 23: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/23.jpg)
#watitis2017
DOOR LOCKS
• Smart locks
• Can use a Bluetooth device (fob,
smartphone) to open lock
• Some allow you to add a network module to
control over your home network
![Page 24: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/24.jpg)
#watitis2017
DOOR LOCKS
• Some have been found to send passwords
unencrypted
• A Bluetooth sniffer could be used to discover
the lock password
• Others responded to an encrypted, but
unchanging, signal
• An attacker could record the signal and
replay it to open the lock
![Page 25: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/25.jpg)
#watitis2017
DOOR LOCKS & AMAZON
• Authorize Amazon delivery people to enter
your home
• Uses smart lock and app
• Camera records your door and lock logs
locking and unlocking
• What could go wrong?
![Page 26: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/26.jpg)
#watitis2017
DOOR LOCKS & AMAZON
• Now you see the delivery person in the
surveillance camera on the right…
![Page 27: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/27.jpg)
#watitis2017
DOOR LOCKS & AMAZON
• …but overwhelm the wireless network, and the camera freezes on the last image seen!
![Page 28: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/28.jpg)
#watitis2017
WEBCAMS
• Once hard-wired to computers and controlled
by them
• Now, often connected directly to networks via
Wi-Fi
• Controlled wirelessly via embedded web
servers
• Useful for
Skype
Monitoring your home
Sharing video…
![Page 29: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/29.jpg)
#watitis2017
WEBCAMS
• Good camera!
![Page 30: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/30.jpg)
#watitis2017
WEBCAMS
• Bad camera!
![Page 31: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/31.jpg)
#watitis2017
WEBCAMS
• Smorgasbord of cameras
![Page 32: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/32.jpg)
#watitis2017
WEBCAMS
• Select live video feed from previous panel
![Page 33: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/33.jpg)
#watitis2017
HOME AUTOMATION
• “Smart” homes
• Network connected
Audio and video
Thermostats
Security cameras
Lighting
• Hubs to control devices from Amazon (Echo),
Apple (Home)
![Page 34: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/34.jpg)
#watitis2017
HOME AUTOMATION
• What happens if I push a button on this
publically accessible interface?
![Page 35: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/35.jpg)
#watitis2017
HOME AUTOMATION
• Attacks
Disable security alarms and cameras
Unlock doors
Adjust thermostat
Use your imagination!
![Page 36: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/36.jpg)
#watitis2017
HOW WERE THESE DEVICES
FOUND?
• That is a elite hacker’s secret!
![Page 37: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/37.jpg)
#watitis2017
HOW WERE THESE DEVICES
FOUND?
• That is a elite hacker’s secret!
• Actually, it was Shodan
![Page 38: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/38.jpg)
#watitis2017
SHODAN
• One of a number of search engines
specializing in finding devices
• Scans the Internet and saves information
that each device gives it about itself
• Can search by device, location, type of
software interface, etc.
![Page 39: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/39.jpg)
#watitis2017
SHODAN
• Detects web servers that act as control
interfaces to IoT devices
• Also detects interfaces to databases, SCADA
systems, gaming servers, etc.
• Finding a vulnerable device to attack is as
easy as using Google
![Page 40: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/40.jpg)
#watitis2017
GOOFY
![Page 41: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/41.jpg)
#watitis2017
$699 WI-FI CONNECTED JUICER
• Needs internet access to verify the
ingredient pouch
![Page 42: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/42.jpg)
#watitis2017
SMART CHOPSTICKS• Announced by Baidu in 2014
• Claimed to detect contaminated oils
• Pairs with a smartphone app
• Never produced, but still described in articles as an innovative IoT device in 2017!
![Page 43: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/43.jpg)
#watitis2017
OTHER DEVICES
• A hands on look
![Page 44: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/44.jpg)
#watitis2017
SPOTSTAR
• Smart heater and fan
• Proximity sensor stops operation when no
one at desk
• Thermostat learns your heating and cooling
preferences
![Page 45: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/45.jpg)
#watitis2017
SPOTSTAR – HOW IT WORKS
![Page 46: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/46.jpg)
#watitis2017
SPOTSTAR – HACKABLE?
• Points of attack
Web server controls parameters• Direct break in
• Steal session credentials and spoof identity
Wireless connectivity• Can observe wireless traffic
• Fake eduroam access point
• Flood network with traffic to prevent updates
![Page 47: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/47.jpg)
#watitis2017
SPOTSTAR – THERE IS A CATCH
• Heater operation can’t be altered if network connectivity is lost
![Page 48: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/48.jpg)
#watitis2017
CONCLUSION
• What do IoT devices really do?
• What do we need our devices to do?
• How should we respond to the rise of IoT?
![Page 49: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/49.jpg)
#watitis2017
ACKNOWLEDGEMENTS
I would like to thank the following people for
their assistance and advice as I developed
this presentation.
• Costin Ograda-Bratu, Ronaldo Garcia, and
Lawrence Folland of CSCF
• Mike Nowakowski and Jason Testart of IST
![Page 50: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/50.jpg)
#watitis2017
RESOURCES 1• privacy not included [2017 Holiday Shopping Guide]
https://advocacy.mozilla.org/en-US/privacynotincluded
• Don't Buy Anyone an Echo
https://gizmodo.com/dont-buy-anyone-an-echo-1820981732
• The Internet Of Hackable Things
https://motherboard.vice.com/en_us/topic/the-internet-of-hackable-things
• Strangers can talk to your child through 'connected' toys,
investigation finds
https://www.theguardian.com/technology/2017/nov/14/retailers -urged-to-
withdraw-toys-that-allow-hackers-to-talk-to-children
• Amazon Key Flaw Could Let Rogue Deliverymen Disable Your
Camera
https://www.wired.com/story/amazon-key-flaw-let-deliverymen-
disable-your-camera/
![Page 51: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/51.jpg)
#watitis2017
RESOURCES 2• “Internet of Things” security is hilariously broken and getting worse
https://arstechnica.com/information-technology/2016/01/how-to-search-the-
internet-of-things-for-photos-of-sleeping-babies/
• Bluetooth Hack Affects 20 Million Amazon Echo and Google Home
Devices
https://thehackernews.com/2017/11/amazon-alexa-hacking-bluetooth.html
• Watch Thieves Hack Keyless Entry to Steal a Mercedes in Less
Than a Minute
https://gizmodo.com/watch-thieves-hack-keyless-entry-to-steal-a-mercedes-in-
1820767189
• Hacks to turn your wireless IP surveillance cameras against youhttps:/ /www.csoonl ine.com/art ic le/2224469/microsoft -subnet/hacks-to-turn-your-wireless- ip-
surveil lance-cameras-against-you.html
• Hackers Use College’s Connected Vending Machines To
Attack Network
https://consumerist.com/2017/02/14/hackers-use-colleges-connected-vending-
machine-to-attack-network/
![Page 52: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/52.jpg)
#watitis2017
INFORMATION SECURITY
SERVICES
• IST team
• We will provide custom information security
consulting or training to your team or
department
• Contact Terry Labach to discuss your
security education needs
![Page 54: YOUR TITLE HEREist.uwaterloo.ca/~tlabach/watitis/2017/Rise Of The... · 2017-12-07 · #watitis2017 INTERNET DISHWASHERS •Miele Professional PG 8528 •Network-enabled Not supposed](https://reader033.vdocuments.mx/reader033/viewer/2022042203/5ea504e351dff74b610898db/html5/thumbnails/54.jpg)
#watitis2017
QUESTIONS?