Inbar Raz - Physical (In)Security – it’s not –ALL– about Cyber

Physical (In)security

Inbar RazMalware & Security ManagerCheck Point Software Technologies

Types of Vulnerability Disclosures

Responsible Disclosure:– Contact the vendor only and inform them of the vulnerability– If asked, work with the vendor– After 3-6 months, proceed to Full Disclosure

Full Disclosure:– Publish all information, including POC– Sometimes – only a video of POC

Disclosure #1

Vendor: An Online Movie Ticket Service

Field: Online shopping and entertainment

Affected Product: On-site Ticket Kiosk

Vulnerability: Multiple vulnerabilities cause the compromise of both customer and company data

Disclosure Details

On-site Kiosk

Touch Screen

Credit CardReader

Ticket Printer

No peripherals,No interfaces

And the journey begins…

Disclosure Details

Improper interface settingsallow the opening of menuoptions.

Menus can be used tobrowse for a new printer.

Disclosure Details

A limited browser is notrestricted enough.

A right-click can be used…

To open a full, unlimitedWindows Explorer.

Now the sky is the limit…

Disclosure Details

Browsing through thefile system revealsindicative directory names…

And even more indicativefile names.

Disclosure Details

Bingo: Credit Card Data(Unencrypted!)

Tools of the trade: Notepad

We can use the ticketprinter to take it home

Disclosure Details

But that’s not all:RSA Keys and Certificatesare also found on the drive!

Which we can print, takehome and then use afree OCR software to read…

Disclosure Details

The result:

RSA Keys used tobill credit cards.

Disclosure #2

Vendor: Point-of-Sale Manufacturer and Users

Field: Network Security

Vulnerability: Improper physical security allows access to insecure PoS devices during afterhours.

Disclosure Details

Point-Of-Sale devicesare all around you.

Disclosure Details

Location: A bar in Tel-Aviv

During working hours – tables, chair and PoS outside

During afterhours – everything is locked inside the facility

But the Ethernet port remains hot– In public space…

Attack Vector

In the past – play hacker/script kiddie with BackTrack.

Today: Fire up wireshark, discover IPs of live machines.

Attack Vector

In the past – play hacker/script kiddie with BackTrack.

Today: Fire up wireshark, discover IPs of live machines.

Detected IP addresses:– 192.168.0.1– 192.168.0.2– 192.168.0.4– 192.168.0.250– 192.168.0.254

Confirm by ping (individual and broadcast)

Attack Vector

Evidence of SMB (plus prior knowledge) lead to the next step:

And the response:

Things to do with an open share

#1: Look around

Things to do with an open share

#1: Look around

#2: Create a file list

The mystery of 192.168.0.250

Answers a ping, but no SMB.

First guess: the ADSL Modem.

Try to access the Web-UI:

The mystery of 192.168.0.250

Use the full URL:

Reminder: We actually had this information.

Going for the ADSL router

Naturally, there is access control:

Want to guess?

Unlocked Achievements

Best for me, worst for them: Credit card data.

Database files (yet to be analyzed).

The program files of the billing system.

Potential attack through the internet.

Next Steps

Create a Responsible Disclose document for the PoS manufacturer

Send an Advisory to businesses

IMPORTANT NOTICE

The bar operation was with full cooperation and consent.

DOING THIS ON YOUR OWN IS ILLEGAL.

Inbar Raz - Physical (In)Security – it’s not –ALL– about Cyber

Technology

International Network for Bamboo and Rattan (INBAR) · International Network for Bamboo and Rattan (INBAR) GLOBAL FOREST RESOURCES ASSESSMENT 2005 BRAZIL ... Government towards policies

Raz Kids2 6

Raz na zawsze.indd

Raz Raz Twocrazyzebras Bw

INBAR Annual Report 2015

Inbar Plaschkes , M.Sc

©2012 Check Point Software Technologies Ltd. Introduction to Reverse Engineering Inbar Raz Malware Research Lab Manager Information Security – Theory vs

Raz Euthanasia

A Growing Sub-programme in INBAR - Haiti...A Growing Sub-programme in INBAR Shyam K. Paudel, Program Officer, INBAR spaudel@inbar.int Dr. Maxim Lobovikov, Programme Manager, INBAR

Inbar Jr v4n1

Raz lq11 earthquakes_clr

Inbar Technical Report No14

RAZ Shower Chairs_2015

Inbar Technical Report No27(2)

Promoting community based business models inbar case studies

PDI of RAZ

Inbar Raz & Eden Shochat: From “One Country - One Floppy” to “Startup Nation”

Raz La25 Opposites

Raz lh31 samsfourthofjuly_clr

©2013 Check Point Software Technologies Ltd. Physical (In)security: Its not all about Cyber… Inbar Raz Malware & Security Research Manager Check Point