Smart vacuum cleaners as remote wiretapping devices
April 21, 2019
9:00 PM – 9:45 PM Add to calendar
9:00 PM – 9:45 PM Add to calendar
EI 7
Exploiting Neato Connected firmware to control high-end vacuum cleaners
The Neato Botvac Connected vacuum cleaners offer a nice platform with up-to-date sensors, including laser scanner mapping your home. The newest Neatos, which are coupled to cloud services over WiFi, run QNX and little was known about them so far. Connected vacuum cleaners are an interesting target regarding privacy, security and safety, as they have access to your home and move freely therein.
The firmware is protected by a write-only interface and an undocumented chip layout - extracting it is a very interesting process. It is a struggle against proprietary chips and QNX systems. We found an upload serial console, which is their anti brick interface, that only accepts QNX file systems, and guessed the chip family correctly, enabling us to print out some memory contents over the serial console. To actually extract something meaningful from this memory, we performed a regular firmware update process on the robot and rebooted into our modified minimal QNX without re-initializing memory---thereby stealing their complete firmware. Based on the firmware extraction, we found many interesting firmware internals.
We analyzed weak encrypted coredumps produced by the vacuum cleaner during Web interface fuzzing. By this, we identified a buffer overflow vulnerability, which enables remote command execution (RCE) with root privileges on the robot. Our RCE vulnerability works without prior authentication and---before Neato was informed and rolled out a bugfix---executable via their cloud infrastructure by anyone guessing or knowing a robot's serial ID, which is printed on packing and robots. An attacker could leverage the RCE to extract sensitive information from the robot and harm the user's privacy. We explain the vulnerability, our exploit and how we overcame obstacles during proof of concept development.
Additional information
| Type | Talk |
|---|---|
| Language | English |
More sessions
| 4/19/19 |
Der Eröffnungstalk!
|
| 4/19/19 |
In diesem Talk wird die KI-basierte Manipulation von Videos gezeigt. Als Beispiel werden Personen aus der Echtzeitübertragung einer IP-Kamera entfernt, um unbemerkt Objekte zu platzieren. Um dies zu ermöglichen wird zusätzlich ein Angriffsvektor auf IP-Kameras gezeigt.
|
| 4/19/19 |
Wie sich die tägliche Arbeit verändert, wenn man ausschliesslich an einem OpenSource Projekt arbeitet.
|
| 4/19/19 |
Für eine sichere und funktionale Datenspeicherung in der Cloud benötigen wir neue Technologien, ein Ansatz ist Searchable Encryption (SE). Nach einer kurzen Einführung zum aktuellen Stand der Verfahren werden wir Searchitekt, unser Developer Framework für SE vorstellen.
|
| 4/19/19 |
Yes, we want to talk about ActivityPub - because it's what drives many popular fediverse services (e.g. mastodon). We will cover history and basic structure of the spec. And then discuss whether or not this a case of XKCD 927 and if Moxie Marlinspike's blogpost applies.
|
| 4/19/19 |
In diesem Talk werden wir uns eine richtige Untote unter den Programmiersprachen etwas genauer anschauen. Unter Anderem stelle ich Details vor, die heute furchterregend sind, zu ihrer Zeit aber wie eine gute Idee aussahen oder technisch notwendig waren.
|
| 4/19/19 |
Vor zwei Jahren stand auf dem Easterhegg-Fahrplan ein Treffen zur Reanimation der Datenschleuder. Seitdem arbeitet ein Team daran, dass es wieder eine Datenschleuder gibt. Darüber, warum und wie wir das machen und wie ihr das auch machen könnt, wollen wir reden.
|
