Hey everybody, welcome back to salted hash. I'm your host Steve Reagan
And today we're going to be talking about smart city security vulnerabilities and other things you may take for granted. We'll be right back
Welcome back as I said, we're going to be talking about smart cities
It's a concept that some of you are familiar with and some of you this may be a new thing
I am joined by IBM x-force Reds Charles Anderson and
We're going to talk about the technologies that drive
smart cities and here recently your group did some research and
you found several zero-day vulnerabilities in
multiple vendors
some of them were including like default credentials authentication bypass even SQL injection in some cases and
once you've dug a little deeper into this you you were able to develop some exploits to
Real-world test these problems and using basic things like Shonen you were able to find hundreds sometimes
thousands of practical devices
So give me a little background on the research and what you first thought after you discovered all this well, you know
whether you're doing research on an on an industrial IOT device or a
Consumer IOT Internet of Things device
Really the vulnerabilities are not all that different. It's it's not as if there are smart city vulnerabilities and at its core
the the researchers Dan gen and Mauro were
focusing on
extending some of the lessons we've learned elsewhere and security to the smart cities and you know
It's kind of interesting because you see you see that that trust break down that
IOT
It's like it's a chain of trust from from that sensor that might be detecting radiation or a flood and giving information
to other smart city technology so that that smart city technology can
make a decision say a dam might release water or not release water a
Radiation detector might send an alert to citizens
The the expectation of the makers of that dam device that that that radiation detection device
Is that the information they're getting out is valid and can be counted on
And if you break that trust you the whole system goes down. So my question is I mean
understanding that technology has phoner abilities and sometimes codes going to break and sometimes people will be careless or even negligent I mean
When it came to this technology, why were these flaws introduced? It's been a few years now since IOT
He's been like a mainstream fixture for a lot of security as elements. So how did stuff like this get mixed? For example, the
nuclear alarm for example give off a radiation warning
why is that that type of device not hardened to make sure that all of the informations accurate so
You know when you're thinking of developing an IOT system. Yep, it's not like the
Nuclear alarm was in the same room as they were developing the sensor and everything
really a lot of these cities in effect are
Integrators of technology, you know, they're doing the integration themselves
They're taking all these parts and they're building an IOT chain that that same IOT chain. We just discussed and
When they are doing it, they're the cities are not testing in a holistic manner
so they're they're assuming
Security's just baked in and because the parts have security baked in that the whole will be secure and the answer is
Frankly that when the cities are purchasing this IOT equipment. They need to budget for more than the IOT equipment
Yeah, they need to budget for maintenance. They need to budget for security
They need to budget for all these things and most importantly security testing
One initial rollout and a continuing program of testing for these smart cities and until that happens
You're gonna see things like this pop up
So when it came to the feedback from the the three vendors and we'll get into that here in a minute
What was their initial reaction when you brought your findings today? They were it was actually very positive I and you know
This is this any vulnerability should be seen if if it's responsibly disclosed and patched
That's a win for security and I think that gets lost a lot
this was a good day for security because
We announced patches two vulnerabilities and we've seen no evidence of them being exploited in the wild
I mean the alternative is you find out about a No from my forensics report
Sorry bats already happened. Yeah, the alternative is just
So staggeringly bad that this should be we should be you know
really celebrating this as a victory and and you know
I think more and more you're seeing manufacturers understanding this and saying hey, let's get this taken care of
Let's get it patched to the patch rollout. Let's let's announce it and
And I think that's a really positive move for security in general. Excellent Charles
Thanks for taking the time to talk to us
It was really a real pleasure
Stick around we're gonna go into a little more technical detail on some of these vulnerabilities and IBM's findings, so I'll be right back
Welcome back. Like I said, I wanted to go into a little more technical detail and to do that
I've brought on Daniel Crowley. Who is the research Baron for IBM's x-force read and one of the
One of the main people behind this particular research. So let's start with some basic questions here
Tell me tell me when when it was that this came to your attention and what actually made you want to research Smart City
Technology. Well a couple years ago. I did a research project with it actually involved one of the researchers on this project as well
on smart home technology
and we found a bunch of bugs there and
the
Future work section of that we talked babble. What's next?
What's what what is the next work that can be done here?
And one of the things we talked about was smart cities, it seemed like a natural extension of smart home technology
and
We had this vision of smart city technology that didn't really match with reality and when we started to do the research
And we it was because we realized that you know instead of this retro futuristic fantasy
where
windowpanes double as informational touchscreens
The reality was much more mundane and it was already here this was not a future thing
This was a present and when we started to realize that we decided well, let's let's take a crack at it
Let's see we can find
So once you started digging into it the report you issued today, who were the three vendors who?
Exelon Corporation. Mm-hmm
Patel and
Why bel iam? Okay. So when you were looking at those one of them one of them, I can't remember
What spender was it stood out to me, but they had SQL injection issues with their their things
So when you were researching you found it was authentication
Bypasses default credentials SQL injection. That's right
What were your initial thoughts when you were finding this was this expected or was this completely out of left field? I
suppose I could best sum it up as
Disappointed but not surprised. Okay, that makes sense
So when you when you reached out and got ahold of the vendors, what was I mean Charles said earlier that they were very cooperative
and then we were easy to work with so was their initial reaction like oh
God what just happened we were busted or were they like hey, wow that that sucks. Thank you and
Went from there. I was it I the disclosure process went much better than am used to I've done a lot of bug disclosure and
normally
You know when you're working with multiple vendors, one of them is like making veiled legal threats and things like that
We didn't really get that
You know, we reached out to them they responded in a timely manner
they
understood the gravity of what we were talking to them about they issued patches within a
Week to three weeks or so
all of these issues are patched and
You know, so at it the disclosure process went very well
We're very pleased you preempted my other two questions, which is just amazing. I like that so when it came time to
Build the presentation and get it up on stage
there were a number of areas who could have looked at and
Having seen the talk notes and actually the the report of the the talk itself
I I noticed you didn't go with the Fudd but you really did want to do like a wake up
And pay attention type atmosphere in the talk
How hard was it to pick what elements to discuss when it came to the risks and potential fallout 4?
yeah, so we we're
We're trying very hard to make sure that this is as little flood as possible
And we already have people call us out on Twitter for fun, but that's neither here nor there
you know, we're trying to present as as much of a
a
Cut and dry technical approach to this as we can and we'll talk a little bit about implications. We said in every single interview
every single time we
Mentioned this that this depends highly on how these devices are deployed and we do have limited visibility into that
we can look at things like
customer case studies from manufacturers websites
but
ultimately
What this comes down to is how these things are deployed we found that we can in
every case
Either use the device as if we were a legitimate administrator due to authentication bypass or code execution bugs
Which leads to anything you want?
Or, you know
We have the level of code execution where we can literally make it do anything
That possible with the physical device that we have just compromised
so when you take that and put it in the context of something that has some amount of control over traffic or
Some amount of control over industrial control systems or some amount of control over
sensors that are detecting things like radiation levels and
You know
water levels that protect prevent flooding and these are there's published case studies that show that people are using it for these things and depending
On how they've set them up if they're relying entirely on these vulnerable devices well
You know, that's a fraud trying to avoid FUD, but I think it's not
Unreasonable to say that yeah
If you're relying this upon this for safety, and this is the only thing that's you're relying on and we can subvert it
Well, there is a safety consequence. Yeah
So then now that you've done your talk and everything
has
Come out in little public
What's next? Where are you going after this? Are you going to continue a smart city research or are you looking at something different?
that's hard to say I
Am fascinated by all sorts of technology, but I think I might continue to look at smart city technology
I'm particularly interested in intelligent transportation systems. And that seems to be a thing that is
Really really? I mean smart city technology in general is being very actively developed and deployed
across the world, but intelligent transportation systems was it seems to be from our research the thing that is
you know the
adopted the most adopted the earliest
And it's also they're just a lot of really interesting
Developments a lot of cool stuff happening there and I think I'd like to continue pursuing that. Thanks a lot. Dad
Thanks for hanging out with us. I appreciate it
It's my pleasure Steve if you'd like to learn more about smart city technology
Don't forget to check out our video series on that that might produce it Chris
Helped with and it was an amazing project on that end
And of course keeping up with smart city tech IBM and everything else stay tuned assaulted hash. And of course CSO online.com
I'm your host Steve reg and I'll see you soon
You