>> Ever wondered how devices like
this tiny little Raspberry Pi get attacked by hackers?
Ofir, from the Azure Security Center team
will show us a demo
of what happen when someone tries
to breach your device and how we're protecting that.
[MUSIC]
>> Hi everyone. This is the IoT Show.
We are on the road at Ignite 2019,
and I'm here with Ofir from the Azure Security Center team,
and we'll talk security with IoT.
Ofir, thanks for joining the IoT Show today.
>> Sure. Sure. I'm really happy to be here.
>> So Ofir, tell us about yourself
and what your team is doing at Microsoft.
>> Okay. So I'm Ofir.
I'm leading the Detection team in Azure IoT security.
So actually we're focused on IP security.
>> Okay.
>>I have a talented team of security researchers and developers,
and we're building the security around the IoT of Azure.
>> Okay. So we discussed
that with some of your colleagues already,
what the overview on IoT in Azure Security Center looks like.
Let's dive into some of
these demos because we talked about the principles of it,
but let's see it in action.
>> Okay. Sure. Sure. I'll be happy to do that.
>> Tell me then.
>> So what you see here, you can hold it.
>> Let me hold it.
>> It's a Raspberry Pi.
>> Yeah.
>> Actually you can see it here.
That's a Raspberry Pi.
>> Yeah.
>> It is connected to a touchscreen which is
running Ubuntu Linux wireless.
It's connected to a network.
This is only the electricity.
>> Got it.
>> Actually, it's live. You can see here.
>> Yeah.
>> It's running. We're going to show you a really cool demo.
>> Okay.
>> I'm going to attack that device.
>> You're going to attack the device.
>> Yes, so hold it tight.
So make sure you keep it safe.
>> It's not going to burn or something, right?
>> I don't promise, and then now,
we're going to see how it works.
>> Okay. So is that one connected right now to Azure IoT Hub?
>> Exactly.
>> Okay.
>> So that device is connected to Azure IoT Hub.
>> Okay.
>> The hub that you can see over here.
>> Okay. Got it.
>> I have several devices connected,
and one of them is that specific device.
>> Okay.
>> This is a regular IoT Hub.
Most devices, if they're working with the Azure,
they're connected to Azure IoT hub.
>> Yeah.
>> On Azure IoT Hub, in Azure portal,
you can just click on the "Security",
"Enable the Security" and then you have it
protected by the Azure Security Center for IoT.
>> Okay. There's an agent running in there,
and you guys provide as
an open source project that people integrate into
the code along with the IoT Hub SDK
to integrate into that infrastructure.
>> Exactly. So agent is an open source as you're saying.
It supports a lot of flavors,
and it actually monitors everything that goes on, on that device.
So every connection, every executable,
if an administrator is added to the system,
so that way we can keep track of
everything that is going on that device.
>> Okay.
>> So the device is connected.
Actually, we're going to look in the security alerts and verify,
but currently we do not have any alerts before we start the demo,
so our page here is clear of alerts, empty.
>> No data to display.
>> There are some recommendations.
>> Okay.
>> This is something we're going
to talk about at the end of the demo.
>> Okay.
>> Recommendation are a way to
tell you how to improve the security.
>> Okay.
>> But we will get back to that.
So actually what I'll do now
is I'm running a Linux machine on my computer,
and I'm going to try and connect from
my computer to the IoT that you are now holding.
>> Okay.
>> I'm doing that right here.
>> Okay.
>> Actually, I'm starting with the simple way
of trying to figure out what is the password of that device.
>> Using a brute force attack on that device.
>> Exactly.
>> Okay.
>> This is what we call a brute force attack.
>> Yeah.
>> For password. Usually, what attackers are doing is they're
using a dictionary of default credentials.
>> Okay.
>> Those are actually the credentials that a lot of
devices come out of the factory with.
>> Root password and this kind of things.
>> Exactly. So for example,
Mirai was the famous IoT attack
that few years ago caused a massive DDoS attack,
and Mirai used only about 60 passwords,
only 60 difficult credentials and with
that managed to infect thousands of devices out there.
So I'm keep trying.
I'm trying to open a [inaudible] and do an ls command here.
>> Okay.
>> I keep failing,
and then I'm using a different username and
a different password out of the dictionary until I will find one.
So in real attack out there, usually,
it can take days or week,
but it doesn't matter because the device is connected.
>> You're in.
>> Right, we're in.
So we managed to find the password,
and actually that's the last command that we invoke.
>> Okay.
>> You can see now that also [inaudible] along the screen, it's-
>> So you basically attacked the device visually as well.
>> I'm showing you that I'm actually
controlling the device without touching it.
>> Okay.
>> It was in your hands all the time.
>> Okay.
>> So this is our first way.
Usually that's how an IoT attack starts.
We did it at very, very quick,
but in real life scenario,
it can take up to weeks,
and then you find the password.
>> Yeah.
>> Now, this is the part where you need to move fast.
Once the attacker has the password,
it has a short window until that device might be disconnected,
the password will be changed,
it will be updated and stuff like that.
>> So now is the part when you need to infect the device,
run my software on the device.
>> Yes.
>> But I cannot put my software here.
>> Yeah.
>> So the trick that we usually do is telling
the device go-ahead and download the text file from my website.
>> Okay.
>> That text file is actually a script.
>> Yeah.
>> So here I go.
I'm downloading the text file,
which is the second payload.
>> Okay.
>> I'm turning it into an
executable and just running it on the device.
>> Okay.
>> Now the device is actually infected.
It is infected because it's running my code now.
>> Got it.
>> Not because it was manufactured.
>> Okay.
>> So the third part is actually
connecting the device to what we
call a command and control server.
In short it's C&C.
Once I have connected it to a command and control server,
I can actually disconnect from the network.
>> Okay.
>> I don't need to be near the device,
because currently they are running on the same network.
But once it is connected to my command and control server,
it will actually go ahead and ask me if I
have a command for it to run.
>> So now you have full control over [inaudible].
>> So I have full control and I can do whatever I want.
>> Yeah.
>> We wrote a very simple command and control server.
We're just asking the device to run a crypto minor on the device.
Now actually I'm making money out of your device,
you're paying for the electricity and I'm getting the coins.
>> So we are in third place here.
>> That's how usually on TextScript are happening.
Some of the additional stuff that we did here,
we created our own user, a privileged user.
>> Okay.
>> So actually now I can connect whenever I want.
>> Yes.
>> I have a back door.
I can remove the original administrator.
So he can not connect anymore,
and now it will be much harder for him to remediate,
you will have to physically
connect into the device in order to do that.
>> Okay.
>> I'm cleaning some of the log files so it will be much harder
to understand where did I come from, etc.
>> Okay.
>> So this is another thing that attackers usually do.
You see here that I managed to get the
exact [inaudible] that the device is running,
that's because I want my server to understand
the exact flavor so I can inject the right command to it.
>> Okay.
>> It was quick.
>> It was quick and easy.
>> Easy and scary.
>> So how are we preventing that?
How are we protecting devices from that?
>> Great. So now let's get back to Azure IoT Hub,
where the security is enabled, Azure IoT security.
We'll reload the event page and see what we have here.
So you can definitely
say that something wrong is going on with the device.
Remember it was empty before.
So now I have around 10 alerts about that.
Let's look at some of the obvious ones.
So here's the one about the brute-force attempt.
>> Okay.
>> The fact that someone is trying to connect with
different password each time.
>> So as long as no one found the password,
you are still okay?
>> Yeah, but then comes the one about the successful remote login.
So if it was only an attempt, that's fine.
It happens. But you can also say that sound actually logs in.
>> Yeah.
>> This one is the fact that we're
downloading a file from a suspicious place,
and this is actually really cool because what we do here,
we leverage Microsoft threat intelligence feed.
>> Okay.
>> So Microsoft has a huge feed of suspicious
IP's from all over Azure and
millions of other computers that Microsoft is securing.
Once we see an IoT device
trying to connect to such a suspicious IP,
we immediately flag it and tell you, "This is wrong."
>> Okay. So as the device builder or the IoT solution builder,
I don't need to know the potential scratch or
stay updated myself, Microsoft does that for you.
>> Exactly. This feed is always getting updated and up-to-date.
We can see here the fact that
the administrator was added to the system.
>> Okay. You know what happens, basically.
>> You get a picture of the attack.
You see where the attacker is coming from.
You can see what it tried to do or did on their device.
>> Yeah.
>> You can to get additional details when you drill in,
and you can actually send these over to
your scene or any other system that can use it.
>> Like, "Hey, just connect that little guy
because it's actually corrupting my old system."
>> Exactly. So you can manage that the way you
manage the rest of your IT firm.
But let's get back to the recommendation that we mentioned before.
>> Yeah, because you want to prevent
that at the end of the day, right?
>> Exactly. The recommendation part
is actually really interesting,
because this entire attack could have been
prevented if we would have fixed
those recommendations that we saw in the beginning of the demo.
>> Okay.
>> So we will drill down into those.
Let's reload it.
So actually there are three recommendations here.
One is the fact that the device has opened
ports and we did use SSH port in order to connect.
>> Yeah.
>> But usually you do need SSH port
because you need maintenance to the device etc.
>> Yeah.
>> So this is the second recommendation here.
It's saying that your firewall policy is too permissive.
If you do need SSH job plan,
then you must restrict it only to your specific IP,
your organization network, etc.
Otherwise if you keep it wide,
you're exposed to the attack, the ones that we see here.
>> Make sense. Yeah.
>> The third one is actually
saying that the OS of this device is not up to date.
If it would have been patched,
it was much more difficult for me to infect it and run myself.
So if those would have been implemented,
of course it would be much more difficult to attack.
>> Awesome. My understanding is
that there's also a way to create customer alerts.
You can also enrich
the whole application based on the agent to add more alerts,
based on your own solution and tackle devices.
>> Exactly. So first of all,
we're trying to bring you value out of the box.
>> Yeah.
>> So we do the intelligence feed
and we manage to detect brute force attacks and things like that.
But when you are writing the application,
you know it very well.
>> Okay.
>> So you can add your own rules.
For example, if you know the message size,
and usually the message size is in a certain size,
then you can add your own rule that if
the size exceeds a certain limit,
then you can issue an alert,
and this one would be added on top
of the other alerts that we can issue to you.
So that's the way for you to add
custom logic and help us protect the device.
>> Awesome. Ofir, that was a great review
and pretty fun attack on a device.
Don't be scared. We got you covered.
We are securing the IoT with Azure Security Center.
Ofir, see you soon on the IoT Show, I hope.
>> Yeah.
>> You guys, see you soon as well. Don't forget to subscribe.
[MUSIC]