Information security took a hammering at Chaos Communications Congress, with intercoms, smart meters and even numbers themselves in the spotlight
Chaos Communications Congress is the worlds oldest hacker seminar, and Europes largest. Every year, thousands of hackers gather in Hamburg to share stories, trade tips and discuss the political, social and cultural ramifications of technology.
As computer security is a big part of the hacker world, they also like to break things. Here are five members of the most important, interesting, and impressive things transgressed this time.
Intercoms
The internet of things has been a security catastrophe since the working day it was no more than a glisten in a marketing directors eye. It turns out inexpensive hardware that cant be easily updated but is permanently attached to the internet is a nightmare for users and a goldmine for hackers.
So if your home is accessed through an internet-of-things intercom, you might want to ensure you have an old fashioned back-up lock to keep things shut while youre away.
Sebastien Dudek, a researcher at French firm Synacktiv, revealed his research on hacking smart intercoms, which replace the conventional built-in telephone with a connection to the phone network. When a guest arrives, the intercom makes a call, either to a landline or a mobile, and the resident can simply make a key on their phonepad to let their visitor in.
Of course, that merely works if the intercom actually calls your telephone. If it can be intercepted to call another random phone, then the doors open to allcomers.
For the simplest type of intercom, which employs a mobile phone SIM card to simply dial the specific objectives telephone number immediately, Dudek was able to use a piece of commodity hardware to spoof the mobile base tower and intercept the call directly.
Some more complicated intercoms instead call a preset command station, which then routes the call through to the final number. That could be more secure, but in practice, Dudek says it merely introduces new avenues of attack.
For one thing, the central server allowed Dudek to compromise multiple intercoms at once. From there, he proposed a number of potential exploits: an attacker could change all the intercoms to premium rate numbers, for example, raking in the money whenever anyone has a guest; or they could use a reverse look-up service to track down where each intercom is connected and organise a mass break-in.
Boarding Cards
The international travel booking network is one of the wonders of the world. Dating back to 1960, “its one” of the first truly global networks to ever be created, and it is still responsible today for letting you book a flight from anywhere in the world to anywhere in the world , no matter where in the world you happen to be at the time.
Unfortunately, computer security has come on a bit since 1960, but the security on the Global Distribution Systems hasnt.
Researchers Karsten Nohl and Nemanja Nikodijevic, of German research firm SRLabs demonstrated the resulting imperfections in front of a live audience, brute-forcing booking records, showing how easy it would be to steal airline miles or even whole tickets, and disclosing how personal data stored in the booking system is scarcely protected at all.
The heart of the insecurities lies in the six-character booking code, printed on everything from luggage tags to boarding cards and confirmation emails. Six characters is few enough that a valid code can easily be guessed, even if it cant be simply found by rummaging through bins in an airport, and most vendors only use another public fact your surname to secure it beyond that.
Global booking systems have pioneered many technologies including Cloud computing, the researchers said. Now is the time to add security best practices that other Cloud users have long taken for granted.
Smart Meters
Whats even more concerning than an insecure smart home? An insecure smart city. Netanel Rubin, co-founder of the security firm Vaultra, presented his research on smart meters, electricity meters that co-ordinate with the utility company and other meters on the same network to ensure that the power grid of a city is fit for the 21 st century.
When utilized well, smart meters offer a host of advantages: individuals can keep better way of their usage, utilities can offer flexible tariffs to encourage utilize when the grid is underloaded, and microgeneration can be rewarded, letting utilities pay people for fitting solar or wind generation to their properties.
Unfortunately, some smart meters are anything but procure. Use a similar technique to Dudek, Rubin managed to intercept the communications between the smart meter and the utilities company itself. That would enable billing scam( either stealing free electricity, or maliciously increasing the bills of victims ), as well as privacy invasions.
Things get worse if a user has other smart devices in their home, such as a smart door lock. Imagine you woke up to find youd been robbed by a burglar who didnt have to break in, Rubin said.
At its worst, he argued, a hacked smart meter could cause detonations or home flames. The devices are designed with the objective of supply that an impossibility, but then, they are also designed with the goal of rendering hacking them impossible. Not every design goal is achieved.
The UK department charged with implementing smart meters, the Department for Business, Energy and Industrial Strategy( BEIS ), says that robust security controls are in place across the end-to-end smart metering system and all devices must be independently assessed by an expert security organisation, irrespective of their country of origin.
Elections
Voting on paper might seem woefully old-fashioned in the 21 st century, but one hour in Chaos Communications Congress will leave you very relieved if your country still votes the old style, and very concerned if it doesnt.
J Alex Halderman and Matt Bernhard, both of the University of Michigan, discussed attempts to prove that the US election wasnt hacked, whether by Russia or some other attacker.
Their findings were concerning: not only would it be entirely possible to alter the results reported by a number of electronic voting machines while leaving no obvious trace of your attack, it is feasible to do that at the scale needed to hack an election.
Im pretty sure my undergraduate security class could have changed the outcome of the presidential election, Halderman said. It really is that bad.
That wouldnt be so bad, since every electronic voting machine used in the United States leaves some sort of paper audit trail, either in the form of receipts published off to mark the vote, or the physical ballot paper scanned in in the first place.
Except no one counts the paper trail, and legal attempts to force them to do so ended in a costly deadlock in December 2016.
The one piece of good news? The abortive recount didnt find any evidence that a hacker had happened; it only also didnt find evidence that it hadnt happened.
Numbers
Even numbers are at risk when the security world gets going. Well, specific kinds of numbers, at least. Jos Wetzels and Ali Abbasi, from the University of Twente in the Netherlands, demonstrated their research on imperfections in embedded cryptographically secure pseudo-random number generators, and it was bad news.
Lets break that down. Random numbers are very important for a number of security applications, such as safely encrypting communications. But without specialist, expensive hardware, true random numbers are impossible for a computer to produce, due to the deterministic way they work.
Instead, they create pseudo-random numbers: a good enough approximation of randomness. Cryptographically secure pseudo-random number generators are a subset of that, which fit specific requirements that let them make random numbers that can be used in a security context. It needs to be impossible to predict what number will come next if you know the number simply generated, for example, and it needs to be impossible to know the previous number generated if youve just seen one be generated.
In order to fake the randomness, many computers use external sources of data to seed the random number generators: information like mouse and keyboard activity, or disk access, can set the number generator in a different country each time. But those sources arent offered in the simple computers used in embedded systems, like those powering the internet of things, ATMs and jet fighters.
So how do manufacturers solve the problems? As Wetzels and Abbasi showed, the answer is: poorly. The pair depicted three vendors including one whose technology is applied in airplane fighters whose number generators were anything but cryptographically secure. The scariest thing? The three they decided to show werent the worst: they were the best.
Read more: www.theguardian.com
