You're Doing IoT RNG

Presented at DEF CON 29 (2021), Aug. 7, 2021, 5 p.m. (45 minutes).

Think of a random number between '0' and infinity. Was your number '0'? Seriously? Crap. Well unfortunately, the hardware random number generators (RNG) used by your favorite IoT devices to create encryption keys may not work much better than you when it comes to randomness.

In this talk, we'll delve into murky design specs, opaque software libraries, and lots of empirical results. We wrote code for many popular IoT SoC platforms to extract gigabytes of data from their hardware RNGs and analyze them. What we found was a systemic minefield of vulnerabilities in almost every platform that could undermine IoT security. Something needs to change in how the Internet of Things does RNG.

The vulnerabilities are widespread and the attacks are practical. RNG is bad out there - "IoT Crypto-pocalypse" bad.

Presenters:

• Dan Petro / AltF4 - Lead Researcher, Bishop Fox   as Dan "AltF4" Petro
  Dan "AltF4" Petro is Lead Researcher at Bishop Fox. Dan is widely known for the tools he creates: Eyeballer (a convolutional neural network pentest tool), the Rickmote Controller (a Chromecast-hacking device), Untwister (pseudorandom number generator cracker), and SmashBot (a merciless Smash Bros noob-pwning machine). @2600AltF4
• Allan Cecil / dwangoAC - Security Consultant, Bishop Fox   as Allan Cecil (dwangoAC)
  Allan Cecil (dwangoAC) is a Security Consultant with Bishop Fox and the President of the North Bay Linux User's Group. He acts as an ambassador for Tasvideos.org, a website devoted to using emulators to complete video games as quickly as the hardware allows. He participates in Games Done Quick charity speed running marathons using TASBot to entertain viewers with never-before-seen glitches in games. @mrtasbot

Links:

• https://defcon.org/html/defcon-29/dc-29-speakers.html#petro
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Dan Petro - You're Doing IoT RNG - Demo.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Dan Petro - You're Doing IoT RNG.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Dan Petro, Alan Cecil - You're Doing IOT RNG - Live.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Dan Petro - Youre Doing IoT RNG.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Dan Petro - You're Doing IoT RNG - Demo.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Dan Petro - You're Doing IoT RNG.srt (subtitles)
• https://www.youtube.com/watch?v=Zuqw0-jZh9Y

Similar Presentations:

• Still Hacking Anyway (SHA2017) / An autopsy in the IoT - Nabaztag, the Hare
• THOTCON 0xA (2019) / When Refrigerators Attack - Defending (and weaponizing) IoT
• CactusCon 11 (2023) / Exploiting IoT devices through Physical Embedded Security