The Consumerization of Home Insecurity

Presented at ToorCon San Diego 17 (2015), Oct. 24, 2015, 11 a.m. (50 minutes).

Trends in manufacturing are causing an explosion in the number and variety of connected devices for the home. Some of these consumer grade devices are even finding success in commercial applications. Among the bounty is a whole class of consumer oriented physical security products. As the market for these tools grows rapidly, many new products are being developed to fill this need for a connected, secure home. These tools come in many forms - electronic locks that are presumed immune to traditional lock picking techniques, alarm systems designed to call the police in the event of a break-in, and a range of Internet-connected devices that can be accessed via mobile applications or through a web browser. More sophisticated devices are not without their drawbacks. The competition is fierce in this market and many solutions are being released without proper application security engineering. In many ways, compromise of one of these complex devices can result in putting the home more at risk than if they were not used. In a world where persistent threats with massive amounts of time and resources are looking to compromise anything and everything, embedded devices are a prime target. We present several vulnerabilities in a number of popular products that are currently on the market and outline a very troubling scenario in which attackers from the Internet or within a short range of the home can use the devices against their owners. It is not unreasonable to imagine cases where skilled attackers have so subtly compromised these devices that it is extremely hard to tell.


Presenters:

  • Joel St. John
    Joel St. John is a security consultant with NCC Group (formerly iSEC Partners) based out of their Seattle office. He does a lot of work with web applications and network security and his research interests cover many areas, spanning topics such as embedded device security and gaming. Joel graduated from the University of Alaska Fairbanks with a BS in Computer Science and Mathematics.
  • Danny Iland
    Danny Iland is a PhD Candidate at the University of California, Santa Barbara, focused on wireless networking for emergency and disaster scenarios. Danny focuses on observing and understanding the operation of cellular networks and cellular devices, and building better cellular systems for disaster relief. As an intern at iSEC partners, Danny had the chance to develop attacks against insecure cellular-enabled devices.

Links:

Similar Presentations: