Security review of proximity technologies: beacons and physical web

With the growing expansion of the IoT, proximity technologies are becoming more and more important to interact with things around us. Apple and Google have released their own beacon protocol, namely iBeacon and Eddystone, but are they really secure for any kind of use? We will study thoroughly both protocols and their capabilities, and discuss several vulnerabilites, illustrating them with live demos. Additionally, we will see that future protocols (W3C Web Bluetooth API) will unfortunately allow very long-range fingerprinting and attacks on most IoT devices, so we will give recommendations to reduce these threats.

Transcript

1. BlackAlps– Switzerland – November 15-16, 2017 Renaud Lifchitz (renaud.lifchitz@digitalsecurity.fr) Security review of proximity technologies: beacons and physical web
2. Outline Introduction to proximity technologies iBeacon security Physical Web security Web Bluetooth security P. 2 Digital Security - Security review of proximity technologies: beacons and physical web
3. Speaker's bio French senior security engineer Main activities:  Penetration testing & security audits  Security research  Security trainings Significant security studies about: contactless debit cards, GSM geolocation, blockchain, RSA signatures, ZigBee, Sigfox, LoRaWAN, Vigik access control and quantum computation https://speakerdeck.com/rlifchitz Digital Security - Security review of proximity technologies: beacons and physical web P. 3
4. About Digital Security Company founded in 2015 by a group of experts with the support of Econocom Group Provides advanced services in security audit, consulting and support Our expertise combine traditional security for infrastructure and application, and skills oriented to the ecosystem of connected objects Has created the CERT-UBIK, first European CERT™ specialized on IoT security (OSIDO monitoring service) Has a laboratory for studying new technologies, protocols and specific operating systems Digital Security - Security review of proximity technologies: beacons and physical web P. 4
5. Introduction to proximity technologies
6. Use cases (1/2) Indoor location Proximity marketing Check-in coupons Contactless payments Contextual information Access control P. 6 Digital Security - Security review of proximity technologies: beacons and physical web Introduction to proximity technologies
7. Use cases (2/2) "A Guide to Bluetooth Beacons", september 2014, GSMA P. 7 Digital Security - Security review of proximity technologies: beacons and physical web Introduction to proximity technologies
8. iBeacon Apple technology Based on Bluetooth Low Energy (Bluetooth >= 4.0) Broadcasts Applications can recognize the broadcasted UUID and react accordingly P. 8 Digital Security - Security review of proximity technologies: beacons and physical web Introduction to proximity technologies
9. EddyStone Google open source format, Apache v2.0 license: https://github.com/google/eddystone Also based on BLE broadcasts Unlike iBeacon, 4 different frame formats:  UID: a unique 16-byte Beacon ID composed of a 10-byte namespace and a 6-byte instance  URL: a URL using a compressed encoding format  TLM: telemetry information about the beacon itself such as battery voltage, device temperature, and counts of broadcast packets.  EID: an encrypted ephemeral identifier that changes periodically for use in security and privacy-enhanced devices P. 9 Digital Security - Security review of proximity technologies: beacons and physical web Introduction to proximity technologies
10. Physical Web 2014 project from Google's Chrome team Uses Eddystone beacon protocol Open source approach Replaces the QR code Allow physical devices to broadcast a URL around:  to provide an access to information  to interact or remote control the device  standard: no need for a different app each time Apps: Google Chrome, "Nearby Notifications", compatible Android & iPhone apps Official web site: https://google.github.io/physical-web/ P. 10 Digital Security - Security review of proximity technologies: beacons and physical web Introduction to proximity technologies
11. An interesting hacking device: the RuuviTag beacon Nordic nRF52832 SoC Sensors: temperature, humidity, air pressure, accelerometer 2 buttons, 2 LEDs, NFC-A tag, SWD debugging, FOTA programming 45 mm diameter PCB, IP67 enclosure 1000mAh battery BLE compatibility: iBeacon & Eddystone C & JavaScript programming (Espruino) Long range RF antenna (500-1000m!) P. 11 Digital Security - Security review of proximity technologies: beacons and physical web Introduction to proximity technologies
12. iBeacon security
13. iBeacon basics & frame format iBeacon frames are sent in plaintext Important data for apps: UUID, major number & minor number Sniffing, replaying and cloning is easy... iBeacon security P. 13 Digital Security - Security review of proximity technologies: beacons and physical web
14. Beacons & iBeacon sniffing (1/2) Sniffing broadcast traffic is easy! Apple restricts arbitrary UUID listening... Using a smartphone:  Android tools: Beacon Toy, nRF Connect, Locate Beacon, ... iBeacon security P. 14 Digital Security - Security review of proximity technologies: beacons and physical web
15. Beacons & iBeacon sniffing (2/2) Or using a computer:  Proprietary Windows tool Nordic nRF Sniffer  Open source Linux tool hcidump (with hcitool and optionally btmon for RSSI): iBeacon security P. 15 Digital Security - Security review of proximity technologies: beacons and physical web $ sudo hcitool lescan --duplicates & $ sudo hcidump --raw -X -t HCI sniffer - Bluetooth packet analyzer ver 5.37 device: hci0 snap_len: 1500 filter: 0xffffffffffffffff 2017-11-14 22:36:33.494792 > 0000: 04 3e 2b 02 01 03 01 24 b4 8c 20 46 29 1f 1e ff .>+....$.. F)... 0010: 06 00 01 09 20 00 09 a8 d0 5a 56 ad 2c 40 92 f5 .... ....ZV.,@.. 0020: 5d 9d f8 05 60 06 a8 9e 2e 95 6e aa 6d a7 ]...`.....n.m. 2017-11-14 22:36:36.705447 > 0000: 04 3e 1a 02 01 04 00 1f ff 1a 6a 3b 12 0e 0d 09 .>........j;.... 0010: 61 62 65 61 63 6f 6e 5f 46 46 31 46 cc abeacon_FF1F. 2017-11-14 22:36:36.788447 > 0000: 04 3e 29 02 01 03 01 f1 6d 1d 44 53 c7 1d 02 01 .>).....m.DS.... 0010: 06 03 03 aa fe 15 16 aa fe 10 fb 03 62 69 74 2e ............bit. 0020: 6c 79 2f 53 55 72 70 72 69 73 65 c8 ly/SUrprise.
16. iBeacon security Sniffing BLE advertisements & iBeacons P. 16 Digital Security - Security review of proximity technologies: beacons and physical web
17. Spoofing attacks hcitool and companion scripts (https://github.com/irontec/ibe acons-simple-tools.git) can easily spoof iBeacons BT profile and BDADDR may have to be spoofed too Android Beacon Toy provides easy cloning feature! iBeacon security P. 17 Digital Security - Security review of proximity technologies: beacons and physical web
18. iBeacon security Forging fake iBeacon frames P. 18 Digital Security - Security review of proximity technologies: beacons and physical web
19. WikiBeacon (1/5) Community resource providing crowd-sourced information (smartphone app) about proximity beacon usage Maps, stats and search tools http://www.wikibeacon.org/ See also https://openuuid.net/ iBeacon security P. 19 Digital Security - Security review of proximity technologies: beacons and physical web
20. WikiBeacon (2/5) iBeacon security P. 20 Digital Security - Security review of proximity technologies: beacons and physical web
21. WikiBeacon (3/5) iBeacon security P. 21 Digital Security - Security review of proximity technologies: beacons and physical web
22. WikiBeacon (4/5) iBeacon security P. 22 Digital Security - Security review of proximity technologies: beacons and physical web
23. WikiBeacon (5/5) iBeacon security P. 23 Digital Security - Security review of proximity technologies: beacons and physical web
24. Attack scenarios: physical access iBeacon security P. 24 Digital Security - Security review of proximity technologies: beacons and physical web Test points or flash memory access Dump with OpenOCD and a suitable adapter Access to all secrets & perfect cloning!
25. Attack scenarios Spoofing beacons can cause:  Location spoofing for applications  Fake data uploaded to cloud  Fraudulent profit (ex: game at CES 2015) iBeacon with weak configurations (DFU/FOTA) or passwords (PIN & passwords are usually sent... plaintext):  RCE  Advertisements for competitors  DoS UUID harvesting (app store or open database):  Application spamming Tracking / motion detection Vulnerabilities involving hooked mobiles applications: remote code execution? iBeacon security P. 25 Digital Security - Security review of proximity technologies: beacons and physical web
26. Physical Web security
27. Payload formats URL scheme prefix and TLD are encoded for compression purposes: Full specification: https://github.com/google/eddystone/tree/master/eddystone-url Physical Web security P. 27 Digital Security - Security review of proximity technologies: beacons and physical web
28. Physical web Uses Eddystone URL protocol Straightforward to implement: Beacon Toy (Android), PyBeacon (Python) But some limitations Physical Web security P. 28 Digital Security - Security review of proximity technologies: beacons and physical web $ sudo pip install PyBeacon $ sudo PyBeacon -u https://twitter.com/nono2357 Advertising: url : https://twitter.com/nono2357
29. Eddystone URL limitations and bypasses (1/2) Basic limitations:  Chrome and Nearby Notifications only support HTTPS URLs  URL length limited to 17 characters URL shorteners! Physical Web security P. 29 Digital Security - Security review of proximity technologies: beacons and physical web
30. Physical Web security P. 30 Digital Security - Security review of proximity technologies: beacons and physical web "Physical" phishing & tracking with URL shorteners
31. Eddystone URL limitations and bypasses (2/2) Google Physical web service uses a proxy to preview links while protecting personal information and possibly filter spam Testing Google proxy could be fun!  User agent cloaking  Recursive redirections  Allowed content types What about other web services? Once link is clicked, the user is no more protected against fingerprinting (IP, MAC, user agent, OS, browser...), tracking and exploits Physical Web security P. 31 Digital Security - Security review of proximity technologies: beacons and physical web
32. mDNS, Wi-Fi Direct, SSDP and FatBeacon support mDNS & SSDP: discovery of physical web services throught Wi-Fi and IP Wi-Fi Direct: serves content via P2P Wi-Fi and HTTP (device name: PW-<title>-<port>) FatBeacon: sends full content over BLE These features need to be carefully tested for security before use Physical Web security P. 32 Digital Security - Security review of proximity technologies: beacons and physical web
33. Eddystone security Eddystone can provide beacon security (requires internet connection) Beacons should also rotate their BDADDR for privacy Eddystone cryptographic features (based on AES- EAX), extended features (mDNS, Wi-Fi Direct, SSDP, FatBeacon) and implementations should be thoroughly audited... Physical Web security P. 33 Digital Security - Security review of proximity technologies: beacons and physical web
34. Web Bluetooth security
35. Introduction to the specification W3C open specification: https://webbluetoothcg.github.io/web-bluetooth/ Allows a desktop/mobile browser to directly query BLE devices Provides a Javascript API: https://developer.mozilla.org/fr/docs/Web/API/Web_Bluetooth_API Web Bluetooth security P. 35 Digital Security - Security review of proximity technologies: beacons and physical web
36. Compatibility Web Bluetooth security P. 36 Digital Security - Security review of proximity technologies: beacons and physical web
37. Security A web page can scan devices and read or write GATT characteristics Web Bluetooth extends IoT RF short range attacks to very long range: typically a web page can query your smartwatch for your phone book or your heart rate! Harmless web sites can be attacked with XSS to relay BLE attacks... Web Bluetooth allows combinations of logical and physical attacks, even remotely! Security nightmare Web Bluetooth security P. 37 Digital Security - Security review of proximity technologies: beacons and physical web
38. Web Bluetooth security Querying a BLE device using a web page: chrome --enable-web-bluetooth chrome://flags/ -> "Experimental Web Platform" https://googlechrome.github.io/samples/web-bluetooth/device-info.html?allDevices=true P. 38 Digital Security - Security review of proximity technologies: beacons and physical web
39. Thanks! Questions? IT & IoT Security Contact: renaud.lifchitz@digitalsecurity.fr info@digitalsecurity.fr P. 39 Digital Security - Security review of proximity technologies: beacons and physical web Follow us on Twitter!: @iotcert