Hey Siri! Hello Barbie! ssmjp

2016/04/28 に #ssmjp で発表した資料です。 @YuhoKameda
・Hey Siri! (Siriを使って機密情報を喋らせてみる)
・Hello Barbie! (喋るBarbieに潜む脆弱性の紹介)

※iPhoneに登録されている情報は、フィクションです

Transcript

1. Hey Siri! Hello Barbie! #ssmjp 2016/04/28 @YuhoKameda
2. Profile ُా ༐า : ykame (@YuhoKameda) ZAP Evangelist ޷͖ͳ͜ͱ Web/PF੬ऑੑ਍அ SOCɾCSIRT CTF / OSINT
3. presentation of #ssmjp ZAPͷεεϝ(2014/03/28) Information Gathering (2014/06/17) Hasegawa Night (2015/10/16)
4. Agenda Hey Siri !! Hello, Barbie !! Siri ͱBarbie ʹXXΛڭ͑ͯ΋Β͓͏
5. Hey Siri !! ىಈ͢ΔͨΊʹ͸…ɻ Hey Siri ͷઃఆ͕ඞཁ
6. ӳޠͰઃఆ͢Δͱɺ೔ຊ ޠಡΈͩͱೝࣝ͠ਏ͍
7. ʲ࢖͍ํʳiOS 9ͷSiriͰग़དྷΔࣄ268ݸΛ·ͱ ΊͯΈͨ http://egg-is-world.com/2015/09/18/ios-9- siri/
8. ໊ݹ԰Ͱ͏ͳကͷඒຯ ͍͠ళ͸? ͜ΕͳΜͷۂ? ઃఆͷมߋɺXXXXͷ ઃఆΛݟͤͯɺXXXX Λ༗ޮ(Φϯ)ʹͯ͠
9. Siri ࣗ෼ͷiPhoneΛ୭͔ʹૢ࡞͞ΕΔঢ়گʹ͓͍ ͯɺSiriΛ࢖ͬͯѱ༻͞ΕΔՄೳੑͷ͋Δ͜ͱ Λߟ͑ͯΈͨ
10. ϩοΫ࣌ɺSiriͷΦϯΦϑઃఆ
11. ϩοΫΛղ͘ඞཁ͕͋Δ৔ ߹ɾɾɾɻ
12. ύείʔυ͕ઃఆ͞Ε͍ͯ Δ৔߹ɺSiri͔Β৘ใ͸ฉ͖ ग़ͤͳ͍͜ͱ͕ଟ͍ ؆୯ͳ΋ͷͰྑ͍ͷͰύε ίʔυ͸ઃఆ͠·͠ΐ͏
13. Siri͔Β৘ใΛฉ͖ग़͢ίπ ܞଳॴ༗ऀͷ໨ઢͰ࣭໰Λ͢Δ ѱ͍ྫ) ஀ੜ೔͸ʁ ྑ͍ྫ) ࢲͷ஀ੜ೔͸ʁ
14. ͜ͷܞଳͷ࣋ͪओͷ໊લ ͸ʁ(ϩοΫ༗) ࢲ͸୭ʁ(ϩοΫ༗)
15. ࢲͷ஀ੜ೔͸ʁ(ϩοΫແ)
16. ࣗ୐ͷॅॴ͸ʁ(ϩοΫແ)
17. ؔ܎৘ใΛొ࿥͍ͯ͠Δ ͱɾɾɾɻ
18. ࢲͷ൴ঁͷ໊લ͸ʁ(ϩοΫঢ় ଶ) ࿈བྷઌʹొ࿥͞Ε͍ͯΔ৔߹ɿ
19. ࢲͷ൴ঁͷ໊લ͸ʁ(ϩοΫঢ় ଶ) ࿈བྷઌʹొ࿥͞Ε͍ͯͳ͍৔߹ɿ
20. ൃ৴ཤྺΛݟͤͯ(ϩοΫແ)
21. ൃ৴ཤྺΛݟͤͯ(ϩοΫ༗)
22. ΞϥʔϜΛશ෦Φϯʹͯ͠ (ϩοΫ༗)
23. [༑ୡΛ୳͢ػೳ] ࢁాଠ࿠͞Μ͕ՈʹؼͬͨΒ ڭ͑ͯ
24. ࣗ୐ͷॅॴΛڭ͑ͯ ࢲͷ஀ੜ೔͸ʁ ൴ঁͷ࿈བྷઌΛڭ͑ͯ 090-xxxx-xxxxʹςετͰ͢ͱϝοηʔδΛૹ৴ ࢁా͞Μʹ࣮͸ؾʹͳ͍ͬͯ·ͨ͠ͱϝοηʔδ ࢁా͞Μ͔Β࠷৽ͷϝοηʔδΛಡΈ্͛ͯ ΰʔϧσϯ΢ΟʔΫͷ༧ఆ͸ʁ ̎̌̍̑೥݄̍̎̎̐೔ͷ༧ఆ͸ʁ ࢲͷπΠʔτΛݟͤͯ Facebookʹ݁ࠗ͠·͢ͱ౤ߘ
25. ࣗ୐ͷॅॴΛڭ͑ͯ ࢲͷ஀ੜ೔͸ʁ ൴ঁͷ࿈བྷઌΛڭ͑ͯ 090-xxxx-xxxxʹςετͰ͢ͱϝοηʔδΛૹ৴ ࢁా͞Μʹ࣮͸ؾʹͳ͍ͬͯ·ͨ͠ͱϝοηʔδ ࢁా͞Μ͔Β࠷৽ͷϝοηʔδΛಡΈ্͛ͯ ΰʔϧσϯ΢ΟʔΫͷ༧ఆ͸ʁ ̎̌̍̑೥݄̍̎̎̐೔ͷ༧ఆ͸ʁ ࢲͷπΠʔτΛݟͤͯ Facebookʹ݁ࠗ͠·͢ͱ౤ߘ
26. ·ͱΊ ൴ࢯ/൴ঁ/Ո଒ؔ܎/ձࣾ/ࣗ୐ ৄ͘͠ొ࿥͍ͯ͠Δ΄Ͳѱ༻͞ΕΔՄೳੑ͕ ্͕Δ SiriΛ௨ͯ͠ԿΛ࣮ߦ͞Ε͔ͨޙ͔Βௐ΂ΒΕ ͳ͍
27. Hello, Barbie!! Barbieਓܗ!!
28. Barbieͷྺ࢙ 1959೥3݄9೔ɹϚςϧ͔ࣾΒൃച 1962೥ɹ೔ຊͰൢച։࢝ 1967೥ɹϦΧͪΌΜਓܗͷൃചʹΑͬͯఫୀ 1986೥ɹλΧϥͱఏܞޙɺղফͰδΣχʔͱͯ͠ൢച 1989೥ɹϚςϧ͔ࣾΒόʔϏʔͱͯ͠࠶ൢച͢Δ΋ఏૌ͞Εൢചऴྃ 2003೥ɹϚςϧࣾόʔϏʔ͕όϯμΠ͔Βൢച͞ΕΔ΋ఏܞղফ ݱࡏɹ೔ຊ๏ਓϚςϧɾΠϯλʔφγϣφϧ͔ΒόʔϏʔ͕ൢച
29. Barbie ຊ໊ : όʔόϥɾϛϦηϯτɾϩόʔπ ೥ྸ : 17ࡀ ৬ۀ : ϑΝογϣϯϞσϧ ϘʔΠϑϨϯυͷ໊લ͸έϯ
30. Hello Barbie ։ൃݩ : T oy T alk Ձ֨ : $74.99 (ࠃ಺AmazonͰ14,000ԁ) ػೳ Ի੠ೝࣝػೳΛ౥ࡌ Wi-FiΛ౥ࡌ ࢠͲ΋ͷϓϥΠόγʔ ৵֐ͩʂʂʂ
31. Hello Barbie 2015೥3݄ɹT oy Fair 2015Ͱൃද(prototype) 2015೥11݄10೔ɹHello Barbieൃച 2015೥12݄4೔ɹPOODLE
32. Hello Barbieͷಛ௃ ΞϓϦͰ࢖༻ڐ୚ͷಉҙ͕ඞཁ(྆਌Λ૝ఆ) ϕϧτͷϘλϯΛԡ͍ͯ͠ΔؒͷΈձ࿩ ه࿥͞ΕͨԻ੠͸҉߸Խ͠T oyT alkαʔό΁ૹ৴ टݩʹϨίʔμʔͱϚΠΫ 2015/9/4࣌఺Ͱ໿8,000ͷձ࿩ू http://hellobarbiefaq.mattel.com/wp-content/uploads/2015/08/hellobarbie-lines-v1.pdf
33. ૣ଎ങͬͯࢼͯ͠Έ·ͨ͠
34. Hello Barbieىಈํ๏ Hello Barbie companion AppΛΠϯετʔϧ BarbieΛى͜͢(ϕϧτԡ͢ͱిݯىಈ)
35. Hello Barbie companion App ೔ຊͰ͸഑෍ແ͠ ver 1.0ɹ2015/11/16 ver 1.1ɹ2015/11/24 ver 1.2ɹ2015/12/6 ver 1.3ɹ2016/3/22
38. http://offers.bluebox.com/rs/080-XOX-229/images/wp-hello-barbie.pdf
39. https://static1.squarespace.com/static/543effd8e4b095fba39dfe59/t/ 56a66d424bf1187ad34383b2/1453747529070/HelloBarbieSecurityAnalysis.pdf
40. ঢ়گ ωοτϫʔΫ໊ɺΞΧ΢ϯτIDɺMP3ͷ౪ௌ ηοτΞοϓதʹىಈ͢ΔWi-FiωοτϫʔΫ໊(e.g. Barbie-1243) ηοτΞοϓதʹࢿ֨৘ใΛૹ৴ αʔόଆͱϞόΠϧΞϓϦͷ྆ํʹ໰୊͋Γ iOS / AndroidΞϓϦͦΕͧΕʹόά͋Γ pkcs12(.p12)ύεϫʔυ͕ϋʔυίʔυ ূ໌ॻ͸DecryptՄೳ
41. ·ͱΊ Internet of Things͸߈ܸͷର৅ʂ ϦϦʔεલʹ͸ɺηΩϡϦςΟ਍அ΍߈ܸ͞ ΕΔ૝ఆΛςετ͠·͠ΐ͏ Attack Surface(߈ܸ͞ΕΔڪΕͷ͋Δڥք) Λཧղ͢Δ͜ͱ͕ॏཁ(Threat Modeling)
42. Link Privacy Policy : https://www.toytalk.com/hellobarbie/ privacy/ Ϩϙʔτ : http://offers.bluebox.com/rs/080-XOX-229/ images/wp-hello-barbie.pdf Ϩϙʔτ2 : https://static1.squarespace.com/static/ 543effd8e4b095fba39dfe59/t/ 56a66d424bf1187ad34383b2/1453747529070/ HelloBarbieSecurityAnalysis.pdf
43. Contact Social Account : @YuhoKameda