The Sound of aTargeted Attack

Stephen Hilt
Trend Micro Forward-Looking Threat Research (FTR) TeamA TrendLabsSM Research Brief

Contents
TREND MICRO LEGAL DISCLAIMER
The information provided herein is for general informationand educational purposes only. It is not intended andshould not be construed to constitute legal advice. The
information contained herein may not be applicable to all

4
Exposed Services

situations and may not reflect the most current situation.
Nothing contained herein should be relied on or acted
upon without the benefit of legal advice based on theparticular facts and circumstances presented and nothingherein should be construed otherwise. Trend Micro

7
Debug Information

reserves the right to modify the contents of this document
at any time without prior notice.
Translations of any material into other languages areintended solely as a convenience. Translation accuracy
is not guaranteed nor implied. If any questions arise

11
Sonos on the Internet

related to the accuracy of a translation, please refer tothe original language official version of the document. Any
discrepancies or differences created in the translation are14

not binding and have no legal effect for compliance orenforcement purposes.

Information on Leakage

Although Trend Micro uses reasonable efforts to include
accurate and up-to-date information herein, Trend Micromakes no warranties or representations of any kind as
to its accuracy, currency, or completeness. You agree
that access to and use of and reliance on this document
and the content thereof is at your own risk. Trend Microdisclaims all warranties of any kind, express or implied.
Neither Trend Micro nor any party involved in creating,producing, or delivering this document shall be liable
for any consequence, loss, or damage, including direct,
indirect, special, consequential, loss of business profits,

24
Sonos Control
30
A Case of Finding the Targetor special damages, whatsoever arising out of access to,use of, or inability to use, or in connection with the use ofthis document, or any errors or omissions in the content
thereof. Use of this information constitutes acceptance foruse in an “as is” condition.

35
Phishing with Sonar
36
Exploitation
37
Hardware Hacking
45
Sonos Update
46

for Raimund Genes (1963-2017)Conclusion

Internet-connected devices are growing in popularity every day. It’s becoming
more and more difficult to buy a device that isn’t internet connected. Having
devices connected to help user functionality, as well as size and cost, is a driver of
why the popularity is growing. Despite knowing the risks in a lot of cases, we findourselves looking at newer devices all the time, ones that add the functionalityof having information in the cloud or use services that we already subscribe to.
For this research, we focused on internet-connected speakers. To look at the
security implications of these devices, we wanted to find ones that are popular,
have the ability to connect to the internet directly via Wi-Fi or Ethernet, and canpair with multiple devices such as duplicates of the device and mobile phones
for remote access. This led us to the speaker systems of Sonos, a brand that has
grown a strong reputation over the years due to good sound quality and a pricethat attracts a wide variety of people.
While the subject of this paper is the Sonos speaker because of availability andaccess to the device, the intent of the research is to focus on a larger issue that
we are facing as internet-controlled sound devices are making their way into thehome as well as businesses: Are there common issues across devices? From thisstance, we also looked at other IoT speaker systems like the Bose SoundTouch
Systems.
We have reached out to both Sonos and Bose regarding our findings. Sonos wasquick to act and fix the issues regarding information leakage. The update they
immediately released is discussed at the end of this study. We are also currently
waiting for Bose to reply or come up with an update to address the gaps insecurity we found.

Exposed Services
The setup process for the Sonos speakers is straightforward and common to many IoT (Internet of Things)
type devices. In this case, there are two methods for setup. You can plug an Ethernet cable into the backof the Sonos or you can connect the speaker over Wi-Fi. We set the devices up over Wi-Fi, and to do thisthe speaker creates an ad hoc access point that you connect to. And then follow the instructions within
the mobile application on setup. If you chose the Ethernet method, your Sonos would be detected by theapplication and you skip the setup process over Wi-Fi.
Once connected to the network, we decided to see what ports were open on the Sonos to see if there
were any basic issues, such as an FTP server or telnet running.

Figure 1. Nmap results for Sonos speaker

Unsure what each of these ports are, we ran nmap with the version probes (-sV) and ran the default nmap
scripts (-A) to see if we could gather some more information about each of the ports and services thatwere running on the Sonos.

Figure 2. Services shown from nmap scan
4 | The Sound of a Targeted Attack

While checking to see which ports and services were open, we found that only three ports were open
on the Sonos itself. These were two Universal Plug and Play (UPnP) services and one encrypted UPnP
service. Launching the Sonos application while running Wireshark showed that over SSDP (Simple
Service Discovery Protocol), the applications were pointed to communicate with http://<ip>:1400/xml/
device_description.xml. Following some communications, it also appeared most of the communications
were over TCP/1400 as the SSDP message below shows.

Figure 3. SSDP packet captured in Wireshark

Based on this information and other work and postings on the Sonos, it became obvious that port
TCP/1400 was the port we wanted to focus on first. In fact, a developer named Barry Caruth had alreadywritten an Nmap script to parse some information from this port. Figure 3 shows the results from thatNmap script showing basic information about the Sonos device.

5 | The Sound of a Targeted Attack

Figure 4. Sonos Nmap script output

When looking into the script itself, it looked like the information was coming from a specific URI path of /status on the device (http://xxx.xxx.xxx.xxx:1400/status).

6 | The Sound of a Targeted AttackDebug Information
When browsing to the local Sonos system on the URI that was provided in the Nmap script, a lot of
subpages were shown via a simple website. This site contained things that are obviously being utilized
to populate the applications that control the Sonos system as well as some items that are used for the
initial setup.

Figure 5. Contents of the status page on the Sonos

Some of the interesting subpages have content that Sonos probably never thought would be exposed
directly to the internet. This site, with no authentication, allows you to see information about the tracks
currently being played, what music libraries it knows about, what devices have ever connected to it tocontrol it, and down to personal information such as emails associated with specific audio streaming
services like Spotify.

7 | The Sound of a Targeted Attack

Sonos has also allowed many debug functions to be exposed via this website. This includes the ability to
traceroute, ping, and even make an mDNS announcement via a simple website.

Figure 6. tools.htm page within the Sonos system

Using the ping utility, you can easily find out the list of other active devices on the network by pinging thedevices individually (given that you have collected the internal IP address of the Sonos device from theifconfig page within the /status menus), or you can see what also responds via a broadcast ping.

Figure 7. Example of a broadcast ping
8 | The Sound of a Targeted AttackWe looked into these pages to see if there were any vulnerabilities that could be exploited to take over the
Sonos Play:1 test unit. Sonos had some good designs, in at least the firmware versions we were testingon, that have input validations as well as a CSRF-token to prevent some attacks. For example, if you type127.0.0.1;ls in the ping field, you would get a response of Error 400 Bad Request.

Figure 8. Error shown if command injection is attempted

Ultimately, if attackers wanted to see and collect all the hosts and what types of hosts they may be after
doing various discovery methods via the Sonos system itself, they would then browse to /status/proc/net/
arp page and collect more information about the devices on the network that the Sonos has been able
to contact.

Figure 9. ARP table from the Sonos device

Let’s say an attacker knows the target uses a Sonos device. The attacker can then take the informationcollected here to tailor better attacks against the target. This could include mobile devices, printers, andeven types of computers on the networks.

9 | The Sound of a Targeted Attack

Within the status page, there is also a page that is titled “scan results.” This runs a command that looks
for wireless access points nearby. This would be utilized during the setup process to determine which
wireless network you would want to connect the Sonos system to, and we will detail more about the risksof this sort of information in the information leakage section of this paper. First, however, let us examine
the amount of exposed Sonos systems on the internet.
According to W3.org, the 400 Bad Request states, “The request could not be understood by the server
due to malformed syntax. The client SHOULD NOT repeat the request without modifications.” Meaningthat adding the semicolon caused an issue and the request could no longer be understood. This is likely
due to some back-end argument checking. To further check through the webpages, we used Burp Suiteto look for any other issues within these pages that may be exploitable. However, we were not able to findany vulnerabilities from an external web interface within the pages listed on /status.

Figure 10. Showing Burp Suite and the csrfToken values

With this information we set out to see how many of these devices were exposed on the internet.

10 | The Sound of a Targeted Attack

Sonos on the Internet
We worked with Shodan to scan the internet for Sonos devices based on the Nmap script that we
previously discussed. To query Sonos devices within Shodan, you will want to use the query parameter“Sonos port:1400.”

Figure 11. Sonos devices in Shodan

The number of Sonos devices have changed from around 4,000 shown here to up to around 5,000 devices
during the course of this research. A lot of this is due to the fact that the IPs that these are on are not fixed
IP address ranges; often they are on residential lines. But what remains the same is that the United Statesand Sweden are the top two places where Sonos speakers are exposed on the internet.

11 | The Sound of a Targeted Attack

Sonos PLAY:1
Sonos BRIDGE
Sonos PLAY:5
Sonos PLAY:3
Sonos CONNECT
Sonos CONNECT: AMP
Sonos PLAYBAR
Sonos SUB
Sonos BOOS
Sonos ZoneBridge ZB100
Sonos ZP100
Sonos PLAYBASE
SonosZP80
Sonos Docl WD100
0

700

1400

Figure 12. Breakdown of types of Sonos exposed on the internet

What is surprising about this is that new products that have been released recently are showing up online.
The PLAYBASE is a new product that allows you to connect your TV’s audio output to a Sonos system.
This product was released early 2017.
Although the Bose SoundTouch line has fewer units that have built-in Ethernet connectivity, this doesn’t
prevent them from winding up exposed online. Much like the Sonos system, the SoundTouch has an
unauthenticated API that allows full control over the speakers. A lot of work has also already gone into
making libraries that work with these speakers. In fact, there is also a Python library.

Figure 13. Using Python Libraries to connect to netcat running on TCP/8090

Based on this, we can determine that on port 8090 there is a web service running and that /info has someof the basic information that is needed to connect to the device. Based on this information, we did somedigging in Shodan to see if we could locate any online.
12 | The Sound of a Targeted Attack

Looking first into port 8090 and keyword Bose got us to a single host. This host had a server type of BoseSoftware. We then searched based on that to find anything else without the port number and this led us
to a lot of UPnP devices that had the server type of Server: Allegro-Software-RomPager. Partnering thiswith the port number of 8090, we searched for what we believe to be Bose SoundTouch devices. While
there were fewer than the number of Sonos devices, the numbers are significant and likely to grow asthese devices are being directly exposed to the internet.

Figure 14. Bose SoundTouch devices online

The Bose SoundTouch 10 does not have an Ethernet port, so these devices are being exposed directly tothe internet via a misconfigured wireless router, or via UPnP which is being allowed to open to any hostto connect to it.

13 | The Sound of a Targeted Attack

Information Leakage
Within the Sonos control website are pages that have a plethora of information depending on how things
are configured. One of the first pages we explored was a page labeled “topology” from the status page.
This page keeps up with what devices have connected to the Sonos system to control it, and what otherspeakers this Sonos knows about. In Figure 15 we have a list of mobile phones that have connected to
the Sonos system.
The Name field is the name configured on the device. Here we see that one of the phones was called
APTPhone. This is the name that is under the about section of the iPhone in settings. The Location
mentioned is the IP address of the remote device. This could be used to help gain some reconnaissanceinformation regarding devices within the same network as the Sonos unit, and where they may be inside
the network segments.
Next, we have the UUID, which, in this case, is what type of device it is, plus a random string afterwards
that is not tied to a serial number or anything on the device. In fact, it looks like this changes every sooften as we have five devices that have the same name. Given that the devices that were connected toit weren’t altered, this led us to believe that these are changing because of something else within theapplication that was downloaded from the app store. Other names we saw were Android phones that
controlled the devices; names like “ASUS Transformer Pad TF300T” and “Samsung SGH-T599” andother variations of Samsung and other vendor phones like Motorola, HTC, and so on. What this gives anattacker is some ability to find out what devices are in the networks or that a person may specifically have.

Figure 15. Topology page showing what devices have connected to the Sonos

14 | The Sound of a Targeted Attack

Not only were some of the devices we observed local to the Sonos device (meaning within RFC 1918
space), but we also saw addresses that were on the same internet routable IP space as the device. This
could be because the device was plugged straight into the network, or because someone had used NAT
to route the IP address through to the internet, allowing anyone to connect to the Sonos, and then theapplication on the controlling device used TCP/1400 to connect to the devices’ SOAP XML interface tocontrol the devices.
While this provides a good deal of information about the users, we can also find out more about theperson if we go and take a look within the accounts page of the Sonos status page. This page keeps
track of the accounts that are tied to the Sonos system. We tried a few music services such as Spotify,
iHeart Radio, and Pandora, to name a few. This page includes a Serial Number that is just a basic number
to keep track of the number of accounts, and a Type, which appears to denote the type of account (inour case, 3079 was Spotify and 3 was Pandora). The UN is the username for the account. Pandora was
the only one that had an email address shown in our tests while the rest of the accounts used some kindof token that was generated. Next, NN is the Name applied to the account when configuring the device.
This is a user-defined field and can be edited at any time. It defaulted to the first name of the person on
the account; in the case of our test unit, it defaulted to ‘stephen’ for all the accounts. The OADevID looks
like an ID used by the Sonos systems to communicate with the services. And then finally a Hash, in which
only Spotify had a Hash. Initially, this Hash looked like it could have been base64 but it is not. And basedon some additional looking, it does change with the length of the password for the Spotify account.

Figure 16. Accounts page on Sonos

Based on information on these pages, we coded a small script that would query the publicly available
Sonos systems on the internet, read the accounts page, and parse out these fields. When we finished theparsing, we had 1,293 emails of which 727 were unique. Email addresses were then loaded into Maltego,an open source intelligence (OSINT) tool, and we ran multiple transforms on them. One transform was one
that queries the website https://haveibeenpwned.com/, which keeps track of whether your email address
has been seen in any breaches.
The Maltego graph got a little large given the size of the breach data and the number of email addresses.
Showing the most common breached sites was a little cumbersome to show in the full Maltego graph as
the one in Figure 17 is zoomed out to 10% to have all the nodes fit.

15 | The Sound of a Targeted Attack

Figure 17. Maltego graph showing results of haveibeenpwnd.com

When you zoom in, you can see some of the top breaches listed, the ones we all know and likely had todeal with by changing passwords, or other issues that may have been caused by these breaches.

Figure 18. Zoomed in Maltego graph showing common breaches

The most common breach was the LinkedIn breach, with 177 accounts. This breach also had the password
hashes released and people around the globe have cracked these passwords to use with penetration tests,
or as malicious actors trying to break into accounts. Knowing these breaches and also what sites theycame from could then lead an attacker to log into the users’ accounts identified from the Sonos. Attackers
can also check if the user hasn’t changed passwords after the breach – an all too common occurrence.
16 | The Sound of a Targeted Attack

linkedin.com
adobe.com
rivercitymediaonline.com
dropbox.com
myspace.com
tumblr.com
last.fm
zomato.com
dailymotion.com
modbsolutions.com
data4marketers.com
netprospex.com
imesh.com
evony.com
edmondo.com
0

100

200

Figure 19. Sonos exposed emails per site breach

Much like the Sonos, the Bose SoundTouch also has a page that keeps track of the accounts that arelinked to the device. Here we show the /sources page from the SoundTouch that shows the Spotify
username which is the source account, as well as the email address that is linked to this Spotify account.
Using the same methods from above, we could perform the same steps against any email addresses thatwere found within the Bose SoundTouch sources page.

Figure 20. SoundTouch sources page17 | The Sound of a Targeted Attack

This is not the only page that an attacker may want to scrape to see information from the Sonos device.
To aid in finding what is near the Sonos speaker, the speaker scans for nearby wireless access points (AP).
This is done during the setup process to have the Sonos know what Wi-Fi AP you want to connect to.
During setup, you’ll choose the one you want to connect to, and what the password for the connection is.
This is done over an SSID that the Sonos starts and you connect to. Once the speaker is associated to awireless access point, you don’t see this option unless you want to change what Wi-Fi it will connect to.
Based on testing, if you are using the Ethernet port on the Sonos, this does not happen.

Figure 21. Scan results page from the Sonos system

While trying to figure out how to use this information to identify the owner of the Sonos system, wecame across a website that compounds multiple sources of Wi-Fi geolocation. The website of Alexander
Mylnikov has an API that you can use to query specific BSSIDs and find the latitude, longitude, and theapproximate range in meters of where the access point is.
Based on the BRCM_TEST_SSID BSSID above, the API shows the latitude, longitude, and the range of
133.2 meters for the information pertaining to the test device.

Figure 22. API results for BRCM_TEST_SSID

18 | The Sound of a Targeted Attack

This information can then be plotted on Google Maps to get a better picture of where the BSSID may beseen in the world. According to the API results, this particular BSSID is located in Zurich, Switzerland.

Figure 23. Approximate location of BRCM_TEST_SSID

To expand on this information, we once more wrote a script to scan publicly accessible Sonos systems on
the internet. This time, we tried looking for BSSID and SSID details, then looked them up in the mentioned
API for location, and stored them as a KML file to load into Google Earth. There were multiple things we
wanted to see while trying to do this. For example, we wanted to see how accurate the grouping of the
SSIDs were in a given area to figure out approximate locations of the Sonos systems.
At the time of our survey of exposed Sonos units online, we found 12,311 BSSIDs. Out of these, 10,219
had geolocations inside the API. A quick scroll around in Google Earth showed that there was some pretty
good accuracy in the location of these access points. Here is an example showing the location of SSIDs
in a location in the Netherlands. Based on the groupings of these SSIDs, you can get a general location
down to a few blocks where the Sonos speaker is likely located. While completely possible, we chose notto narrow down the locations of these devices even further for this case study.

19 | The Sound of a Targeted Attack

Figure 24. High-level view of parts of Europe with exposed Sonos devices

Figure 25. Zoomed-in area in The Netherlands

20 | The Sound of a Targeted Attack

These are just a few of the pages wherein we examined information. There are plenty of other types of
information on a few other pages that could be utilized. For example, in the “wpa_supplicant.log” page,
you can see what access point the Sonos is joining, and partner this with the already-collected information
to get a closer approximation of the location of the Sonos speaker. Sifting through the collected SSIDs,
we were able to see the AP names as well.
^_^Princess Leia ‘s

Hogwarts Great Hall WiFi

This is Wifiiiiii

NoFreeWifiForYou

Back officePretty fly for a Wifi

Nacho WiFi

A_LAN_DOWN_BY_THE_RIVER

Bill_Wi_the_science_Fi

Ermarhgerd We Fer

404 Server Error

Router? I hardly know her

2ez4meTable 1. Some of the Wi-Fi SSIDs we found

The Bose SoundTouch had a more limited view, based on what we have seen that from the port 8080 on
the device, there is a configuration page that shows you the neighboring SSIDs and allows you to connect
to one. While this doesn’t present you the same information such as the BSSID or RSSI that the Sonos
does, using services like Wigle, it is possible to look up approximate locations based on the SSID itself.

Figure 26. SoundTouch Wi-Fi configuration page

21 | The Sound of a Targeted Attack

Using a Wigle account, it is possible to search the SSID and find a location based off of the SSID. If there
are multiple SSIDs, you can partner this information with the IP address geolocation to figure out a moreaccurate location for the SSID. Figure 27 is an example of searching for the SSID shown in Figure 26 in
Wigle. This shows that the Bose SoundTouch device is in the Baltimore area. We can perform with thesame results as we did with the Sonos with multiple SSIDs.

Figure 27. Location of SSID according to Wigle

Another cause for concern is the shares page. This page shows any mounted shared drives that are usedin the library. We tested this and it provided a list of all songs that were on the shared drive that wereplayable by the Sonos system. This also includes any local folders you have shared with your Sonos
speaker. When setting up the Sonos you have to manually add these — they are not auto-discovered.

Figure 28. Example of the Sonos Add Music folder page

22 | The Sound of a Targeted Attack

Once you have added any of the above options, they will show up in the shares page on the Sonos status
page. This information could be utilized to collect more information about a potential target of an attack.
If an attacker finds out what type of music or even an artist the user liked, it may provide an avenue for
an attack. For example, the attacker could craft a spear-phishing email leveraging social engineering, or
promising tickets to an upcoming gig of the target’s favorite artist.
Knowing that these speakers are very popular, a possible attack scenario is that an attacker could write a
web application that scans for this information via a client-side attack. This could be done within a JavaApplet, or if there is a vulnerability within the browser, by using a CSRF (Cross Site Request Forgery) to
try to scan a local subnet via the browser. This could gather information about the Sonos that are notdirectly exposed on the internet and gain the same information as shown previously. Also, malware could
be utilized for the same attack trying to collect more information about these devices and their owners.

23 | The Sound of a Targeted Attack

Sonos Control
While there is a lot of information that is on the status page of the Sonos, there is still more information
we can learn by interfacing directly with the SOAP XML interface. When looking into the information thatis sent back and forth between the client and the Sonos system, you find that you can see in plain text
the commands that are being used to control the Sonos, such as pause, play, skip to the next track, andchange the volume. Of course anything that you can do with the app you can do over this SOAP XML
interface also, as we will show it has no authentication or encryption. When you watch the commands ina tool such as Wireshark, you can see all this information. Below is an example of the “Next” commandwithin Wireshark.

Figure 29. Sonos Next command sent via user interface

We wanted to see if there is anything within this packet that could hinder us from resending the same data
again and be able to skip songs. After further inspection of the packet, it was determined that a packet
replay would likely successfully change the song on the Sonos system. To test this, we took the packet
from Wireshark by selecting it and copying the Hex Stream. We then stripped the Ethernet and IPv4
headers off the packet and sent the information with the code below. As expected, the song went to thenext track. Figures 30 and 31 show the script running, and the Sonos application running to alert us thatthe next track is playing and what it is. The Sonos application does not need to be running to change tothe next track — This is only included to visually show the change in this paper.
24 | The Sound of a Targeted Attack

Figure 30. Python code to change to the next song

Figure 31. Sonos notification saying the next song is playing

25 | The Sound of a Targeted Attack

Before going much further in looking into what else we could code to control the device, a simple searchshowed us that there is a preexisting Python Library called SoCo that was written to help control thedevices. There is even an example web application to control your Sonos devices. It’s key to point out
that there is no authentication for any of the methods on the Sonos SOAP XML interface. This meansthat anyone can control your device or watch the tracks, or even just monitor what songs you are playing.
This could be done to learn more about the person who owns the Sonos, or it could be done to determine
when someone is around the Sonos and is listening to music. In the case of attackers, given they alreadyknow approximately where the devices are located, they can now use this to determine when a person is
physically at home or not by observing these patterns over time. A burglar could also use this knowledge
to determine when the property is vacant and go into the house based on these patterns. To test this ideathat we could monitor what was being watched, we decided to write up something using SoCo that pulls
the currently played track.

Figure 32. Python code using SoCo to list details about the current track

We found that in the response, there is a field that shows how long the song is, and what the current timein the track it is at. This could be used by an attacker to determine if the song is being played or paused
as well as to help determine if the person is actively listening to the track, or if it is paused based on thetime between queries. Shown here is an example of the above script running on our Sonos test unit. Thisshows that the Sonos is currently being played.

Figure 33. Sonos current track current time example
26 | The Sound of a Targeted Attack

Under the SoCo project, there is an example of playing a song by providing it a URI path. Upon further
searching, we found that there is a project called Ghosty that utilizes the Ruby scripting language to playsongs on a Sonos at random times that mimic a ghost or a creaking door. While this sounds like a simple
piece of fun code, there are real-world examples in the Sonos community forums of this happening topeople, and not just creaking doors and ghost sounds. One post described the user’s experience ofhearing sounds similar to “an explosion from a movie.” It is likely a scary encounter to have your speaker
turn on and make an explosion sound that repeats until you unplug the device itself. One user responded
to the original poster and said they should check out the diagnosis page that is located at status/perf.
This information can be used for any forensics you may have to do on these devices as it keeps a recordof what IPs are connecting to the Sonos device and what commands they are running. Here is an example
of our perf page.

Figure 34. Sonos status/perf page

After the command such as next(), there is an IP address followed by the OS and also the type of computerat the end of the entry.
In recent news, there was an episode of South Park that made people’s Amazon Echo units add things totheir Amazon wish list. When we saw the episode, we were amazed because we had tried the exact samething for this research, but the episode aired before we could publish this. Congratulations Eric Cartman
for beating us to this research.

27 | The Sound of a Targeted Attack

Based on the SoCo example to play a URI path, we coded up an example where we hosted the soundsof Alexa commands as a proof of concept. For the audio content, there were a few options. We could
simply record our voice, something that we have done a few times before in earlier research where weshowed that you can control an Echo with a human voice. Instead, we chose to use the say commandwithin Linux and created an MP3 and hosted it on a local web server. Once we had the sound file, we ran
our script to play a URI path.

Figure 35. Python script to play URI path

Once played, the Echo performed the task that we tested. We tested a few commands, which are listed
in the table below along with the outcome.
CommandResult“Alexa what time is it”“The time is 3:12 pm”“Alex rap for me ”

Connect sync link all the pieces of your life I
Get it done at the speed of WiFi
I’m the player, the coach, the arena, the gameIf you want something done, you just gotta say my name

“Alexa play song”“I can’t find any music in your library”“Alexa What’s on my shopping list”“Our shopping list is empty”“Alexa <item> to shopping list”“I have added <item> to your shopping list”“Alexa turn off hue light”

Lights turns off “OK”
Table 2. Commands sent via Sonos to Alexa

With the Bose SoundTouch devices, you can also play a URL. Inside of the libsoundtouch documentation,
it mentions that you can point it to a URL just as with the Sonos systems. This was not tested as we did
not have a Bose SoundTouch test unit to issue commands at. However, this allows the same commands
to be issued as we have demonstrated above.
28 | The Sound of a Targeted Attack# Play URL
device.play_url(‘http://fqdn/file.mp3’)

Figure 36. play_url function in libsoundtouch

As with the Sonos, it is also possible to get the current track playing on the SoundTouch devices, andthis information could be used in the same way as it can be with the Sonos. However, one noticeable
difference is that the source in which the track is being played can be gathered easily. Below is theexample of a device that was queried.

Figure 37. Song currently playing on the Bose SoundTouch

29 | The Sound of a Targeted Attack

A Case of Finding the Target
Combining everything we now know about how information was being leaked, and having determined
more information about the current state of the Sonos speaker, we decided to do a case study of one
user to determine if we could find out more about the person, and the area where they live. We chose a
Sonos speaker at random and proceeded. The identity of the person won’t be revealed but the steps wetook will be outlined.
In Colorado, there were a couple of Sonos devices shown in Shodan. In total, we found six exposed
devices online at the time of testing and chose one at random.

Figure 38. Sonos devices in Colorado showing in Shodan

Once we had the device IP, we browsed to the accounts page, viewed the scan results page, and looked
up the BSSIDs as we had done before. This led us to go down classic open source intelligence routes tofind more information about the person.

30 | The Sound of a Targeted Attack

First, the accounts page gave us a Pandora account. We know it’s a Pandora account due to the Type
being listed as 3, which is the same as the Pandora account that was linked to our Sonos test unit. Thisemail address was recorded and put into Maltego, where we ran a few transforms on the email address
and found only one really useful bit of information — which is that the person has a Pandora account withthat email address (no surprises there).
Viewing the “scanresults” page provided us with the general location of this Sonos based on the BSSID
geolocation lookups via the previously mentioned API.

Figure 39. Approximate location of the randomly chosen Sonos unit

Based on this information, we started trying to figure out the exact location of the Sonos based on theother information that is in the Sonos website.
For the email address, we cross-referenced the subject user’s email address with Pipl, an online searchtool used to locate people based off of public information. In doing so, it was possible to find a nameassociated with the email address.

31 | The Sound of a Targeted Attack

Figure 40. Search result in Pipl

Sites like Pipl should be taken with a grain of salt, so we went on to verify the information by searching forthe email address on Facebook to see if we could generate the same account by email address. Using
the site IntelTechniques.com, you can search Facebook for an email address. In this case, the result on
Facebook was that we could not tie the email address to an account, as shown below.

Figure 41. Email address not found on Facebook

This is fine as this could be because of a privacy setting that doesn’t allow people to search for the user
by email address. So, another way to search for an email address is to click the “Forgot account” link anduse the email address as the input.

32 | The Sound of a Targeted Attack

Figure 42. Reset account screen on Facebook

In this case, we can see that this is a valid email address for someone on Facebook, but we aren’t
presented with a Facebook profile picture or anything else that may help us tie the two accounts together
based on the Pipl search. At this point, we normally wouldn’t consider these accounts verified. But
knowing the neighboring access points and a possible name of the person who owns that email address,
we can attempt to find an address for this person in the town.
Using a website called FamilyTreeNow.com, or any other site that has public records on it, we can start
to see if we can find a possible address for this person, and we found a few potential addresses. The
state this user was in also has a really interesting public database that gives the current address of aperson and their voter information. This information, along with the information from FamilyTreeNow.com,
led us to an address that was highly likely to be correct. In normal OSINT, there is no really great way todetermine if this is the address of the person, other than based on records.

Figure 43. Possible addresses pulled from FamilyTreeNow.com

33 | The Sound of a Targeted Attack

Since we already had local scanning of nearby SSIDs and our previously discussed method of mappingthese out, we were able to plot the address from our OSINT investigation and see if we were close to
those access points. As can be seen in Figure 44, the suspected current address above mapped to alocation that is directly beside the previously shown SSIDs.

Figure 44. Address mapped with SSIDs

Now we had to figure out if we could find what type of music the person may be into. Running ourprevious script that pulls the current track revealed that the person may like 80s hair metal, or is intoclassic rock based on the selection that was currently playing.

Figure 45. Song currently playing on Sonos

34 | The Sound of a Targeted Attack

Phishing With Sonar
With the ability to target users down to knowing the exact house they are in and then confirming it basedon only the information that’s within the Sonos and OSINT, an attacker could take the information andsend them a targeted phishing attack to try and get them to become a victim of malware. In this attack
case, however, we can now add sound to make the phish more believable – much like when people arefishing with fish finders that use sonar, a system that emits sound pulses and listens for them to bounce
off an object. In this case, an attacker can use sound as well. However, it won’t be a pulse of sounds but
a directed message to partner with the email. Needless to say, we did not go so far as to use this attack
scenario on the individual in our research. But we did verify everything on our own test setup.
Let’s assume that an attacker knows your model number, serial number, and all the other information
about your Sonos. They can then take that information and craft a message that states “Sonos System
Alert: Your Sonos Play:1 speaker is having some technical difficulties, instructions on how to correct thiscan be located within an email sent to your email address that you have registered with.”Partnering the email with the audio alert would make the message even more believable to even the mostskeptical end user, such that the likelihood of getting the person to fall for the phish would likely be morethan if this was just an email sent to the email address that was found within the Sonos system.

35 | The Sound of a Targeted Attack

Exploitation
During the research, we also wanted to see if we could find any exploits that may be remotely leveraged
by fuzzing some of the SOAP XML interface fields. This started with us writing a custom script tofirst fuzz the UUID field. While playing a song on the Sonos speaker, we ran our script and quickly
made the Sonos stop playing songs and remove itself from the application to control the Sonos. As
shown here, it sends an IGMPv3 leave group message as well as an MDNS query to flush the cachefor the Sonos name. While this is not a buffer overflow or anything at this point in time, there are somemishandling issues if the values are non-ASCII values. In this case, you see the UUID is shown as
0x352494e434f4e5r3934394633453133364130383031343030a0d. All the UUIDS end with 0x0a0d as
that’s a new line and a carriage return value in hex. If the values have an ASCII to start with such as
AAAAAA_AAAAAAAAAAAAAAAAA00 and this proved to not crash the system, the music continues toplay. So, it appears that parsing non-ASCII values is causing this issue.

Figure 46. Non-ASCII characters causing the DoS

Because we stopped the tracks at will from playing and we disappeared from the application, an attacker
could also do this method to have their phishing attack be more successful. If the attacker sent an email
from product support and said that it had noticed the Sonos system is having an issue and to click a linkto learn more information and get support on how to fix the Sonos system, again the likelihood of successwould go up.

36 | The Sound of a Targeted Attack

Hardware Hacking
With IoT devices, there is always the question of how the hardware is implemented. With the spread of
IoT botnets like Mirai, we looked closer at the exposed systems. We felt like there were enough of these
online that if there was an issue found with the firmware, there was a large enough user base for an
attacker to create a botnet. Not only can an attacker script a ping-based DDoS bot already (based on thepage shown earlier), but we wondered what else could be done if there is access to the hardware?
First we checked what was possible to do with the firmware file. We attempted to capture the files overa network pcap, then extract the firmware from the pcap. This turned out to be a waste of time because
there is an “upgrade.log” file on the status page of the Sonos. This page contains a URL string that when
you copy and paste into a browser or cURL/wget you will get the firmware file that the Sonos is running.
It turned out that, based on the two models we had, there is a PowerPC version and an ARM version of
the hardware. We focused on the ARM version because it seemed to be the most prevalent and had themost number of tool sets that could work with the firmware files if extracted.

Figure 47. Example of upgrade.log that shows the URL of the firmware file

We did some looking into this and there were examples of people on forums that had downloaded older
versions of the firmware and were able to extract it and read the contents. However, this was not the casefor our firmware files that we downloaded. Most of them were gziped firmware with custom entry points.
We attempted to find older versions of firmware to see if there were any versions we could locate thatwere able to be unpacked. We found an older version of 29.5-90191-1-5. This version was able to be
extracted via binwalk where we had a few files that were extracted.

37 | The Sound of a Targeted Attack

Figure 48. Firmware extracted with binwalk

The files vmlinux.29.5-90191.bin and 8EC90.cramfs were extracted, then using the uncramfs commandfrom the firmware-mod-kit found on github, we deflated the cramfs to reveal a Linux folder structure.

Figure 49. Contents of extracted firmware

In each of these folders, such as etc, there are typical files such as shadow and passwd. However, thesefiles have no contents. We tried multiple times with multiple tool sets and were never successful in getting
an older version unpacked. Based on information online, it looked like we would have had to go back to aversion of firmware before 20.0 to be able to get any information from the extracted files anyway. Becauseof this, we moved on and disassembled the Sonos test unit.
A good resource for IoT devices is iFixit.com, where they have a manual with pictures on how to take apart
the Sonos Play:1. Once we had taken it apart based on the instructions on iFixit, we started to look at any
areas that we may want to spend some time on to determine if we can locate anything that would lead us
to either console access to the OS or a method to extract the firmware.

38 | The Sound of a Targeted Attack

First thing we started looking at were the chips that were in use. Here is the layout of the front and backof the motherboard in the Sonos (ARM version). Once you remove the RF protection cages around theequipment, you’ll see the processor, memory, and a bunch of other components. One interesting note isthat as hardware breakdowns go, this one was easy but interesting as things are hot glued and there isfoam around areas to prevent rattling inside the speaker.

Figure 50. Sonos motherboard

The chips that we dug into were the Freescale CPU and the Winbond chip shown in Figure 51. The
Winbond chip in the image on the right is the NAND Flash that is used by the Sonos for storage. On theleft is the Freescale ARM processor that is a dual-core ARM chip.

Figure 51. Closeup of the Winbond chip

39 | The Sound of a Targeted Attack

Figure 52. Chip schematic of Winbond chip

Figure 53. Closeup of the ARM chip by Freescale

Before looking into the chips much further, we looked into whether there was any low-hanging fruit on thisboard, such as an open serial interface, or a JTAG interface for us to tap and interface with. There were afew different locations that we tried initially to see what kind of data there may be on the board. Next tothe Ethernet port were a set of pads that resembled a possible location of a UART port, or another type ofinterface. However, when we probed this, there were no signals on any of these pads and they appeared
to be disabled.

40 | The Sound of a Targeted Attack

Figure 54. Disabled interface to the Sonos

Below the wireless card, there is another interface that we probed. This interface had data on it and it
looked to be a Serial Wire Debug (SWD).

Figure 55. Possible SWD interface

Once we had attached some pins to the pads, we were able to connect our Saleae Logic Analyzer tothese ports and attempt to see if we could find any information on it. Allowing the Saleae to auto decode
it as SWD and playing with the configuration of which of the pins was what input (SWDIO and SWCLK),
the best we could find is shown below, where it appeared to have some SWD on the interface.

41 | The Sound of a Targeted Attack

Figure 56. Signal shown in Saleae logic analyzer

Using an STM32 F4 Discovery and attaching the pins to the corresponding pins on the board, we
attempted to see if we could interface directly via SWD. However, we never were able to connect to thedevice via SWD despite our best efforts. Below is a screenshot showing the st-info command showingthat once you remove the CN3 jumpers from the board, this turns the board to Discovery mode. Thismeans that any device attached should show up with a proper serial number much like the device did withthe jumpers on. This was never the case no matter what we attempted, so we moved on and assumed
this is not SWD anymore.

Figure 57. st-link information output

Next, we found what could possibly be a JTAG interface next to the cage where the ARM chip is.

42 | The Sound of a Targeted Attack

Figure 58. Possible 10 pin JTAG interface

Under the wireless card itself are eight other pins that are in a staggered placement. These pins, much likethe JTAG interface, are labeled in order.

Figure 59. Interface under the wireless card

Next, we found where any of the possible traces coming out of the Freescale processor may have viasthat we could probe, and used the Saleae to determine if there were any signals present. This proved tofind nothing of value for anything that we knew what to do with. Most of them at the time of probing had
no signals on them.

43 | The Sound of a Targeted Attack

Figure 60. Probing vias with a needle

As with any research, there are successes and failures. In this case, trying to find any interface to directlyinteract with the Sonos systems via hardware was not a success. While we focused on the Sonos Play:1,
some older devices had an exposed UART that was pretty clear; as an example, the Sonos Play:5 is thisway according to some of the forum posts that we saw on the internet. This could help provide us withsome information that were missing on the Sonos Play:1. These looked to be of the PowerPC variant andnot the ARM, but the underlying functionality is almost the same minus some of the features we wereusing to target some people such as wireless scan results and review log files.
Special thanks to Kevin Finisterre for the hardware help.

44 | The Sound of a Targeted Attack

Sonos Update
We reported our findings to Sonos before this paper was published. Sonos was quick to respond andstarted remediating some of the issues. Sonos has fixed the DoS problem and now returns with an HTTP
error code 412 (Precondition failed). In addition, now you can no longer see the scanresults page or manyof the other pages that provide some information leakage. There are a few left such as the accounts page.
Figure 61 shows the Sonos status page after the update.

Figure 61. Updated Sonos status page

While the update is a step in the right direction, you can still control these and gather more informationfrom the devices with what is still being exposed via the status page. This is as of the software date“2017-09-27 16:26:54.868089” and software version number 37.12-45270. If you have not updated to thisversion of the software, you should update now to limit the personal data that is being exposed via these
services, even if you are not directly exposed to the internet.

45 | The Sound of a Targeted Attack

Conclusion
With the popularity of IoT devices growing every day, it is very important to be knowledgeable of thebuilt-in security of these devices that ultimately could affect the owner and make them a target of an
attack. While this research focused on Sonos speakers, we do not at all want to single them out as the
only IoT device with security issues on the market today. As we showed, Bose SoundTouch also shared
a lot of problems with the Sonos according to our findings. This is a common issue we observe in IoT
devices, where there is a lack of security built into the design. With the Sonos, this was the case with theunauthenticated SOAP XML interface, and the web interface that leads to the information leakage. Whilethese devices are never supposed to be exposed on the internet, we have shown that they can and willfind their way directly on the internet. We believe that the manufacturers should do whatever they can tomake sure that their devices are secured enough that if it is placed on the internet, the likelihood of attack
is really low.

46 | The Sound of a Targeted Attack

Created by:

The Global Technical Support and R&D Center of TREND MICROTREND MICROTM
Trend Micro Incorporated, a global cloud security leader, creates a world safe for exchanging digital information with its Internet content security andthreat management solutions for businesses and consumers. A pioneer in server security with over 20 years experience, we deliver top-ranked client,server, and cloud-based security that fits our customers’ and partners’ needs; stops new threats faster; and protects data in physical, virtualized, andcloud environments. Powered by the Trend Micro™ Smart Protection Network™ infrastructure, our industry-leading cloud-computing security technology,
products and services stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe.
For additional information, visit www.trendmicro.com.

www.trendmicro.com©2017 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks ofTrend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners.