IoT Linux Forensics

hello!
Ali Hadi,

Joseph McCormack,Austin Grupposo,Assistant Professor andResearcher at
Champlain College.

Sophomore Digital
Forensics student at
Champlain College.

Sophomore Digital
Forensics student at
Champlain College.

2

IoT Linux Forensics
is becoming Important to Digital Forensics Investigators; Are You
Caught Up?
3

A Primer✘ IoT security issues are often overlooked✘ Devices can interconnect throughout a consumer network✘ Devices could be assembled from different components
manufactured by different producers.

4

Purpose and Scope✘✘✘✘✘✘

Research and utilize access methods in a forensic setting
Many devices available at the Leahy Center
Software and Hardware level research
Root access to look into ﬁle system
Open-Source Linux tools
Logs, conﬁg ﬁles, user artifacts

5

IoT Device File Systems✘ The most common ﬁle systems found on IoT ﬁrmwares:○ Ext2○ Cramfs○ JFFS2○ Squashfs○ YAFFS2✘ They can be identiﬁed using their signature (still under research)
6

IoT Device Compression Methods
Compression is used on most devices due to limited space:
✘✘✘
✘

Gzip
LZMAZlibZip

7

Access Methods to IoT Devices✘ Software and Hardware exploits○ Known exploits that can lead to root

✘ Different Interfaces to access the IoT device○ Web○ USB○ Ethernet✘ JTAG/UART
8

Why UART Communication?
✘ Universal Asynchronous Receiver/Transmitter✘ Allows interacting with devices:○ Reading debug logs
○ Bootloader access○ admin/admin, root/toor, admin/password■ Get root...
9

How Many UART Pins?
✘ Many devices use 8-pins for read/write✘ 4-pins were used for the devices used in this research, since only
reading was required○ E.g. the camera only allows reading10Serial Communication?
✘ Most IoT devices use Serial Communication and protocols✘ Transfer 1-bit at a time
✘ Common Channels: RS232, USB, HDMI, etc

11Baud rate
✘ The rate at which information is transferred✘ UART has no clock rate
✘ Ex. 9600 baud, 19200 baud, 115200 baud

12

UART Converter✘ Translates serial data into readable data via USB✘ Requires additional cabling (often included)✘ Purchased on Amazon

13

Devices Researched● Smart Home:○ Philips Hue Lights○ Pet Cube Play○ Nest Thermostat● Security Systems:○ Samsung SmartCam○ D-Link 5030L Wiﬁ Cam○ Ring Video Doorbell● Voice Assistants:○ Amazon Echo
○ Google Home
○ Facebook Portal● Smart Hubs:○ Samsung Smartthings
Hub○ Wink Hub 2○ Circle by Disney

14

IoT Catalog (p1) ...

15

IoT Catalog (p2) ...

16

Available
Interfaces
for Access17

Surface Mapping (Ports & Services)18

Devices Investigated...

19

“✘ Philips Hue Bridge✘ D-Link HD Pan Wiﬁ Cam 5030l

20Forensic Workflow

Step One: Datagen and acquisition
1.
2.
3.
4.
5.

Factory Reset
Utilize Device as normal
Document actions in Timeline
Connect device to UART converter
Use Linux machine to access shell (Kali/Ubuntu)

22

Step Two: Finding the baud rate of a device✘ Installing Python✘ Installing Pyserial✘ Baudrate.py by DevTTYS023

3. Setting up serial ports in Linux✘✘✘✘✘

Connect the UART hardware to the computer
Conﬁrm whether or not the device is connected
Setserialchmod 666 /dev/ttyUSB0”
cu -l /dev/ttyUSB0 -s 115200”

24

D-Link DCS-5030L Security
Camera Accessing Backend Linux✘ F232 UART Device Connection

Systems via UART25Serial Communication using Putty✘ COM8, F232 UART device location✘ 57600, Baud rate of D-Link Smart Cameras

dlinkSerial.log
26

Bootloader
Booting System via
Flash, opening MIPS
Linux Kernel Image

Device Bootloader
27

Success!
Device Bootloader

28

Metadata Revealed onFirst Login✘ Saved JPEG images, Saved
MP4 video settings✘ Files appear to be cachedlocally until Reset Button ispushed✘ Admins password changed
automatically after login,cannot elevate to sudo once
logged in, but resets to[u:admin p: ] after every
boot, leaving root shellvulnerable29

Autorunning FS Scripts without Shell Input✘ BSS_FOUND/BSS_NOT_FOUND showing the radio antenna actively
searching for previously established connections, even whenantenna is unplugged from board✘ Found IOTLinux, showing that previously connected WiFi network
data/IP tables are stored internally. Active connections weredisabled during this serial session, meaning D-Link could not havescanned for available SSIDs
30

Philips Hue Bridge

31

Philips Hue Bridge - Accessing
through Hardware Hacking✘ F232 UART device location✘ 115200 baud rate
✘ Shorting contact to bypass bootloader✘ Accessing root shell✘ Using dropbear to remotely connect to rootshell
32

Splash Screen w/ SSH✘ Uses outdated algorithm, makes accessing system much easier✘ Connected at 10.0.0.2/24✘ Access shell using
default user andpassword

Device Bootloader
33

Getting OS Information✘ cat /etc/*release; uname -a✘ Will list the distro information and version of Linux34

Network information✘ Ifconﬁg -a✘ Lists network location for
Remote access (Importantfor quarantine)

Device Bootloader
35

Checking for Mount points✘ mount✘ Lists the location of ﬁle to image

36

Listing Root Directory✘ Ls -al /✘ Listing all
directories in rootDirectory✘ Timestamps andaccess permissions

37

Listing Active Services✘ Netstat -tulpn✘ Showing open ports andservices being used by
the device while running

38

Busybox

39

/etc

Device Bootloader
40Custom Firewall Rules

Root user has read and write permissions tochange any settings in the ﬁrewall conﬁg ﬁles41

42

Imaging on the Linux side

Saving the result to ourtarget system
The result of the compressed tar will be something similar to what is listedbelow:

43

Challenge(s)✘ COVID-19 Lockdown○ Leahy Center Locked down from March - late September✘ Smaller Team○ Ali, Joseph, Austin, Sid○ Zero previous IoT Experience!
✘ Lack of resources○ Cloud vs. On-Board

44

What Comes Next?
✘✘✘✘

IoT File Systems
Detailed forensic acquisitions
Automated forensics
IoT Forensics Toolkit

45

thanks!
Questions/Suggestions?
#hadi-linuxforensics-iot on the OSDFCon Discord Server
Ali Hadi, @binaryz0ne via Twitter
Austin Grupposo, via LinkedIn
Joseph McCormack, via LinkedIn
46