How Cybercriminals Steal Wi-Fi Passwords through an IoT device [CVE-2021-3774]
Channel: Gerard Fuguet
Date: 2021-05-02

This story is inspired in a real one scenario.
A hacker decides to buy a smart wall switch (specifically a Meross model MSS550X) and this person usually performs a traffic inspection test doing information gathering to their devices to know what is happening inside it at network level perspective... When he is coming back to his home, he meets a neighbor and says hello. Neighbor, using social engineering tactics, realize he has a Meross type device in their hand, it knows about their functions and decides to do a Cybercrime against him.

Join to this tragic event and get knowledge to perform a Machine-in-the-Middle infrastructure to review your IoT devices.


00:00 - Intro
00:37 - Cybercrminal: Preparing the attack
01:35 - Cybercrminal: Wi-Fi sniffing
01:49 - Hacker: Studying the installation of Meross MSS550X
02:13 - Hacker: Preparing Machine-in-the-Middle (Hardware part)
02:45 - # Preparing machine-in-the-middle environment
03:24 - # Creating hostapd.conf
03:40 - # Discovering Network Parameters
03:54 - # Our Gateway is their IP
04:08 - # Tell Gargoyle (OpenWRT based System) to act as Wi-Fi client for connecting to the Meross Network
05:22 - # Disable IPv4 and IPv6 all interfaces via Network Manager for transparency (GUI mode)
06:31 - # Avoid conflicts stopping Network Manager
06:38 - # Execute now your HotSpot
06:45 - # Lets create the Bridge
06:55 - # Checking the just created Bridge
07:13 - # Time to Monitoring :)
09:13 - Cybercrminal: Inspecting the capture file
09:51 - Ending


INCIBE has coordinated the publication of this vulnerability with the internal code INCIBE-2021-0451.
https://www.incibe-cert.es/en/early-warning/security-advisories/meross-mss550x-missing-encryption-sensitive-data

The Common Vulnerabilities and Exposures (CVE) Program has assigned the CVE ID: CVE-2021-3774 to this vulnerability.
https://www.cve.org/CVERecord?id=CVE-2021-3774


Need help on some of the how-to or to get deeper information? Here you have a white paper explaining it in detail with diagrams plus building on a Windows OS:
My neighbor’s flat smells like data. https://www.slideshare.net/fuguet/my-neighbors-flat-smells-like-data


This video features the following songs:
Urgency by CSoul (c) copyright 2015 Licensed under a Creative Commons Attribution Noncommercial  (3.0) license. http://dig.ccmixter.org/files/CSoul/51334 Ft: SackJo22

Celestial Darkness by Blake (c) copyright 2015 Licensed under a Creative Commons Attribution Noncommercial  (3.0) license. http://dig.ccmixter.org/files/blakeht/49364

SOELiveAtTheMarsRebellion by ghosts4hire (c) copyright 2009 Licensed under a Creative Commons Attribution Noncommercial  (3.0) license. http://dig.ccmixter.org/files/WilliamE/23093


Production Assistant:
Esther Martínez

"How Cybercriminals Steal Wi-Fi Passwords through an IoT device even against Machine-in-the-Middle," © 2021 Gerard Fuguet, used under a Creative Commons Attribution license:
https://creativecommons.org/licenses/by/4.0/
#MachineInTheMiddle
#InformationGathering
#WiFiPassword