SlideShare a Scribd company logo
1 of 86
Internet is made of cats, porn
and stuff your neighbors
shouldn't know about you.
Rafał Hryniewski
@r_hryniewskifb.me/hryniewskinet
Agenda
• Introduction
• Fun stuff
• Fun stuff
• Fun stuff
• Not fun stuff
• Questions
Glossary
• ICS – Industrial Control System
• SCADA - Supervisory Control And Data Acquisition
Does those disturb you?
It is disturbing for some people!
And yet we love to watch other people!
The more stupid shit the better!
Sharing is caring!
Would you want to see your face here?
Would you want to see your face here?
Would you want to see your face here?
Would you want to see your face here?
Sure, install this in your house and …
IP Cam + Security Ignorance = …
Cheap room in good localization?
Even bees have cams!
Hiya!
It gets creepy as fuck
Seriously? Bedroom?
Photo: https://www.amazon.co.uk/Paranormal-Activity-DVD-Katie-Featherston/dp/B0030IMZ3E
So how about offices?
Yuuup!
G’night!
Shopping
Could you enter your PIN please?
How about closeup?
Crazy scientist’s labs
“Christian counseling call-in show”
Barking cameras with light control
You’re not safe in the middle of a fucking forest either!
Sometimes you can identify specific place from cam
Like this
So… what exactly happens here?
CSI level stuff
Another one?
How much?
Basic features = free
Extended features = 49 USD one time payment
A shitload of RDP sessions…
… even on prehistoric systems
Refridgerator units (there’s ammonia control in menus!)
Restaurant/kitchen controls
Restaurant sales system
Licenceplate recognition with database
Photo: https://money.cnn.com/gallery/technology/security/2013/05/01/shodan-most-dangerous-internet-searches/2.html
Some kind of turbine?
19651 gallons = 74387 liters
No clue what’s that but – 32767m3
Another tank, this time with huge pressure
A MINE!
Hong Kong Shopping Mall LED Control Panel
Electric substation (?) with main switch
Something from Poland
So…imagine you have a crematory…
Photo: https://www.vice.com/en_uk/article/9bvxmd/shodan-exposes-the-dark-side-of-the-net
… or a bunch of traffic lights
Photo: https://money.cnn.com/gallery/technology/security/2013/05/01/shodan-most-dangerous-internet-searches/3.html
Swimming pool acid pump
Photo: https://money.cnn.com/gallery/technology/security/2013/05/01/shodan-most-dangerous-internet-searches/3.html
Gondola control
Photo: https://money.cnn.com/gallery/technology/security/2013/05/01/shodan-most-dangerous-internet-searches/8.html
Power plant
Screenshot
Screenshot: https://www.ndtv.com/world-news/humiliated-by-sex-tape-leak-woman-commits-suicide-1459724
Screenshot: https://www.bbc.com/news/technology-34044506
Security researchers claim that at least 68,000 medical
systems — like MRI scanners and infusion systems —
from a “large, unnamed US health group” are accessible
online for hackers to attack.
Source: https://gizmodo.com/thousands-of-medical-devices-are-open-to-hacking-over-t-1733961503
Source: https://mashable.com/2017/07/18/hacking-boats-is-fun-and-easy/?europe=true#edR_65LnKaqf
Anyone who gained access to the system in question, and was
so inclined, could manually change a ship's GPS coordinates or
possibly even brick the boat's navigation system entirely by
uploading new firmware
Screenshot: https://www.independent.co.uk/news/business/news/hackers-electricity-grid-take-over-solar-panel-equipment-security-loopholes-worldwide-
shut-down-a7884626.html
“We did research in which we used Shodan and found all of the
nuclear plants in France that are connected to the internet. If a user
knows what he is looking for, he could easily find this information.”
- Cyber Security at Civil Nuclear Facilities Understanding the
Risks(September 2015)
Screenshot: https://www.nytimes.com/2017/07/06/technology/nuclear-plant-hack-report.html
Questions?
@r_hryniewskifb.me/hryniewskinet

More Related Content

Similar to Internet of Things security risks exposed

North americai iotskynet-v2
North americai iotskynet-v2North americai iotskynet-v2
North americai iotskynet-v2Steve Poole
 
Design Analysis
Design AnalysisDesign Analysis
Design AnalysisR. Sosa
 
Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01Home
 
Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01Home
 
Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014
Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014
Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014Christian Heilmann
 
Emerging practices 2019 week 6 design analysis
Emerging practices 2019 week 6 design analysisEmerging practices 2019 week 6 design analysis
Emerging practices 2019 week 6 design analysisR. Sosa
 
115 batshit stupid things you can put on the internet in as fast as I can go ...
115 batshit stupid things you can put on the internet in as fast as I can go ...115 batshit stupid things you can put on the internet in as fast as I can go ...
115 batshit stupid things you can put on the internet in as fast as I can go ...vissago
 
Imagining the physical web
Imagining the physical webImagining the physical web
Imagining the physical webyiibu
 
Country domination - Causing chaos and wrecking havoc
Country domination - Causing chaos and wrecking havocCountry domination - Causing chaos and wrecking havoc
Country domination - Causing chaos and wrecking havocTiago Henriques
 
Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02
Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02
Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02World Sports Boats
 
Don't Think Websites, think data
Don't Think Websites, think dataDon't Think Websites, think data
Don't Think Websites, think dataMike Ellis
 
Mini Computers
Mini ComputersMini Computers
Mini Computersjonjahr
 
nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...
nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...
nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...n|u - The Open Security Community
 
The Brain in the Game
The Brain in the GameThe Brain in the Game
The Brain in the GameGil Steiner
 
Projects list raspberry pi projects complete 1480 projects
Projects list   raspberry pi projects complete 1480 projectsProjects list   raspberry pi projects complete 1480 projects
Projects list raspberry pi projects complete 1480 projectsWiseNaeem
 
60 Gadgets In 60 Minutes
60 Gadgets In 60 Minutes60 Gadgets In 60 Minutes
60 Gadgets In 60 MinutesVickie Kline
 
Exploring Hardware Security
Exploring Hardware SecurityExploring Hardware Security
Exploring Hardware SecuritySpeck&Tech
 

Similar to Internet of Things security risks exposed (18)

Hacking the world
Hacking the worldHacking the world
Hacking the world
 
North americai iotskynet-v2
North americai iotskynet-v2North americai iotskynet-v2
North americai iotskynet-v2
 
Design Analysis
Design AnalysisDesign Analysis
Design Analysis
 
Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01
 
Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01Smashingconf 150319145648-conversion-gate01
Smashingconf 150319145648-conversion-gate01
 
Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014
Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014
Welcome to planet Fintlewoodlewix - SmashingConf Oxford 2014
 
Emerging practices 2019 week 6 design analysis
Emerging practices 2019 week 6 design analysisEmerging practices 2019 week 6 design analysis
Emerging practices 2019 week 6 design analysis
 
115 batshit stupid things you can put on the internet in as fast as I can go ...
115 batshit stupid things you can put on the internet in as fast as I can go ...115 batshit stupid things you can put on the internet in as fast as I can go ...
115 batshit stupid things you can put on the internet in as fast as I can go ...
 
Imagining the physical web
Imagining the physical webImagining the physical web
Imagining the physical web
 
Country domination - Causing chaos and wrecking havoc
Country domination - Causing chaos and wrecking havocCountry domination - Causing chaos and wrecking havoc
Country domination - Causing chaos and wrecking havoc
 
Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02
Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02
Dontthinkwebsitesthinkdatafinal 090713100859 Phpapp02
 
Don't Think Websites, think data
Don't Think Websites, think dataDon't Think Websites, think data
Don't Think Websites, think data
 
Mini Computers
Mini ComputersMini Computers
Mini Computers
 
nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...
nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...
nullcon 2011 - No bullshit on underground crime: traces, trends, attribution,...
 
The Brain in the Game
The Brain in the GameThe Brain in the Game
The Brain in the Game
 
Projects list raspberry pi projects complete 1480 projects
Projects list   raspberry pi projects complete 1480 projectsProjects list   raspberry pi projects complete 1480 projects
Projects list raspberry pi projects complete 1480 projects
 
60 Gadgets In 60 Minutes
60 Gadgets In 60 Minutes60 Gadgets In 60 Minutes
60 Gadgets In 60 Minutes
 
Exploring Hardware Security
Exploring Hardware SecurityExploring Hardware Security
Exploring Hardware Security
 

More from Rafał Hryniewski

DevSecOps - security all the way
DevSecOps - security all the wayDevSecOps - security all the way
DevSecOps - security all the wayRafał Hryniewski
 
DevSecOps - Security all the way
DevSecOps - Security all the wayDevSecOps - Security all the way
DevSecOps - Security all the wayRafał Hryniewski
 
Large scale, distributed and reliable messaging with Kafka
Large scale, distributed and reliable messaging with KafkaLarge scale, distributed and reliable messaging with Kafka
Large scale, distributed and reliable messaging with KafkaRafał Hryniewski
 
Meet Gremlin – your guide through graphs in Cosmos DB
Meet Gremlin – your guide through graphs in Cosmos DBMeet Gremlin – your guide through graphs in Cosmos DB
Meet Gremlin – your guide through graphs in Cosmos DBRafał Hryniewski
 
Shit happens – achieve extensibility, modularity and loosely coupled architec...
Shit happens – achieve extensibility, modularity and loosely coupled architec...Shit happens – achieve extensibility, modularity and loosely coupled architec...
Shit happens – achieve extensibility, modularity and loosely coupled architec...Rafał Hryniewski
 
Public speaking - why am I doing this to myself and why you should too?
Public speaking - why am I doing this to myself and why you should too?Public speaking - why am I doing this to myself and why you should too?
Public speaking - why am I doing this to myself and why you should too?Rafał Hryniewski
 
Azure SQL - more or/and less than SQL Server
Azure SQL - more or/and less than SQL ServerAzure SQL - more or/and less than SQL Server
Azure SQL - more or/and less than SQL ServerRafał Hryniewski
 
Essential security measures in ASP.NET MVC
Essential security measures in ASP.NET MVC Essential security measures in ASP.NET MVC
Essential security measures in ASP.NET MVC Rafał Hryniewski
 
ORM – The tip of an iceberg
ORM – The tip of an icebergORM – The tip of an iceberg
ORM – The tip of an icebergRafał Hryniewski
 
Quick trip around the Cosmos - Things every astronaut supposed to know
Quick trip around the Cosmos - Things every astronaut supposed to knowQuick trip around the Cosmos - Things every astronaut supposed to know
Quick trip around the Cosmos - Things every astronaut supposed to knowRafał Hryniewski
 

More from Rafał Hryniewski (17)

Azure messaging
Azure messagingAzure messaging
Azure messaging
 
Azure developer
Azure developerAzure developer
Azure developer
 
Great webapis
Great webapisGreat webapis
Great webapis
 
DevSecOps - security all the way
DevSecOps - security all the wayDevSecOps - security all the way
DevSecOps - security all the way
 
DevSecOps - Security all the way
DevSecOps - Security all the wayDevSecOps - Security all the way
DevSecOps - Security all the way
 
Anchor modeling
Anchor modelingAnchor modeling
Anchor modeling
 
Large scale, distributed and reliable messaging with Kafka
Large scale, distributed and reliable messaging with KafkaLarge scale, distributed and reliable messaging with Kafka
Large scale, distributed and reliable messaging with Kafka
 
Meet Gremlin – your guide through graphs in Cosmos DB
Meet Gremlin – your guide through graphs in Cosmos DBMeet Gremlin – your guide through graphs in Cosmos DB
Meet Gremlin – your guide through graphs in Cosmos DB
 
Shit happens – achieve extensibility, modularity and loosely coupled architec...
Shit happens – achieve extensibility, modularity and loosely coupled architec...Shit happens – achieve extensibility, modularity and loosely coupled architec...
Shit happens – achieve extensibility, modularity and loosely coupled architec...
 
Web app security essentials
Web app security essentialsWeb app security essentials
Web app security essentials
 
Public speaking - why am I doing this to myself and why you should too?
Public speaking - why am I doing this to myself and why you should too?Public speaking - why am I doing this to myself and why you should too?
Public speaking - why am I doing this to myself and why you should too?
 
Azure SQL - more or/and less than SQL Server
Azure SQL - more or/and less than SQL ServerAzure SQL - more or/and less than SQL Server
Azure SQL - more or/and less than SQL Server
 
Blazor
BlazorBlazor
Blazor
 
Essential security measures in ASP.NET MVC
Essential security measures in ASP.NET MVC Essential security measures in ASP.NET MVC
Essential security measures in ASP.NET MVC
 
.NET, Alexa and me
.NET, Alexa and me.NET, Alexa and me
.NET, Alexa and me
 
ORM – The tip of an iceberg
ORM – The tip of an icebergORM – The tip of an iceberg
ORM – The tip of an iceberg
 
Quick trip around the Cosmos - Things every astronaut supposed to know
Quick trip around the Cosmos - Things every astronaut supposed to knowQuick trip around the Cosmos - Things every astronaut supposed to know
Quick trip around the Cosmos - Things every astronaut supposed to know
 

Internet of Things security risks exposed