Downloaded 18 times
Uploaded byCAVEDU Education
絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座Final
李倫銓是一位網路安全專家，連同其媒介科技的專案展示了一款結合物聯網和雲端技術的光劍，應用於2015年的CTF競賽中。該光劍搭載了無線路由器，並利用開源技術如OpenWRT和Snort來提升其功能，還可以連接MCS雲端平台進行資料監控和控制。文件中深入探討了光劍的設計與應用，並討論了IoT設備的安全挑戰與解決方案。
More Related Content
Similar to 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座Final
絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座Final
- 1.
- 2. • HITCON 協會發言人 •HITCON CTF領隊與競賽負責人 • 交大資工所，台大電機所博士候選人， 目前任職 聯發科技 • 專長：網路安全相關技術、惡意程式與 流量分析、雲端服務規劃與研究。 2 李倫銓
- 3. OUTLINE 1. 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座 • HITCONCTF 2015 決賽應用 2. 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座 • Mediatek Linkit 7688 firmware解除封印 AP mode+ station mode 3. 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座 • 7688 + OpenWRT + Snort 打造駭客入侵偵測器 4. 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座 • MCS雲端平台 + IFTTT 擴增應用
- 4. HITCON CTF 2015決賽應用 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座
- 6.
- 7.
- 8. CTF是甚麼？ 全名 Captuare TheFlag 又稱搶旗賽
- 9.
- 10.
- 11. Attack & Defence攻擊流程 1 每個隊伍獲得一個 有漏洞服務的主機 2 3 4 分析主機上的漏洞 找到漏洞利用的方式 將漏洞寫成攻擊程序 並攻擊其他隊伍 透過攻擊 獲取主機上的 Flag 將 Flag 提交給大會 得分 💀 Service 💀 Service 💀 Service
- 12.
- 13. DEFCON CTF final2015
- 14.
- 15. CTF + StarWars • 燈控光劍效果
- 16.
- 17. 打人時伸出光劍劍刃並發出音效 • 當得分隊伍 submitflag，計分系統會立刻透過 socket傳訊號給”被得分隊伍”桌上的光劍底座 (Linkit Smart 7688 ) • 光劍底座跑一支server.py ，接收計分系統來的控 制訊號
- 19. 光劍主體 • 使用台灣最知名的馬可多版光劍 • 劍刃共有六段伸縮節 •劍把，馬可多手工打造電路板 • + 電池 + 喇叭
- 21.
- 22. 22 – 1T1R 802.11nWi-Fi radio – 580MHz MIPS® 24KEcTM CPU – USB2.0 host, SD-XC, I2S / PCM, I2C, PWM, UART, GPIO, SPI, SPI-slave – Also featured 5-port router, eMMC, PCIe support Chipset information MT7688AN MEDIATEK MT7688AN
- 23. 23 Specification – MT7688 – 128MBDDR2 – 32MB Flash – Chip Antenna (default) – IPEX Ext Antenna – microSD – USB Host – JTAG
- 24.
- 25.
- 26.
- 27.
- 28. 步驟 •uci set network.lan.ipaddr=xxx •拷貝光劍音效 •Madplay –S •關閉dhcp •關閉wireless •opkg install /root/openssh-sftp-server_6.8p1- 1_ramips_24kec.ipk
- 29. 透過MRAA來控制GPIO import mraa print (mraa.getVersion()) x=mraa.Gpio(13) x.dir(mraa.DIR_OUT) x.write(1)
- 30. • 剛剛的D1~D6 分別接到GPIO14-19
- 32. 製作過程已經放上Hackday.io • Lightsaber Standfor Hackers - Making a Star Wars themed lightsaber scoreboard for 2015 HITCON CTF
- 33.
- 34. MEDIATEK LINKIT 7688 FIRMWARE原廠解除封印AP MODE+STATION MODE 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座
- 35.
- 36. Linkit 7688 AP+ Station =Repeater mode 連上AP 當AP 上internet
- 37.
- 38. 7688 + OPENWRT+ SNORT 打造駭客入侵偵測器 絕地武士心靈控制家用雲端智慧型物聯網光劍搭載無線路由器光劍底座
- 39. Snort • Snort isa multi-mode packet analysis tool – Sniffer – Packet Logger – Forensic Data Analysis tool – Network Intrusion Detection System
- 40. Snort on 7688openwrt • #opkg update • #opkg install snort • 設定local.rules – alert icmp any any -> any any (msg:"ICMP test"; sid:10000001; rev:001;) • #snort -i apcli0 -c /etc/snort/snort.conf -c local.rules --daq-dir /usr/lib/daq -l ./
- 41.
- 42. 7688 + OpenWRT+ Snort 打造駭客入侵偵測器 DEMO
- 43. • A#snort -iapcli0 -c /etc/snort/snort.conf -c local.rules --daq-dir /usr/lib/daq -l ./ • B# ./alert.py • C# ping www.hinet.net -c 1
- 44.
- 45. 45 A cloud baseddata service platform for Internet of Things devices. MediaTek Cloud Sandbox (MCS)
- 46. MCS – Creatingan end-to-end development support for makers 46 Push data points into clouds Retrieve data generated from device Send notification for specific event Remote switching and control
- 47. 47 Maker Maker to Maker Makerto Market Quickly prototype MCS – Creating an end-to-end development support for makers Share device Device management Test devicePrototype Test devicePrototype Prototype Beta release device MCS Service
- 48. 48 Development Progress Device managementTestdevicePrototype • Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support Multi Language Forum System MonitorAPI Document Tutorial
- 49. MCS Service Architecture CommonServices Trigger & action Remote Control Data Storage Data Visualization Beta Release Device Registration Device Status & Usage Report Prototyping Firmware Update HTTP / HTTPS Restful API TCP Socket Protocol MCS Console MCS App Developing Tool Support API reference API hint Tutorial FAQ Forum Data Channel Design Test Device Management User Privilege Integration Service Oauth
- 50. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support
- 51. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support Visualization Data Channels
- 52. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support
- 53. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support
- 54. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support
- 55. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support
- 56. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support
- 57. Device managementTest devicePrototype •Data Channel • Trigger & Action • User Privileges • API Hint • Data Visualization • Remote Control • Notification • FOTA • Device Activation Support (Preview)
- 58. 58 Support Multi Language Forum System MonitorAPIDocument Tutorial 简中 繁中 En Multi Language support
- 59. MCS 目前可由IFTTT makerchannel來控制了
- 60.
- 62.
- 63.
- 64.
- 65. • 智慧型手機 • 燈泡 •IP camera • 車子 • 路由器 • 工業SCADA ….
- 66. 克萊斯勒的Uconnect的車載資訊娛樂系統（In-Vehicle Infotainment, IVI），提供娛樂、手機、導航、語音命令與控制功能，還有一 Uconnect AccessVia Mobile服務允許駕駛利用手機的數據服務存取 支援Uconnect的行動程式。
- 67. 不過，Marc Rogers和Kevin Mahaffey找到TeslaS的漏洞並證實可以入侵後，Tesla則發揮電動車 的優勢，他們不需要像其他傳統車廠，例如克萊斯勒一樣，必須召回受駭車輛回廠維修，而這也 是發現Tesla漏洞的資安專家認為，電動車不同於其他款汽車最大的優勢。 他們認為，當Tesla在發現電動車上的軟體、系統有任何漏洞後，都可以在完成漏洞程式撰寫後， 直接透過Over The Air（OTA）的方式，更新電動車的軟體，大幅提高電動車更新軟體 的速度與安全性。
- 69.
- 71. FILESYSTEM • -e option自動提fs • git clone https://github.com/mirror/firmware-mod-kit • 編譯squashfs-2.1-r2: make -C src/squashfs-2.1-r2 • 使用unsquashfs_all.sh腳本解壓縮得到rootfs
- 72.
- 74. MASS SURVEILLANCE Remote accessto sensor data
- 80.
- 81.
- 82.
- 83.
- 84.
- 85. 駭客掃描的好工具 - NMAP •nmap -iL hostlist.txt • Nmap –O : fingerprint OS • Nmap –sV : 各服務版本 • Nmap –p T:80 指定TCP連接埠, -p U:53(UDP 53)
- 86. https://github.com/jgamblin/Mirai-Source- Code/blob/master/mirai/bot/scanner.c MIRAI原始碼 The countries withthe highest number of vulnerable devices are Vietnam (80,000), Brazil (62,000), Turkey (40,000), Taiwan (29,000), China (22,000), South Korea (21,000), Thailand (16,000), India (15,000) and the United Kingdom (14,000).
- 87. THE OWASP INTERNETOF THINGS (IOT) TOP 10 I1: 不安全的網頁介面(Insecure Web Interface) I2: 不充分的認證與授權(Insufficient Authentication/Authorization) I3. 不安全的網路服務(Insecure Network Services) I4. 欠缺傳輸時的加密保護(Lack of Transport Encryption) I5. 隱私威脅(Privacy Concerns) I6. 不安全的雲端介面(Insecure Cloud Interface) I7. 不安全的行動介面(Insecure Mobile Interface) I8. 不充分的安全設定(Insufficient Security Configurability) I9. 不安全的軟體與韌體(Insecure Software/Firmware) I10. 實體安全考量不足(Poor Physical Security)
- 88.
- 89. MQTT Message Queue TelemetryTransport • 基於Publish-subscribe 進行資料傳遞 • 透過Broker • 支援推播(Push) • 可一對多(one-to-many) • 資料傳輸小、類似REST架構 • 預設通訊埠 1883/8883(TLS) Publisher可以是sensor或是推播程式，訂閱者可 以是個伺服器上的應用服務也可以是個手機
- 90. Topics 類似rest case-sensitive Single Level:+ Multi Level: #
- 91. Broker Retained Message &Offline Message The MCS MQTT Broker also supports Retained message and Offline message as the MQTT standard defined. Retained message: This message will be sent everytime a client is subscribe to the topic. For example, a welcome message. Offline message: This message will be keep in the broker if the client is offline, and sent to the client when it goes online.
- 92.
Editor's Notes
- #21 並聯
- #23 http://www.aboway.com.tw/uploadfile/AB-R7688MA1.pdf 聯發科最新的系統單晶片MT7688AN ，支援802.11n Wifi標準，無線傳輸速率最高可 達150Mbps。MT7688AN內置一個580MHz MIPS 24KEc CPU，支持DDR2，支援1-port 10/ 100M乙太網,USB2.0 host ,I2C,SD-XC ,I2S/PCM, UART, 多個GPIO。
- #47 How to make this more interactive? Real life usecases
- #50 Update Angie’s latest service component
- #51 How to make this more interactive? Real life usecases
- #52 How to make this more interactive? Real life usecases
- #53 How to make this more interactive? Real life usecases
- #54 How to make this more interactive? Real life usecases
- #55 How to make this more interactive? Real life usecases
- #56 How to make this more interactive? Real life usecases
- #57 How to make this more interactive? Real life usecases
- #58 How to make this more interactive? Real life usecases
- #80 108.178.242.2:8080 140.115.31.220 沒設密碼 有問題的camera: 220.136.114.155 user: admin password: 123456 220.130.214.159 user:admin password:admin
- #86 https://blog.gtwang.org/linux/nmap-command-examples-tutorials/
- #87 http://www.securityweek.com/over-500000-iot-devices-vulnerable-mirai-botnet
- #91 http://www.hivemq.com/blog/mqtt-essentials-part-5-mqtt-topics-best-practices