Smart doorbell atau bel pintar telah menjadi populer dalam sistem keamanan rumah pintar. Namun, banyak dari perangkat ini masih menggunakan protokol yang tidak aman untuk berkomunikasi, protokol yang rentan terhadap serangan keamanan seperti jamming, sniffing dan replay attack. Penelitian ini bertujuan untuk menganalisis kelemahan penggunaan protokol komunikasi pada smart doorbell, serta menginvestigasi potensi pemanfaatan Software Defined Radio (SDR) dan modul arduino dalam mengamati komunikasi gelombang elektronik pada frekuensi 433 MHz. Selain itu penelitian ini ditujukan untuk mengidentifikasi potensi risiko yang dihadapi oleh pengguna pengkat IoT, serta memberikan pandangan tentang perlindungan yang lebih baik.

1. IOT hacking series
Hacking
Smart Doorbell
@smrx86

2. WHoami
WHoami
Father of one son
Independent security
researcher.
My day job is doing trick to
impress client.
Speaker @Idsecconf 2013,
2014, 2015, 2019,
2020.2022,2023

3. Agenda
Defining Iot security
device
Agenda
The targets Analysis Exploitation

4. Defining IoT
security devices
~ Wikipedia: IoT security Devices
“are electronic tools connected via Internet to a common network and are used to provide security
measures. These devices can be controlled remotely through a mobile application, web-based interface
or any proprietary installed software, and they often have capabilities such as remote video monitoring,
intrusion detection, automatic alerts, and smart automation features. IoT security devices form an
integral part of the smart ecosystem, which is characterized by the interconnectivity of various
appliances and devices through the Internet”

5. Beckend API Server
33%
IoT
Architecture
Gateway/edge router
33%
Smart devices
33%

6. DOORBELL
Doorbell

7. Cheap smartdoorbell that sell as ODM product of
taffhome.
The Targets
The Targets

8. The Targets
The Targets

9. The Targets
The Targets
1. 801.11 b/g/n compliant, Support CMOS sensor 8-bit DVP
2. MCU up to 180 MHz
3. Integrate CODEC+Bluetooth® Low Energy 4.2
4. Integrate 512K RAM ， 4M SPI flash
5. Support Jtag, USB, SPI, I2C, UART, SDIO interface etc
6. Integrate charge control circuit. Operation voltage from 3.0 V to 4.2 V
7. Six 32-bit timers and six 32-bit PWM

10. ASK & OOK
op
en
ASK & OOK signal

11. Hacking 433 Mhz signal

12. Sniff BLE, sniff wifi, capturing 433 mhz signal data
Dynamic Analysis
Analysis

13. Initiation:BLE sniff Using Bluetooth HCI snoop log. We can find the
app sending ’{”s”:[SSID],”p”:[PASS],”u”:[Userid]}’
to handle 0x12

14. Post initiation

15. WIFI sniff
Create fake wifi, dump and analyze the
connection protocol

16. WIFI sniff
Create fake wifi, dump and analyze the
connection protocol

17. Sniff 433 Mhz signal
Capture signal with universal radio hacker

18. Sniff 433 Mhz signal
Capture signal with nodemcu + 433 Mhz
module (receiver)
03

19. Exploitation
Exploitation
01
02
04
06

20. Exploitation
Exploitation

21. Exploitation
Exploitation

22. Exploitation
Exploitation

23. Exploitation
Exploitation

24. Solutions
Solutions
. Choose for IoT product with Vulnerable Disclosure Program.
https://iotsecurityfoundation.org/wp-content/uploads/2023/01/IoTSF-Release-The-
State-of-Vulnerability-Disclosure-Usage-in-Global-Consumer-IoT-in-2022.pdf

25. FIN