Analysing Vulnerabilities and Risks in IoT Devices

April 22, 2020 21-minute read

Introduction Link to heading

Nowadays, the Internet has become a favourable environment for committing crimes that occur not only in cyberspace but have consequences for the real life of both an individual and entire states. The same applies to the Internet of Things, which is nothing but one of the stages of the development of the World Wide Web. IoT becomes a combination of physical and digital reality, the transformation of the Internet into a “network of networks”, which includes all the objects of the surrounding world - not only familiar devices, but also objects that seem to be not created for the role of “nodes”: coffee makers and refrigerators, traffic lights and outdoor video cameras, water meters and plumbing devices, medical and industrial equipment. Security issues have pursued the Internet of Things since its inception. Everyone, from suppliers to corporate users and consumers, is concerned that their trendy new devices and IoT systems may be compromised. The problem is actually even worse because vulnerable IoT devices can be hacked and used on giant botnets that threaten even properly protected networks. This paper will examine the smart light bulb by Xiaomi and will try to find existing vulnerabilities in it. It will explain the steps that were used for penetration testing of the smart light bulb. Moreover, it will examine data gathered via JTAG and/or chip-off method.

Deceptive simplicity Link to heading

It is no secret that in the field of Internet of Things the information security is not considered as a first priority. Moreover, various organizations are trying to become innovators in this particular area, at least for an hour. As a result, a number of specialists in the field of information security note that IoT carries in itself quite serious security threats, because, typically, the human is not involved in the interaction between such systems. On the one hand, “Smart Home” is a very convenient way to organise your living space; on the other hand, different sensors and even life support systems, being in the hands of an intruder, significantly increase the risks of information security. Mauro Junior, D., et al. (2019) showed that not only IoT devices are vulnerable, but also the applications that are used to control such devices via mobile phones or tablets. Their paper focuses on different “companion” applications for currently most popular IoT devices. They showed that often the communication between the device and application is not secured and/or encrypted. In November 2018 ENISA (The European Union Agency for Network and Information Security) issued a document “Good Practices for Security of Internet of Things in the context of Smart Manufacturing”, which collected all sorts of practices for cybersecurity for Industrial Internet of Things (IIoT), and analyzed about a hundred documents with best practices in this area (Good practices for security of Internet of things in the context of smart manufacturing, 2018). The document focuses on IIoT, takes into account the industrial architecture and related assets, threats and scenarios of possible attacks. In August 2014, David Jacoby tried to hack his own house and he managed to do it (Jacoby, 2014). The results were disastrous: he has obtained full control over the systems, as well as he managed to place backdoors on the devices, so that they can be transformed into zombies in a botnet; moreover, he managed to get access to all of his files. For business and the state, the challenges associated with the security of the Internet of Things have been around for quite some time and the fight against them on these fronts has been going on for years. The National Security of Things Forum on the security of the Internet of Things has been held in Cambridge for several years now (SECoT, 2018). Moreover, the protection of hospital patients’ personal data, which can be accessed through wearable devices, and the security holes of medical institutions, including those available through the IoT, is a problem that has been struggling since the early 2010s (Abie & Balasingham, 2012). The Internet of Things allows different devices to communicate on the Internet. This, in turn, brings different possibilities to obtain personal data from those devices. Zhang, Z.-K., et al. (2014) explain what the current vulnerabilities of IoT are and also, they try to predict what security issues will be encountered by IoT devices in the future.

Carelessness Link to heading

The ease of operation of IoT leads to the fact that people perceive these devices as ordinary household appliances, do not go deep into the study of instructions, and do not think about changing the default settings (Hanes, Salgueiro, Grossetete, Barton, & Henry, 2017). For instance, Kaspersky Lab in 2015 showed that an attacker could use multiple popular smart devices for different means. For instance, Google Chromecast can stream something from the attacker’s device even if the attacker not in a range of Wi-Fi network (however, directional antennae needed) (Alyushin & Krylov, 2015). Even despite the fact, that IoT has been introduced more than 10 years ago, there are still trivial vulnerabilities exist. In October 2018, LimitedResults examined smart bulb and managed to dump its firmware using JTAG, as a result, there were WiFi credentials and even geo-location stored in plain-text inside the firmware (LimitedResults, 2018). Each object connected to a network has an IP address and is connected by one or another port according to a certain data transfer protocol. Today, there are many tools for finding and accessing unprotected ports. The most extensive features are provided by the search engine Shodan or, as it is often called an “evil Google” (Pham & Dang, 2018). Designed by John Matherly and named after the artificial intelligence from the first part of the System Shock game, Shodan can not only detect random public IP addresses and find vulnerable webcams, but also filter them by port number, country and city, operating system and even the domain name in which the search is performed (Matherly, 2015). Recently, a search engine allows access not only to open ports, but also to secure ones (Simon, Moucha, & Keller, 2017). Therefore, you can break into cameras, printers, routers and many other devices. It was through Shodan that hackers managed to detect vulnerabilities in connections to control the access to the reactor of a nuclear station and one of the atomic particle accelerators used by scientists (Baylon, Brunt, & Livingstone, 2015).

DDoS and IoT devices Link to heading

IoT vulnerabilities not limited to information gathering, multiple devices can be used to perform DDoS attacks. In September 2016, Brian Krebs’s blog experienced a massive hacker attack (665 Gbps). This is the largest DDoS attack in the history of the Internet of Things by intruders who have joined hundreds of thousands of devices into a botnet (“KrebsOnSecurity Hit With Recrod DDoS,” 2016). Various smart devices use CoAP for interaction and this protocol is perfect for DDoS because it uses the UDP protocol without establishing a connection and involves sending a data packet in response to a request (Bormann, Castellani, & Shelby, 2012). According to Trend Micro’s research conducted by Maggi, F., Vosseler, R., & Quarta, D. (2018), using the possibility of block transfer as provided by the CoAP protocol, it is possible to form such a request that the device response will be 32 times more than the request. Thus, to organize an attack with a capacity of 32 Mbit/s, it is enough for an attacker to have a channel with a capacity of 1 Mbit/s. In 2017, Marek Majkowski showed that SDDP protocol can be used to generate a huge DDoS attack (2017). It turned out that many devices had a flow in the UPnP software and it allowed an attacker to redirect traffic to the destination they wanted.

Methodology Link to heading

Traffic sniffing via Wireshark Link to heading

The first step was to set up the smart light bulb by Xiaomi and to check what protocols and what kind of data is sending back and forth for this particular device using Wireshark. The initial setup was made and the light bulb was connected to the LAN network. Communication with the light bulb can be done in couple different ways. First, the easiest one is to install the vendor’s application on a smartphone that allows controlling the light bulb and its settings. Second, the smart device can be controlled using python3 and yeelight library, which was found on GitHub (Korokithakis, 2019). In order to discover how many light bulbs exist in LAN we can type the following python command:

1from yeelight import discover_bulbs
2discover_bulbs()

The output of this command was all the settings of currently available light bulbs within the network JSON formatted.

Figure 1. Output of discover_bulbs() command.

Now, it is obvious that we can control our light bulb using its IP address and different commands from python library. Next step was to capture traffic using Wireshark. As expected, the data between the device and the light bulb was sent via UDP/TCP protocols and it was in plain text, using the same JSON structure. For instance, when I sent the request to turn on the light bulb, I received the following response from the bulb’s IP address:

Figure 2. The response from the light bulb.

However, it is only useful if you already inside the same network with the light bulb. Therefore, it is not really a vulnerability in this case. Next, I decided to check the traffic between the smartphone application and a light bulb. The result was not so colourful. It turned out that the light bulb communicates via SSDP multicast protocol.

Figure 3. Smartphone app communication with the device.

In other words, it sends the packet to the multicast address with port number 1982 and tries to discover the device named “wifi_bulb”.

Figure 4. The details of the packet between the application and smart device.

However, as I already mentioned there is a possibility to perform DDoS attack using SSDP protocol (Majkowski, 2017) and it allows amplification as well.

JTAG Link to heading

Picture from the game “The incredible machine”. How to turn on the light bulb?

Since I could not found anything useful during the traffic analysis phase, I moved to a physical examination of the light bulb. Firstly, I had to disassemble the light bulb. After I removed the plastic cup, which was a relatively easy procedure, I noticed that the Wi-Fi module is there and there were some test points as well.

Figure 5. Test points (looks like JTAG) and Marvell chip (Wi-Fi module).

Then I decided to solder some wires and try to perform JTAG on the Marvell chip.

Figure 6. Wires have been soldered to test points.

I noticed that Xiaomi used Marvell 88MW300 chip model and according to their datasheet, there are pinouts for JTAG. I used two different readers because I accidentally “fried” one of them.

Software	Hardware
OpenOCD v0.10.0	Altera USB Blaster I
Kali Linux 4.17.0-kali3-amd64	JTAGULATOR
macOS Mojave 10.14.5	Buspirate v3.6
screen version 4.06.02

I decided to use OpenOCD software combined with configuration file for Marvell MW3xx chip to perform JTAG readings from the light bulb. I found the configuration file on DewMobility-GitHub and modified it a little bit to work with my Altera USB blaster, the full code of configuration file:

 1# Copyright (C) 2008-2014, Marvell International Ltd.
 2# All Rights Reserved.
 3#
 4
 5# OpenOCD config script for mc200 and mw300
 6
 7if { [info exists CHIPNAME] } {
 8   set  _CHIPNAME $CHIPNAME
 9} else {
10   set  _CHIPNAME wmcore
11}
12
13if { [info exists ENDIAN] } {
14   set  _ENDIAN $ENDIAN
15} else {
16   set  _ENDIAN little
17}
18
19# Work-area is a space in RAM used for flash programming
20# By default use 16kB
21if { [info exists WORKAREASIZE] } {
22   set  _WORKAREASIZE $WORKAREASIZE
23} else {
24   set  _WORKAREASIZE 0x4000
25}
26
27# JTAG speed should be <= F_CPU/6. F_CPU after reset is 32MHz,
28# and it has been found not to work reliably at 5MHz,
29# so use F_JTAG = 3MHz
30adapter_khz 3000
31
32adapter_nsrst_delay 100
33jtag_ntrst_delay 100
34
35#jtag scan chain
36if { [info exists CPUTAPID ] } {
37   set _CPUTAPID $CPUTAPID
38} else {
39   set _CPUTAPID 0x4ba00477
40}
41
42if {[using_jtag]} {
43   jtag newtap $_CHIPNAME cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id $_CPUTAPID
44}
45
46set _TARGETNAME $_CHIPNAME.cpu
47target create $_TARGETNAME cortex_m -endian $_ENDIAN -chain-position $_TARGETNAME
48
49$_TARGETNAME configure -work-area-phys 0x2001C000 -work-area-size $_WORKAREASIZE -work-area-backup 0
50if { [info exists CONFIG_FLASH] } {
51   flash bank wm0.flash mrvlqspi 0x0 0 0 0 $_TARGETNAME 0x46010000
52   flash bank wm1.flash mrvlqspi 0x400000 0 0 0 $_TARGETNAME 0x46090000
53}
54
55gdb_report_data_abort enable
56
57$_TARGETNAME configure -event gdb-attach {
58    echo "WE are here."
59    $_TARGETNAME configure -rtos auto
60}
61
62# if srst is not fitted use SYSRESETREQ to
63# perform a soft reset
64cortex_m reset_config sysresetreq

Screen software was used to connect to hardware devices such as buspirate or JTAGULATOR. I will explain what JTAGULATOR is and how I used it later in the report. Then, I connected test points to USB blaster and tried different combinations to identify JTAG probes. However, because it was my first experience with microelectronics, I did not realise that I had to supply power to the light bulb.

Figure 7. The output from OpenOCD when no power supply to target.

After that, I decided to turn on the light bulb and try again and it was another mistake because of lack of knowledge. After I supplied power to the light bulb and turned it on, my USB blaster exploded because of a short circuit somewhere in the light bulb’s PCB and partially because the power was higher than needed, since I supplied 220V.

Figure 8. Blown chip in USB blaster after I supplied 220V to the target device.

It is obvious that the chip responsible for voltage regulation is blown up.

Because of this failure, performing JTAG without breaking the whole light bulb apart was not an option and I had no choice but to break the bulb and extract the Mi module itself. Therefore, I used a saw and different other tools to extract module.

Figure 9. Extracted Mi module.

I noticed that there were some pins on the module itself and thought that there should be pins for power supply. Using multimeter I determined the ground pin and VCC.

Figure 10. GND and VCC pins on Mi module detected.

I connected a 3.7V battery as a power supply to GND and VCC pins and tried to use Buspirate to read JTAG output via OpenOCD. Configuration file for buspirate:

1interface buspirate
2
3buspirate_vreg 0
4buspirate_mode open-drain
5buspirate_pullup 1
6
7buspirate_port /dev/tty.USB0

Figure 11. Initial setup with buspirate and 3.7V power supply.

Unfortunately, because I had six unknown wires on target’s test points, I had to try 480 different combinations of wires in order to determine which test pin represents which JTAG pin. In other words, I did not know which test pin/wire on the target module is TCK, TMS, TDI or TDO. I tried about 120 possible combinations; however, output was always the same

Figure 12. OpenOCD output errors.

Therefore, there were two possible explanations of such output: either I connected the wrong wires to JTAG probes or the module itself has been broken because of that short circuit earlier. I decided to check all other possible combinations using JTAGULATOR. JTAGULATOR is an open source hardware tool that can help to identify connections from test points on a target device. Images below show the JTAGULATOR in progress and its output.

Unfortunately, JTAGULATOR could not found anything and it meant that the module itself was broken, probably because of the short circuit I made during the first tries to read the chip’s data via JTAG.

Chip-off technique Link to heading

While I was trying different combinations of wires to do JTAG, I noticed that there was a small SPI chip on the module itself (figure 14) and decided to try the chip-off technique to read data directly from the chip.

Figure 14. Location of SPI chip on the Mi module.

Sofware and hardware I used to read the data from the chip:

Hardware	Software
Buspirate	macOS Mojave version 10.14.5
Pomona SOIC-CLIP	Flashrom v1.0

I connected the clip to the chip and wires from the buspirate to the respective clip’s pins. Figure 15 shows the initial setup for SPI flash reading.

Figure 15. SPI reading setup.

Next step was to dump the memory from the chip using flashrom and buspirate. The SPI chip model was GigaDevice GD25Q16C. According to their datasheet, I connected the wires from my buspirate to the clip. Then, I used flashrom software to dump the memory from the chip with the following command:

1flashrom -p buspirate_spi:dev=/dev/tty.usbserial-A506PZ82 -r rom.bin

The output was successful and the software determined the chip correctly and started to read the data, as in figure 16.

Figure 16. The successful output from flashrom software.

Now, I used strings to check if there were any readable data inside the bin file. Using the command:

1strings rom.bin | less

I did not expect such a result because there were many strings in plain text including my Wi-Fi credentials.

Figure 17. Wi-Fi credentials stored in plain text inside the SPI flash chip.

Finally, one of the methods succeed and I was able to gather some information about the device and its SPI memory contains. Apparently, it was more than enough to consider such devices insecure.

Discussion Link to heading

According to LimitedResults, Xiaomi’s smart light bulbs have multiple vulnerabilities. As mentioned in this report, they still exist and they are very severe. At first sight, people may say “so what? It is just a light bulb and you need physical access to it in order to obtain Wi-Fi credentials”. Yes, indeed; however, to unscrew the light bulb from its socket would take about 30 seconds and reading the data from the chip would take another one hour. Then, an attacker would have access to the LAN of an organisation or an individual’s home. Another possible scenario may be dumpster diving. For instance, people typically get rid of broken light bulbs without erasing their SPI memory. Hence, an attacker can search for used light bulbs in rubbish bins near the organisation or individual’s home and perform the same techniques I mentioned above to obtain Wi-Fi credentials. It is especially scary, because all the data stored on SPI chip is in plain text, with no encryption at all. One more possible attack vector may be firmware patching via JTAG. During my experiment, because of the lack of knowledge, I could not make any use of JTAG. However, the person with the right mindset and broader knowledge in microelectronics (so he does not blow up the chip) could possibly modify the firmware and even load some virus/worm in it. Moreover, it can be modified in such a way that it can be sold and used by other people. Indeed, the plastic cover on the bulb is very easy to remove and the procedure leaves no visible damage. Therefore, an attacker can patch the firmware via JTAG means and then put the bulb’s cover back and sell the device on the marketplace (e.g. eBay, GumTree).

Vendors’ reaction Link to heading

I could not find any information on Xiaomi’s website about these vulnerabilities. However, I found some blog articles describing these vulnerabilities. Therefore, I can conclude that the company have not done anything to fix these issues and patch the vulnerabilities. Moreover, their website state that the light bulb “increases your sense of security” (“Yeelight LED Light Bulb (Color),” 2019), but there is no description about what security they use and how exactly it helps to prevent attacks. Unfortunately, this is not just Xiaomi’s problem. The majority of companies do not want to disclose the information if they have been hacked. There may be multiple reasons for that, and in my opinion, the main reason is that they do not want to lose reputation and to lose customers. There some exceptions, for example, a vendor called LIFX, had a blog post on the website about existing vulnerabilities in their light bulbs. Now they created a separate page on their website called “Privacy and Security” (2019) where they disclose all existing breaches and vulnerabilities within their devices. Moreover, this page allows researchers to submit their findings (i.e. bounty hunting) and any other new security breaches for LIFX devices. Another vendor Philips also has a web page dedicated to security concerns of their smart devices including Hue light bulbs. Philips warns its customers about existing vulnerabilities and advises them to update application and firmware regularly (Philips, 2019).

People’s awareness Link to heading

Unfortunately, today the situation is that customers are not aware of any vulnerabilities in the smart IoT devices, because there is no information about them on vendors’ official websites and even the sales persons do not know about any vulnerabilities because they do not think it may be a problem. Firstly, I decided to make a survey by asking sale persons in different stores about their awareness of any vulnerabilities in IoT devices they are selling. However, after I asked two people in Bunnings and JB Hi-Fi stores and received the negative result (they did not know about anything), I decided to stop this survey (apparently, I have not even started it), because it was obvious that results would be all the same.

Improving IoT devices security and minimising risks Link to heading

When buying an IoT device, consumers need to think about safety as well as convenience and price. Consumers should consider the following advice when buying a new smart IoT device:

Check the device manufacturer, because not all companies that produce IoT devices care about security. Most of them are start-ups, trying to bring their developments to the market as soon as possible. As a result, they often do not pay enough attention to the protection of the product.
Try to find out about existing vulnerabilities in other devices of the same vendor. Usually, if one device has a vulnerability, probably others with similar functions will also have the same vulnerabilities.
Evaluate the vendor’s response to vulnerabilities in the past. The manufacturer that quickly releases updates for their devices’ firmware, and eliminates discovered vulnerabilities will most likely create protected devices in the future.
All passwords set on any devices by default should be changed, and if the standard password on any device cannot be changed, then it is better not to use it at all. The privileges assigned to devices must be minimal and just sufficient for their operation.
For IoT devices, if possible, you need to create a separate network protected by a firewall.
Do not use functions that you do not need. For example, if the device is used just for turning the light on and off, you can completely turn off its microphone.

Conclusion Link to heading

The total number of IoT devices is growing rapidly. It is difficult to predict what else will be connected to the uncontrolled world of the Internet of things. The growing number of smart devices increases the number of possible attacks. Many of these gadgets are actually miniature computers connected to the Internet or other networks, equipped with their own operating system. The more we surround ourselves with the Internet of Things devices, the more cybercriminals have to make them as their primary target. We all can imagine how you can abuse individual “smart” devices and what problems may arise if manufacturers do not begin to pay attention to the protection of their products. The experiment showed that there are existing vulnerabilities in the Xiaomi smart light bulb devices and they are very crucial. They allow an attacker to get access to the internal LAN and to perform further reconnaissance. Despite Xiaomi has been warned about these vulnerabilities, they did not fix them and did not even disclose flaws in their devices to the public. I believe if every company have disclosed their breaches and what techniques attackers have used, it would help to build a more secure environment we are working with, especially in terms of IoT. In addition, customers should be informed about any existing and possible vulnerabilities in IoT devices.

References Link to heading

Click here to view references...

Abie, H., & Balasingham, I. (2012). Risk-based adaptive security for smart IoT in eHealth. Paper presented at the Proceedings of the 7th International Conference on Body Area Networks.
Alyushin, V., & Krylov, V. (2015). Surviving in an IoT-enabled world. Retrieved from https://securelist.com/surviving-in-an-iot-enabled-world/72595/
Baylon, C., Brunt, R., & Livingstone, D. (2015). Cyber security at civil nuclear facilities: Understanding the risks: Chatham House.
Bormann, C., Castellani, A. P., & Shelby, Z. J. I. I. C. (2012). Coap: An application protocol for billions of tiny internet nodes. (2), 62-67.
Good practices for security of Internet of things in the context of smart manufacturing. (2018). Publication. European Union Agency for Network and Information Security. Retrieved from http://doi.org/10.2824/851384
Hanes, D., Salgueiro, G., Grossetete, P., Barton, R., & Henry, J. (2017). IoT fundamentals : networking technologies, protocols, and use cases for the Internet of things. Indianapolis, Indiana, USA: Cisco Press.
Jacoby, D. (2014). Last-minute paper: How I hacked my own house! Retrieved from https://www.virusbulletin.com/conference/vb2014/abstracts/how-i-hacked-my-own-house
Korokithakis, S. (2019). python-yeelight. Retrieved from https://gitlab.com/stavros/python-yeelight
KrebsOnSecurity Hit With Recrod DDoS. (2016). In Krebs on Security (Vol. 2019). Krebs on Security: Krebs on Security.
LIFX. (2019). Privacy and Security: Responsible Disclosure of Security Vulnerabilities. Retrieved from https://www.lifx.com/pages/privacy-security
Maggi, F., Vosseler, R., & Quarta, D. (2018). The Fragility of Industrial IoT’s Data Backbone. Security and Privacy Issues in MQTT and CoAP Protocols. Retrieved from Trend Micro Research: https://documents.trendmicro.com/assets/white_papers/wp-the-fragility-of-industrial-IoTs-data-backbone.pdf?v1
Majkowski, M. (2017). Stupidly Simple DDoS Protocol (SSDP) generates 100 Gbps DDoS. Retrieved from https://blog.cloudflare.com/ssdp-100gbps/
Matherly, J. (2015). Complete Guide to Shodan. Shodan, LLC (2016-02-25).
Mauro Junior, D., Melo, L., Lu, H., d'Amorim, M., & Prakash, A. (2019). Beware of the App! On the Vulnerability Surface of Smart Devices through their Companion Apps. arXiv e-prints. Retrieved from https://ui.adsabs.harvard.edu/\#abs/2019arXiv190110062M
Pham, V., & Dang, T. (2018). CVExplorer: Multidimensional Visualization for Common Vulnerabilities and Exposures. Paper presented at the 2018 IEEE International Conference on Big Data (Big Data).
Philips. (2019). Security Advisory. Retrieved from https://www2.meethue.com/en-us/support/security-advisory
SECoT. (2018). About Us. Retrieved from https://securityofthings.com/about/
Simon, K., Moucha, C., & Keller, J. (2017). Contactless Vulnerability Analysis using Google and Shodan. J. UCS, 23(4), 404-430.
Yeelight LED Light Bulb (Color). (2019). Retrieved from https://www.mi.com/us/yeelight-led-light-bulb/#overall
Zhang, Z.-K., Cho, M. C. Y., Wang, C.-W., Hsu, C.-W., Chen, C.-K., & Shieh, S. (2014). IoT security: ongoing challenges and research opportunities. Paper presented at the 2014 IEEE 7th international conference on service-oriented computing and applications.