parcomagic: security analysis of public terminals
DESCRIPTION
A video game called Watch Dogs offers a realistic view on our near future – our surroundings filled to the brim with digital devices, machines which accept and dispense cash, and a variety of other connected things ridden with all sorts of vulnerabilities, which a hacker can exploit. In the game, the main character successfully compromises a video surveillance system using a smartphone, gaining the ability to conduct surveillance and obtain additional information. The game’s fans are divided: some say this is too ‘dystopian’ – taking a smartphone and hacking into everything around you. Others are somewhat skeptical, saying that things really aren’t that great and the game world is in many ways a reflection of real life. Below, we argue that devices in parks and other public spaces, which we often pass without giving them a second thought, may be vulnerable and therefore dangerous, at least for our personal finances. ZeroNights 2014 is an international conference dedicated to the practical side of information security.TRANSCRIPT
PARCOMAGICSecurity analysis of public terminals
Denis Makrushin (@difezza), Kaspersky Lab
Stanislav Merzlyakov, Positive Technologies
WATCH OUT! WATCHDOGS.
2
Common usage terminals
Life is a good teacher
Methodic of Penetration testing
Virtual keyboard
Moving in Control panel
Arbitrary code execution
Windows Help or Desktop
Input Data fuzzing
Tap-fuzzing
Escape from the application
Fullscreen application
Calling the additional elements of the
system’s interface
Calling the undocumented features of
the application
View from the developer
Street magic: escape from the app
Street magic: virtual keyboard
Who am I?
Another kind of PoC
Catch me!
Post-exploitation
• Located in public places
• 24/7 available
• Same configuration
• The higher degree of
confidence from the user
• Connected to each other and to
private network
• Advertising
• Social engineering/phishing
• Botnet use cases
• Dump of app for offline
reversing
• Internal network attack
• …
Take a look around
Firewall
Terminal’s
server
Main office
