Chaos Communications Congress is the world’s oldest hacker conference, and Europe’s largest. Every year, thousands of hackers gather in Hamburg to share stories, trade tips and discuss the political, social and cultural ramifications of technology.
As computer security is a big part of the hacker world, they also like to break things. Here are five of the most important, interesting, and impressive things broken this time.
Intercoms
The internet of things has been a security disaster since the days it was no more than a glint in a marketing manager’s eye. It turns out cheap hardware that can’t be easily updated but is permanently connected to the internet is a nightmare for users and a goldmine for hackers.
So if your house is accessed through an internet-of-things intercom, you might want to ensure you have an old fashioned back-up lock to keep things shut while you’re away.
Sebastien Dudek, a researcher at French firm Synacktiv, revealed his research on hacking smart intercoms, which replace the conventional built-in phone with a connection to the phone network. When a visitor arrives, the intercom makes a call, either to a landline or a mobile, and the resident can simply hit a key on their phonepad to let their visitor in.
Of course, that only works if the intercom actually calls your phone. If it can be intercepted to call another random phone, then the door’s open to allcomers.
For the simplest type of intercom, which uses a mobile phone SIM card to simply dial the target phone number directly, Dudek was able to use a piece of commodity hardware to spoof the mobile base tower and intercept the call directly.
Some more complicated intercoms instead call a preset command station, which then routes the call through to the final number. That could be more secure, but in practice, Dudek says it just introduces new avenues of attack.
For one thing, the central server allowed Dudek to compromise multiple intercoms at once. From there, he proposed a number of potential exploits: an attacker could change all the intercoms to premium rate numbers, for instance, raking in the cash whenever anyone has a visitor; or they could use a reverse look-up service to track down where each intercom is connected and organise a mass break-in.
Boarding Cards
The international travel booking network is one of the wonders of the world. Dating back to 1960, it was one of the first truly global networks to ever be created, and it is still responsible today for letting you book a flight from anywhere in the world to anywhere in the world, no matter where in the world you happen to be at the time.
Unfortunately, computer security has come on a bit since 1960, but the security on the Global Distribution Systems … hasn’t.
Researchers Karsten Nohl and Nemanja Nikodijevic, of German research firm SRLabs demonstrated the resulting weaknesses in front of a live audience, brute-forcing booking records, showing how easy it would be to steal airline miles or even whole tickets, and revealing how personal data stored in the booking system is barely protected at all.
The heart of the insecurities lies in the six-character booking code, printed on everything from baggage tags to boarding cards and confirmation emails. Six characters is few enough that a valid code can easily be guessed, even if it can’t be simply found by rummaging through bins in an airport, and most vendors only use another public fact – your surname – to secure it beyond that.
“Global booking systems have pioneered many technologies including Cloud computing,” the researchers said. “Now is the time to add security best practices that other Cloud users have long taken for granted.”
Smart Meters
What’s even more concerning than an insecure smart home? An insecure smart city. Netanel Rubin, co-founder of the security firm Vaultra, presented his research on smart meters, electricity meters that co-ordinate with the utility company and other meters on the same network to ensure that the power grid of a city is fit for the 21st century.
When used well, smart meters offer a host of advantages: individuals can keep better track of their usage, utilities can offer flexible tariffs to encourage use when the grid is underloaded, and microgeneration can be rewarded, letting utilities pay people for fitting solar or wind generation to their properties.
Unfortunately, some smart meters are anything but secure. Using a similar technique to Dudek, Rubin managed to intercept the communications between the smart meter and the utilities company itself. That would enable billing fraud (either stealing free electricity, or maliciously increasing the bills of victims), as well as privacy invasions.
Things get worse if a user has other smart devices in their house, such as a smart door lock. “Imagine you woke up to find you’d been robbed by a burglar who didn’t have to break in,” Rubin said.
At its worst, he argued, a hacked smart meter could cause explosions or house fires. The devices are designed with the goal of rendering that an impossibility, but then, they are also designed with the goal of rendering hacking them impossible. Not every design goal is achieved.
The UK department charged with implementing smart meters, the Department for Business, Energy and Industrial Strategy (BEIS), says that “robust security controls are in place across the end-to-end smart metering system and all devices must be independently assessed by an expert security organisation, irrespective of their country of origin”.
Elections
Voting on paper might seem woefully old-fashioned in the 21st century, but one hour in Chaos Communications Congress will leave you very relieved if your country still votes the old way, and very concerned if it doesn’t.
J Alex Halderman and Matt Bernhard, both of the University of Michigan, discussed attempts to prove that the US election wasn’t hacked, whether by Russia or some other attacker.
Their findings were concerning: not only would it be entirely possible to alter the results reported by a number of electronic voting machines while leaving no obvious trace of your attack, it would be possible to do that at the scale needed to hack an election.
“I’m pretty sure my undergraduate security class could have changed the outcome of the presidential election,” Halderman said. “It really is that bad.”
That wouldn’t be so bad, since every electronic voting machine used in the United States leaves some sort of paper audit trail, either in the form of receipts printed off to mark the vote, or the physical ballot paper scanned in in the first place.
Except no one counts the paper trail, and legal attempts to force them to do so ended in a costly deadlock in December 2016.
The one piece of good news? The abortive recount didn’t find any evidence that a hack had happened; it just also didn’t find evidence that it hadn’t happened.
Numbers
Even numbers are at risk when the security world gets going. Well, specific kinds of numbers, at least. Jos Wetzels and Ali Abbasi, from the University of Twente in the Netherlands, demonstrated their research on weaknesses in embedded cryptographically secure pseudo-random number generators, and it was bad news.
Let’s break that down. Random numbers are very important for a number of security applications, such as safely encrypting communications. But without specialist, expensive hardware, true random numbers are impossible for a computer to generate, due to the deterministic way they work.
Instead, they create pseudo-random numbers: a “good enough” approximation of randomness. Cryptographically secure pseudo-random number generators are a subset of that, which fit specific requirements that let them generate random numbers that can be used in a security context. It needs to be impossible to predict what number will come next if you know the number just generated, for instance, and it needs to be impossible to know the previous number generated if you’ve just seen one be generated.
In order to fake the randomness, many computers use external sources of data to “seed” the random number generators: information like mouse and keyboard activity, or disk accesses, can set the number generator in a different state each time. But those sources aren’t available in the simple computers used in “embedded” systems, like those powering the internet of things, ATMs and jet fighters.
So how do manufacturers solve the problems? As Wetzels and Abbasi showed, the answer is: badly. The pair showed three vendors – including one whose technology is used in jet fighters – whose number generators were anything but cryptographically secure. The scariest thing? The three they decided to show weren’t the worst: they were the best.
