What are the big challenges of all these smart devices is the wild amount of connectivity that they
can take advantage of.
So in this episode what I want to do is go through a number of specifically listed security plus objectives
and talk about scenarios where these particular types of connectivity could be or in some cases are
completely not an issue.
So for me probably the easiest one to start with is probably the safest one of all.
SatCom
Why don't know about you but I don't find myself in a situation where I'm in the middle of the Pacific
Ocean on the top of Mt. Everest and suddenly just really need to make a phone call.
Anyway that's the world of satellite communication or SatCom.
Now traditionally satellite communication phones have been proprietary dedicated devices.
However the last few years we have seen a number of folks that create SatCom snap ons for your regular
old smartphone.
So here's an example of one right here.
Now if you look at that you'll see it's just a regular old smartphone but you snap on this extra device
and now you have a cell phone.
The only thing I want to say about Bluetooth is that we cover Bluetooth security at other episodes.
So certainly Bluetooth is common on wireless devices and it's something we need to be thinking about.
But keep in mind we've already covered.
Think about things like blue jacket and blue snarfing and some of the problems we have to do there.
Otherwise Bluetooth is pretty much already covered.
However one that is not covered is one of my personal favorites and that is near-field communication
so near-field communication is a very very short range wireless connectivity.
It's actually electronically very very similar to Bluetooth.
The only big difference is that you need physical contact between two devices or almost physical contact.
Now I'm using Android devices because we all know that Android is wildly superior to Apple devices but
nobody is saying anything.
And it's very easy to get NFC to work on Androids.
I am not aware of any Apple products that support NFC that could even be a security plus question.
So anyway if you take a look at these two screens on one screen at the bottom here I just have a default
desktop.
And on top here I have a web page open to an incredibly powerful amazing book written by my favorite
author of all time Mike Myers.
So what I'm going to be doing with that is see is I'm just going to take these two guys and press them
together.
Now it's going to take a moment but if you see there hey.
Hold on let me show you Let me show you Let me show you.
So you can see he's automatically transferred this one particular web page and open a browser and moved
it over to the other system.
Near-field communication is an incredibly powerful tool.
It's one that I am surprised that people don't use as much as they possibly can.
The only downside to NFC is that if it's turned on there's no security there's no PIN code there's nothing
to prevent if you leave your phone on your desk or something like that I can walk over tap them together
and grab what is ever on your screen at any given moment in this particular case I was using a web page
but you gave your contacts up.
You can have your bank information up whatever it is.
And it just takes a tap.
And I've got that information.
So next I want to talk about one that I should be using a little bit more and that is a..
The problem with Bluetooth and even NFC is that there's a lot of times where we have very very simple
devices that need to make a wireless connection to a smartphone or whatever it might be.
A entire standard called a 20 or a n t plus was developed that was primarily for things like bicycle
odometers heart rate monitors practice bikes that you could see where you were how many miles you've
got in and the anti and anti plus standards worked really really well for that.
As of this writing I am unaware of any security issue that has ever taken place with AT&T Plus that
was at least big enough to cross my radar.
It's a very very simple form of wireless communication.
It is incredibly slow and incredibly well-protected.
Now let's go back to one of the types that I really like and that's infrared
one of the reasons I like Android compared to Apple is that most Android devices have built in infrared
transmitters.
They're not receivers.
Once in a while you'll see a receiver but built into most Android phones although unfortunately it's
starting to fade out is a transmitter.
And what that does for me is I can be sitting at a sushi bar and if I don't like what's on the channel
I can press some buttons with the right app and we're watching whatever I want to watch now because
the infrared that's built into these devices is transmit and not receive.
There's very little danger in terms of security for anything taking place within the phone where you
can hurt the phone.
The problem is is when naughty people like me go around to sushi bars or television production studios
or anything where there's infrared receivers of any type for any kind of device.
I'm just a guy who's mean enough to start pressing things and maybe I'll change your cable modem to
something I like next.
Let's talk about USP.
USP is another one of these types of connectivity that we've talked about in other episodes so I don't
want to develop that too much.
You have to be pretty robust in and of itself.
However there is one part of us be that can be a real problem for smart devices and that's called us
be on the go.
Now a lot of people aren't aware of this use B is traditionally a one way device where you plug into
something and it just takes commands from that particular device.
But you can make us be two way and that's what us be on the go is all about.
For example I can take this phone plug it into my desktop.
And now this thing just acts like a hard drive and I can look at the storage or whatever it might be.
So it's going from the device out to my desktop However you know if you ever seen something like this
what I've got let me hold it up so you guys can see what is going on.
So all I've got here is a mouse with a little adapter.
In this particular case I'm using USPC.
So I've got a regular old USP now.
Nothing special it's got to be a connector on there.
But I've got the special adapter that actually came from Google that goes from USPSA to us b c it's
also important understand us be a female to us b c male with this little device we can have a little
bit of fun.
When I'm going to do is I'm going to plug this mouse into my phone.
So we'll see if we can get a capture of this.
Can you actually see that the mouse is working.
That's with us be on the go is all about us be on the go will allow any one US report to either be ingoing
or outgoing which is not a standard part of the U.S. be standard itself.
However what makes it interesting is that as a bad guy if I've got the right kind of adapter I can plug
a thumb drive in there I could plug into things like a hack fives us be rubber duck device and plug
this in and start sending a whole bunch of commands and grabbing data and things like that.
The downside to us beyond the go is that it's probably something you don't want to turn off because
we use it so often without actually thinking about it.
This is where really one of the big things we can do with our smart devices is make sure we know where
they are at all times.
Somebody leaving a wireless device on a desk or you know in a restaurant is just asking for trouble
just because guys like me we might plug something in that because we're mean.
We're just curious what we can get away with.
The last thing I want to talk about is Wi-Fi and there's two aspects of Wi-Fi I want to talk about a
one shot.
I want to talk about Wi-Fi Direct and I want to talk about tethering
obviously every type of smart device supports the 10:42 standard if there isn't one I wouldn't be interested
in it.
The problem with regular 10:42 is that it's used almost exclusively just create Internet connections
to a wireless access point and we call that infrastructure mode and it works absolutely great.
But there are other modes to 10:42 that people forget about since 1:52 11 was invented there's been
a mode called Ad-Hoc with ad hoc mode.
What I can do is I can take one device it doesn't have to be a smartphone but I could take any one device
and I can create a wireless connection and Ato two eleven connection between these two devices now and
how connections are rare.
There are places where they're used but they're fairly uncommon.
However one place we do see these ad hoc type connections is in something called Wi-Fi Direct.
We know that everybody has streaming devices now in Chrome casts and road crews and things like that.
Now some of these streaming devices use a technology called Wi-Fi Direct which allows a device to connect
to another device very very easily.
The downside to Wi-Fi Direct is that it uses Wi-Fi protected services WPX and in other episodes we talk
about the downside to WPX.
Generally what we do in these cases is we do a little research on whatever streaming device we have
on security and see if there aren't some situations it's not that hard for me to be able to connect
to some of these streaming devices as a bad guy just by doing standard wireless attacks.
If you watch other episodes we talk about for example the diot attack and being able to completely intercept
the stream of all your data.
Now the other part to this is tethering.
Now let's make sure we understand what tethering means tethering basically for most people tethering
means to plug my phone into for example a laptop.
And when I make this plug in connection I can actually take advantage of the cellular in on my phone
and use that as a internet connection for my laptop.
So most of the time when we talk about tethering tethering is great when it's done.
Wired The downside to tethering and this is where 8:0 to 11 comes into play.
Is that almost all smart devices today support wireless tethering.
So you've got your cellular way.
And then this little phone right here starts to act as a wireless access point and not properly configured
by setting up this type of tethering.
You can literally let anybody connect to the Internet through your phone.
So the secret to this is on almost all of these phones you take the time to configure it properly set
up WPA WPA too and get that encryption up and running to at least make somebody sign in and get a password
before they start doing whatever they do on your phone.