Universal Radio Hacker

Size: px

Start display at page:

Download "Universal Radio Hacker"

Marcus Burke
5 years ago
Views:

1 Universal Radio Hacker A Suite for Analyzing and Attacking Stateful Wireless Protocols Johannes Pohl and Andreas Noack University of Applied Sciences Stralsund August 13, 2018

Internet of Things Proprietary wireless protocols everywhere Smart Home Increase comfort through wireless sockets, door locks, valve sensors.

2 Internet of Things Proprietary wireless protocols everywhere Smart Home Increase comfort through wireless sockets, door locks, valve sensors... Devices are designed under size and energy constraints Less resources for cryptography Risks of Smart Home Manufactures design custom proprietary wireless protocols Hackers may take over households and e.g. break in without physical traces How can we eavesdrop and manipulate the wireless communication between such devices to assess the security? August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 2

3 Software Defined Radios Software Defined Radio Why Software Defined Radios? Send and receive on nearly arbitrary frequencies a Flexibility and extendability with custom software a e.g. HackRF: 1 MHz - 6 GHz (a) USRP N210 (b) HackRF August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 3

4 Software Defined Radios Software Defined Radios are affordable Last Checked: July 21, 2018 August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 4

5 Software Defined Radios Universal Radio Hacker August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 5

6 Software Defined Radios Universal Radio Hacker Interpretation Analysis August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 5

7 Software Defined Radios Universal Radio Hacker Interpretation Format Stateless Analysis Generation August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 5

8 Software Defined Radios Universal Radio Hacker Interpretation Format Generation Stateless Analysis Stateful Format Simulation August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 5

9 Introduction Attacking a Door Lock Conclusion Protocol Setup CCU August 13, 2018 door lock Johannes Pohl and Andreas Noack Universal Radio Hacker remote control Slide 6

10 Protocol Overview Pairing AES-Key AES-Key central (CCU) door lock remote control August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 7

11 Protocol Overview Pairing AES-Key AES-Key central (CCU) door lock remote control OPEN Command August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 7

12 Protocol Overview Pairing AES-Key AES-Key central (CCU) door lock remote control OPEN Command Challenge August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 7

13 Protocol Overview Pairing AES-Key AES-Key central (CCU) door lock remote control OPEN Command Challenge Response AES-Key (Challenge) August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 7

14 Protocol Overview Pairing AES-Key AES-Key central (CCU) door lock remote control OPEN Command Challenge Response AES-Key (Challenge) ACK August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 7

15 Protocol Overview Pairing AES-Key AES-Key central (CCU) door lock remote control OPEN Command AES-Key Challenge Response AES-Key (Challenge) wireless socket ACK August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 7

16 Interpretation Record and demodulate signal Capture of door lock open communication Zoom into start of second message August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 8

Interpretation Demodulation and Signal Editing with URH Further Interpretation Features Synchronized selection between demodulated and raw signal Signal Editor i.e.

17 Interpretation Demodulation and Signal Editing with URH Further Interpretation Features Synchronized selection between demodulated and raw signal Signal Editor i.e. copy, paste, crop, mute signal selections Configurable moving average and bandpass filters August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 9

18 Analysis Analysis phase In Analysis phase we reverse engineer the protocol format. Example format Preamble Synchronization Length Source Address Destination Address Data Checksum This includes Decode messages Labeling of protocol fields Group messages by assigning message types August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 10

19 Analysis What kind of decoding does the door lock use? All messages are encoded in the following way 1 Pseudo encryption 2 Data Whitening 3 (Modulation) August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 11

20 Analysis Pseudo Encryption Code enc [0] = msg [0]; enc [1] = ~( msg [1]) ^ 0x89 ; for (i = 2; i < NUM_BYTES ; i ++) enc [i] = ( enc [i -1]+ 0xdc ) ^ msg [i]; Use Does not increase the security Assumption: Obscure method for pseudo security August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 12

21 Analysis Data Whitening Data Whitening To increase transmission quality a data whitening is used XOR with each 8 LSB of a pseudo-random sequence generated by an LFSR represented by the polynomial x 9 + x 5 + x 0 + s 8 s 7 s 6 s 5 s 4 s 3 s 2 s 1 s 0 s 8 s 7... s 0 Initial state is First eight states of the LFSR August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 13

22 Analysis Decodings with URH August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 14

23 Analysis Result in URH after decoding and labeling Other Options: Select all, Filter, Align Assign manually or rule based Check against configurable CRC August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 15

24 Simulation Simulation phase In Simulation phase we can work on the logical layer. URH takes care of Modulation and Encoding during simulation time. August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 16

25 Simulation Demonstration Video August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 17

26 Summary and future work Summary Software Defined Radios offer a high flexibility when investigating radio protocols Tools like Universal Radio Hacker abstract the required HF basics and enable analyzing such protocols without having to be a hardware expert Smart Home manufactureres have to react, Security by Obscurity is no longer an option Ongoing work Rule based intelligence for automatic analysis phase Enhance accuracy of detecting interpretation parameters Support for more complex modulations e.g. 4-PSK August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 18

27 Contact Slack: GitHub: apple August 13, 2018 Johannes Pohl and Andreas Noack Universal Radio Hacker Slide 19

Universal Radio Hacker: A Suite for Analyzing and Attacking Stateful Wireless Protocols

Universal Radio Hacker: A Suite for Analyzing and Attacking Stateful Wireless Protocols Johannes Pohl University of Applied Sciences Stralsund, Germany Andreas Noack University of Applied Sciences Stralsund,