MOD 18 - Iot and OT Hacking

Question 1

SDR-Based attacks on IoT

Answer 1

SDR=Software Defined Radio. This is a method of using software (instead of hardware) to generate radio communications and processing radio signals.
URH (Universal Radio Hacker) is free software for doing wireless attacks against IoT and other wireless devices. Review the 3 attacks here: Replay, Cryptanalysis, and Reconnaissance attacks

Question 2

• HMI-based attack

Answer 2

HMI=Human Machine Interface. This is a common type of control system for OT networks. Attackers try to gain access to the HMI to cause damage or steal data.

Question 3

• Power/Clock/Reset Glitching

Answer 3

Attackers inject faults or glitches into the power supply and clock network of the chip.

Question 4

Defend against IoT hacking

Answer 4

Monitor port 48101 as infected devices often attempt to spread malware on this port. The famous Mirai botnet used this to infect IoT devices in 2016, according to CISA: https://us-cert.cisa.gov/ncas/alerts/TA16-288A

Question 5

FCC ID Search

Answer 5

Used to look up a device’s basic information, such as Vendor, Product ID, and granted FCC certification. Using this info, you can search for vulnerabilities on that device

Question 6

OT Network

Answer 6

Operational Technology - Hardware or software that monitors or controls Industrial Control Systems (SCADA, for example)

Question 7

nmap script enip-info

Answer 7

Enumerates Rockwell PLC devices and collects device name and type, Vendor name, Product name and code, IP address, etc. (Ethernet/IP Info)

Question 8

Flowmon

Answer 8

OT security tool to ensure the reliability of industrial networks in order to avoid downtime and disruption of service continuity. Does continuous monitoring to detect anomalies, incidents, zero-days, cyber espionage, malware, etc.

Question 9

• Censys

Answer 9

IoT search engine (like Shodan) that can give you info about a target IoT device

Question 10

• IoTSeeker

Answer 10

Tool that can discover IoT devices that are using default credentials

Question 11

Replay Attack (SDR Attack)

Answer 11

Obtain specific frequency, used for sharing info between devices, captures original data, then segregates command sequence and injects into the IoT network which replays it.

Question 12

Dyn Attack

Answer 12

(Mirai) piece of malware that deliberately finds the IoT devices to infect them. Mirai on Port 48101

Question 13

HMI

Answer 13

Human Machine Interface