Give me a stable input and I'll hack the planet. Bad Zack

1. Give me a stable point
and i’ll hack the planet

2. whoami
Hacker : A person who delights in having an intimate understanding
of the internal workings of a system, computers and computer
networks in particular. The term is often misused in a pejorative
context. #RFC1392

3. What's this is
NOT
ABOU

4. What's this is
ABOU

5. Focus:

6. Why?
Not something “standard”
Bad airport connections :(
(lots of time spent in airports)
Curiosity
Challenge

7. Rules :
Escape the Luser jail || get
cmd
Leave everything as found
Hands. No tools.
(or less as possible / no highly technical stuff)

9. How
Inputs:
Techniques:
⁍ Keyboard
⁍ Mouse
⁍ Touch screen
⁍ Caméras
…
⁍ Race condition
⁍ Crash
⁍ “Touchy
touchy”
⁍ URIs
⁍ XSS, SQLi
⁍ “Murphy”- Knock, knock.
+ Race condition.
- Who's there?
A bad joke about “race condition”
Andsomemore...:)

10. Runs results
Disclamer : Evil is evil, so be
good

11. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique:?????XSS

12. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: XSS
Bardo <input type="file" class="upload">

13. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: XSS
%windir%
%appdata%
%fnord%
[…]
%tmp%

14. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: XSS

15. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: XSS
Shodan
to the rescue ;)

16. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: XSS

17. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: URIs

18. ⁍ Location: FR ⁍ Device: Kiosk
⁍ Technique: URIs

19. ⁍ Location: FR ⁍ Device: Internet
kiosk⁍ Technique: If you wanna boot, boot into this.

20. ⁍ Location: FR ⁍ Device: Museum
gadget⁍ Technique: L.A.C.E.

21. ⁍ Location: FR ⁍ Device: Museum
gadget⁍ Technique: L.A.C.E.
L337 And Cool Equipment

22. ⁍ Location: FR ⁍ Device: Museum
gadget⁍ Technique: L.A.C.E.

23. ⁍ Location: FR ⁍ Device: Museum
gadget⁍ Technique: L.A.C.E.

24. ⁍ Location: FR ⁍ Device: Renting
⁍ Technique: “Kevin Mitnick© style”

25. ⁍ Location: FR ⁍ Device: Renting
⁍ Technique: “Kevin Mitnick© style”

26. ⁍ Location: NL ⁍ Device: Elevator
⁍ Technique: Hidden menu

27. ⁍ Location: FR ⁍ Device: Tickets
⁍ Technique: “Hidden” Keyboard

28. ⁍ Location: FR ⁍ Device: Tickets
⁍ Technique: “Hidden” Keyboard

29. ⁍ Location: FR ⁍ Device: Tickets
⁍ Technique: “Hidden” Keyboard

30. ⁍ Location: FR ⁍ Device: Tickets
⁍ Technique: “Hidden” Keyboard

31. ⁍ Location: FR ⁍ Device: Left 4 dead ?
⁍ Technique:

32. ⁍ Location: FR ⁍ Device: « Display » screen
⁍ Technique: Pick and choose…

33. ⁍ Location: FR ⁍ Device: Amex kiosk
⁍ Technique: “Hidden” Keyboard

34. ⁍ Location: FR ⁍ Device: « Display screen »
⁍ Technique: Bluetooth

35. ⁍ Location: FR ⁍ Device: « Display screen »
⁍ Technique: Bluetooth

36. ⁍ Location: FR ⁍ Device: Shopper aid
⁍ Technique: “Human fuzzer”

37. ⁍ Location: FR ⁍ Device: Shopper aid
⁍ Technique: “Human fuzzer”

38. ⁍ Location: FR ⁍ Device: Shopper aid
⁍ Technique: “Human fuzzer”
Huh ?

39. ⁍ Location: FR ⁍ Device: Shopper aid
⁍ Technique: “Human fuzzer”

40. ⁍ Location: FR ⁍ Device: Shopper aid
⁍ Technique: “Human fuzzer”
~900$

41. ⁍ Location: FR ⁍ Device: Ads
⁍ Technique: “Murphy law” / Shell happens

42. ⁍ Location: RU ⁍ Device: Kiosk
⁍ Technique: “Murphy law” / Shell happens

43. ⁍ Location: FR ⁍ Device: ATM
⁍ Technique: Wait for it

44. ⁍ Location: FR ⁍ Device: ATM
⁍ Technique: Wait for it

45. ⁍ Location: ES
⁍ Device: Banking change machine
⁍ Technique: Race condition

46. ⁍ Location: FR ⁍ Device: ATM
⁍ Technique: “Murphy law”

47. « State of the art »
(protections)

48. « State of the art »
(protections)

49. Let’s summarize:
⁍ It was EASY
⁍ Internet access is often available
⁍ Many devices lacked updates, proper
segmentation, antivirus
⁍ People supposed to supervise are clueless
⁍ Devices are CRITICAL or at least
INTERESTING

50. Environment / Risks
Airport networks:
⁍ “Standard” computers (Check-in, boarding controls...)
⁍ SCADA systems?
Money related devices:
⁍ Free tickets :D
⁍ Banking information?
Critical devices:
⁍ Lifts
⁍ Smart grids, gas station near mail.ru office

51. What about…?

52. The cavalry is
coming

53. I am the cavalry

54. Q&A

55. Contact
@zackhimself
zack@4sec.Fr

56. Finished
already ?