The series "Mr. Robot" is already more than 10 years old. I remember watching it back in…

TV series "Mr. Robot" for more than 10 years now. I remember watching it back in high school, when I was just planning to enter university. How long ago was this... well, okay, the stingy man's tears have already dried up, so let's get down to business. The other day I decided to rewatch this series. By the way, if you haven’t watched it, I recommend it ( The technical consultants there did a good job, so everything really looks believable ). Closer to the point ⤵️

In the fourth episode of the first season, Elliot ( main character ) suggests fsociety ( hacktivists ) an interesting way to destroy E Corp backups located in a secure Steel Mountain vault. Instead of trying to get directly to the magnetic tapes themselves, he suggests attacking the building's climate control system

For this, the series used a very real Raspberry Pi ( that's why I decided to release this post ). In fact, the guys had to physically get inside Steel Mountain, install a Raspberry Pi behind one of the thermostats, use it to organize a backdoor into the internal network, gain access to the climate control system and raise the temperature in the rooms with magnetic tapes. And in the fifth episode, Elliot gets inside and installs the device

We have already discussed how suitable Arduino Pro Micro for picking locks in "Peacemaker" and how it happens the process of capturing a fleet of robots using the example of "Cyber Village" . Well, now let’s figure out how realistic what they did in “Mr. Robot” with the Raspberry Pi is. Let's start with single-plate 😎

Well, first of all, as I mentioned just above, the Raspberry Pi is not a microcontroller ( although there is a Pico series, it was not in the series ), like the same Arduino Pro Micro. This is a full-fledged single board computer. You can run Linux on it, use Ethernet, USB, GPIO, run network services and, in general, do almost everything the same as on a regular car with Linux. It’s just that this thing is compact and it pays for it with its power.

Therefore, the very idea of ​​using the Raspberry Pi as a small device that can physically be left inside someone else's infrastructure is not something out of the ordinary. Moreover, in Elliot’s plan, it is needed as a point of presence within a trusted network. That is, in fact, his Raspberry Pi inside the building goes to the Steel Mountain internal network and gets access to the infrastructure. Let's take a closer look here 🧐

Modern facilities do not consist of thousands of independent thermostats on which employees manually turn something. Such systems combine in BAS and BMS ( it's ours Building Automation System and Building Management System , respectively )

Through such infrastructure, heating, ventilation, lighting, power supply, temperature/humidity sensors, etc. can be controlled. NIST , by the way, refers to BAS as Operational Technology. These are systems that interact with the physical world ( Did you miss IoT? )

Therefore, there is a fundamental difference here with the usual hacking of a conditional web server, for example. Because in regular infrastructure, the result of a command is most often data. But not in OT. There we are already talking about processes. Because the command is transmitted to the controller, which triggers some mechanism that affects the change in the physical process itself. Relatively speaking, they changed the value in the system, and after a while the room became hotter or colder. From the point of view of ensuring the security of such systems, this is just a terrible horror. 😳

BMS components have their own protocols for interaction. Conditional BACnet was created by a specialist for building automation and is used in HVAC, lighting, security systems, etc. There may also be Modbus , KNX , and various proprietary protocols of manufacturers

We don't know what specific protocol AirDream uses in Mr. Robot. They don't tell us about this in the series. It's a pity, but from an architectural standpoint it doesn't bother us

If the Raspberry Pi is connected to a network segment from which the BMS is accessible, it may well become an entry point. But the show still makes the assumption, because you can’t just plug a Raspberry Pi behind a thermostat. More precisely, of course, it is possible, but this alone is not enough. It is necessary that the management infrastructure is actually accessible from there. If the BAS is normally segmented, there are ACLs/firewalls between the user/corporate network and OT, devices are authenticated + there is any protection against Shadow IoT, then the Raspberry Pi inside the building will not do anything on its own

And this is precisely why IoT requires segmentation, minimally required network communications, device authentication, a unique identity for each device, normal certificate and key management, NAC, control of outgoing connections and monitoring of anomalous behavior. I have written about this more than once on the channel 🤌

If the thermostat at some point started communicating with an address it had never interacted with before, or five devices were simultaneously commanded to raise the temperature to some crazy value... well, this is, to put it mildly, a reason to go see what happened there

But okay. Again I’m turning the post into a conference report with my recommendations. Let's laugh together at one nuance of this whole attack from the series 😏

According to Elliott, if the temperature exceeds 95 °F ( and here we have about 35 °C ), the polyurethane binder of the magnetic tape will begin to soften, after which the data will become unreadable. Sounds smart. Although my favorite "MythBusters" would be I definitely wanted to check this out for myself

I have neither the energy nor the time to test this hypothesis, but I have a browser. So here it is

Fujifilmfor generations LTO 1–5 specified an operating range of up to 45°C and short-term storage of up to 35°C. And for modern LTO, the temperature that can lead to irreversible damage to the tape can generally be a cosmic 52 °C. I understand that the series is over 10 years old, but nevertheless, 35 degrees is not enough to spoil the tape

Prolonged temperature and humidity deviations beyond acceptable conditions really do not bring anything good to magnetic media. But it is unlikely that it will be possible to instantly turn all this into bricks immediately after crossing the 35 °C mark. Moreover, Elliot himself literally says “Linear Tape-Open standard nine.” That is, in fact, LTO-9 ( this is a waste, because the series was released in 2015, when the LTO-9 specification was only in the roadmap; she appeared in 2020 )

Therefore, the moment with the attack turned out to be interesting. On the one hand, precisely in the scenario with a single-board platform on the network, everything looks really good and believable. But the very idea of ​​raising the temperature to 35 degrees to destroy magnetic tape is simply too optimistic. But specifically, I liked the Raspberry Pi chain. For this, the series consultants have huge respect. 🤝

P.S. This is all for informational purposes. If I find out that one of my subscribers is planting Shadow IoT devices in the organization, I will separate you from my channel 😎

🫡 Website | 🤔 Habr

#information_security
#internet_things