Hello everyone 🫶 I decided that I needed a little reboot (a Zoomer retreat), so for the w…

Hello everyone 🫶

I decided that I needed a little reboot ( Zoomer retreat ), so for the weekend I came to a spa hotel 200 km from Moscow

And without expecting it, I found content for you. It's called a "coffee machine" Dr.coffee Proxima", which is located on the territory of the hotel

It all looked something like this: I go up to this wonderful machine to buy coffee. I see an icon with gears in the interface. My professional deformation tells me that I should press it. I click and fall into the password entry page. And under the password line... a pin code for generating a temporary password 🤌

Well, more precisely, I didn’t know at that time that it was for a temporary password. Therefore, I find the documentation for this machine in the public domain and read how a temporary password is created based on a PIN code. From the same document I also find out the default service password

I enter the service password and get into the admin console. I enter a temporary password ( the remainder of the sum of the first and last PIN code values divided by 10 + the second digit of the PIN code + the third digit of the PIN code + the remainder of the sum of the second and third PIN code values divided by 10 ) and I also get into the admin console

By the way, the temporary password and the service password open the console with the same rights. It's surreal 🥲

The fact that the owner of the coffee machine did not change the service password to his own is a total joke. We talk a lot here about IoT security, and I won’t tell you the secret that this is the most common way to break devices. Just change the default password

But in the case of this coffee machine, this will not help you. Because knowing the algorithm for constructing a temporary password ( which is in the public domain ), you can safely go to the admin panel by entering the service password in general

By the way, in the admin panel I have the opportunity to set the cost of drinks. I can get my own latte for free. This, of course, is great, but if everything was limited to this, I wouldn’t write the post 🫠

Having gained access to the admin panel, I can download the configuration of the entire machine using its standard tools. Directly to the flash drive. The documentation contains all the information on what we can download. There is a Wi-Fi password, payment data, and much more ( IP, gateway, DNS, SSID, software and firmware version, beverage statistics, network connection settings ). In addition, this machine has the ability to update the firmware via USB from a flash drive. Therefore, we can easily replace the original firmware of the coffee machine with our custom one. Do you know what I mean?

The coffee machine becomes the entry point for an attack on the hotel's infrastructure. This is exactly how they first break casinos through smart thermometer in aquarium with fish mi, and then a smart home through light bulb

There will be no morality here. The coffee machine manufacturer is great. Left a gift for the attackers ( Well, I wrote a post, thank you for that ). The owner is great. I didn't change the password. I bought the car, installed it and forgot about it. Beauty

P.S. By the way, I paid for the coffee

🫡 Website | 🤔 Habr

#information_security
#internet_things