Nytro Posted November 7, 2011 Report Posted November 7, 2011 Hacking Embedded Devices For Fun And ProfitAuthored by prdelkaThese are slides from a talk called Hacking Embedded Devices for Fun and Profit. It uses Sky Broadband as a case study.HISTORY REPEATS ITSELF...- Typically run with no privilege separation- Everything runs as highest user privilege- SYSTEM / root (uid=0) on all processes- A single defect could potentially compromise the platform- Embedded Developers are not Security Conscious- Commonly write insecure routines- XSRF / XSS- Design & Logic bugs (e.g. Directory Traversal)- Buffer Overflow Defects- Small number of commonly re-used Libraries- Devices re-use open-source libraries across platforms- SNMP- UPnP- BusyBox- TinyHttpd, Micro_Httpd … etcDownload:http://dl.packetstormsecurity.net/papers/attack/Hacking_Embedded_Devices-HackerFantastic.pdfSursa: http://packetstormsecurity.org/files/106684 Quote
