Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
8/20/2015
05:08 PM
Steve Grobman
Steve Grobman
Partner Perspectives
50%
50%

Spiderbot, Spiderbot, Does Whatever A Hacker Thought

Virtual machine, she ignores, owns the bot, then controls yours.

At this week’s Intel Developer Forum, CEO Brian Krzanich demonstrated some gesture-controlled spiderbots during his opening keynote that lit up and danced across the stage, entertaining the crowd. These robots spawned from Intel’s investments in the maker movement, demonstrating the limitless creativity and innovation of the developer community.

Big Mama spiderbot, reporting for duty

One significant upside to the evolution of technology is lowering the barrier to entry for developers. Innovations like Intel’s Edison board enable an individual or small team to create sophisticated, autonomous robots in days instead of weeks. During the mega-session of Chris Young, senior VP and general manager of Intel Security Group, the bots were assigned sentry duty, guarding a big donut because software developers need to protect important assets such as sugary food and drinks. All joking aside, the reality is that we really do need to protect key assets, and sound coding is critical to securing our infrastructure.

Spiderbot on duty, guarding the donut

Along with this development agility, however, come new risks that need to be understood by Intel Security and developers. As connected devices become more sophisticated, they are inherently more susceptible to attacks. We took the opportunity during Young’s mega-session to showcase how vulnerabilities in the computing ecosystem can be exploited if platform and application developers are not careful in their coding practices.

We replicated a common cloud environment with multiple virtual machines running on the same physical server. In this case, the robots had a control application running in a virtual machine, which was communicating wirelessly and giving the spiderbot commands. Then we asked one of our senior software engineers, Jenny Mankin, to see if she could commandeer the robot for her own nefarious purposes. She could, and she commanded the robot to stop performing its sentry duty.

Jenny Mankin commandeering Steve Grobman's spiderbot

First, Jenny needed to steal credentials from the control application in the virtual machine. She took advantage of a vulnerability in the firmware implementation to install a rootkit inside the firmware. The rootkit allowed her to remap memory from the controlling VM to her own VM and monitor all activity in the controlling VM. (For more information on this class of attack, refer to the presentation from Black Hat USA 2015 by Intel’s Advanced Threat Research team.) This is a BIOS implementation vulnerability that breaks the VM isolation, moving the classic issue of privilege escalation in the realm of cloud, virtualization, and the Internet of Things. It also shows the attack technique of lateral movement, where the attacker uses her position in the environment (in this case, being on the physical machine) to take the next step in her attack.

In this case, once Jenny had the credentials she was able to reprogram the spiderbot by sending a return-oriented programming (ROP) exploit remotely to open a reverse-shell on the spiderbot. With ROP attacks, instead of trying to inject her own code into the software on the spiderbot, Jenny uses instructions that are already in memory and exploits a buffer-overflow vulnerability to chain together short sequences of instructions in an unintended order to execute the functionality she wants.

With Capabilities Comes Risk

As IoT devices become connected, we get much greater capabilities, but at the same time we expose ourselves to new risks. I think of the challenges demonstrated last month on automotive hacking, where a remote attacker completely took over control of a car. It is a big issue and one that developers need to comprehend in the world of rapid development, which can lead to quick but sloppy coding practices that are functional but susceptible to security vulnerabilities.

In the short term, our focus is helping the developer community understand good security coding practices. For more information, check out the following resources:

In the long term, Intel and Intel Security are looking at technology to detect and prevent this type of exploitation so that your spiderbot -- and your donuts -- remain yours. 

Steve Grobman is the chief technology officer for Intel Security Group at Intel Corporation. In this role, Grobman sets the technical strategy and direction for the company's security business across hardware and software platforms, including McAfee and Intel's other security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.