Sécuriser la connexion Bluetooth Low Energy de son objet connecté

Transcript

1. #DevoxxFR #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Sécuriser son Object Connecté Bluetooth LE

   Alexis DUQUE @alexis0duque

2. #embeddedSEC18 #BleSecurityConf About Me ALEXIS DUQUE R&D and Security leader

   at Rtone PhD @alexis0duque #BleSecurityConf alexisduque alexisd@rtone.fr security.rtone.fr | sli.do/BleSecurityConf medium.com/rtone-iot-security EXPERTS IN SMART AND CONNECTED THINGS #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf

3. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Internet Of Things Security

4. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf “20 billions interconnected devices by the year

   2020” Gartner

5. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf “8.4 billions Bluetooth Low Energy devices by

   2020” Bluetooth SIG

6. #embeddedSEC18 #BleSecurityConf IoT Security Challenges • Uncontrolled Environment • Heterogeneity

   • Users and Manufacturers not aware of security risks • Scalability • Constrained Resources • Surface of attacks: hardware + software

7. #embeddedSEC18 #BleSecurityConf Attack Surface Area

8. #embeddedSEC18 #BleSecurityConf IoT Privacy Challenges • How to obtain informed

   consent? • How can people have control over data? • Who is responsible? • How data can be safeguarded? • How do you detect attacks or leaks?
9. None
10. None

11. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Bluetooth Low Energy

12. #embeddedSEC18 #BleSecurityConf Bluetooth LE Bluetooth Low Energy = BLE =

    Bluetooth 4/5 = Bluetooth SMART Completely different than previous Bluetooth 2, 3 (BR/EDR) Designed for low energy usage, simplicity rather than throughput

13. #embeddedSEC18 #BleSecurityConf Bluetooth LE Bluetooth 4.0 has weak security mechanisms

    Bluetooth 4.2 adds strong encryption Bluetooth 5 increase throughput and range

14. #embeddedSEC18 #BleSecurityConf Bluetooth LE 3 devices roles: Central / Advertiser

    / Peripheral

15. #embeddedSEC18 #BleSecurityConf Bluetooth LE Client Write Request Server Confirmation Client

    Write Command Server Server Client Write Command Server Write Client Indication Server Confirmation Client Client Indication Server Confirmation Client Notification Server Notification - Indication Valeur Client Read Request Server Read

16. #embeddedSEC18 #BleSecurityConf BLE Security & Pairing What are we protecting

    against ? • Man In The Middle Attacks • Passive Eavesdropping • Tracking: Broadcasting Identity Information (E.g. Mac Address)

17. #embeddedSEC18 #BleSecurityConf BLE Security & Pairing Phase 1: Pairing Feature

    Exchange How to determine the Temporary Key (TK)? PHASE 1 PHASE 2 PHASE 3 Just Works: It’s actually a key of zero. No I/O needed Passkey Display: 6-digit PIN, when the device has a display Numeric Comparison: LE Secure Connection only (4.2) Out of band (OOB): e.g. using NFC, VLC, kiwink.io

18. #embeddedSEC18 #BleSecurityConf Bluetooth Legacy Pairing Phase 2: Authentication and Encryption

    w/ LEGACY PAIRING • The Temporary Key (TK) is generated using Passkey Entry, OOB, or Just Works pairing methods • TK is authenticated in Passkey Entry & OOB (strength of authentication depends on method used for OOB transfer) • TK is used to generate Short Term Key which will be used to encrypt Phase 3 & subsequent connection PHASE 1 PHASE 2 PHASE 3

19. #embeddedSEC18 #BleSecurityConf Bluetooth 4.2 Pairing Phase 2: Authentication and Encryption

    w/ LE Secure Connection • Elliptic Curve Diffie Hellman Public Key is transmitted & Diffie Hellman Key is generated • Numeric Comparison, Passkey Entry, OOB methods are used to authenticate confirmation values. Just Works uses Numeric Comparison but is unauthenticated with no MITM protection • LTK computed from Diffie Hellman Key & authenticated values PHASE 1 PHASE 2 PHASE 3

20. #embeddedSEC18 #BleSecurityConf BLE Security & Pairing Phase 3: Transport Specific

    Key Distribution and Encryption Uses Diffie-Hellman Key Distribution to share various keys Encrypt the link using a LTK (LE Sec.) or STK (Legacy Encryption) w/ AES-128 CCM (Counter with CBC-MAC) • Identity Resolving Key is used for privacy (IRK), Signing RK • Long Term Key (LTK) exchanged over the air (Legacy Encryption only) PHASE 1 PHASE 2 PHASE 3

21. #embeddedSEC18 #BleSecurityConf BLE Privacy Feature Reduces the ability to trace

    a device over a period of time Use the “resolved” address using the Identity Resolving Key (IRK) IEEE Public Random Private Non Resolvable Random Private Resolvable Random Static

22. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Bluetooth Core Specification “None of the pairing

    methods provide protection against a passive eavesdropper” • TK is used as the key to generate the STK which encrypts the connection • TK is subject to Passive Eavesdropping because it is either 0 or weak entropy (Passkey Entry) • LTK is transmitted over-the-air in Phase 3 PW NED!!

23. #embeddedSEC18 #BleSecurityConf Bluetooth 4.2 Encryption Elliptic Curve Diffie Hellman P-256

    Public/Private Key Exchange (FIPS approved) AES-CMAC authentication is used during Phase 2 to authenticate values used to derive Long Term Key and protect against MITM attacks LTK is derived and never sent over the encrypted link In practice, ~80% of tested devices do not implement BLE-layer encryption

24. #embeddedSEC18 #BleSecurityConf Bluetooth Vulnerabilities Lake of BLE Authentication and/or Encryption

    Hardcoded secrets, default credentials, encryption keys Unsafe Software Implementation Unsafe BLE Driver Implementation Unsafe Protocole Design

25. #embeddedSEC18 #BleSecurityConf BlueBorne Vulnerabilities Bluetooth Driver Implementation https://www.armis.com/blueborne/ Android, Windows,

    iOS & Linux Amazon Echo and Google Home 8 vulnerabilities

26. #embeddedSEC18 #BleSecurityConf BlueBorne Vulnerabilities Heap-based Buffer Overflow Integer Underflow Memory

    Corruption + Privilege Escalation + Remote Code Execution Payload Injection + Remote Code Execution “Heartbleed Like” Data Leak Fake Ip Interface + Packets Interception

27. #embeddedSEC18 #BleSecurityConf BleedingBit Vulnerability Exposes Enterprise Access Points and Unmanaged

    Devices to Undetectable Chip Level Attack TI CC2540 Driver Implementation https://www.armis.com/bleedingbit/ Cisco, Aruba, Meraki router Any CC264x,CC2650,254x CC1350 devices 2 vulnerabilities

28. #embeddedSEC18 #BleSecurityConf BleedingBit Vulnerability • Remote Code Execution (CVE-201816986) Aruba

    Overflow Advertising Backet • Over the Air firmware Download RCE (CVE-2018-708) Hardcoded password • BLE chip exploit to compromise the main OS => access to the WiFi network • Solution: update TI BLE-STACK – Disable Unauthenticated OAD

29. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Hacking Unsafe BLE is Easy! BLE USB

    dongle (CSR8510) Ubertooth nRF or TI Sniffer Wireshark

30. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Many of the vulnerabilities discovered are 10

    years old!

31. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Bluetooth LE Security with nRF52840

32. #embeddedSEC18 #BleSecurityConf nRF52840 « High-end nRF52 multiprotocol SoC for high-performance,

    feature-rich applications with best-in-class security ». 64 MHz Cortex-M4F 1 MB Flash, 256 KB RAM 2.4 GHz Transceiver, NFC-A Bluetooth 5, Bluetooth mesh ANT, 802.15.4, Thread, Zigbee Security Feature: ARM TrustZone® CryptoCell.

33. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf LE SECURE CONNECTION WITH NUMERIC COMPARISON •

    Call pm_init() for initializing the Peer Manager pm_init() • Set the security parameters to be used for all security procedures sec_param.bond = SEC_PARAM_BOND; // 1 sec_param.mitm = SEC_PARAM_MITM; // 1 sec_param.lesc = SEC_PARAM_LESC; // 1 sec_param.keypress = SEC_PARAM_KEYPRESS; // 0 Sec_param.io_caps = BLE_GAP_IO_CAPS_DISPLAY_YESNO pm_sec_params_set() • Subscribe to the Peer Manager events by calling pm_register(). pm_register(). STEP 1: Configure the BLE Peer Manger

34. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf LE SECURE CONNECTION WITH NUMERIC COMPARISON attr_perm_t

    perm[MAX_CHARACTERISTIC]; prop_attr_t prop[MAX_CHARACTERISTIC]; perm[0].perm_read = BLE_GAP_CONN_SEC_MODE_SET_LESC_ENC_WITH_MITM; perm[0].perm_write = BLE_GAP_CONN_SEC_MODE_SET_LESC_ENC_WITH_MITM; prop[0].read = 1; prop[0].write = 1; prop[0].notify = 1; STEP 2: Configure GATT Characteristics Attributes

35. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf LE SECURE CONNECTION WITH NUMERIC COMPARISON •

    Init ARM CryptoCell Peripheral nrf_crypto_init(); • Call lescGenerateKeyPair() to generate the ECDH keys. lescGenerateKeyPair() STEP 3: Generate Cryptographic Keys for ECDH Protocol

36. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf LE SECURE CONNECTION WITH NUMERIC COMPARISON if

    (accept) { key_type = BLE_GAP_AUTH_KEY_TYPE_PASSKEY; } else { key_type = BLE_GAP_AUTH_KEY_TYPE_NONE; } err_code = sd_ble_gap_auth_key_reply(conn_handle, key_type, NULL); STEP 4: Handle Numeric Comparison request

37. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf LE SECURE CONNECTION WITH NUMERIC COMPARISON •

    In Peer Manager handler, disconnect when the connection could not be secured pm_handler_disconnect_on_sec_failure(pm_evt_t const *p_pm_evt) • In BLE Event Manager handler, start security process pm_handler_secure_on_connection(ble_evt_t const *p_ble_evt) STEP 5: Do not miss that!

38. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf LE SECURE CONNECTION WITH NUMERIC COMPARISON •

    Handle the BLE_GAP_EVENT: SEC_PARAMS_REQUEST,AUTH_KEY_REQUEST,PASSKEY_DISPLAY, LESC_DHKEY_REQUEST, AUTH_STATUS • Initiate and send pairing request at the connection • Reject services and characteristics discovery before bonding process ends Some Tips

39. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Conclusion

40. #embeddedSEC18 #BleSecurityConf IoT Security Best Practises Security objectives must be

    considered during the product life cycle! • Security “by design” • Risks analysis • Technologies choices and their threat • Architecture requirements for security • Integration in the project workflow • Security review during the project Sec

41. #embeddedSEC18 #BleSecurityConf Firmware Update • Need to be able to

    update firmware • Automatic updates? • Needs to be tested on all hardware variants • Download path needs to be secure • Update path needs to be secure

42. #embeddedSEC18 #BleSecurityConf sli.do/BleSecurityConf Merci / Thanks you security.rtone.fr #BleSecurityConf |

    sli.do/BleSecurityConf