Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Hey Siri! Hello Barbie! ssmjp

Hey Siri! Hello Barbie! ssmjp

2016/04/28 に #ssmjp で発表した資料です。 @YuhoKameda
・Hey Siri! (Siriを使って機密情報を喋らせてみる)
・Hello Barbie! (喋るBarbieに潜む脆弱性の紹介)

※iPhoneに登録されている情報は、フィクションです

Yuho Kameda

April 28, 2016
Tweet

More Decks by Yuho Kameda

Other Decks in Technology

Transcript

  1. Hey Siri! Hello Barbie!
    #ssmjp 2016/04/28
    @YuhoKameda

    View full-size slide

  2. Profile
    ُా ༐า : ykame (@YuhoKameda)
    ZAP Evangelist
    ޷͖ͳ͜ͱ
    Web/PF੬ऑੑ਍அ
    SOCɾCSIRT
    CTF / OSINT

    View full-size slide

  3. presentation of #ssmjp
    ZAPͷεεϝ(2014/03/28)
    Information Gathering (2014/06/17)
    Hasegawa Night (2015/10/16)

    View full-size slide

  4. Agenda
    Hey Siri !!
    Hello, Barbie !!
    Siri ͱBarbie ʹXXΛڭ͑ͯ΋Β͓͏

    View full-size slide

  5. Hey Siri !!
    ىಈ͢ΔͨΊʹ͸…ɻ
    Hey Siri ͷઃఆ͕ඞཁ

    View full-size slide

  6. ӳޠͰઃఆ͢Δͱɺ೔ຊ
    ޠಡΈͩͱೝࣝ͠ਏ͍

    View full-size slide

  7. ʲ࢖͍ํʳiOS 9ͷSiriͰग़དྷΔࣄ268ݸΛ·ͱ
    ΊͯΈͨ
    http://egg-is-world.com/2015/09/18/ios-9-
    siri/

    View full-size slide

  8. ໊ݹ԰Ͱ͏ͳကͷඒຯ
    ͍͠ళ͸?
    ͜ΕͳΜͷۂ?
    ઃఆͷมߋɺXXXXͷ
    ઃఆΛݟͤͯɺXXXX
    Λ༗ޮ(Φϯ)ʹͯ͠

    View full-size slide

  9. Siri
    ࣗ෼ͷiPhoneΛ୭͔ʹૢ࡞͞ΕΔঢ়گʹ͓͍
    ͯɺSiriΛ࢖ͬͯѱ༻͞ΕΔՄೳੑͷ͋Δ͜ͱ
    Λߟ͑ͯΈͨ

    View full-size slide

  10. ϩοΫ࣌ɺSiriͷΦϯΦϑઃఆ

    View full-size slide

  11. ϩοΫΛղ͘ඞཁ͕͋Δ৔
    ߹ɾɾɾɻ

    View full-size slide

  12. ύείʔυ͕ઃఆ͞Ε͍ͯ
    Δ৔߹ɺSiri͔Β৘ใ͸ฉ͖
    ग़ͤͳ͍͜ͱ͕ଟ͍
    ؆୯ͳ΋ͷͰྑ͍ͷͰύε
    ίʔυ͸ઃఆ͠·͠ΐ͏

    View full-size slide

  13. Siri͔Β৘ใΛฉ͖ग़͢ίπ
    ܞଳॴ༗ऀͷ໨ઢͰ࣭໰Λ͢Δ
    ѱ͍ྫ) ஀ੜ೔͸ʁ
    ྑ͍ྫ) ࢲͷ஀ੜ೔͸ʁ

    View full-size slide

  14. ͜ͷܞଳͷ࣋ͪओͷ໊લ
    ͸ʁ(ϩοΫ༗)
    ࢲ͸୭ʁ(ϩοΫ༗)

    View full-size slide

  15. ࢲͷ஀ੜ೔͸ʁ(ϩοΫແ)

    View full-size slide

  16. ࣗ୐ͷॅॴ͸ʁ(ϩοΫແ)

    View full-size slide

  17. ؔ܎৘ใΛొ࿥͍ͯ͠Δ
    ͱɾɾɾɻ

    View full-size slide

  18. ࢲͷ൴ঁͷ໊લ͸ʁ(ϩοΫঢ়
    ଶ)
    ࿈བྷઌʹొ࿥͞Ε͍ͯΔ৔߹ɿ

    View full-size slide

  19. ࢲͷ൴ঁͷ໊લ͸ʁ(ϩοΫঢ়
    ଶ)
    ࿈བྷઌʹొ࿥͞Ε͍ͯͳ͍৔߹ɿ

    View full-size slide

  20. ൃ৴ཤྺΛݟͤͯ(ϩοΫແ)

    View full-size slide

  21. ൃ৴ཤྺΛݟͤͯ(ϩοΫ༗)

    View full-size slide

  22. ΞϥʔϜΛશ෦Φϯʹͯ͠
    (ϩοΫ༗)

    View full-size slide

  23. [༑ୡΛ୳͢ػೳ]
    ࢁాଠ࿠͞Μ͕ՈʹؼͬͨΒ
    ڭ͑ͯ

    View full-size slide

  24. ࣗ୐ͷॅॴΛڭ͑ͯ
    ࢲͷ஀ੜ೔͸ʁ
    ൴ঁͷ࿈བྷઌΛڭ͑ͯ
    090-xxxx-xxxxʹςετͰ͢ͱϝοηʔδΛૹ৴
    ࢁా͞Μʹ࣮͸ؾʹͳ͍ͬͯ·ͨ͠ͱϝοηʔδ
    ࢁా͞Μ͔Β࠷৽ͷϝοηʔδΛಡΈ্͛ͯ
    ΰʔϧσϯ΢ΟʔΫͷ༧ఆ͸ʁ
    ̎̌̍̑೥݄̍̎̎̐೔ͷ༧ఆ͸ʁ
    ࢲͷπΠʔτΛݟͤͯ
    Facebookʹ݁ࠗ͠·͢ͱ౤ߘ

    View full-size slide

  25. ࣗ୐ͷॅॴΛڭ͑ͯ
    ࢲͷ஀ੜ೔͸ʁ
    ൴ঁͷ࿈བྷઌΛڭ͑ͯ
    090-xxxx-xxxxʹςετͰ͢ͱϝοηʔδΛૹ৴
    ࢁా͞Μʹ࣮͸ؾʹͳ͍ͬͯ·ͨ͠ͱϝοηʔδ
    ࢁా͞Μ͔Β࠷৽ͷϝοηʔδΛಡΈ্͛ͯ
    ΰʔϧσϯ΢ΟʔΫͷ༧ఆ͸ʁ
    ̎̌̍̑೥݄̍̎̎̐೔ͷ༧ఆ͸ʁ
    ࢲͷπΠʔτΛݟͤͯ
    Facebookʹ݁ࠗ͠·͢ͱ౤ߘ

    View full-size slide

  26. ·ͱΊ
    ൴ࢯ/൴ঁ/Ո଒ؔ܎/ձࣾ/ࣗ୐
    ৄ͘͠ొ࿥͍ͯ͠Δ΄Ͳѱ༻͞ΕΔՄೳੑ͕
    ্͕Δ
    SiriΛ௨ͯ͠ԿΛ࣮ߦ͞Ε͔ͨޙ͔Βௐ΂ΒΕ
    ͳ͍

    View full-size slide

  27. Hello, Barbie!!
    Barbieਓܗ!!

    View full-size slide

  28. Barbieͷྺ࢙
    1959೥3݄9೔ɹϚςϧ͔ࣾΒൃച
    1962೥ɹ೔ຊͰൢച։࢝
    1967೥ɹϦΧͪΌΜਓܗͷൃചʹΑͬͯఫୀ
    1986೥ɹλΧϥͱఏܞޙɺղফͰδΣχʔͱͯ͠ൢച
    1989೥ɹϚςϧ͔ࣾΒόʔϏʔͱͯ͠࠶ൢച͢Δ΋ఏૌ͞Εൢചऴྃ
    2003೥ɹϚςϧࣾόʔϏʔ͕όϯμΠ͔Βൢച͞ΕΔ΋ఏܞղফ
    ݱࡏɹ೔ຊ๏ਓϚςϧɾΠϯλʔφγϣφϧ͔ΒόʔϏʔ͕ൢച

    View full-size slide

  29. Barbie
    ຊ໊ : όʔόϥɾϛϦηϯτɾϩόʔπ
    ೥ྸ : 17ࡀ
    ৬ۀ : ϑΝογϣϯϞσϧ
    ϘʔΠϑϨϯυͷ໊લ͸έϯ

    View full-size slide

  30. Hello Barbie
    ։ൃݩ : T
    oy T
    alk
    Ձ֨ : $74.99 (ࠃ಺AmazonͰ14,000ԁ)
    ػೳ
    Ի੠ೝࣝػೳΛ౥ࡌ
    Wi-FiΛ౥ࡌ
    ࢠͲ΋ͷϓϥΠόγʔ
    ৵֐ͩʂʂʂ

    View full-size slide

  31. Hello Barbie
    2015೥3݄ɹT
    oy Fair 2015Ͱൃද(prototype)
    2015೥11݄10೔ɹHello Barbieൃച
    2015೥12݄4೔ɹPOODLE

    View full-size slide

  32. Hello Barbieͷಛ௃
    ΞϓϦͰ࢖༻ڐ୚ͷಉҙ͕ඞཁ(྆਌Λ૝ఆ)
    ϕϧτͷϘλϯΛԡ͍ͯ͠ΔؒͷΈձ࿩
    ه࿥͞ΕͨԻ੠͸҉߸Խ͠T
    oyT
    alkαʔό΁ૹ৴
    टݩʹϨίʔμʔͱϚΠΫ
    2015/9/4࣌఺Ͱ໿8,000ͷձ࿩ू
    http://hellobarbiefaq.mattel.com/wp-content/uploads/2015/08/hellobarbie-lines-v1.pdf

    View full-size slide

  33. ૣ଎ങͬͯࢼͯ͠Έ·ͨ͠

    View full-size slide

  34. Hello Barbieىಈํ๏
    Hello Barbie companion AppΛΠϯετʔϧ
    BarbieΛى͜͢(ϕϧτԡ͢ͱిݯىಈ)

    View full-size slide

  35. Hello Barbie companion App
    ೔ຊͰ͸഑෍ແ͠
    ver 1.0ɹ2015/11/16
    ver 1.1ɹ2015/11/24
    ver 1.2ɹ2015/12/6
    ver 1.3ɹ2016/3/22

    View full-size slide

  36. http://offers.bluebox.com/rs/080-XOX-229/images/wp-hello-barbie.pdf

    View full-size slide

  37. https://static1.squarespace.com/static/543effd8e4b095fba39dfe59/t/
    56a66d424bf1187ad34383b2/1453747529070/HelloBarbieSecurityAnalysis.pdf

    View full-size slide

  38. ঢ়گ
    ωοτϫʔΫ໊ɺΞΧ΢ϯτIDɺMP3ͷ౪ௌ
    ηοτΞοϓதʹىಈ͢ΔWi-FiωοτϫʔΫ໊(e.g. Barbie-1243)
    ηοτΞοϓதʹࢿ֨৘ใΛૹ৴
    αʔόଆͱϞόΠϧΞϓϦͷ྆ํʹ໰୊͋Γ
    iOS / AndroidΞϓϦͦΕͧΕʹόά͋Γ
    pkcs12(.p12)ύεϫʔυ͕ϋʔυίʔυ
    ূ໌ॻ͸DecryptՄೳ

    View full-size slide

  39. ·ͱΊ
    Internet of Things͸߈ܸͷର৅ʂ
    ϦϦʔεલʹ͸ɺηΩϡϦςΟ਍அ΍߈ܸ͞
    ΕΔ૝ఆΛςετ͠·͠ΐ͏
    Attack Surface(߈ܸ͞ΕΔڪΕͷ͋Δڥք)
    Λཧղ͢Δ͜ͱ͕ॏཁ(Threat Modeling)

    View full-size slide

  40. Link
    Privacy Policy : https://www.toytalk.com/hellobarbie/
    privacy/
    Ϩϙʔτ : http://offers.bluebox.com/rs/080-XOX-229/
    images/wp-hello-barbie.pdf
    Ϩϙʔτ2 : https://static1.squarespace.com/static/
    543effd8e4b095fba39dfe59/t/
    56a66d424bf1187ad34383b2/1453747529070/
    HelloBarbieSecurityAnalysis.pdf

    View full-size slide

  41. Contact
    Social Account : @YuhoKameda

    View full-size slide