Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Hey Siri! Hello Barbie! ssmjp

Hey Siri! Hello Barbie! ssmjp

2016/04/28 に #ssmjp で発表した資料です。 @YuhoKameda
・Hey Siri! (Siriを使って機密情報を喋らせてみる)
・Hello Barbie! (喋るBarbieに潜む脆弱性の紹介)

※iPhoneに登録されている情報は、フィクションです

F9b27b006dc2c4f3ca6613073c661834?s=128

Yuho Kameda

April 28, 2016
Tweet

Transcript

  1. Hey Siri! Hello Barbie! #ssmjp 2016/04/28 @YuhoKameda

  2. Profile ُా ༐า : ykame (@YuhoKameda) ZAP Evangelist ޷͖ͳ͜ͱ Web/PF੬ऑੑ਍அ

    SOCɾCSIRT CTF / OSINT
  3. presentation of #ssmjp ZAPͷεεϝ(2014/03/28) Information Gathering (2014/06/17) Hasegawa Night (2015/10/16)

  4. Agenda Hey Siri !! Hello, Barbie !! Siri ͱBarbie ʹXXΛڭ͑ͯ΋Β͓͏

  5. Hey Siri !! ىಈ͢ΔͨΊʹ͸…ɻ Hey Siri ͷઃఆ͕ඞཁ

  6. ӳޠͰઃఆ͢Δͱɺ೔ຊ ޠಡΈͩͱೝࣝ͠ਏ͍

  7. ʲ࢖͍ํʳiOS 9ͷSiriͰग़དྷΔࣄ268ݸΛ·ͱ ΊͯΈͨ http://egg-is-world.com/2015/09/18/ios-9- siri/

  8. ໊ݹ԰Ͱ͏ͳကͷඒຯ ͍͠ళ͸? ͜ΕͳΜͷۂ? ઃఆͷมߋɺXXXXͷ ઃఆΛݟͤͯɺXXXX Λ༗ޮ(Φϯ)ʹͯ͠

  9. Siri ࣗ෼ͷiPhoneΛ୭͔ʹૢ࡞͞ΕΔঢ়گʹ͓͍ ͯɺSiriΛ࢖ͬͯѱ༻͞ΕΔՄೳੑͷ͋Δ͜ͱ Λߟ͑ͯΈͨ

  10. ϩοΫ࣌ɺSiriͷΦϯΦϑઃఆ

  11. ϩοΫΛղ͘ඞཁ͕͋Δ৔ ߹ɾɾɾɻ

  12. ύείʔυ͕ઃఆ͞Ε͍ͯ Δ৔߹ɺSiri͔Β৘ใ͸ฉ͖ ग़ͤͳ͍͜ͱ͕ଟ͍ ؆୯ͳ΋ͷͰྑ͍ͷͰύε ίʔυ͸ઃఆ͠·͠ΐ͏

  13. Siri͔Β৘ใΛฉ͖ग़͢ίπ ܞଳॴ༗ऀͷ໨ઢͰ࣭໰Λ͢Δ ѱ͍ྫ) ஀ੜ೔͸ʁ ྑ͍ྫ) ࢲͷ஀ੜ೔͸ʁ

  14. ͜ͷܞଳͷ࣋ͪओͷ໊લ ͸ʁ(ϩοΫ༗) ࢲ͸୭ʁ(ϩοΫ༗)

  15. ࢲͷ஀ੜ೔͸ʁ(ϩοΫແ)

  16. ࣗ୐ͷॅॴ͸ʁ(ϩοΫແ)

  17. ؔ܎৘ใΛొ࿥͍ͯ͠Δ ͱɾɾɾɻ

  18. ࢲͷ൴ঁͷ໊લ͸ʁ(ϩοΫঢ় ଶ) ࿈བྷઌʹొ࿥͞Ε͍ͯΔ৔߹ɿ

  19. ࢲͷ൴ঁͷ໊લ͸ʁ(ϩοΫঢ় ଶ) ࿈བྷઌʹొ࿥͞Ε͍ͯͳ͍৔߹ɿ

  20. ൃ৴ཤྺΛݟͤͯ(ϩοΫແ)

  21. ൃ৴ཤྺΛݟͤͯ(ϩοΫ༗)

  22. ΞϥʔϜΛશ෦Φϯʹͯ͠ (ϩοΫ༗)

  23. [༑ୡΛ୳͢ػೳ] ࢁాଠ࿠͞Μ͕ՈʹؼͬͨΒ ڭ͑ͯ

  24. ࣗ୐ͷॅॴΛڭ͑ͯ ࢲͷ஀ੜ೔͸ʁ ൴ঁͷ࿈བྷઌΛڭ͑ͯ 090-xxxx-xxxxʹςετͰ͢ͱϝοηʔδΛૹ৴ ࢁా͞Μʹ࣮͸ؾʹͳ͍ͬͯ·ͨ͠ͱϝοηʔδ ࢁా͞Μ͔Β࠷৽ͷϝοηʔδΛಡΈ্͛ͯ ΰʔϧσϯ΢ΟʔΫͷ༧ఆ͸ʁ ̎̌̍̑೥݄̍̎̎̐೔ͷ༧ఆ͸ʁ ࢲͷπΠʔτΛݟͤͯ Facebookʹ݁ࠗ͠·͢ͱ౤ߘ

  25. ࣗ୐ͷॅॴΛڭ͑ͯ ࢲͷ஀ੜ೔͸ʁ ൴ঁͷ࿈བྷઌΛڭ͑ͯ 090-xxxx-xxxxʹςετͰ͢ͱϝοηʔδΛૹ৴ ࢁా͞Μʹ࣮͸ؾʹͳ͍ͬͯ·ͨ͠ͱϝοηʔδ ࢁా͞Μ͔Β࠷৽ͷϝοηʔδΛಡΈ্͛ͯ ΰʔϧσϯ΢ΟʔΫͷ༧ఆ͸ʁ ̎̌̍̑೥݄̍̎̎̐೔ͷ༧ఆ͸ʁ ࢲͷπΠʔτΛݟͤͯ Facebookʹ݁ࠗ͠·͢ͱ౤ߘ

  26. ·ͱΊ ൴ࢯ/൴ঁ/Ո଒ؔ܎/ձࣾ/ࣗ୐ ৄ͘͠ొ࿥͍ͯ͠Δ΄Ͳѱ༻͞ΕΔՄೳੑ͕ ্͕Δ SiriΛ௨ͯ͠ԿΛ࣮ߦ͞Ε͔ͨޙ͔Βௐ΂ΒΕ ͳ͍

  27. Hello, Barbie!! Barbieਓܗ!!

  28. Barbieͷྺ࢙ 1959೥3݄9೔ɹϚςϧ͔ࣾΒൃച 1962೥ɹ೔ຊͰൢച։࢝ 1967೥ɹϦΧͪΌΜਓܗͷൃചʹΑͬͯఫୀ 1986೥ɹλΧϥͱఏܞޙɺղফͰδΣχʔͱͯ͠ൢച 1989೥ɹϚςϧ͔ࣾΒόʔϏʔͱͯ͠࠶ൢച͢Δ΋ఏૌ͞Εൢചऴྃ 2003೥ɹϚςϧࣾόʔϏʔ͕όϯμΠ͔Βൢച͞ΕΔ΋ఏܞղফ ݱࡏɹ೔ຊ๏ਓϚςϧɾΠϯλʔφγϣφϧ͔ΒόʔϏʔ͕ൢച

  29. Barbie ຊ໊ : όʔόϥɾϛϦηϯτɾϩόʔπ ೥ྸ : 17ࡀ ৬ۀ : ϑΝογϣϯϞσϧ

    ϘʔΠϑϨϯυͷ໊લ͸έϯ
  30. Hello Barbie ։ൃݩ : T oy T alk Ձ֨ :

    $74.99 (ࠃ಺AmazonͰ14,000ԁ) ػೳ Ի੠ೝࣝػೳΛ౥ࡌ Wi-FiΛ౥ࡌ ࢠͲ΋ͷϓϥΠόγʔ ৵֐ͩʂʂʂ
  31. Hello Barbie 2015೥3݄ɹT oy Fair 2015Ͱൃද(prototype) 2015೥11݄10೔ɹHello Barbieൃച 2015೥12݄4೔ɹPOODLE

  32. Hello Barbieͷಛ௃ ΞϓϦͰ࢖༻ڐ୚ͷಉҙ͕ඞཁ(྆਌Λ૝ఆ) ϕϧτͷϘλϯΛԡ͍ͯ͠ΔؒͷΈձ࿩ ه࿥͞ΕͨԻ੠͸҉߸Խ͠T oyT alkαʔό΁ૹ৴ टݩʹϨίʔμʔͱϚΠΫ 2015/9/4࣌఺Ͱ໿8,000ͷձ࿩ू http://hellobarbiefaq.mattel.com/wp-content/uploads/2015/08/hellobarbie-lines-v1.pdf

  33. ૣ଎ങͬͯࢼͯ͠Έ·ͨ͠

  34. Hello Barbieىಈํ๏ Hello Barbie companion AppΛΠϯετʔϧ BarbieΛى͜͢(ϕϧτԡ͢ͱిݯىಈ)

  35. Hello Barbie companion App ೔ຊͰ͸഑෍ແ͠ ver 1.0ɹ2015/11/16 ver 1.1ɹ2015/11/24 ver

    1.2ɹ2015/12/6 ver 1.3ɹ2016/3/22
  36. None
  37. None
  38. http://offers.bluebox.com/rs/080-XOX-229/images/wp-hello-barbie.pdf

  39. https://static1.squarespace.com/static/543effd8e4b095fba39dfe59/t/ 56a66d424bf1187ad34383b2/1453747529070/HelloBarbieSecurityAnalysis.pdf

  40. ঢ়گ ωοτϫʔΫ໊ɺΞΧ΢ϯτIDɺMP3ͷ౪ௌ ηοτΞοϓதʹىಈ͢ΔWi-FiωοτϫʔΫ໊(e.g. Barbie-1243) ηοτΞοϓதʹࢿ֨৘ใΛૹ৴ αʔόଆͱϞόΠϧΞϓϦͷ྆ํʹ໰୊͋Γ iOS / AndroidΞϓϦͦΕͧΕʹόά͋Γ pkcs12(.p12)ύεϫʔυ͕ϋʔυίʔυ

    ূ໌ॻ͸DecryptՄೳ
  41. ·ͱΊ Internet of Things͸߈ܸͷର৅ʂ ϦϦʔεલʹ͸ɺηΩϡϦςΟ਍அ΍߈ܸ͞ ΕΔ૝ఆΛςετ͠·͠ΐ͏ Attack Surface(߈ܸ͞ΕΔڪΕͷ͋Δڥք) Λཧղ͢Δ͜ͱ͕ॏཁ(Threat Modeling)

  42. Link Privacy Policy : https://www.toytalk.com/hellobarbie/ privacy/ Ϩϙʔτ : http://offers.bluebox.com/rs/080-XOX-229/ images/wp-hello-barbie.pdf

    Ϩϙʔτ2 : https://static1.squarespace.com/static/ 543effd8e4b095fba39dfe59/t/ 56a66d424bf1187ad34383b2/1453747529070/ HelloBarbieSecurityAnalysis.pdf
  43. Contact Social Account : @YuhoKameda