Reversing IoT: Xiaomi Ecosystem Gain cloud independence and - PowerPoint PPT Presentation

Backside layout mainboard LIDAR UART R16 UART (115200 baud) Tx STM UART Rx (921600 baud) Tx 38 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Frontside layout mainboard (GEN2) R16 512 MB STM32 SOC RAM MCU 4GB WiFi Module eMMC Flash 39 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Rooting • Usual (possibly destructive) way to retrieve the firmware 40 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Rooting • Usual (possibly destructive) way to retrieve the firmware 41 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Rooting Our weapon of choice: 42 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Pin Layout CPU UART0 MMC2 MMC1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 MMC Reset D6 D4 D2 D0 D2 D0 CLK TX UART1 A D7 D5 D3 D1 D3 D1 RX CMD B CLK SDA TWI1 C RX TX SCL CMD D E Recov Confir UART2 ery m F RX TX G Line IN L H LINE J IN R PHO NE IN K PHO NE IN L PHO MIC1 M NE P PHO MIC2 N NE P SDA SCK RESET RSB0 P R USB- USB- LCD9 LCD7 LCD5 LCD3 LCD1 USB 1 DM0 DP0 T USB USB- USB- LCD8 LCD6 LCD4 LCD2 LCD0 DRV DM1 DP1 USB 2 U DRAM VCC/VDD GND LCD 43 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Rooting Initial Idea: • Shortcut the MMC data lines • SoC falls back to FEL mode • Load + Execute tool in RAM – Via USB connector – Dump MMC flash – Modify image – Rewrite image to flash 44 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Software • Ubuntu 14.04.3 LTS (Kernel 3.4.xxx) – Mostly untouched, patched on a regular base • Player 3.10-svn – Open-Source Cross-platform robot device interface & server • Proprietary software (/opt/rockrobo) – AppProxy – RoboController – Miio_Client – Custom adbd-version • iptables firewall enabled – Blocks Port 22 (SSHd) + Port 6665 (player) 45 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Available data on device • Data – Logfiles (syslogs, duration, area, ssid, passwd) – “/ usr/sbin/tcpdump -i any -s 0 -c 2000 –w” – Maps – Multiple MBytes/day • Data is uploaded to cloud • Factory reset – Restores recovery to system – Does not delete data • Maps, Logs still exist 46 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Available data on device • Maps – Created by player – 1024px * 1024px – 1px = 5cm 47 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Available data on device Northeastern University, ISEC Building, 6th floor 48 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Communication relations <-soundpackages, firmware compass uart_lds uart_mcu maps,logs-> *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 ot.io.mi.com:80(tcp) wifimgr ott.io.mi.com:8053(udp) RoboController <-commands, AES encrypted Miio_client reports-> (local):54322 (tcp) AppProxy Android/ 0.0.0.0:54321 (udp) iPhone App Robot intern IPC plain json (tcp) enc(key) json (tcp/udp) enc(token) json (udp) 49 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

eMMC Layout Label Content Size in MByte boot-res bitmaps & some wav files 8 env uboot cmd line 16 app device.conf (DID, key, MAC), adb.conf, vinda 16 recovery fallback copy of OS 512 system_a copy of OS (active by default) 512 system_b copy of OS (passive by default) 512 Download temporary unpacked OS update 528 reserve config + calibration files, blackbox.db 16 UDISK/Data logs, maps, pcap files ~1900 50 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

eMMC Layout Label Content Size in MByte boot-res bitmaps & some wav files 8 env uboot cmd line 16 app device.conf (DID, key, MAC), adb.conf, vinda 16 recovery fallback copy of OS 512 system_a copy of OS (active by default) 512 system_b copy of OS (passive by default) 512 Download temporary unpacked OS update 528 reserve config + calibration files, blackbox.db 16 UDISK/Data logs, maps, pcap files ~1900 51 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process 52 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process miIO.ota {"mode":"normal “, "install":"1", "app_url":"https://[URL]/v11_[version].pkg", "file_md5":“[md5]",”proc":" dnld install“} 53 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process 54 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data 2. Download [app_url] 55 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data 2. Download [app_url] 56 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data 57 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data MD5 ok? 58 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data Decrypt + image OK? 59 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data Unpack + dd 60 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Update root pw Download in /etc/shadow Data 61 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download dd Data 62 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process Active system_a copy system_b Download Data rebooting … 63 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process system_a Active system_b copy Download Data rebooting … 64 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process system_a dd Active system_b copy Download Data 65 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Update process system_a Active system_b copy Download Data 66 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Firmware updates • Full and partial images – Encrypted tar.gz archives – Full image contains disk.img • 512 Mbyte ext4-filesystem • Encryption – Static password: “ rockrobo ” – Ccrypt [256-bit Rijndael encryption (AES)] • Integrity – MD5 provided by cloud 67 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Firmware updates • Full and partial images – Encrypted tar.gz archives – Full image contains disk.img • 512 Mbyte ext4-filesystem • Encryption Sound Packages Static password: “r0ckrobo#23456” – Static password: “ rockrobo ” – Ccrypt [256-bit Rijndael encryption (AES)] • Integrity – MD5 provided by cloud 68 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

69 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely • Preparation: Rebuild Firmware – Include authorized_keys – Remove iptables rule for sshd • Send „ miIO.ota “ command to vacuum – Encrypted with token • From app or unprovisioned state – Pointing to own http server 70 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely unprovisioned state Webserver 71 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely „ Get Token“ unprovisioned state Webserver 72 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely „ Get Token“ unprovisioned state Webserver 73 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely „ Get Token“ „ miIO.ota “ unprovisioned state Webserver 74 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely „ Get Token“ „ miIO.ota “ unprovisioned state Webserver 75 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Lets root remotely „ Get Token“ „ miIO.ota “ Webserver 76 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

SSH 77 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

78 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

79 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

80 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

81 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

82 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Gain Independence Xiaomi Cloud Two methods: • Replacing the cloud interface • Proxy cloud communication 83 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Replacing the cloud interface compass uart_lds uart_mcu *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 ot.io.mi.com:80(tcp) wifimgr ott.io.mi.com:8053(udp) RoboController <-commands, My cloud client Miio_client reports-> (local):54322 (tcp) (local):54322 (tcp) AppProxy Android/ 0.0.0.0:54321 (udp) https, mqtt , etc… iPhone App Robot intern IPC plain json (tcp) enc(key) json (tcp/udp) enc(token) json (udp) 84 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Replacing the cloud interface compass uart_lds uart_mcu *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 wifimgr RoboController <-commands, reports-> AppProxy Robot intern IPC plain json (tcp) enc(key) json (tcp/udp) enc(token) json (udp) 85 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Replacing the cloud interface compass uart_lds uart_mcu *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 wifimgr RoboController <-commands, My cloud client reports-> (local):54322 (tcp) AppProxy FHEM https, mqtt , etc… Home Assistant Robot intern IPC plain json (tcp) enc(key) json (tcp/udp) enc(token) json (udp) 86 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Replacing the cloud interface compass uart_lds uart_mcu player 0.0.0.0:6665 wifimgr RoboController <-commands, My cloud client reports-> (local):54322 (tcp) AppProxy FHEM https, mqtt , etc… Home Assistant /etc/hosts Robot intern IPC 127.0.0.1 awsbj0... plain json (tcp) 127.0.0.1 aswbj0- files… enc(key) json (tcp/udp) 127.0.0.1 cdn.cnbj0…. enc(token) json (udp) 87 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Proxy cloud communication compass uart_lds uart_mcu *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 ot.io.mi.com:80(tcp) wifimgr ott.io.mi.com:8053(udp) RoboController <-commands, Miio_client reports-> (local):54322 (tcp) AppProxy Android/ 0.0.0.0:54321 (udp) iPhone App Robot intern IPC plain json (tcp) enc(key) json (tcp/udp) enc(token) json (udp) 88 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Proxy cloud communication compass uart_lds uart_mcu *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 ot.io.mi.com:80(tcp) wifimgr ott.io.mi.com:8053(udp) RoboController <-commands, Miio_client reports-> (local):54322 (tcp) AppProxy Android/ 0.0.0.0:54321 (udp) iPhone App Robot intern IPC plain json (tcp) enc(key) json (tcp/udp) enc(token) json (udp) 89 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Proxy cloud communication compass uart_lds uart_mcu *.fds.api.xiaomi.com (https) player 0.0.0.0:6665 ot.io.mi.com:80(tcp) wifimgr ott.io.mi.com:8053(udp) Dustcloud RoboController <-commands, Miio_client reports-> (local):54322 (tcp) AppProxy Android/ 0.0.0.0:54321 (udp) iPhone App Robot intern IPC /etc/hosts plain json (tcp) enc(key) json (tcp/udp) 130.83.x.x ot.io.mi.com enc(token) json (udp) 130.83.x.x ot.io.mi.com 90 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Summary of the Vacuum • Rooting – Remote ! • Cloud Connection – Run without cloud – Run with your own cloud • Our goal: We want the Cloudkeys! 91 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

SMART HOME GATEWAY, LIGHTBULBS AND LED STRIPS 92 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Xiaomi Ecosystem HTTPS Xiaomi Cloud ZigBee Gateway 93 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Xiaomi Ecosystem HTTPS Xiaomi Cloud ZigBee Gateway 94 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Overview Hardware • Application-MCU: Marvell 88MW30x – ARM Cortex-M4F @ 200 MHz – RAM : 512KByte SRAM – QSPI interface, supports XIP – Flash : 16 MByte (Gateway) • 4 Mbyte SPI (LED Strip, Lightbulb) – Integrated 802.11b/g/n WiFi Core • Zigbee-MCU: NXP JN5169 (Gateway only) – 32-bit RISC CPU – RAM: 32 kB – Flash: 512 kB embedded Flash, 4 kB EEPROM 95 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Sensors connected via gateway Zigbee (NXP JN5169) based • Door Sensor (Reed contact) • Temperature sensor • Power Plug • Motion Sensor • Button • Smoke Detector • Smart Door Lock • … 96 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Acquiring the Key • PCB got lots of testing points • SWD is enabled by default SDCLK SDIO RST TX* GND RX* *UART We can get the key from the memdump 97 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Acquiring the Key • Can we get the Key without a hardware attack? • Firmware updates are not signed … 98 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Acquiring the Key • Can we get the Key without a hardware attack? • Firmware updates are not signed … 99 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer

Acquiring the Key • Can we get the Key without a hardware attack? • Firmware updates are not signed … Lets create a modified firmware which gives us the key automatically! 100 ReCon BRX 2018 – Dennis Giese, Daniel Wegemer