Name: Fintech Insights - Securing Fintech, Hacking Smart Devices and the UK PSTI Law
Uploaded: 2024-08-07T11:16:44.184Z
Duration: 337.14
Description: Fintech Insights explores the dangers of smart devices being hacked with Ken Munro, Managing Partner at Pen Test Partners LLP during the Centre Stage.

Fintech Insights - Securing Fintech & Smart Devices.mp4

Fintech Insights - Securing Fintech & Smart Devices.vtt

ENGLISH

{{00:00:12}}
So the UK PSTI is a real step
forward for smart device security.

{{00:00:16}}
Designed to stop really insecure products
like this rather cute little dolly, who

{{00:00:21}}
we discovered we could make her swear,
and snoop on kids, to stop that happening.

{{00:00:27}}
And there are three fundamental
principles of the PSTI.

{{00:00:30}}
Number one is no default passwords.

{{00:00:32}}
So you can't leave a password blank,
default, or it's really not good enough.

{{00:00:35}}
And that's great.

{{00:00:36}}
It stops products like this
getting onto the market.

{{00:00:40}}
You also need to state how long you're
going to secure the product for.

{{00:00:42}}
How long are you going to
keep updates coming out?

{{00:00:44}}
And finally, you need to have a
vulnerability disclosure policy, so that

{{00:00:48}}
when researchers and other people like
us find bugs in your product, you've got

{{00:00:53}}
a way that they can easily get in touch
with you and get that vulnerability fixed.

{{00:01:04}}
So the bugs that bother me the most
in smart devices are those that can

{{00:01:08}}
be used to destabilize the rest of
the internet that we use every day.

{{00:01:12}}
And a great example of that was the
Mirai botnet that It was misunderstood,

{{00:01:16}}
but actually affected a large
number of consumer digital video

{{00:01:19}}
recorders on home CCTVs, or DVRs.

{{00:01:22}}
Now, they weren't well secured, and
as a result of which, a couple of

{{00:01:26}}
smart researchers realised you could
cause them to start sending traffic

{{00:01:30}}
and create a denial of service attack.

{{00:01:33}}
But that affected so many different
DVRs it became a distributed denial

{{00:01:37}}
of service attack, and took down
the DNS providers for several

{{00:01:41}}
mainstream social media channels.

{{00:01:43}}
Now, as a result of that, rather
fortunately, those DVRs didn't

{{00:01:49}}
actually they weren't very stable, so
they kept rebooting, and it made it

{{00:01:53}}
difficult to keep the scale of DDoS up.

{{00:01:56}}
It gives us a flavor of just
how bad security problems with

{{00:02:00}}
smart devices can actually be.

{{00:02:02}}
And an example here, this is a
CCTV camera from quite a well known

{{00:02:06}}
brand, and this had a problem.

{{00:02:08}}
It wasn't correctly sending
you the right home TV footage.

{{00:02:14}}
It wasn't showing you your home.

{{00:02:15}}
It would accidentally show
you somebody else's house.

{{00:02:18}}
Now imagine that in the
context of your organization.

{{00:02:20}}
CCTV inside and it's showing
you the wrong organization.

{{00:02:25}}
Potential for spying
and data theft is huge.

{{00:02:36}}
So smart devices in buildings and
businesses can be a bit more interesting

{{00:02:39}}
because they're often found in cupboards
under the stairs, in plant rooms,

{{00:02:43}}
and maybe not subject to the usual
security oversight you might have.

{{00:02:46}}
And this is an interesting example.

{{00:02:48}}
This we found at a major airport.

{{00:02:49}}
It's a building management controller.

{{00:02:51}}
And it controls the smart door locks,
meeting booking rooms, heating,

{{00:02:55}}
ventilation, air conditioning.

{{00:02:57}}
And we discovered vulnerabilities
so bad in this, we could actually

{{00:02:59}}
trip the entire building offline.

{{00:03:02}}
So it's not just about your IT systems.

{{00:03:05}}
You need to think really
carefully about the systems that

{{00:03:08}}
enable your buildings to run.

{{00:03:10}}
Because if you haven't got a
building, it can be a whole lot

{{00:03:12}}
more difficult to run your business.

{{00:03:21}}
So I've given TED Talks about the cyber
security of smart devices, and there are

{{00:03:26}}
a couple of things that really irked me.

{{00:03:28}}
One was this device, which is a
smart tracking watch for kids.

{{00:03:31}}
So if you lose your kids in the
park, you can find them easily again.

{{00:03:35}}
Hey, I'm a bad parent,
it's happened to me.

{{00:03:37}}
But unfortunately, this is effectively
a phone inside a watch, and the result

{{00:03:43}}
of security problems in that, it meant
that anyone could track your kid.

{{00:03:47}}
Worse, they could change where your
child appeared to be, and they could

{{00:03:51}}
speak to, and bug, your child too.

{{00:03:55}}
So the potential for privacy
invasion is absolutely huge.

{{00:03:58}}
Now that was an API flaw.

{{00:04:00}}
So the connection between the smart
device and the cloud, where they

{{00:04:02}}
hadn't got authorization done properly.

{{00:04:05}}
But other examples that we find, so this
is a smart thermostat, can be used in

{{00:04:10}}
commercial premises too, and we showed
that through vulnerabilities in the

{{00:04:14}}
hardware, so the chipsets, problems with
the firmware, that we could successfully

{{00:04:18}}
run Ransomware on a smart device, so
it no longer works, you've lost control

{{00:04:24}}
of your home, parts of your office.

{{00:04:26}}
Now we did that as proof of concept,
we didn't publish the code, but

{{00:04:29}}
hopefully we'll see manufacturers
start to improve so bad actors

{{00:04:34}}
can't do the same sort of things.

{{00:04:43}}
Now I'm often asked about the future.

{{00:04:45}}
Is the cybersecurity of
smart devices getting better?

{{00:04:48}}
And very sadly I was somewhat
let down by Fisher Price Mattel.

{{00:04:52}}
They, published this, which is a smart
version of the toy that we had as a kid.

{{00:04:55}}
I had one of these.

{{00:04:57}}
Very sadly, it's got exactly the
same cybersecurity problems as my

{{00:05:01}}
friend Kayla, the swearing doll.

{{00:05:03}}
So even six years later, we still
see the same vulnerabilities.

{{00:05:07}}
Now, regulation and
legislation is helping things.

{{00:05:10}}
Manufacturers are starting to
realise that there's actual real

{{00:05:13}}
value to doing cyber security well.

{{00:05:15}}
It'll help their products sell.

{{00:05:17}}
But, it worries me over time, in the
future, that perhaps not quite enough

{{00:05:22}}
is being done to make sure that our
children, our homes, and our offices

{{00:05:27}}
are being kept really safe and secure.

So the UK PSTI is a real step
forward for smart device security.

Designed to stop really insecure products
like this rather cute little dolly, who

we discovered we could make her swear,
and snoop on kids, to stop that happening.

And there are three fundamental
principles of the PSTI.

So you can't leave a password blank,
default, or it's really not good enough.

It stops products like this
getting onto the market.

You also need to state how long you're
going to secure the product for.

How long are you going to
keep updates coming out?

And finally, you need to have a
vulnerability disclosure policy, so that

when researchers and other people like
us find bugs in your product, you've got

a way that they can easily get in touch
with you and get that vulnerability fixed.

So the bugs that bother me the most
in smart devices are those that can

be used to destabilize the rest of
the internet that we use every day.

And a great example of that was the
Mirai botnet that It was misunderstood,

but actually affected a large
number of consumer digital video

Now, they weren't well secured, and
as a result of which, a couple of

smart researchers realised you could
cause them to start sending traffic

But that affected so many different
DVRs it became a distributed denial

of service attack, and took down
the DNS providers for several

Now, as a result of that, rather
fortunately, those DVRs didn't

actually they weren't very stable, so
they kept rebooting, and it made it

It gives us a flavor of just
how bad security problems with

And an example here, this is a
CCTV camera from quite a well known

It wasn't correctly sending
you the right home TV footage.

It would accidentally show
you somebody else's house.

Now imagine that in the
context of your organization.

CCTV inside and it's showing
you the wrong organization.

Potential for spying
and data theft is huge.

So smart devices in buildings and
businesses can be a bit more interesting

because they're often found in cupboards
under the stairs, in plant rooms,

and maybe not subject to the usual
security oversight you might have.

And it controls the smart door locks,
meeting booking rooms, heating,

And we discovered vulnerabilities
so bad in this, we could actually

You need to think really
carefully about the systems that

Because if you haven't got a
building, it can be a whole lot

So I've given TED Talks about the cyber
security of smart devices, and there are

One was this device, which is a
smart tracking watch for kids.

So if you lose your kids in the
park, you can find them easily again.

Hey, I'm a bad parent,
it's happened to me.

But unfortunately, this is effectively
a phone inside a watch, and the result

of security problems in that, it meant
that anyone could track your kid.

Worse, they could change where your
child appeared to be, and they could

So the potential for privacy
invasion is absolutely huge.

So the connection between the smart
device and the cloud, where they

But other examples that we find, so this
is a smart thermostat, can be used in

commercial premises too, and we showed
that through vulnerabilities in the

hardware, so the chipsets, problems with
the firmware, that we could successfully

run Ransomware on a smart device, so
it no longer works, you've lost control

Now we did that as proof of concept,
we didn't publish the code, but

hopefully we'll see manufacturers
start to improve so bad actors

Is the cybersecurity of
smart devices getting better?

And very sadly I was somewhat
let down by Fisher Price Mattel.

They, published this, which is a smart
version of the toy that we had as a kid.

Very sadly, it's got exactly the
same cybersecurity problems as my

So even six years later, we still
see the same vulnerabilities.

Now, regulation and
legislation is helping things.

Manufacturers are starting to
realise that there's actual real

But, it worries me over time, in the
future, that perhaps not quite enough

is being done to make sure that our
children, our homes, and our offices

Fintech Insights

Expert Insight

Fintech Insights explores the dangers of smart devices being hacked with Ken Munro, Managing Partner at Pen Test Partners LLP during the Centre Stage.