Hacked Smartphone Apps Could Be Used to Blow Up Your Workplace
In our 21st century economy, it's not uncommon for workers to monitor and manage their machines remotely, using a mobile app. Employers use apps to automate their industrial processes because they record and track data that maximizes efficiency, offering an instantaneous support log for how things might be running smoother.
There's one major problem with these apps, though—they're all vulnerable to cyber attacks.
Over the last year, security researchers Alexander Bolshev of IOActive and Ivan Yushkevich of Embedi discovered just how vulnerable these apps were. Examining 34 apps from various companies that were chosen randomly from the Google Play store, they found a whopping 147 security vulnerabilities.
Though they remained moot on what companies had the most egregious numbers of vulnerabilities, the pair only found two apps that were optimized for protection against cyber attacks.
In the report of their findings, Bolshev and Yushkevich explain that there are three main possible threat types: Unauthorized physical access to the device or "virtual" access to device data, Communication channel compromise (MiTM), and Application compromise.
They then lumped likely attack types into two groups.
An attack that directly or indirectly influencing an industrial process or industrial network infrastructure "could be carried out by sending data that would be carried over to the field segment devices," they explain. "Various methods could be used to achieve this, including bypassing ACL/ permissions checks, accessing credentials with the required privileges, or bypassing data validation." This could allow hackers to send malware, through mobile, that takes over the commands of a machine and has it execute its own directive.
The other attack involves compromising a SCADA operator to unwillingly perform a harmful action on the system. "The core idea is for the attacker to create environmental circumstances where a SCADA system operator could make incorrect decisions and trigger alarms or otherwise bring the system into a halt state," they explain. This could mean tricking an operator into thinking a machine is running safely, when in fact it is dangerously close to malfunction. This could easily lead to a methodically planned factory explosion, and companies that don't take steps to safeguard against such vulnerabilities wouldn't know what hit them.
It's not all bad news, though. The pair has also provided a list of best practices that employees and administrators alike can implement to prevent themselves from being hacked.
Among them are implementing unit and functional tests for the app on backend servers, covering authentication and authorization features at least. Enforcing password/PIN validation is another, part in parcel with avoiding storing any credentials online using cleartext. They stress the importance of paying attention to catch and handle exceptions seriously. They also recommend encrypting all communication using strong protocols, such as TLS 1.2 with elliptic curves key exchange and signatures and AEAD encryption schemes.
Last year, researchers at CMU showed that by compromising the facial recognition software that will provide security to self-driving cars, they can easily be hacked. A team of hackers also showed just how easy it is to hack automated home robots. Hackers also managed to infiltrate our power grid, though no damage was done.