Uncovering Covert Channels in Your IoT Networks
summary
Claims a working open‑source detector called MPA Python analyzer that parses PCAPs or live traffic, correlates Modbus Transaction/Unit/Function IDs, and raises missing-request alerts and orphan-response criticals. Demos show it runs on a Raspberry Pi, emits CSV and integrates with Grafana/InfluxDB or Splunk, and flags anomalous flows. Research finds cleartext UIDs/MACs/passwords and video uploads to Alibaba, SSDP and RTSP used as covert channels, Nucleus OS present on ~1 billion devices, and thousands hit by supply‑chain Trojans.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:25The Problem - Poor Visibility, Flawed Supply Chain
- 2:46Why? It's easy to remain covert with lot
- 10:48Observations - Surveillance Cameras - Spy vs. Spy?
- 13:06IoT - Surveillance Cameras - Flawed Supply Chain
- 15:18One week after our disclosure...
- 15:37ICS and MODBUS
- 16:37Protocol Basics - MODBUS / TCP
- 17:26Request TCP Packet Construction
- 18:18Response TCP Packet Construction
- 20:36What we learned testing many loT and ICS devices
- 24:53Applying CIA to loT - Reality
- 27:06MODBUS - uncovering anomalies
- 31:51Apply What You Have Learned Today
- 35:14RSAConference 2021
related talks
45mWhen Machines Can't Talk
06mIoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale
30mThe Hunt for Major League IoT-ICS Threats: A Deep Dive into IoT Threat Terrain
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
32mThe Evil of Spy Camera
40mRogue One: A Wifi Story
32mThere and Back Again: Discovering OT Devices Across Protocol Gateways
51mThings That Go Bump in the Night: Detecting Problems in the Internet of Things