BenQ InstaShow - Security Done Right

The Concept

At a local small business incubator near where I live, a local municipal government spent thousands of dollars on a wired presentation system with multiple HDMI wall jacks and a surround sound speaker system. The system is brand new, state of the art, all controlled through an infrared remote to switch between wall jacks. The problem? Guests don’t know how the system works, so they walk up to the big screen TV used for presentations, unhook the presentation system, and connect their laptop directly to the TV with an HDMI cable. After they’re finished, they hook the presentation system back up. Sadly that several thousand dollar presentation system sits unused, not because it doesn’t work, but because nobody knows how it works, so they bypass it completely.

The concept behind the BenQ InstaShow (paid link) is a very simple “hardware only” solution to wirelessly presenting your computer screen. The InstaShow can be connected to any projector or big screen TV which supports a HDMI input, providing wireless transmission of video and audio. Being able to present wirelessly is extremely important for conference and meeting rooms, especially if those rooms are frequently used by guest presenters. Full specs are available on the BenQ website.

The simplicity of the InstaShow is what really sets it apart from other presentation systems. When you turn on the host unit and TV or projector, you’re stepped through on the screen how to connect the system to your laptop and begin presenting. No fumbling through manuals, no waiting for the IT department to come assist, and no installing drivers or software. The InstaShow is true plug-and-play as it was meant to be.

Why a Hardware Solution Matters

Most wireless presentation systems require the user to install software, and connect to a WiFi network. This opens the presenter laptop to attacks from not only other devices on the same network, but to vulnerabilities within the presentation software. Often times presenters won’t even be able to install the software, as their IT department has secured their device to prevent modifications, which is in accordance with security best practices. By using a hardware only solution, BenQ is avoiding this problem completely.

Something really important to mention is “app creep”. We’re all guilty of this - we install an application on our laptop or phone, use the application once, and then it just sits there. The biggest problem with app creep isn’t that it’s just wasted space on our devices, but these apps typically don’t get security updates, making your device more vulnerable to attack. By making InstaShow a hardware solution, BenQ is helping to reduce app creep on our devices. Other manufacturers please take note; no I don’t want to install your app!

Attack Surface

I was very impressed with the minimal attack surface of the InstaShow. The InstaShow features two 5GHz wireless networks - one management network and one network used by the transmitter.

Both networks use WPA2 with 128-bit encryption - which is typically the best available at the time of writing this review.

I used a “black box” approach to analyzing the InstaShow. Scans using OpenVAS came back extremely clean, with only 3 medium findings and 1 low finding. Most network devices, such as printers or routers, will typically have many more findings, so that’s impressive. Below is an overview of the findings.

Telnet Unencrypted Cleartext Login (Medium) - This is a pretty common finding for network devices. We don’t have a telnet login, so while this port does increase the potential attack surface, the risk is pretty low.

Cleartext Transmission of Sensitive Information via HTTP (Medium) - This shows up twice, once for port 80 and once for port 8080.  Both ports lead to the same Web UI management interface for configuring the InstaShow. Obviously implementing a SSL certificate isn’t really feasible, and this is no different than common router configuration interfaces.

TCP Timestamps (Low) - This low vulnerability is due to the implementation of RFC1323, which timestamps all TCP packets from the management IP. This allows an attacker to determine the host’s uptime.  Ultimately not very useful, unless an attacker wants to know how long your presentation has lasted.

Best of all, these vulnerabilities can be protected against by simply not connecting the InstaShow to a corporate LAN, as well as disabling the WiFi management network in the interface. More on hardening later in this review.

Default Passwords

The management network has a default password which matches the network name.  So for example, if the management network has a SSID of WDC10_12345, then the password will be WDC10_12345.  Once connected to the management network, the user can use their web browser to visit 192.168.168.2, and enter the default username and password of “admin”/”0000”.

The InstaShow also has an option to connect to a wired network using an Ethernet port. The InstaShow assigns itself an IP address via DHCP. Once again, the configuration settings can be accessed with the default username and password of “admin”/”0000”. Just like security best practices for everything else, these passwords should be changed from their defaults.

Attack Scenario - Attacking the WiFi Management Network

The most likely attack carried out against the InstaShow will be attacking the WiFi management network. For the purposes of this attack, we’ll assume the InstaShow has been plugged into a corporate LAN, as well as the WiFi management network enabled. We’ll also assume that the InstaShow is using default usernames and passwords.

Step 1: Attacker connects to the InstaShow WiFi network using the default password.

Following security best practices, this shouldn’t happen. However, in security the user is always the weakest link, and sometimes we forget to lock down our devices.

Step 2: Attacker runs an IP address scan using nmap. This scan returns the management IP address at 192.168.168.2.

Step 3: Attacker attempts to traverse the network into the corporate LAN.

This attempt fails, as the InstaShow isolates the WiFi management network from any wired network.

Step 4: Attacker attempts to use packet sniffing to view current presentation.

This attempt fails, as the InstaShow transmits the HDMI signal over a separate WiFi SSID.

Step 5: Attacker connects to the InstaShow Web UI using the default username and password.

Once again, following security best practices this shouldn’t happen, but for the purposes of this attack let’s assume the user once again forgot to change the defaults.

Once in the management Web UI, the attacker is very limited in what they can do. There is no option to change the password for the presentation network, and no option to access the corporate LAN. They can see the DHCP IP address assigned to the device on the corporate LAN, and they can disrupt any in-progress presentation by resetting the InstaShow. Neither of these options have the potential to leak any sensitive corporate information, nor do these options allow the attacker to infect the network with malware.

Overall this is a very secure implementation, which even helps compensate for user error.

Hardening the InstaShow

While the InstaShow is pretty secure by default, there are a few steps the user can take to make it more secure. Detailed steps for each of these items are available in the User’s Manual, which is available on BenQ’s website.

1) Disable WiFi Management Network

By disabling the WiFi Management Network, you remove the ability of external attackers gaining access to your device.  Disabling the WiFi Management Network is very easy, just go to “Wireless Network”, choose “Disable”, and click “Apply”.

2) Change the default admin password.

By changing the default admin password, anyone with direct physical access to the device will be unable to login to the management Web UI.

3) Unplug the InstaShow from the LAN when not being configured.

Once you’ve setup the InstaShow, there’s very little reason to leave it plugged in to the corporate LAN. By unplugging it completely, when combined with the above hardening steps, the attack surface is reduced to only the WiFi network used for transmitting presentations. This wireless network is only going to be compromised if someone cracks the WPA2 wifi key. If someone has the capability of cracking the WPA2 key, then they will most likely have already compromised the rest of your corporate wireless networks, and compromising this device will be of negligible impact. Ideally, the InstaShow should only be configured through a direct ethernet cable to a laptop, and never connected to the corporate LAN.

4) Offer a USB plug adapter for the HDMI version of the InstaShow.

While the InstaShow is designed to run off the power of a USB port, some users may be uneasy about plugging in a USB device into their laptop - and rightfully so, as USB devices can be used to perform attacks against a computer when mounted as a USB disk drive. Fortunately the HDMI version of the InstaShow itself does not transmit or receive any data over USB, and only uses USB to power the transmitter for the HDMI signal. To make security-conscious users feel a bit more at ease about using the InstaShow, a USB extension cable and USB power adapter could be used, so that only the HDMI cable will need to be connected.

Device Performance and Quality

Of course, if security impedes a user from getting their work done, that security is worthless. At the end of the day what really matters is that users can still perform their work without being interrupted or blocked by security measures.

The InstaShow has two display modes: presentation and video. Presentation provides a slightly better picture quality with a lower refresh rate, while video provides a better refresh rate with a slightly lower picture quality. Honestly, I couldn’t tell much difference at all with picture quality set to video, as the image still seemed crystal clear. I was able to stream several videos from YouTube without issue. Audio and video synced perfectly, and were very clear.

Keeping in mind that the InstaShow wasn’t designed for video gaming, I decided to test its limits. I tried several different PC games, and was able to play without any issue whatsoever. I did notice some very very slight input lag, but we’re talking milliseconds. For the casual gamer like me, it won’t make a difference, but of course gamers whole play a lot of first person shooters will want to probably stick to wired connection, since those milliseconds can be life or death. So if you’re doing something like fighting for Azeroth or launching Kerbals to explore the stars, this would let you very easily connect to the big screen or home theatre without wires, and still provide an enjoyable gaming experience.

Summary

Unfortunately in today’s world, despite all of the cyber threats out there, security is often “tacked on” at the end of a project as an afterthought. I’m extremely impressed with the InstaShow, in that it was clearly designed from the beginning with security in mind. As a cyber security professional, I hear a lot that security is a hassle, cumbersome, or prevents work. The InstaShow is proof that properly designed and integrated security is none of those things, as long as you properly integrate security from the beginning. I’ve seen cyber security done right, and cyber security gone horribly wrong. The InstaShow is security done right and keeps the user experience simple, while still keeping your sensitive data secure.

The BenQ InstaShow is available on Amazon (paid link) as well as retailers such as Office Depot.

About Me: Ken is a cyber security professional with over 12 years experience. He specializes in security evaluations and continuous monitoring of corporate and federal environments. This review is my own personal opinion, and does not reflect the opinions of my employer or clients. As an Amazon Associate I earn from qualifying purchases when using a paid affiliate link above.

Point of Sale and ATMs: Your Data at Risk

One of the topics I'm going to be covering in my upcoming book "Death by Identity Theft" is how industry's lack of regard for security has significant impacts for consumers.

One of the most important lessons I try to teach any newcomer to Cyber Security is that compliance does not mean security. In fact, compliance often creates a false sense of security.

Major retailers recently hit by point of sale malware were PCI compliant. This means their systems met payment card industry standards for security. And yet, their point of sale systems were still compromised by malware, putting customers' personal information at risk. I previously covered this problems with PCI compliance.

Unfortunately, even though most consumers have now been issued EMV chip credit cards, many businesses still aren't ready to accept them, and those that do are only requiring signatures, not PINs.

Oh, and did I mention that 95% of the world's ATMs are still running Windows XP?

These are just a few examples of problems consumers face when trying to protect themselves from identity theft or credit card fraud.

If you haven't signed up for identity theft protection, now would be a good time.

Fed Employees, Contractors, and Spouses Identities Compromised

According to the U.S. Office of Personnel Management, the personal information of all current, former, and prospective Federal employees, contractors, and their spouses, who have been subject of a background investigations since 2000. The 21.5 million individuals compromised includes 19.7 million individuals that applied for a background investigation, and 1.8 million non-applicants, primarily spouses or co-habitants of applicants.

Types of information in the incident involving background investigation records:

• Social Security Numbers
• Residency and educational history
• Employment history
• Information about immediate family and personal and business acquaintances
• Health, criminal and financial history

Some records could also include:

• Findings from interviews conducted by background investigators
• Fingerprints. 
• Usernames and passwords used to fill out your forms

This is probably the worst possible data breach for the Federal government, and not because they're going to have to offer credit monitoring for everyone affected.

Noticeably absent from the release is any mention of "who" was responsible for this breach.
Many news sources believe the breach was the work of the Chinese government.

U.S. Senator Sasse believes the database will be used for spy recruitment, and even blackmail, according to Wired.

As a Federal contractor, I'm quite honestly terrified. While the Federal Government is offering identity theft protection, they are taking no steps to protect affected employees and contractors from blackmail attempts - and how could they? At this point, the only way to protect affected employees and contractors would be to give them, as well as their families, a completely new identity. Obviously, with 21.5 million affected individuals, this won't happen.

At the same time, I feel very betrayed, as I'm sure many Federal contractors and employees currently feel. If the Federal government did not take the protection of our personal information seriously, what's to ensure they will do so in the future? This could seriously impact the ability of the Federal government to gain new or retain existing employees or contractors - including myself.

Private sector - now's your chance! There are a lot of disgruntled Federal contractors who will probably jump at a chance to leave, and go somewhere their personal information will actually be protected. Start posting those open positions, and let the mass exodus from Federal contracting begin.

Why I No Longer Visit Slashdot or SourceForge

For many years, I've always used Slashdot to keep me in formed of "geek" news, and SourceForge for great open source software.

Since Slashdot and SourceForge are owned by the same parent company, I am now refusing to patronize either website, due to multiple incidents of SourceForge bundling malware with open source project downloads.

This all started approximately two years ago. Case in point, this bug ticket for FileZilla.

In May, SourceForge started distributing malware with GIMP, a popular image editor.

Finally, just a few days ago, SourceForge started hijacked nmap for possibly the same purpose, software which is popular in the security community - talk about a slap in the face.

With this most recent incident, no longer will I sit idle and let SourceForge infect unsuspecting people with malware. There are no excuses for this behavior, and anything SourceForge will say to justify this should be completely disregarded by the open source and security community.

As of today, I will recommend to my clients that they do not download any software from SourceForge, and recommend alternative news sites from Slashdot, such as Reddit.

If you have an open source project on SourceForge, now is the time to migrate to GitHub or other similar sites, and close your project on SourceForge.

Show SourceForge and Slashdot you will not stand for intentionally infecting people with malware.

Twitch Hacked - Users' Full Name, Addressees and Email Compromised

I received the following breach notification from Twitch a few minutes ago.

We are writing to let you know that there may have been unauthorized access to some of your Twitch user account information, including possibly your Twitch username and associated email address, your password (which was cryptographically protected), the last IP address you logged in from, and any of the following if you provided it to us: first and last name, phone number, address, and date of birth.

For your protection, we have expired your password and stream keys. In addition, if you had connected your account to Twitter or YouTube, we have terminated this connection.

You will be prompted to create a new password the next time you attempt to log into your Twitch account. If applicable, you will also need to re-connect your account to Twitter and YouTube, and re-authenticate through Facebook, once you change your password. We also recommend that you change your password at any other website where you use the same or a similar password.

We apologize for this inconvenience.

The Twitch Team

New Book in Progress - The Cyber Game: Redefining the World of Information Security

Today I've started a new project. This long-term project will be my own book on Information Security, its origins, basics, and how we can redefine the approach to today's InfoSec problems.

As a teaser, below is the introduction to this great new project!

Introduction

While most attribute the Morris Worm of 1988 as the first “cyber attack”, the history of Information Security goes back much further.

In 1903, a physicist named John Ambrose Fleming was preparing to demonstrate to the Royal Institution in London a “secure” wireless telegraph system developed by Italian radio pioneer Guglielmo Marconi. This system was designed to transmit over 300 miles, and Marconi claimed he could “tune [his] instruments so that no other instrument that is not similarly tuned can tap [his] messages”. The “tuning” of course was based upon the same radio frequency principles which allow modern-day radio waves to transmit music to your car stereo.

Shortly before Marconi transmitted his message from Cornwall approximately 300 miles away, another signal was received by the equipment being set up by Fleming. This transmission was strong that it caused the projection lamp to flicker as a message was sent in Morse Code. At first the message was only one word repeated, “RATS”. The message eventually evolved into numerous insults directed towards Marconi, effectively accusing him of tricking the audience into thinking the system was secure.

Several days later, it was revealed that the Eastern Telegraph Company had hired a magician named Nevil Maskelyne to reveal the security holes in Marconi’s system, not only for the public good, but to protect the wired telegraph industry from the potential impact on their business.

Marconi’s system was indeed far from secure. The wireless telegraph transmitted and received without any authentication or encryption, allowing third parties to intercept and interfere with transmissions. The biggest flaw in Marconi’s approach was that he never accounted for the fact that an attacker could use an untuned broadband receiver or transmitter to interfere with his frequency tuned equipment.

Today’s information systems, much like Marconi’s wireless telegraph, must “expect the unexpected” in order to be secure from attack. With cyber crime costing worldwide approximately $445 billion per year, information security simply cannot be ignored.

References:
Marks, Paul. "Dot-dash-diss: The Gentleman Hacker's 1903 Lulz." NewScientist. 27 Dec. 2011. Web. 10 Jan. 2015. <http://www.newscientist.com/article/mg21228440.700-dotdashdiss-the-gentleman-hackers-1903-lulz.html>.

"The History of Cyber Attacks - a Timeline." NATO Review Magazine. Web. 10 Jan. 2015. <http://www.nato.int/docu/review/2013/cyber/timeline/EN/index.htm>.

Sandle, Paul. "Cyber Crime Costs Global Economy $445 Billion a Year: Report." Reuters. Ed. Pravin Char. Thomson Reuters, 9 June 2014. Web. 10 Jan. 2015. <http://www.reuters.com/article/2014/06/09/us-cybersecurity-mcafee-csis-idUSKBN0EK0SV20140609>.

Oct. is Cyber Security Awareness Month! Will you be Cyber Safe this Holiday Season?

Not only is October Breast Cancer Awareness Month, but October is also Cyber Security Awareness Month! The following are a few talking points which would be great to discuss with family, friends, and co-workers, to help spread awareness and keep yourself, and others, safe online.

Attacks Against Point of Sale Machines on the Rise

Myth: If I don't own a computer, I don't have to worry about cyber security.

Fact: Cyber Security affects everyone, even those without computers.

Did you know that you could become a victim of a cyber crime without ever owning a computer or smart phone?

Over just the past two years, cyber attacks against Point of Sale machines have drastically increased. What initially started as a collection of isolated incidents has quickly grown into a continuous stream of attacks against major retailers.

Cyber criminals have learned that it's much easier to attack the Point of Sale machines directly, instead of attacking the databases retailers use to store payment information. This means an increased threat to consumers and merchants.