Fooling the ‘Smart City’

Denis Makrushin
Mar 26, 2017 · 15 min read

Smart Terminals Have Their Weak Points Too

Fooling the 'Smart City'
Fooling the 'Smart City'
Ticket terminals in a movie theater

Smart City Terminals

Fooling the 'Smart City'
Fooling the 'Smart City'
Exiting the kiosk mode

Techniques for Exiting the Kiosk Mode

Fooling the 'Smart City'
Fooling the 'Smart City'
Methodology for analyzing the security of public terminals

Tap Fuzzing

Data Fuzzing

Other Techniques

Fooling the 'Smart City'
Fooling the 'Smart City'
Exiting the full-screen application of a cinema ticket vending terminal

Bike Rental Terminals

Fooling the 'Smart City'
Fooling the 'Smart City'
Status bar containing a URL
Fooling the 'Smart City'
Fooling the 'Smart City'
The Internet Explorer opens not only a web page, but also a new opportunity for the attacker
Fooling the 'Smart City'
Fooling the 'Smart City'
The current Windows session is running with administrator privileges

Terminals at Government Offices

Fooling the 'Smart City'
Fooling the 'Smart City'
A detail of the printing process on one of the terminals

Public Devices at Airports

Fooling the 'Smart City'
Fooling the 'Smart City'
Exiting the kiosk mode by opening an additional browser window
Fooling the 'Smart City'
Fooling the 'Smart City'
List of addresses blocked by policies
Fooling the 'Smart City'
Fooling the 'Smart City'
A configuration file in which administrator logins and password hashes are stored

Infotainment Terminals in Taxicabs

Fooling the 'Smart City'
Fooling the 'Smart City'
Exiting the kiosk mode on a device installed in a taxi makes it possible to download external applications
Fooling the 'Smart City'
Fooling the 'Smart City'
Android interface and folder structure
Fooling the 'Smart City'
Fooling the 'Smart City'
Exiting the terminal’s full-screen application in a taxi gives access to the operating system’s functions

Our Recommendations

Elements of the Road Infrastructure

Speed Cameras

Fooling the 'Smart City'
Fooling the 'Smart City'
Direct broadcast screenshot from a speed camera

Routers

Our Recommendations

Conclusion

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade