Is the JetKVM MORE SECURE than the NanoKVM?

0:00 so today I'm taking another look at the jet KVM for those of you who didn't see my first video this little kindy guy here with the little screen is is the jet KVM it's a remote keyboard video Mouse solution so you plug this guy in with his HDMI cable and his USB cable into your victim computer then you can completely control this computer remotely as if you were there with a keyboard mouse and you can see the monitor on your computer so anyway I uh I reviewed this thing relatively favorably I got a link up here to the original video if you want to see that and I'm not here to talk about how it works today I'm here to do a followup on security so I recently took a look at the cheaper Nano KVM by cede this stirred a very long video on all the security issues of this product and so some of you guys asked if I could go

0:46 back and take another look at the jet KVM to see if it had any of those same security issues so I'm going to try to look at all of the different security issues that the Nano KVM had and some other similar issues and see if any of them also apply to the jet KVM so how is its data security in general obviously the jet KVM is a remote access device so by putting this on your computer you're giving anyone who has control of the jet KVM essentially full remote control of whatever computer it's connected to so that could be potentially a very dangerous thing if you're not careful with who has access to your jet KVM and that's why security for a device like this is so important I mean security should be important for every device who put on the network period but this is a device for remote access that's a particularly security sensitive topic so

1:33 anyway come along in this adventure couple disclosures today first off jet KVM sent me this unit for review in the past review video was already put up there somewhere uh no money changed hands they did see the review video already because I released it in the past but they again won't see this video until you guys do I've also contributed not to any of their code but I've submitted issues as I was testing the device originally and since then and they've been very responsive to me in their GitHub and most of the issues I've reported have either already been addressed or being addressed also this is not a brand new unit so with the Nano KVM I was able to take it out of the box and test it directly I've already thoroughly tested this guy so before I test it today I'm going to do a full firmware update then

2:19 I'm going to try to reset it to factory default and go from there and I hope that's reset enough that it gets a close to outof the boox experience but that's the best I can do this is the same test setup I had from the ccip nanm video got a microti hexs that's doing my packet capture it's also acting as a router on this little subnet DNS that kind of stuff so I'm going to give this guy maybe 20 seconds to boot up do any initial stuff I might do then I'll log into it and hopefully we can differentiate those two times in the packet capture so I'm logged in here to the KVM this is again not using https this is only using HTTP by default SSH is disabled so I could prove that but you have to come down here and enter your public key to enable SSH and they only allow SSH key

3:06 off they don't allow usernames and passwords so I've connected HTMI just so we can kind of look at what's going on here I'm going to log into this machine so I just typed a bit of text out here I'm going to see if I can recover that text because this is insecure although I don't believe it's using HTTP for the actual transport of this stuff so I've got the packet capture the basic stuff going on here I haven't set up their cloud environment um you can enroll in it once you've configured the device initially I didn't do that so I shouldn't see anything reaching after the cloud I expect to see basic stuff like ntp um maybe checking some gateway to see if the internet connection's up maybe checking for updates because I loaded the UI uh some elements of the UI do check for updates so we'll see how that goes so looks like it started right

3:52 off with a duplicate address Discovery for IPv6 so that probably means it's actually doing IPv6 I'll get back to that in a second so here it did a DHCP discover offer request a so it got an IP address and it got 250 so here it reaches out for DNS for cloud flare it's actually looking for 127.0.0.1 which is an interesting thing to see on the wire and I'm guessing that's a bug so next up we're looking for stuff over mdns over ipv4 and IPv6 we're looking for a number of locals uh we're looking for quades in all these cases I think none of those come back next up we have a stun binding request and this actually goes out to my network so I think this is my laptop I guess maybe I should have like closed the web browser on my laptop I still have the Page open from when this was rebooted before so I believe it's trying

4:39 to stun its way to my laptop which has an IP address on a different subnet so I'm looking at this thing from my normal subnet not my restricted subnet and I guess it's trying to do that connection with stun locally yeah so 1581 is my laptop and then here it says finding success 1554 that's actually the router of my um micro router so next it queried itself on the wire for ap.com and this is going to be the update Checker and then you see here it successfully did application data using dtls 1.2 so this would be web RTC that figured itself out via stun so even though the web page itself is loaded insecurely over HTTP the actual data traffic on this thing is

5:24 using web RTC and that is secured with a self-sign certificate so you don't get the same security is having publicly sign certificates but I don't think we expect a device like this to actually come with a realer we expect you to have to install that if you're going to use a real CT so self- sign assert is a very normal thing for this to do and I'm glad they're using security so next up it does a DNS request to the router for time. cloudflare.com so it's trying to sync time I'm going to guess ntp and it's correctly asking my network um DNS server and then again it reaches out to time. cloudflare.com to sync ntp very normal so all the way down here at 29 seconds is when it starts reaching out to API atj cm.com so this is after I have opened the web browser so now it's checking for an update to fulfill the

6:10 web browser request and then it does that over TLS 1.3 as well so the only reaching out to the internet did before I open my web browser was connecting to time. cloud.com over ntp so that's to sneak Network time I think we kind of expected that once I connected my web browser then it reached out to api. jkvm which I believe is the update Checker um in any case it got back that there was no update needed it was a relatively short conversation editing appart here for a little bit of an interjection when I did the CP Nano KVM I noticed it was reaching out to stun and turns uh servers from Google and Cloud Player I thought that was part of tail scale but someone else pointed me to that it's actually part of cyp's web RTC implementation so stun is a protocol

6:57 used to matchmake between two different peers even if they're behind Gat so it's fused for Gat traversal um tail scale uses it internally obviously which is why I thought they were reaching out they were the ones doing it but web RTC also makes heavy use of stun and so here on the jet KVM it's doing stun Discovery but it's only doing it locally so you can see my Subnet here was 192 to 168 at 88 that's the subnet that the jet cmaz on and it stunned its way to 17227 15 which is one level up in the gat so it punched through one level of Gat to find my laptop and it never went out to the internet to do this so through all of these traffic logs it never connected to a public stun server it never went out to Google or cloudfare

7:42 or anyone it was able to use its HTTP connection um to figure out the IP addresses on my laptop and then get their bias done so the ccip Nano KVM was not able to do this they were relying on public stun servers Google and cloudflare to do their web RTC matchmaking whereas this library that jet KVM is using if you're on a purely local connection does not reach out to the internet for stun and turn I'm also capturing in real time now on my Mac so I can look at that HTTP traffic so I hit refresh here it should reload everything on the page and should be able to see what's going on in uh play shark so we got just a ton of traffic now so I'll stop the log so 250 is the KVM and2 is

8:28 my laptop but after all this TCP then we switch over to dtls and we do everything over dtls so this is the um datagram TLS this will be the actual web RTC traffic so I'm going to set a password here let's see where that goes so now we need to log in and let's log in no F off Safari so there our password end up in this and there in fact is the password I would like to point out here that sending the password to the server Like This Is Not Unusual in cases where the transport layer is secure so my last video I mentioned a bit about hashing on the client side and that would be the best advice in cases where the transport

9:13 is insecure so the transports insecure we have to do hashing and encryption on both sides to do a secure handshake however if we're using TLS we already rely on TLS to provide that secure handshake and we need to do password hashing on the server side so this is a correct design Choice except for the fact that we don't have that Transport Security TLS so TLS probably needs to come into play so now TLS support is on their road map and they are allegedly working on it so based on their progress on their GitHub I kind of Tross them on that in case you guys are curious on the server side they use the algorithm bcrypt to encrypt passwords so you can see here they're doing some bcrypt operation they're using a library written go that does bcrypt password cryptography so here's their password changing code and again it's us using

9:59 bcrypt so bcrypt for those of you who don't know is a password hashing function based on Blowfish that is uh quite good it's used by openbsd it's used by Linux things like that so it's a very reasonable Choice here I'd also like to point out that um this does not happen over the cloud connection so let's take a look at what the cloud connection looks like so I'm going to now enroll my guy in the cloud so now I'm connected through the cloud here so I'm working remotely what does this data look like on the wire so this is what the traffic looks like going through the router and you can see it found a shortcut path because we're on the same network so it found a shortcut through my router to my

10:46 land Network where it um doesn't even have to go through the cloud it's just connecting directly this is all UDP and it's not able to decrypt any of it it just says data so why your shark is not helping me here so recognizes this as dtls but it's not able to decode anything meaningful from it it looks like this is it reaching out to their control server and again this is all using TLS 1.2 so this seems to be quite happy look like we CAU a reconnection here so it's doing a client certificate key exchange server key exchange let's see do we have anything here we can look at server hello so looks like their certificate uh just says common name is web RTC and it's a ecdsa with SH out 2 V6 key

11:33 which is very normal so they claim their cloud service is end to end encrypted and it sure seems like that's true when we're running through the cloud service all of the traffic goes through web RTC which is encrypted using dtls datagram TLS and it's using self-sign Sears on both sides which is a normal thing for device like this not to have a publicly signer and it's about as secure as using https again with publicly signer um because they're using web RTC for this it actually managed to find a connection through my network on its own without having to go through a relay server in the cloud now it could have also done that using tail scale that would have been a much heavier weight solution than doing web RTC like they did here so I think this is a reasonable choice I still like to see https on the web UI but actually if you just log in

12:19 through the cloud service even locally you'll get a direct connection locally on the same network because they'll figure out they're around the same network and talk to each other and you'll get all of the encryption that you would have gotten from the cloud service so it's actually more secure to go through the cloud service even on the local network which I think is interesting so only problem I see that still hasn't been fix is there's no IPv6 support still it actually gets an IPv6 address and drop by SSH works over SSH but for some reason their app isn't binding correctly and we actually took a little bit of a look at it with one of the developers and it should be binding correctly they're telling it to bind correctly so not entirely sure what's going on there but they're looking at it so let them do that and get on with it in any case this was a much shorter video than the CP Nano KVM because I

13:05 don't have to do any binary reverse engineering here this is running a pretty basic Rock Chip CPU they're starting with a rock chip build root Linux image and they're only adding like two binaries to it KVM native and Jet KVM KVM so it's pretty much it it's pretty simple setup they've got going on they're relying on Rock chips Hardware libraries that come with rock chips Linux distribution so nothing is going out of band there they're not running their own download server or anything like that um so I don't see a lot of the same problems we saw with C so anyway thanks for coming along in this adventure hopefully you guys like the jet KVM I like the jet KVM I like working with the guys too they've been very responsive to issues I brought up um the community in general they have a Discord server where they talk about

13:51 enhancements and things like that so of course is a Kickstarter so all their backers are starting to get their backing shipped some of them have gotten them by now some of them haven't but that's just how kickstarters go um if you want to chat with me personally I have a Discord server link down below for that uh what else I have a Kofi it's kind of like patreon but it's only a onetime thing not recurring if you want to give me a tip I greatly appreciate that uh and as always I'll see you guys on the next adventure