IoT Security
Potential Attacks
and Attack Vectors
Dr. Hakan Kılınç
[email protected] IoT Malwares
Malware Malware Classes
• Can be devastating • Rootkits - provide a backdoor for illegal
• Attack can infiltrate the network access
• Spyware - records keystrokes
• Allow unauthorized access
• Trojans - contains malware
• Viruses - can self-replicate
• Worms - self-propagating virus
IoT Viruses and Worms
Virus Worm
• Like a human virus - can self-replicate and • Is a virus subclass
spread • Has the ability to spread without any help
• Results can be as simple as launching a pop-up
• Is more dangerous
• More serious results such as destroying files • Can have a devastating effect on all hosts
• A virus must have a transport agent • Many users are unaware of a worms
replication
o Until it consumes system resources such as
memory, processing, bandwidth
IoT Viruses and Worms
Proof-of-Concept Worm IoT Worms
• Researches have developed a proof-of-concept • Worms that spread using the IoT are a
worm powerful weapon,
• Had the capacity to go through an entire city • They can cause a massive chain, infect
• Affecting all of the lights devices, and then have devastating results,
• Causing them to malfunction • Take over lights in a smart city,
• Mine cryptocurrency,
• The worm was able to spread because there
was no authentication between the light bulbs • Attack the electrical grid
VOICE AND SOUND
AT TACKS
Subliminal Message
• Concealed message outside of the normal limits
of human hearing or visual perception
• Advertisers use this to convey a hidden message
to the user.
IoT Devices
• Can recognize voice commands
• learning to communicate using inaudible sounds
• We can't hear the sounds
• But they exist.
VOICE AND
Tracking Feature
SOUND
• Inaudible high frequency sound that creates a tracking
AT TACKS feature
• Covertly tracks a person's online behavior using phones, TVs,
tablets, and computers
• A more accurate way to track users across devices
• Used to market ads specific to the user
SOUND WAVES
• Trick sensors into getting backdoor access
into systems
• They hacked into automobiles, medical
devices, and other IoT products using
specific acoustical tones
• Allowed them to not only disable systems
but also control their output and alter the
behavior of the devices
VOICE
COMMANDS
• Hidden inside videos that may
be able to communicate with
your smartphone through voice
recognition
• Inaudible to humans, but the
phone is able to recognize and
understand the message
• Some of the possible dangers
include using the phone to open
a website.
IOT ATTACK
VECTORS
IOT
ATTACK
VECTORS
IOT ATTACK
VECTORS
IOT ATTACK
VECTORS
IOT ATTACK
VECTORS
IoT Attack Vectors
1. Weak, Guessable, or Hardcoded
Passwords
• Use of:
• Easily brute forced
• Publicly available
• Unchangeable credentials
• Including backdoors in firmware or client
software that grants unauthorized access.
IoT Attack Vectors
2. Insecure Network Services
Unneeded or insecure network services running
on the device itself, especially:
• Those exposed to the Internet
• Any that compromise the confidentiality,
integrity/authenticity, or availability of
information
• Any service that allows unauthorized remote
control
IoT Attack Vectors 3. Insecure Ecosystem Interfaces
• Insecure interfaces in the
ecosystem outside the device:
• Web
• Backend API
• Cloud
• Mobile
• Common issues:
• Lack of authentication
• Lack of authorization
• Lacking or weak encryption
• Lack of input and output
filtering
IoT Attack Vectors
4. Lack of Secure Update Mechanism
• Lack of ability to securely update the device.
• Lack of firmware validation on device
• Lack of secure delivery (un-encrypted in transit)
• Lack of anti-rollback mechanisms
• Lack of notifications of security changes due to updates
For Example;
• 2016 Carnegie Mellon University Study "On Board Diagnostics: Risks and
Vulnerabilities of the Connected Vehicle«
• Observations: insecure firmware updates and downloads
• Researchers were able to make arbitrary firmware modifications and
maliciously update remote firmware.
https://resources.sei.cmu.edu/library/asset-view.cfm?assetID=453871
5. Use of Insecure or Outdated Components
Use of deprecated or insecure software components/libraries that could
allow the device to be compromised.
IoT Attack Vectors
• Insecure customization of operating system platforms
• Third-party software libraries from a compromised supply chain
• Third-party hardware components from a compromised supply chain
6. Insufficient Privacy Protection
• User’s personal information stored on the device or in the ecosystem
that is used insecurely, improperly, or without permission.
For Example,
IoT Attack • 2017 Cornell University Study, «A Smart Home is No Castle: Privacy
Vectors Vulnerabilities of Encrypted IoT Traffic»
• “We examine four IoT smart home devices [a Sense sleep monitor, a
Nest Cam Indoor security camera, a WeMo switch, and an Amazon
Echo] and find that their network traffic rates can reveal potentially
sensitive user interactions even when the traffic is encrypted”
https://arxiv.org/abs/1705.06805
7. Insecure Data Transfer and Storage
IoT Attack
Vectors Lack of encryption or access control of sensitive data anywhere within the
ecosystem, including at rest, in transit, or during processing.
8. Lack of Device Management
Lack of security support on devices deployed in production, including asset management, update management,
secure decommissioning, systems monitoring, and response capabilities.
IoT Attack This problem has not be solved this for non-IoT environments yet..
• 25% still rely on Excel spreadsheets to track assets
Vectors •
•
56% verify asset location only once a year, while 10-15% verify only every five years
Staff spends 10+ hours weekly to resolve data accuracy issues
• Nearly 66% of IT managers have an incomplete record of their IT assets
https://www.scmagazine.com/home/opinion/executive-insight/tighter-control-over-it-asset-management-the-key-to-securing-your-enterprise/
IoT Attack Vectors
9. Insecure Default Settings
• Devices or systems shipped with insecure default settings or
lack the ability to make the system more secure by restricting
operators from modifying configurations.
• Bad filesystem permissions
• Exposed services running as root
10. Lack of Physical Hardening
• Lack of physical hardening measures, allowing potential attackers to
IoT Attack Vectors gain sensitive information that can help in a future remote attack or take
local control of the device.
• Easily Available Debug Port Discovery
RO OT C AU S ES O F I OT AT TAC K
V EC TO RS
• Pressures of getting to market quickly
• Unfamiliarity with IoT product development process
• Unfamiliarity with secure development practices
• Nothing is more permanent than a temporary solution
• Product requirements
• Low friction deployment & warehouse problem
• Outdated training for hardware and software teams
• Turn-key ecosystems
• Secure by design
What can we do for
• Secure base-OS with support for quick and easy
IoT Attack Vectors? updates (docker?)
• Libraries and frameworks to solve problems like
updates, first-connection trouble, IAM
• Education and training (IoT Top 10 a good start)
Thanks
