10 IoT Cyber Security
489
and Hananel Levine identified the common weaknesses exposed at the edge [17]. A
summary of the common weaknesses identified include:
• Insecure default credentials. This includes well known username/password
combinations. These are often published in data dictionaries used by password
cracking tools and automated malware to quickly compromise a device. Also
included are hard-coded passwords that cannot be changed and password shared
across many devices in a family.
• Insufficient encryption. This includes not encrypting communications between
IoT devices and peer devices, gateways, or servers. This also includes a lack
of encryption on storage mediums allowing attackers to compromise sensitive
information. This also includes failure to protect the keys used by cryptographic
algorithms to secure information.
• Weaknesses in authentication. This includes a failure to authenticate remote
access to the device or cloud service. This also includes failure to require multifactor authentication to access cloud services that are directly integrated with the
device.
• Use of vulnerable network services. Telnet, FTP, UPnP, and other well-known
insecure network services can leave open insecure ports that are targeted by
automated malware and other exploits.
• Software vulnerabilities. Just as Information Technology (IT) systems require
secure software, so do IoT devices and services. Standard vulnerabilities such as
cross site scripting, command injection and buffer overflows can be exposed by
not sufficiently testing the security of a product.
• Weaknesses in firmware or software update processes. This includes allowing
unsigned firmware to be loaded to a device, or not validating the signature of
a firmware file. These inactions allow bad actors to upload modified firmware
files with new and potentially malicious capabilities that provide an easy path for
gaining root privileges on an IoT device.
• Failure to enforce least privilege. This includes failure to restrict access limit
privileges assigned to non-admin/root accounts, allowing bad actors to take
advantage of the excess privilege to perform unintended functions.
The threats associated with IoT devices is real. Once at attacker gains access to
the firmware of an IoT device, there are high quality tools available that can reverse
engineer and identify or insert vulnerabilities. For example:
• Firmwalker: This tool supports firmware file system searches [18].
• IDA-Pro: Supports disassembly and debugging of software [19].
• Binwalk: Signature-based file scanning and extraction [20].
If attackers can gain physical access to a machine, there are many opportunities
to capture the firmware. For example, JTAG or UART interfaces may provide
unauthenticated access to extract firmware. Attackers may also use tools such as
the ones mentioned above to modify firmware and change the intended behavior of
a device.
489
and Hananel Levine identified the common weaknesses exposed at the edge [17]. A
summary of the common weaknesses identified include:
• Insecure default credentials. This includes well known username/password
combinations. These are often published in data dictionaries used by password
cracking tools and automated malware to quickly compromise a device. Also
included are hard-coded passwords that cannot be changed and password shared
across many devices in a family.
• Insufficient encryption. This includes not encrypting communications between
IoT devices and peer devices, gateways, or servers. This also includes a lack
of encryption on storage mediums allowing attackers to compromise sensitive
information. This also includes failure to protect the keys used by cryptographic
algorithms to secure information.
• Weaknesses in authentication. This includes a failure to authenticate remote
access to the device or cloud service. This also includes failure to require multifactor authentication to access cloud services that are directly integrated with the
device.
• Use of vulnerable network services. Telnet, FTP, UPnP, and other well-known
insecure network services can leave open insecure ports that are targeted by
automated malware and other exploits.
• Software vulnerabilities. Just as Information Technology (IT) systems require
secure software, so do IoT devices and services. Standard vulnerabilities such as
cross site scripting, command injection and buffer overflows can be exposed by
not sufficiently testing the security of a product.
• Weaknesses in firmware or software update processes. This includes allowing
unsigned firmware to be loaded to a device, or not validating the signature of
a firmware file. These inactions allow bad actors to upload modified firmware
files with new and potentially malicious capabilities that provide an easy path for
gaining root privileges on an IoT device.
• Failure to enforce least privilege. This includes failure to restrict access limit
privileges assigned to non-admin/root accounts, allowing bad actors to take
advantage of the excess privilege to perform unintended functions.
The threats associated with IoT devices is real. Once at attacker gains access to
the firmware of an IoT device, there are high quality tools available that can reverse
engineer and identify or insert vulnerabilities. For example:
• Firmwalker: This tool supports firmware file system searches [18].
• IDA-Pro: Supports disassembly and debugging of software [19].
• Binwalk: Signature-based file scanning and extraction [20].
If attackers can gain physical access to a machine, there are many opportunities
to capture the firmware. For example, JTAG or UART interfaces may provide
unauthenticated access to extract firmware. Attackers may also use tools such as
the ones mentioned above to modify firmware and change the intended behavior of
a device.