10 IoT Cyber Security
503
A tester will examine the system for basic weaknesses. She will look for
default passwords used across IoT machines and gateways, or even the networking
equipment within the system. The tester will examine the system for untrusted
services such as telnet, ftp, and UPnP and look for out-of-date firmware, software,
and third-party libraries with known vulnerabilities that can be exploited quickly.
A Penetration Tester will also deploy tools to monitor traffic within the system.
He will use tools such as Wireshark, SecBee, AirCrack, KillerBee, BlueMaho, etc.
depending on the target protocols used within the system. For testers with advanced
RF knowledge, a tool such as HackRF can be configured to monitor the RF spectrum
from 1 MHz to 6 GHz. This allows the tester to look for unencrypted or unexpected
communications within the system. Password crackers can also be used to attempt
to find weak passwords and keys.
A Penetration Tester will use creativity to examine the hardware of the IoT
machines at the edge. This includes evaluation of the device operating location
to determine if the device can be taken without an alert being generated or
someone noticing. If the device can be surreptitiously swapped out, then perhaps the
firmware can be extracted and analyzed. Tamper protections will also be evaluated
to determine any controls that prevent opening the device casing. Testing and debug
ports will be evaluated to determine if any allow unauthenticated access to device
internals or the command line. Tools such as Shika [28] can be used to interface
with device hardware and attempt to dump memory or download firmware.
A good penetration tester will also examine the system for process weaknesses.
This includes analyzing the process of updating firmware, if no authentication or
integrity check is performed by a machine prior to loading new firmware, then he or
she will attempt to reconfigure and upload a malicious firmware version. Additional
processes associated with the handling or administration of devices will also be
examined. When applicable social engineering skills will be put to use to attempt to
trick trusted insiders into giving out knowledge needed to access the system.
As can be seen, a thorough penetration test will do much more than a vulnerability scan. A creative tester can probe for system weaknesses at multiple points in
the architecture, including the human elements. This very closely mimics the length
and effort that a malicious actor might go to try and gain unauthorized access to the
system.
10.6 A Secure Cloud
The cloud has become a key component of any IoT system. Cloud services provide
the web servers that allow IoT services to collect and process information and
implement unique capabilities. The cloud also provides data storage, analysis, and
work-flow management features. Capabilities such as machine-learning are vital to
injecting intelligence into IoT systems and these are often configured to run in the
cloud.
503
A tester will examine the system for basic weaknesses. She will look for
default passwords used across IoT machines and gateways, or even the networking
equipment within the system. The tester will examine the system for untrusted
services such as telnet, ftp, and UPnP and look for out-of-date firmware, software,
and third-party libraries with known vulnerabilities that can be exploited quickly.
A Penetration Tester will also deploy tools to monitor traffic within the system.
He will use tools such as Wireshark, SecBee, AirCrack, KillerBee, BlueMaho, etc.
depending on the target protocols used within the system. For testers with advanced
RF knowledge, a tool such as HackRF can be configured to monitor the RF spectrum
from 1 MHz to 6 GHz. This allows the tester to look for unencrypted or unexpected
communications within the system. Password crackers can also be used to attempt
to find weak passwords and keys.
A Penetration Tester will use creativity to examine the hardware of the IoT
machines at the edge. This includes evaluation of the device operating location
to determine if the device can be taken without an alert being generated or
someone noticing. If the device can be surreptitiously swapped out, then perhaps the
firmware can be extracted and analyzed. Tamper protections will also be evaluated
to determine any controls that prevent opening the device casing. Testing and debug
ports will be evaluated to determine if any allow unauthenticated access to device
internals or the command line. Tools such as Shika [28] can be used to interface
with device hardware and attempt to dump memory or download firmware.
A good penetration tester will also examine the system for process weaknesses.
This includes analyzing the process of updating firmware, if no authentication or
integrity check is performed by a machine prior to loading new firmware, then he or
she will attempt to reconfigure and upload a malicious firmware version. Additional
processes associated with the handling or administration of devices will also be
examined. When applicable social engineering skills will be put to use to attempt to
trick trusted insiders into giving out knowledge needed to access the system.
As can be seen, a thorough penetration test will do much more than a vulnerability scan. A creative tester can probe for system weaknesses at multiple points in
the architecture, including the human elements. This very closely mimics the length
and effort that a malicious actor might go to try and gain unauthorized access to the
system.
10.6 A Secure Cloud
The cloud has become a key component of any IoT system. Cloud services provide
the web servers that allow IoT services to collect and process information and
implement unique capabilities. The cloud also provides data storage, analysis, and
work-flow management features. Capabilities such as machine-learning are vital to
injecting intelligence into IoT systems and these are often configured to run in the
cloud.