Introduction to Internet of Things (IoT)

Introduction to Internet of Things (IoT) and IoT Security Challenges

Information security, often referred to as InfoSec, is a set of strategies to protect sensitive business information from unauthorized use, modification, disruption, destruction, recording or inspection. InfoSec does not only protect information in transit but also at rest in storage.

InfoSec programs are built around the core objectives of the CIA triad and its primary focus is on sustaining the balance between Confidentiality, Integrity and Availability of business data. This triad ensures that sensitive information is only disclosed to authorized parties (confidentiality), prevent unauthorized modification of data (integrity) and guarantee the data can be accessed by authorized parties when requested (availability).

Is there any difference between cyber security and information security?

Yes! They are both different. Although they are used interchangeably and they both deal with security and protection of information from breaches (information being stolen) and threats but cyber security deals with protecting data in cyber space whereas information security protects data in general.

As it is well known:

“Physical data is often easier to protect in locked filing cabinets, but electronic data requires greater protection”

The field is of growing importance due to increasing dependency on computer systems, the Internet and wireless networks such as Bluetooth and Wi-Fi, and due to the growth of “smart” devices, including smartphones, televisions and the various other small devices that constitute the Internet of Things.

What exactly is Internet of Things?

Internet of Things (IoT) basically includes anything and everything connected to the internet or to each other. These things are always connected, communicate with each other, swapping data with devices and finally uploading it all to the cloud based server. With an increasing pressure in terms of competition to deliver better and fast services, there is a need for the data to travel from any device in the world to provide more perception and control over the elements in our connected lives.

Doesn’t it make one’s life easy? What can one do using a normal alarm clock apart from setting alarm? Snooze time, set multiple alarms etc. With IoT based alarm clocks, if a user sets alarm at 8 am to go to work, this alarm would fetch real time weather and traffic data in order to calculate time required to commute to work and automatically ring some time prior to what is set to compensate for the time delay. The benefits of IoT include efficient resource utilization, reduced human efforts, reduced costs and increasing productivity, real-time marketing, decision analytics, better customer experiences, high-quality data, to name a few. But nothing comes easy! Along with all the comfort it provides, we all should not ignore the risks it brings with it.

IoT security testing is considered less complex and has not been given importance that it deserves, considering it has no human intervention there will be no human error. Human error is the major cause of security breaches, for example a user clicking on a malicious link in an email or is lured into sending their personal details. All this needs human intervention. Therefore, in IoT environment, as there is no one to lure and hence less security challenges or breaches. This supposition is totally deceptive. According to recent research on IoT breaches, it was found that 84% of companies have already experienced some sort of IoT breach in a study involving over 3,000 companies across 20 countries. In fact, in an IoT environment, intruders have more opportunities to breach as its architecture comprises a number of elements that become potential hacker’s targets.

How IoT Evolved?

IoT is one of the trending topics in the field of Information Technology but let’s also have a quick review of its background and existence.

The term IoT was first coined by Kevin Ashton in 1999 and since then it has come a long way.

A few decades ago people were connected to the outside world in a very limited way which included radios and televisions. Besides, it provided one-way communication experience i.e. one couldn’t talk, interact with it. This slowly changed with the arrival of home computers like the one made by Atari and Commodore in the 1980s and later by the IBM PC. Now users could connect to the outside world but connectivity was still in its infancy. But assisted by Moore’s Law, technology become available, compact and more affordable every year. This is when security and privacy issues made their way into the user’s consciousness. By late 1990s much had changed, people started using mobiles phones over landlines resulting in more and more compact devices every passing year. The market for online commerce boomed as most people were now connected to the internet. By middle of the 20th century, there were rapid changes and advancement in technology.  For instance, the only security concerns of having a watch was it could be physically stolen but nowadays it is about if the watch is disclosing personal information that could enable identity theft or fraud.

The reason IoT is trending is because various IoT products have gained popularity in the market; including smart refrigerators, home thermostats and door locks controlled by smartphones. Let’s take an example of a smart home, a smart home is full of products that understand your preferences, foresee your everyday needs so that you spend less time managing or supervising your house and more time living in it.

What are the security challenges in IoT?

IoT is already trending all over the Information Technology Domain. With this popularity it becomes harder to secure IoT System. There are many vectors a developer has to focus on in order to secure the IoT environment such as:

1.Default credentials & Configuration
2.Ensure high availability
3.Secure web, mobile, and cloud applications
4.Secure communication
5.Authorize and authenticate devices
6.Security Patches
7.Detect vulnerabilities and incidents
8.Manage vulnerabilities

IoT Security is being taken even more seriously due to the past Cryto Mining and DDoS attacks like Mirai Botnet, Stuxnet, Cold in Finland, Brickerbot, Botnet Barrage, etc

Mirai Botnet:
Mirai (Japanese for “the future”) is a self-propagating botnet virus which infects poorly protected Internet connected devices by using telnet service to find devices using factory default username and password. The effectiveness of Mirai is due to its ability to reach other insecure devices and co-ordinate with them to perform DDoS attack against the target. Mirai was used, along with BASHLITE, in the DDoS attack on 20 September 2016 on the “Krebs on Security” site which reached 620 Gbit/s. “Ars Technica” also reported a 1 Tbit/s attack on French web host.

How to address security issues in IoT environment?

IoT Penetration testing is not widely followed because IoT development itself is not yet entirely evolved. In the field of IT many organizations from small-scale to large-scale MNCs are developing IoT related products without expertise and security awareness.

IoT Pentesting should be conducted on all products in UAT environment before deploying it in production. Upon mapping the attacking surface of IoT, we can categorize it as follows:

Hardware Hacking

Hardware hacking consists of analysing internal architecture of the device including internal components to determine attacking surface, firmware extraction, identification of test points, reconfiguring the device’s hardware to bypass authentication and intercept traffic.

Network Testing

Network testing consists of identifying security flaws in the services running on a network or in a cloud server. An attacker can gain access to sensitive information and with readily available exploits, she/he can successfully compromise servers and further compromising entire IoT infrastructure.

Software Hacking

Software hacking consists of penetration testing of Web Application and Mobile Application.

Communication Protocol

IoT devices often use non-standard communication protocols (MQTT, CoAP) and radio waves (BLE, Zigbee) which can be tested for cryptographic security, ability to sniff traffic and modify it from an attacker’s perspective.

What are the common security concerns missed out by developers?

With the growth of new and advanced frameworks for IoT development, developers don’t really need to think about configurations of servers, devices, encryption,etc which makes it efficient and faster to develop an IoT product within given limited time frame. With all these advantages come few of the security flaws which every developer needs to keep in mind before deploying an IoT product. Most common security mistakes which developers make while developing IoT products are:

Default Credentials

Most of the IoT devices in use have default credentials enabled which can be easily found in the documentation section of the corresponding product.

Storing Sensitive Data

Most of the developers might store sensitive data like API Keys, Encryption Keys, FTP Credentials on the devices. (i.e. in mobile devices via Mobile application or IoT devices via firmware.)

Debugging Services Not Disabled

On hardware level, developers often debug the hardware in order to find any flaws so as to minimize it. Usually it is conducted with the help of debugging pins like UART, JTAG, Serial, USB, SWD which are not disabled after the deployment of the devices in an IoT infrastructure. Using these debugging ports an attacker can successfully gain root/shell access to system, dump firmware or flash data from the device and successfully compromise the device.

Missing Patches

Upon deploying devices in an IoT Infrastructure, developers often run the devices with the older firmware and operating system without checking it for software updates and security patches regularly. This might leave a loophole for an attacker to compromise the system.

Services with no Encryption

Often times developers take extra efforts to make the product efficient, which mostly aggrandize the overall user experience. But due to lack of security awareness a developer might disable many crucial security features like Encryption. As IoT devices need to be low power consuming they are configured to use few protocols without encryption which can lead to theft of credentials. For example, Unencrypted MQTT service might lead an attacker to sniff entire traffic transmitted by IoT devices.

What are the best security practices for developers to follow?

Best security practices suggest a developer to avoid exposing any sort of sensitive information on a device, network or application level. It is advised to avoid all common security mistakes to ensure a secure IoT environment.

Here, we are done with the basics of IoT security testing. It basically can be performed by pentester who has proper understanding of IoT architecture and expertise in black box and white box penetration testing.

In further blogs we will discuss all vectors included in IoT Pentesting in detail which would also consist of in-depth impact analysis of most common IoT vulnerabilities. These IoT devices are an integral part of our lives and to secure them you all have got Varutra Consulting to happily assist you in IoT Security.

Author,

Attack & PenTest Team

Varutra Consulting