Teaching Security of Internet of Things in Using RaspberryPi Oliver Nichols, Li Yang University of Tennessee at Chattanooga Xiaohong Yuan North Carolina A& T State University 1

Introduction ❏ The Internet of Things (IoT) is becoming a reality in today’s society. ❏ The IoT can find its application in multiple domains including healthcare, critical infrastructure, transportation, and home and personal use. ❏ It is important to teach students importance and techniques that are essential in protecting IoT. 2

Importance of IoT Security Bruce Schneier said that while website security is a major issue, the Internet of Things will prove much more difficult to manage. “These are devices that are made cheaply with very low margins, and the companies that make them don’t have the expertise to secure them. 3

Setting up Experiment Environment We set up a Smart Home environment using a Raspberry Pi, Razberry Daughter Board, and Z-Wave sensors. 4

Lab 1: Sniffing of IoT and Its Countermeasures Sniffing is a form of passive attack to learn about the communication between two computers. Remote Access Analysis: Communication between the mobile device and find.zwave.me, and communication between find.zwave.me and Raspberry Pi. User will use find.zwave.me to log into his Raspberry Pi remotely. Observe difference when find.zwave.me is set to “Not a secure connection” or othewise. Local Access Analysis: 5

Students analyzed the web application hosted on the Raspberry Pi. 6 Lab 1: Sniffing of IoT and Its Countermeasures The connection from the Mobile device to the server used TLS 1.2. The certificate appears to be valid, and no issues were reported using Firefox, Internet Explorer, or Chrome. Traffic between the server and the Raspberry Pi also used TLS. Vulnerabilities for TLS were tested on the Raspberry Pi’s implementation using a test script which can be found at

Lab1: Access: find.zwave.me server ❏ Communication between Mobile Device and find.zwave.me is secure ❏ Communication between find.zwave.me and PI is secure (no serious vulnerabilities) ❏ Allows for Client-Initiated Renegotiation: Potential DoS threat ❏ Implements TLS_FALLBACK_SCSV ❏ Implements SSLv3 with RC4 (highly discouraged) 7

Lab 1: Local System Vulnerabilities ❏ Given access to local area network (LAN) where Raspberry Pi is connected with. ❏ No encryption between local computer and the PI ❏ Credentials exchanged in Plain Text 8

Lab1: Local System Vulnerabilities continued 9

Lab 2: Session Hijacking and Replay Attacks Session ID or cookie ID is a unique identifier used to determine communications between two parties. Session hijacking is to first acquire the session ID and then combine with replay attacks to impersonate one party of the communication. Students first discover Session ID between Rasberry Pi and Smart Switch: 10

Lab 2: Session Hijacking and Replay Attacks Students are then asked to use the same session ID to replay the control message from the Raspberry Pi to the smart switches. Students are able to change “on” and “off” easily by replaying the control message with its session ID. 11

Lab 3: ARP Cache Poisoning Attack Man-in-the-Middle (MitM) attacks can be achieved by using ARP cache poisoning on a local network. ARP cache poisoning is an achievable task due to the fact that no authentication mechanism exists for ARP. To begin the attack, the students will need to know the address of the Raspberry Pi and the machine attempting communication with the Raspberry Pi. This information can be given to the students or discovered using wireshark, nmap, or another tool. 12

Lab 3: ARP Cache Poisoning Attack Students are first instructed to modify ARP table so that Host-A’s IP address will be mapped to the MAC address of the attacking PC. Host A IP: Attacking PC MAC: 00:14:22:30:a3:6d. 13 Before attack After attack

Students logged into the Raspberry Pi (Host-B) from the Host-A computer. As the password is sent in plaintext, sniffing shows Raspberry Pi’s login password again. 14 Lab 3: ARP Cache Poisoning Attack Password Revealed by an ARP Cache Poisoning Attack

Lab 4: ARM Stack Exploits and Security Measures The Raspberry Pi B+ uses an ARM11 processor which is based on the ARMv6 architecture. Most mobile devices use ARM because it dissipates less heat and uses less energy than its major competitors. A buffer overflow (BoF) attack is to supply enough data to overfill the buffer, and write malicious data into an area that can be directly called by address. 15

Lab 4: ARM Stack Exploits and Security Measures Students are first asked to write a program called “overflow_exploit” with a typical Buffer Overflow (BoF) program called “vulnerable_callee” that copies the user- supplied parameter into a buffer with fixed size. 16 Starting Memory Address of vulnerable_callee Success BoF attack

EVALUATION AND DISCUSSION These labs are designed to demonstrate attacks and security practices; and show the significance of security in the Internet of Things. The attacks are designed to work against TCP/IP and the Razberry software. These labs do not directly address Z-Wave because it is closed source and resources on Z-Wave are limited. 17

Future works Attacks against the IP camera Attacks on sensors Analyze other protocols such as ZigBee or Bluetooth Low Energy Acquiring a hub for a Smart Home, such as the SmartThings hub and analyze protocols, smartphone app, and hub software 18

Thank you! Questions? 19