Internet of Things Vulnerabilities By: Christian Oliva

Introduction Internet of Things is a collection of network enabled devices such as speakers, cars, baby monitors and other forms of objects that have software and sensor embedded into them. These objects connect to the internet and relay data based on their environment.

Problem Many IoT-enabled devices are not sufficiently secured for consumers whether if its personal or business. Many devices may never see an update and have poor outdated code embedded in the software. The average consumer do not possess the technical prowess to secure their networks to prevent intrusion.

IoT Device These computable devices have sensors in order to provide the necessary information they are required of. They must be connected to a home network, cell towers (4G, 3G) or via Bluetooth. They come in all shapes and sizes. Some popular examples are Amazon Echo speaker, Phillips Hue Smart light bulbs and Nest Thermostat.

Sensors Sensors are the backbone to provide all the necessary data to perform their tasks. The hub within a sensor is what integrates everything together. The hub within a devices allows the sensors work together as a whole. There are different sensors such as temperature and proximity sensors. Once the data is analyzed it will the produce results.

Sensor-based attacks Attacks can be exploited via the sensors embedded in IoT devices. They can be done in a passive or active way. There are four key categories that sensor-based attacks are categorized under such as Information Leakage, False Sensor Data Injection, Denial-of-Service and Transmitting Malicious Sensor Patterns or Commands.

Sensor-based attacks Information Leakage is the most common based attack. It can be done with eavesdropping with the microphone of the device and data such as password can be revealed. Transmitting Malicious Sensor commands can trigger malware by a message that is embedded in a song. False Sensor Data Injection is when data is captured and altered in any way. If GPS-enabled device location is tampered with and changes the location Denial-of-Service doesn’t allow legitimate users access a system. This can be achieved with flooding a system with massive amount of traffic.

Sensor-based security Semadroid, an extension in the Android mobile operating system that allows sensor management. This extension allows logging and monitoring of the sensor to make sure there is legitimate activity going on. Policies can also be implemented to control the transmitted data and limiting third party application access to the data. Location-Privacy Preserving Mechanism reduces the attacks on data location. Attackers like to know the location of the victim to launch attacks

Mitigation Strong passwords must be implemented on a router to help prevent intrusions. Change username and password on router configuration. Hardwire IoT devices (if possible) instead of using wireless. Updating firmware on IoT device. Disabling features that are not necessary.

Network Segmentation Separate your network in zones. You can connect all your IoT devices in one network and isolate the rest of your devices on another. If zone is comprised, it wont risk the infection across your entire network.

Minimize Bandwidth There are about 50 million devices connected to the internet. If 1 percent of those devices were under control, they can be controlled to perform a DDoS attack. They can cause up to 81 trillion frames per second of damage. Vendors should dive deeper into the kernel and throttle network transmission. These ‘smart devices’ should be programmed to detect any suspicious activity and perform a reset.

Conclusion Even though Internet of Things faces many vulnerabilities, consumers need to protect themselves or assets. Consumers need to be aware of these exploits and be educated in the matter. Every day many security risks are being introduced due to the popular uprising. Networks need to be secured, security applications need to be utilized and software must be update to date to intrusions more difficult for the hackers.