Data security in iot devices Aj DeTorrice

What is an “iot” device? An IoT device refers to the vastly expanding network of internet connected devices other than laptops, desktops, and smartphones. Researchers estimate that by 2020 there will be more than 26 times more connected IoT devices than people on Earth.

Why is security an issue? Security costs money Many IoT device manufacturers are willing to cut corners on security to meet budget requirements for a project Many of these devices are constrained in terms of memory, storage, and processing – making encryption-heavy security approaches harder to implement These devices often control critical devices such as smoke detectors and door locks

A real issue: smart cars In 2015, security researchers successfully hacked into a 2014 Jeep Cherokee and were able to turn the steering wheel, disable the breaks, and shut down the engine. Used Uconnect as an attack vector

Why are IOT devices targeted? Always on – IoT devices are rarely turned off Many manufacturers shy away from security in favor of usability IoT devices aren’t checked on by users – “setup and forget” There are millions of them – this allows for a significant amount of DDoS traffic from these devices Users don’t interact with their devices actively – less likely to notice a hijacker

Mirai botnet In 2016, Mirai was used to take down Dyn, a dns provider for several hours – blocking many popular sites such as Twitter, Netflix, and Reddit from end users – over 1Tbps Simple to gain access to these IoT devices – many have default username/password combinations

Mirai botnet overview Brute forces its way into poorly configured IoT devices Upon gaining a shell, forwards to the report server Via the C&C server, the controller can authorize a download of the malicious binary After executing the malware, the controller can use the C&C server to attack a target server

Vulnerabilities extend to “home security” devices Opticam i5 – had hardcoded passwords for both the web UI and the built in FTP server ASL-01 smartlocks – guest access can be used to get irrevocable admin access If someone bought a used smartlock, the previous owner or guest of a previous owner can unlock it “75% (of the locks tested) could be hacked relatively easily, and one reported to have great security could actually be broken into with a screwdriver”

Replay attacks Many IoT devices do use encryption, but fail to discard keys. When an encrypted signal is sent to the device, an attacker can listen in and record said signal, then replay it back to the device to gain access.

How can users secure their own devices? If possible, change passwords from their default Don’t allow these devices on a network with important systems/files Don’t use these devices