Presented by John Johnson Hacking IOT: A Case Study on Baby Monitor Exposures and Vulnerabilities “Frameworks Aren’t Enough” By the Rapid7 Team Presented by John Johnson

Why this paper? Survey of multiple brands of an IOT device Starting point for discussing the surface area for attacking IOT Another style of paper than we have read previously Why security nihilism is a thing

Just a little too new… IOT devices have blown up recently But no security pipeline is in place to deal with the appearance of vulnerabilities IOT are typically a hodgepodge of commodity software, each with a different patching entity

Baby monitors Surveillance placed willingly in the house Watching what is presumably your most prized relative And still totally unregulated

Speculative end user pains IOT devices can be exploited to pivot inside a secure network Home networks are typically undefended beyond a firewall Parents who work from home may be particularly at risk DDOS mitigation is often disruptive to innocent users

A peek at different vulnerabilities

To be more specific

Many different types of vendor A vendor who practically lives off the grid (No Contact) A vendor who kicks the can (“Not my fault!”) A vendor who thinks you are the devil (“Why are you hacking us???”) A Good Vendor™ who cares

Different study by Veracode Looks at different types of IOT devices and their security features Done by a different security company Same similar results

Many different things to compromise Credit to Veracode: IoT Security Research Study

That’s not too bad! Credit to Veracode: IoT Security Research Study

Okay, this isn’t great but we can live with it! Credit to Veracode: IoT Security Research Study

Well that’s… pretty bad Credit to Veracode: IoT Security Research Study

Remember this slide? Credit to Veracode: IoT Security Research Study

Title Credit to Cisco for this diagram

There are many moving parts in an IOT infrastructure In your house: Device, sensor, gateway, router, phone Not in your house: backend storage, backend backups, virtual machine servers(think EC2 servers), company infrastructure Intangible: OS on each of the above devices, phone apps, programs

Every element in the IOT stack can fall to a different department/person Is each expert following best practices? What about at the seams between components? What happens if something goes wrong? Do you have experts who handle incident response? On a budget? In a brand new company of 10 people?

Recommendations Get vendors to use an established framework Get more security people on board at vendor companies Defense in Depth

Thank You!