Weaponizing IoT Ted Harrington Executive Partner SBX2-W2 Weaponizing IoT Ted Harrington Executive Partner Independent Security Evaluators (ISE) @ISESecurity

Weaponize wep-uh-nahyz 1) To convert to use as a weapon 2) To supply or equip with weapons Purpose of this slide is to define the key title term and overall presentation theme. Set the groundwork for the disucssion about how IoT can and is weaponized. Rest of the presentation ties back to this concept.

Agenda Overview Common IoT exploits Case Study Victim Chain Prophecies Recommendations

Overview Purpose of this slide is to establish credibility and set context. Very briefly introduce ISE’s research contributions, in particular as it pertains to IoT via IoT Village

Overview Purpose of this slide is to introduce IoT Village, from which data and other themes are extracted in support of the argument made during the rest of this presentation. Mention here that IoT Village is why RSA has asked us to organize IoT Sandbox

Trends & Data

IoT Security Trends August 2015 – Present: 113 new 0-days 50 device types 39 manufacturers Discuss metrics in order to analyze an quantify the scope of the IoT security problem

Common IoT Security Flaws 2016 2017 Denial of Service Lack of Encryption Key Exposure Privilege Escalation Remote Code Execution Backdoors Runs as Root All of the previous!! PLUS: Buffer Overflow Command Injection Session Management Etc etc etc Describe that things are trending worse, not better. Outline the types of issues relevant to IoT, setting up for a deeper dive into some of the more significant items

Exploit Analysis

Key Exposure Define what this vulnerability means, how it generally works in the context of IoT, and extrapolate the significance.

Remote Code Execution Define what this vulnerability means, how it generally works in the context of IoT, and extrapolate the significance.

Command Injection Define what this vulnerability means, how it generally works in the context of IoT, and extrapolate the significance.

Case Study: Mirai Botnet Advance the talk now from the generalized concepts discussed previously to a real-world, high profile incident

Mirai Botnet Give context and background, for those who might be unfamiliar with the Mirai botnet story

Mirai Botnet Break down the attack anatomy

Mirai Botnet Break down the attack anatomy

WHO CARES?! Score some cheap laughs, then really ask the question. Set up for a discussion of who the victims are and why they might (or might not) care, and how that motivation would dictate whether the problem gets solved

Victim Chain Discuss each victim type, what they care about, and how that impacts the ultimate victim

Where do we go from here?

Recommendations Threat Modeling Secure Design Principles Adversarial Perspective Self-regulate Talk through each recommendation, one by one

Prophecies It will get worse before it gets better The 10/16/16 event was covering something larger A person(s) will get hurt physically

Apply Consider motivation Think like the attacker Adhere to secure design principles

Thank You! ted.harrington@securityevaluators.com