1. Data security in iot devices
Aj DeTorrice

2. What is an “iot” device?
An IoT device refers to the vastly expanding network of internet connected devices other than laptops, desktops, and smartphones.
Researchers estimate that by 2020 there will be more than 26 times more connected IoT devices than people on Earth.

3. Why is security an issue?
Security costs money
Many IoT device manufacturers are willing to cut corners on security to meet budget requirements for a project
Many of these devices are constrained in terms of memory, storage, and processing – making encryption-heavy security approaches harder to implement
These devices often control critical devices such as smoke detectors and door locks

4. A real issue: smart cars
In 2015, security researchers successfully hacked into a 2014 Jeep Cherokee and were able to turn the steering wheel, disable the breaks, and shut down the engine.
Used Uconnect as an attack vector

5. Why are IOT devices targeted?
Always on – IoT devices are rarely turned off
Many manufacturers shy away from security in favor of usability
IoT devices aren’t checked on by users – “setup and forget”
There are millions of them – this allows for a significant amount of DDoS traffic from these devices
Users don’t interact with their devices actively – less likely to notice a hijacker

6. Mirai botnet
In 2016, Mirai was used to take down Dyn, a dns provider for several hours – blocking many popular sites such as Twitter, Netflix, and Reddit from end users – over 1Tbps
Simple to gain access to these IoT devices – many have default username/password combinations

7. Mirai botnet overview
Brute forces its way into poorly configured IoT devices
Upon gaining a shell, forwards to the report server
Via the C&C server, the controller can authorize a download of the malicious binary
After executing the malware, the controller can use the C&C server to attack a target server

8. Vulnerabilities extend to “home security” devices
Opticam i5 – had hardcoded passwords for both the web UI and the built in FTP server
ASL-01 smartlocks – guest access can be used to get irrevocable admin access
If someone bought a used smartlock, the previous owner or guest of a previous owner can unlock it
“75% (of the locks tested) could be hacked relatively easily, and one reported to have great security could actually be broken into with a screwdriver”

9. Replay attacks
Many IoT devices do use encryption, but fail to discard keys.
When an encrypted signal is sent to the device, an attacker can listen in and record said signal, then replay it back to the device to gain access.

11. How can users secure their own devices?
If possible, change passwords from their default
Don’t allow these devices on a network with important systems/files
Don’t use these devices