1. Presented by John Johnson
Hacking IOT: A Case Study on Baby Monitor Exposures and Vulnerabilities “Frameworks Aren’t Enough”
By the Rapid7 Team
Presented by John Johnson

2. Why this paper? Survey of multiple brands of an IOT device
Starting point for discussing the surface area for attacking IOT
Another style of paper than we have read previously
Why security nihilism is a thing

3. Just a little too new… IOT devices have blown up recently
But no security pipeline is in place to deal with the appearance of vulnerabilities
IOT are typically a hodgepodge of commodity software, each with a different patching entity

4. Baby monitors Surveillance placed willingly in the house
Watching what is presumably your most prized relative
And still totally unregulated

5. Speculative end user pains
IOT devices can be exploited to pivot inside a secure network
Home networks are typically undefended beyond a firewall
Parents who work from home may be particularly at risk
DDOS mitigation is often disruptive to innocent users

6. A peek at different vulnerabilities

7. To be more specific

8. Many different types of vendor
A vendor who practically lives off the grid (No Contact)
A vendor who kicks the can (“Not my fault!”)
A vendor who thinks you are the devil (“Why are you hacking us???”)
A Good Vendor™ who cares

12. Different study by Veracode
Looks at different types of IOT devices and their security features
Done by a different security company
Same similar results

13. Many different things to compromise
Credit to Veracode: IoT Security Research Study

14. That’s not too bad!
Credit to Veracode: IoT Security Research Study

15. Okay, this isn’t great but we can live with it!
Credit to Veracode: IoT Security Research Study

17. Well that’s… pretty bad
Credit to Veracode: IoT Security Research Study

19. Remember this slide?
Credit to Veracode: IoT Security Research Study

20. Title
Credit to Cisco for this diagram

21. There are many moving parts in an IOT infrastructure
In your house: Device, sensor, gateway, router, phone
Not in your house: backend storage, backend backups, virtual machine servers(think EC2 servers), company infrastructure
Intangible: OS on each of the above devices, phone apps, programs

22. Every element in the IOT stack can fall to a different department/person
Is each expert following best practices?
What about at the seams between components?
What happens if something goes wrong? Do you have experts who handle incident response?
On a budget? In a brand new company of 10 people?

23. Recommendations Get vendors to use an established framework
Get more security people on board at vendor companies
Defense in Depth

25. Thank You!