A Hacker’s POV of Internet of Things Security

Jason Haddix is the head of trust and security at Bugcrowd.

Today, internet of things devices outnumber humans. Internet-enabled children’s toys, household appliances, automobiles, industrial control systems and medical devices—new IoT devices are being designed and released every day but many of these devices are built with little-to-no security in place. Given the rapid growth of these devices and unregulated market, it’s no surprise that these devices represent a growing threat as well as a major opportunity for hackers.

How Manufacturers Play a Role in IoT Insecurity

The sheer number and types of the devices being networked and connected to cloud interfaces and on-the-internet APIs are one of the greatest challenges in security today. Each device has its own set of technologies, thus its own set of security vulnerabilities. Add to that the pressure to rush to market and meet consumer demand, many manufacturers have simply not implemented a robust security review process.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

What’s especially concerning is that IoT manufacturers are collecting large amounts of life pattern behavior on their users, as well as access to home and work networks. This is a treasure trove of useful data for those that would target phishing attacks or product marketing, or pivot off these relatively insecure devices to compromise other systems on the network that contain more valuable data.

Unfortunately, many internet-enabled device manufacturers have not yet fully realized that they are now complex software vendors, shipping not only the embedded control system on a toy or vacuum, but frequently also managing mobile applications across multiple platforms, web applications, cloud storage, and web APIs. They have a responsibility to ensure product security throughout the life of the device. However, many IoT devices have poor software update mechanisms that compound the impact of design flaws and security vulnerabilities.

As a result, while the attacks we've seen in the last year have been massive, they’re built around trivial vulnerabilities. The Mirai botnet, for example, has grown by exploiting IoT devices with weak or default passwords. It was responsible for unleashing one of the largest DDoS attacks to date and is still at large.

It's important for IoT vendors who haven't prioritized security to take attacks as a wake-up call, and understand that we're entering a period where there is a very real, calculable, and painful impact to having insecure products. These types of attacks will only grow until the industry gets a handle on the issues of IoT security.

Defenders: Evolving today’s policies  

IoT security is in the standards phase right now, which means legislators haven’t yet prescribed specific policies around what security devices need to have in place for manufacturers to ship them. Some existing efforts have been made to classify the devices by the confidentiality of data connected devices handle, but even this proves to be troublesome with such a large diversity of devices.

Another challenge is the physical aspect of security when it comes to IoT devices. Should they be held to a standard that requires not only protection from remote exploitation, but also having protections from reverse engineering a device that an adversary has physical access to? If so, the requirements become very high in the development and electrical engineering aspects of these devices and systems.

Simple policies (that should be enforced by the FCC or some other regulatory/industry-council) should require annual third-party security testing on both the device and the websites or APIs it uses. This should mimic the likes of what the PCI Security Standards Council mandates for payment processors. In addition, minimal standards should be enforced, like the use of HTTPS or SSL in all communications, forced changing of default administration passwords, two factor authentication options, encryption of data at rest, and logging. Several projects have been spun up to threat model (generically) the IoT landscape that would work as standards for policy, including the OWASP Internet of Things (Security) Project.

The industry has learned some major lessons around IoT security in the last year. However, change takes time. Security isn’t a destination, it’s a process. The adversary is going to continue to find new ways to attack devices, and the industry needs to be better prepared. That’s why securing IoT begins at the bottom: bringing together security experts that can engage in this process. IoT is an enormous category so creating a set of standard requirements will be challenging yet it’s vital to start identifying vulnerabilities no matter how minor or obvious, and making changes to move the security maturity of this market forward.