Questions tagged [iot]
Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.
141
questions
0
votes
1
answer
189
views
How can one use HTTPS without a domain name, or on a local network?
I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
- 103
0
votes
1
answer
56
views
How to resolve an issue with potential mismatch between device certificate and CA certificate?
I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
- 103
0
votes
0
answers
29
views
TLS Certificate life for IoT System
I'm developing an IoT product's software, where it runs HTTPS client.
Given that the certificate of servers are renewed every year, it's not that issue while we're authenticating against the ...
- 23
1
vote
1
answer
71
views
Write message that can be verified by any member of a group
I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by.
There may be tens of messages generated each ...
- 111
0
votes
2
answers
105
views
Hosting a Honeypot to collect data [closed]
I want to collect IoT botnets in order to analyze them. Are there any good VPS providers who allow to do that? - I'm a little cautious about this because of possible misconfigurations that could ...
- 3
1
vote
1
answer
105
views
Next movement in IoT pentest when you have restricted information
I am a newbie cyber security engineer working on IoT. Today, a task is given to me. The task was making pentest to a cooker. Because of the privacy, I cannot share the brand of the cooker. The cooker ...
0
votes
1
answer
224
views
Can a simcard's public IP be accessed?
I am in a discussion with someone about IoT devices.
We use private IPs for simcards, but the other organisation is using public IPs.
I think it is possible for a hacker to access these public IPs to ...
0
votes
0
answers
91
views
Providing encryption and password for an IOT device over gRPC
I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online.
My IOT device servers will run on the client network and may be accessed over it or over the ...
- 101
0
votes
1
answer
1k
views
How secure are tp link kasa devices?
When setting up a kasa smart device, say a wifi smart plug, it asks for the wifi credentials and then it connects to the network.
Since these devices can be controlled remotely via the kasa app, one ...
- 35
2
votes
2
answers
409
views
WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks
While WPA2-PSK and WPA3-SAE are really secure once a connection has been established, my understanding is that if you have access to the Wi-Fi password you can impersonate the AP without any problems. ...
- 61
1
vote
3
answers
123
views
Is it possible to restrict individual devices connected to a home router from communicating outside the local network?
I have a device which I don't want to have any communication with the outside world sans any initial updates/etc (say, an IoT device that would otherwise phone home). I would still like to be able to ...
- 113
3
votes
4
answers
164
views
Can IoT connect to each other forming their own network?
I recently purchased a fairly sleek LED lamp. Like most new-fangled furnishings it comes with a pile of unnecessary features including bluetooth, wifi, and a mobile app.
Hence my new-found paranoia. I ...
- 203
0
votes
1
answer
154
views
Are there IoT devices that send data home despite blocked internet connection (with the detour via bluetooth on the phone)?
I am increasingly buying IoT aka smart devices for my household.
All these devices need to be connected to WLAN and proprietary app (via bluetooth on iPhone). I do this initial step, but then block ...
- 1,445
0
votes
2
answers
166
views
How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?
This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets.
Also, most of the persistence methods I have seen tend to be ...
- 15
0
votes
2
answers
382
views
How do IoT devices know the checksum of firmware upgrades?
As I understand, some IoT devices verify the integrity of firmware updates downloaded from the internet using the checksum of the file before installing the update, making it impossible for attackers ...
- 3
1
vote
1
answer
1k
views
TPM use without secure boot
I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
- 111
0
votes
0
answers
82
views
Secure logs on an embedded IoT device
I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development.
Since logs will be primarily event & data logs, the size of the log ...
- 173
2
votes
2
answers
192
views
Am I authenticating devices securely?
I'm building a IOT platform for my home as a hobby. Currently, I'm trying to implement device authentication. A device in my case could be a Raspberry Pi, Arduino, Jetson Nano. To authenticate devices ...
- 123
0
votes
1
answer
127
views
Collect traffic from mobile app to IoT device [closed]
I have a mobile app that connects to a IoT device over port 8888 to send commands. I'm not sure how to intercept this. MITMproxy was not able to capture the data as the app would not load behind a ...
5
votes
2
answers
2k
views
How can I make an SSL certificate for an IoT device trusted on all browsers?
I have a web server running on an IoT device, more specifically, on an ESP32.
This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
- 53
0
votes
1
answer
214
views
How to secure microphones on smart home devices?
I have a number of smart home devices in my house. Some of which are a Samsung refrigerator, a Whirlpool washer, a Bose Bluetooth speaker with wifi and a Roku TV all of which I assume have microphones....
- 589
0
votes
0
answers
124
views
Spoofing a server to intercept my IoT device's data
I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
- 101
22
votes
6
answers
6k
views
When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?
I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
- 331
2
votes
0
answers
121
views
IoT Device Authentication
I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/
I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
- 21
0
votes
0
answers
136
views
Routing attacks on Peer 2 Peer networks?
I've started creating a framework that aims to make anything into an IoT device. In order to stay online, a peer 2 peer layer needs to be implemented. On top of it, common point services will give the ...
- 1
0
votes
1
answer
187
views
Sensor device web interface certificate
I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
- 101
0
votes
1
answer
934
views
HDMI with Ethernet: Network Security Risk?
I recently found out that HDMI cables (v1.4 and over) have ethernet capabilities for higher res output, so I want to know one thing:
Say I have a PC/laptop connected to the internet, and a monitor (...
- 1
0
votes
1
answer
108
views
Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment
Background:
We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer.
Previous models had certs issued by a different CA and that CA cert was published, ...
- 103
1
vote
1
answer
312
views
RSA vs ECC certificate for IoT device client side certificate authentication
I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA.
There are the provisions of ...
- 173
8
votes
3
answers
3k
views
Key differences between X509 TLS Client certificate and server certificate
Is there any difference between a X509 TLS client cert and a server cert?
I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
- 173
2
votes
1
answer
311
views
Validation of server identity via SSL certificate in during SSL connection handshake
My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
- 173
1
vote
1
answer
228
views
Securing IoT application
I'm designing an IoT product, I'm searching solutions to secure the system.
The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities.
I've read enough to come with this ...
- 23
1
vote
2
answers
98
views
Securing APIs used by remote devices
We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
- 113
1
vote
0
answers
146
views
What data can be sniffed in a LoRaWAN network at various points?
What data or metadata can be sniffed in a LoRaWAN network at various points like the end-device (node), the gateway, the network server and the application server? Is there exists a standardized data ...
- 11
3
votes
1
answer
576
views
Setup network with IoT devices
I bought a new router and I'm thinking to make my network a bit smarter from the security aspect.
My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
- 133
3
votes
2
answers
455
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
- 131
0
votes
1
answer
195
views
How to distribute bash scripts to multiple IOT devices securely
Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source.
Our customers however will have to buy separate IOT devices ...
- 687
1
vote
1
answer
129
views
Why the need to hardcode passwords? [closed]
Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices.
Why don't they store the hashed password instead?
For what functionality do they need the plaintext ...
- 2,493
0
votes
0
answers
111
views
How cameras receive Wi-Fi credentials from App?
I bought a wifi camera and performed the simple startup process:
Powered on
Discovered the camera through the dedicated App
Set the WiFi credentials on the App to pass to the camera
After that, the ...
- 119
1
vote
2
answers
274
views
Do some IoT devices connect to your wifi without you knowing it?
I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
- 11
3
votes
2
answers
565
views
How can I implement TLS on a connection with very low throughput?
I'm doing a IoT project therefore want to reduce connection overhead to a minimum. We want to secure the communication, especially the authenticity and confidentiality. With a standard TLS protocol, a ...
- 31
0
votes
2
answers
484
views
Are smart plugs safe? (Xiaomi in particular)
Are smart plugs safe, Xiaomi ones in particular (Zigbee and WI-FI versions)?
My main concern is that the plug is connected to Mi account and allows remote management. In case hacker gains access, can ...
- 127
0
votes
0
answers
117
views
How to secure smart home devices?
I'm interested in how I can secure my IoT devices from hackers. Particularly, I have a Xiaomi hub and a range of child devices for it. Also, how to secure devices that communicate using the Zigbee ...
- 127
20
votes
4
answers
14k
views
Should I only let my TV connect to the guest WiFi?
According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this.
Is this true? Is it a ...
- 625
1
vote
1
answer
134
views
Security assessment of a legacy SSL/TLS implementation on an IoT device
I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation.
The mode of assessment is ...
- 173
1
vote
1
answer
214
views
When does it make sense to deploy an embedded firewall on my IoT device?
I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
- 173
2
votes
1
answer
2k
views
Find Ripple20 using nmap or wireshark
Everyone might have heard about Ripple20 vulnerability which has impacted millions of IoT devices. I know that using Nessus or Qualys, it is possible to identify this vulnerability.
Is it possible to ...
- 51
2
votes
1
answer
661
views
What is the purpose of anti-rollback protection in IoT devices?
The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks:
C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware.
What is ...
- 29.6k
2
votes
1
answer
221
views
Which security protocols are the todays state of the art in WSN?
WSN (Wireless sensor networks) are mostly distributed low-power computers with sensing tasks that rely on limited battery life and therefore are not able to implement full-size security protocols. ...
- 125
4
votes
1
answer
2k
views
Self-signed certificates in embedded IoT device
I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC).
These IoT nodes would be deployed and, during ...
- 103