Questions tagged [iot]

Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
66 views

How are scam call centers cctv stream easily hacked by scam baiters

Recently i have been seeing the videos of fake call centers being busted by scam baiters like Mark Rober In all of these videos the scam baiters are easily able to hack into the the network camera ...
user avatar
0 votes
2 answers
89 views

How do IoT devices know the checksum of firmware upgrades?

As I understand, some IoT devices verify the integrity of firmware updates downloaded from the internet using the checksum of the file before installing the update, making it impossible for attackers ...
user avatar
  • 3
0 votes
1 answer
73 views

TPM use without secure boot

I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
user avatar
  • 101
0 votes
0 answers
59 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
user avatar
2 votes
2 answers
166 views

Am I authenticating devices securely?

I'm building a IOT platform for my home as a hobby. Currently, I'm trying to implement device authentication. A device in my case could be a Raspberry Pi, Arduino, Jetson Nano. To authenticate devices ...
user avatar
  • 23
0 votes
1 answer
37 views

Collect traffic from mobile app to IoT device

I have a mobile app that connects to a IoT device over port 8888 to send commands. I'm not sure how to intercept this. MITMproxy was not able to capture the data as the app would not load behind a ...
user avatar
1 vote
2 answers
249 views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
user avatar
0 votes
1 answer
75 views

How to find Vulnerable Cyber Physical Devices (small ones)?

I am trying to find vulnerable & small CPS(cyber physical system) devices. I need these because I want to do model checking, threat modelling and other stuffs on them. I've tried to search on ...
user avatar
0 votes
1 answer
178 views

How to secure microphones on smart home devices?

I have a number of smart home devices in my house. Some of which are a Samsung refrigerator, a Whirlpool washer, a Bose Bluetooth speaker with wifi and a Roku TV all of which I assume have microphones....
user avatar
0 votes
0 answers
83 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
user avatar
  • 101
22 votes
6 answers
6k views

When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?

I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
user avatar
2 votes
0 answers
98 views

IoT Device Authentication

I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/ I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
user avatar
0 votes
0 answers
113 views

Routing attacks on Peer 2 Peer networks?

I've started creating a framework that aims to make anything into an IoT device. In order to stay online, a peer 2 peer layer needs to be implemented. On top of it, common point services will give the ...
user avatar
0 votes
1 answer
134 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
user avatar
0 votes
1 answer
287 views

HDMI with Ethernet: Network Security Risk?

I recently found out that HDMI cables (v1.4 and over) have ethernet capabilities for higher res output, so I want to know one thing: Say I have a PC/laptop connected to the internet, and a monitor (...
user avatar
  • 1
0 votes
1 answer
97 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
user avatar
  • 103
1 vote
1 answer
163 views

RSA vs ECC certificate for IoT device client side certificate authentication

I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA. There are the provisions of ...
user avatar
7 votes
3 answers
1k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
user avatar
2 votes
1 answer
115 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
user avatar
1 vote
1 answer
198 views

Securing IoT application

I'm designing an IoT product, I'm searching solutions to secure the system. The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities. I've read enough to come with this ...
user avatar
1 vote
2 answers
89 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
user avatar
  • 113
1 vote
0 answers
91 views

What data can be sniffed in a LoRaWAN network at various points?

What data or metadata can be sniffed in a LoRaWAN network at various points like the end-device (node), the gateway, the network server and the application server? Is there exists a standardized data ...
user avatar
  • 11
3 votes
1 answer
196 views

Setup network with IoT devices

I bought a new router and I'm thinking to make my network a bit smarter from the security aspect. My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
user avatar
  • 133
2 votes
2 answers
212 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
user avatar
  • 121
0 votes
1 answer
142 views

How to distribute bash scripts to multiple IOT devices securely

Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source. Our customers however will have to buy separate IOT devices ...
user avatar
  • 667
1 vote
1 answer
112 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
user avatar
  • 2,099
1 vote
0 answers
98 views

How cameras receive Wi-Fi credentials from App?

I bought a wifi camera and performed the simple startup process: Powered on Discovered the camera through the dedicated App Set the WiFi credentials on the App to pass to the camera After that, the ...
user avatar
  • 131
1 vote
2 answers
171 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
user avatar
3 votes
2 answers
327 views

How can I implement TLS on a connection with very low throughput?

I'm doing a IoT project therefore want to reduce connection overhead to a minimum. We want to secure the communication, especially the authenticity and confidentiality. With a standard TLS protocol, a ...
user avatar
  • 31
0 votes
2 answers
352 views

Are smart plugs safe? (Xiaomi in particular)

Are smart plugs safe, Xiaomi ones in particular (Zigbee and WI-FI versions)? My main concern is that the plug is connected to Mi account and allows remote management. In case hacker gains access, can ...
user avatar
  • 127
0 votes
0 answers
108 views

How to secure smart home devices?

I'm interested in how I can secure my IoT devices from hackers. Particularly, I have a Xiaomi hub and a range of child devices for it. Also, how to secure devices that communicate using the Zigbee ...
user avatar
  • 127
20 votes
4 answers
10k views

Should I only let my TV connect to the guest WiFi?

According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this. Is this true? Is it a ...
user avatar
  • 547
1 vote
1 answer
108 views

Security assessment of a legacy SSL/TLS implementation on an IoT device

I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation. The mode of assessment is ...
user avatar
1 vote
1 answer
151 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
user avatar
1 vote
1 answer
1k views

Find Ripple20 using nmap or wireshark

Everyone might have heard about Ripple20 vulnerability which has impacted millions of IoT devices. I know that using Nessus or Qualys, it is possible to identify this vulnerability. Is it possible to ...
user avatar
2 votes
1 answer
478 views

What is the purpose of anti-rollback protection in IoT devices?

The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks: C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware. What is ...
user avatar
  • 28.5k
1 vote
1 answer
158 views

Which security protocols are the todays state of the art in WSN?

WSN (Wireless sensor networks) are mostly distributed low power computer with the sensing task that rely on limited battery life and therefore are not able to implement full size security protocols. ...
user avatar
  • 113
3 votes
1 answer
963 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
user avatar
3 votes
2 answers
477 views

Authentication Certificates in Embedded System (Microcontroller)

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices. In order to have a proper security I´m thinking about using Authentication Certificates ...
user avatar
1 vote
0 answers
475 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
user avatar
  • 11
0 votes
0 answers
134 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
user avatar
  • 1
0 votes
0 answers
79 views

BLE IoT device as platform backdoor for hackers

I have a IoT device that works with BLE and uses a smartphone as a bridge to connect to a digital platform (cloud). The communication between the IoT device and the platform is based in PKI. The IoT ...
user avatar
0 votes
0 answers
70 views

Which kind of attacks could be done on CoAP protocol?

I'm a student and I'm studying the security of the CoAP protocol. So, thinking on the attack-surface my thought was about internal attacks (i.e inside the network) and the external attack (i.e. ...
user avatar
1 vote
1 answer
173 views

How does my ipcamera work despite UPnP disabled on home router? [closed]

Recently I bought an IPcamera in order to test its security. Unfortunately, it just has 2 ports open : 554/tcp RTSP 5000/tcp UPnP I was pretty sure the ipcamera would poke my router and open up ...
user avatar
  • 151
1 vote
0 answers
243 views

How is eSIM profile cloning prevented?

How are eSIM profiles tied to a particular device? That is, what prevents a bad actor from digitally copying an eSIM profile (or, why is the eUICC chip required; can't we have a soft or emulated SIM)?
user avatar
2 votes
2 answers
5k views

Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?

UPDATE: Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection). I don't know what I am looking for here in Wireshark, but I added the host ...
user avatar
  • 155
5 votes
3 answers
2k views

What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?

I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
user avatar
  • 187
2 votes
2 answers
335 views

Using Diffie-Hellman exchange on low power IoT devices

I have almost 0 knowledge of IoT, their protocols and usual device constraints. I had a discussion today with someone that has a fair amount of IoT experience and we were discussing some security ...
user avatar
  • 123
0 votes
2 answers
236 views

Using unencrypted protocols with IoT devices

Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
user avatar
4 votes
3 answers
860 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
user avatar
  • 41