Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [iot]

Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
88 views

AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment

Let's say we produce IoT devices and want them to access AWS IoT Core. The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
Francesco B.'s user avatar
0 votes
1 answer
572 views

How can one use HTTPS without a domain name, or on a local network?

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
Jack B's user avatar
  • 103
0 votes
1 answer
113 views

How to resolve an issue with potential mismatch between device certificate and CA certificate?

I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
monkey's user avatar
  • 103
0 votes
0 answers
95 views

TLS Certificate life for IoT System

I'm developing an IoT product's software, where it runs HTTPS client. Given that the certificate of servers are renewed every year, it's not that issue while we're authenticating against the ...
Hamza Hajeir's user avatar
1 vote
1 answer
122 views

Write message that can be verified by any member of a group

I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by. There may be tens of messages generated each ...
gilbertbw's user avatar
  • 111
0 votes
2 answers
174 views

Hosting a Honeypot to collect data [closed]

I want to collect IoT botnets in order to analyze them. Are there any good VPS providers who allow to do that? - I'm a little cautious about this because of possible misconfigurations that could ...
Jan's user avatar
  • 3
1 vote
1 answer
209 views

Next movement in IoT pentest when you have restricted information

I am a newbie cyber security engineer working on IoT. Today, a task is given to me. The task was making pentest to a cooker. Because of the privacy, I cannot share the brand of the cooker. The cooker ...
Not a Salmon Fish's user avatar
0 votes
1 answer
450 views

Can a simcard's public IP be accessed?

I am in a discussion with someone about IoT devices. We use private IPs for simcards, but the other organisation is using public IPs. I think it is possible for a hacker to access these public IPs to ...
Iot_Engineer's user avatar
0 votes
0 answers
139 views

Providing encryption and password for an IOT device over gRPC

I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online. My IOT device servers will run on the client network and may be accessed over it or over the ...
FlashDD's user avatar
  • 101
0 votes
1 answer
2k views

How secure are tp link kasa devices?

When setting up a kasa smart device, say a wifi smart plug, it asks for the wifi credentials and then it connects to the network. Since these devices can be controlled remotely via the kasa app, one ...
rvh's user avatar
  • 35
2 votes
2 answers
736 views

WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks

While WPA2-PSK and WPA3-SAE are really secure once a connection has been established, my understanding is that if you have access to the Wi-Fi password you can impersonate the AP without any problems. ...
Facundo's user avatar
  • 71
1 vote
3 answers
251 views

Is it possible to restrict individual devices connected to a home router from communicating outside the local network?

I have a device which I don't want to have any communication with the outside world sans any initial updates/etc (say, an IoT device that would otherwise phone home). I would still like to be able to ...
Drew's user avatar
  • 113
3 votes
4 answers
242 views

Can IoT connect to each other forming their own network?

I recently purchased a fairly sleek LED lamp. Like most new-fangled furnishings it comes with a pile of unnecessary features including bluetooth, wifi, and a mobile app. Hence my new-found paranoia. I ...
fny's user avatar
  • 203
0 votes
1 answer
250 views

Are there IoT devices that send data home despite blocked internet connection (with the detour via bluetooth on the phone)?

I am increasingly buying IoT aka smart devices for my household. All these devices need to be connected to WLAN and proprietary app (via bluetooth on iPhone). I do this initial step, but then block ...
Sybil's user avatar
  • 1,479
0 votes
2 answers
207 views

How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?

This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets. Also, most of the persistence methods I have seen tend to be ...
MoooonX's user avatar
  • 15
0 votes
2 answers
507 views

How do IoT devices know the checksum of firmware upgrades?

As I understand, some IoT devices verify the integrity of firmware updates downloaded from the internet using the checksum of the file before installing the update, making it impossible for attackers ...
jweik's user avatar
  • 3
1 vote
1 answer
2k views

TPM use without secure boot

I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
Alex's user avatar
  • 111
0 votes
0 answers
115 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
Akhilesh Gupta's user avatar
2 votes
2 answers
243 views

Am I authenticating devices securely?

I'm building a IOT platform for my home as a hobby. Currently, I'm trying to implement device authentication. A device in my case could be a Raspberry Pi, Arduino, Jetson Nano. To authenticate devices ...
Riki's user avatar
  • 123
0 votes
1 answer
176 views

Collect traffic from mobile app to IoT device [closed]

I have a mobile app that connects to a IoT device over port 8888 to send commands. I'm not sure how to intercept this. MITMproxy was not able to capture the data as the app would not load behind a ...
JamesAnderson's user avatar
5 votes
2 answers
3k views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
lukecam95's user avatar
0 votes
1 answer
260 views

How to secure microphones on smart home devices?

I have a number of smart home devices in my house. Some of which are a Samsung refrigerator, a Whirlpool washer, a Bose Bluetooth speaker with wifi and a Roku TV all of which I assume have microphones....
Rideboards's user avatar
0 votes
0 answers
159 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
Breina's user avatar
  • 101
22 votes
6 answers
6k views

When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?

I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
JohnnyAppleseed's user avatar
2 votes
0 answers
157 views

IoT Device Authentication

I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/ I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
Falconar's user avatar
0 votes
0 answers
169 views

Routing attacks on Peer 2 Peer networks?

I've started creating a framework that aims to make anything into an IoT device. In order to stay online, a peer 2 peer layer needs to be implemented. On top of it, common point services will give the ...
ZARKONES's user avatar
0 votes
1 answer
224 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
Tomas Creemers's user avatar
0 votes
1 answer
1k views

HDMI with Ethernet: Network Security Risk?

I recently found out that HDMI cables (v1.4 and over) have ethernet capabilities for higher res output, so I want to know one thing: Say I have a PC/laptop connected to the internet, and a monitor (...
BBB's user avatar
  • 1
0 votes
1 answer
139 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
AnyDev's user avatar
  • 103
1 vote
1 answer
446 views

RSA vs ECC certificate for IoT device client side certificate authentication

I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA. There are the provisions of ...
Akhilesh Gupta's user avatar
9 votes
3 answers
4k views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
Akhilesh Gupta's user avatar
2 votes
1 answer
412 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
Akhilesh Gupta's user avatar
1 vote
1 answer
262 views

Securing IoT application

I'm designing an IoT product, I'm searching solutions to secure the system. The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities. I've read enough to come with this ...
Hamza Hajeir's user avatar
1 vote
2 answers
125 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
Sen's user avatar
  • 113
1 vote
0 answers
190 views

What data can be sniffed in a LoRaWAN network at various points?

What data or metadata can be sniffed in a LoRaWAN network at various points like the end-device (node), the gateway, the network server and the application server? Is there exists a standardized data ...
Karthik's user avatar
  • 11
3 votes
1 answer
760 views

Setup network with IoT devices

I bought a new router and I'm thinking to make my network a bit smarter from the security aspect. My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
rekire's user avatar
  • 133
3 votes
2 answers
564 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
fa__'s user avatar
  • 131
0 votes
1 answer
230 views

How to distribute bash scripts to multiple IOT devices securely

Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source. Our customers however will have to buy separate IOT devices ...
AK_'s user avatar
  • 687
1 vote
1 answer
156 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
microwth's user avatar
  • 2,473
0 votes
0 answers
139 views

How cameras receive Wi-Fi credentials from App?

I bought a wifi camera and performed the simple startup process: Powered on Discovered the camera through the dedicated App Set the WiFi credentials on the App to pass to the camera After that, the ...
kuma's user avatar
  • 119
1 vote
2 answers
355 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
Lucas Shuck's user avatar
3 votes
2 answers
663 views

How can I implement TLS on a connection with very low throughput?

I'm doing a IoT project therefore want to reduce connection overhead to a minimum. We want to secure the communication, especially the authenticity and confidentiality. With a standard TLS protocol, a ...
Tian's user avatar
  • 31
0 votes
2 answers
561 views

Are smart plugs safe? (Xiaomi in particular)

Are smart plugs safe, Xiaomi ones in particular (Zigbee and WI-FI versions)? My main concern is that the plug is connected to Mi account and allows remote management. In case hacker gains access, can ...
Peter's user avatar
  • 127
0 votes
0 answers
147 views

How to secure smart home devices?

I'm interested in how I can secure my IoT devices from hackers. Particularly, I have a Xiaomi hub and a range of child devices for it. Also, how to secure devices that communicate using the Zigbee ...
Peter's user avatar
  • 127
20 votes
4 answers
15k views

Should I only let my TV connect to the guest WiFi?

According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this. Is this true? Is it a ...
Evorlor's user avatar
  • 635
1 vote
1 answer
167 views

Security assessment of a legacy SSL/TLS implementation on an IoT device

I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation. The mode of assessment is ...
Akhilesh Gupta's user avatar
1 vote
1 answer
246 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
Akhilesh Gupta's user avatar
2 votes
1 answer
2k views

Find Ripple20 using nmap or wireshark

Everyone might have heard about Ripple20 vulnerability which has impacted millions of IoT devices. I know that using Nessus or Qualys, it is possible to identify this vulnerability. Is it possible to ...
Ishmeet Kaur's user avatar
2 votes
1 answer
740 views

What is the purpose of anti-rollback protection in IoT devices?

The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks: C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware. What is ...
Sjoerd's user avatar
  • 30.8k
2 votes
1 answer
244 views

Which security protocols are the todays state of the art in WSN?

WSN (Wireless sensor networks) are mostly distributed low-power computers with sensing tasks that rely on limited battery life and therefore are not able to implement full-size security protocols. ...
baxbear's user avatar
  • 125