Questions tagged [iot]

Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.

Filter by
Sorted by
Tagged with
0
votes
0answers
71 views

Routing attacks on Peer 2 Peer networks?

I've started creating a framework that aims to make anything into an IoT device. In order to stay online, a peer 2 peer layer needs to be implemented. On top of it, common point services will give the ...
0
votes
1answer
75 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0
votes
1answer
72 views

HDMI with Ethernet: Network Security Risk?

I recently found out that HDMI cables (v1.4 and over) have ethernet capabilities for higher res output, so I want to know one thing: Say I have a PC/laptop connected to the internet, and a monitor (...
0
votes
1answer
54 views

Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment

Background: We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer. Previous models had certs issued by a different CA and that CA cert was published, ...
1
vote
1answer
69 views

RSA vs ECC certificate for IoT device client side certificate authentication

I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA. There are the provisions of ...
6
votes
3answers
834 views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
2
votes
1answer
67 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
1
vote
1answer
95 views

Securing IoT application

I'm designing an IoT product, I'm searching solutions to secure the system. The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities. I've read enough to come with this ...
1
vote
2answers
48 views

Securing APIs used by remote devices

We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
1
vote
0answers
51 views

What data can be sniffed in a LoRaWAN network at various points?

What data or metadata can be sniffed in a LoRaWAN network at various points like the end-device (node), the gateway, the network server and the application server? Is there exists a standardized data ...
2
votes
1answer
92 views

Setup network with IoT devices

I bought a new router and I'm thinking to make my network a bit smarter from the security aspect. My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
2
votes
2answers
82 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
0
votes
0answers
322 views

OT & IoT security related standards/metrics

To analyze OT & IoT security, I want to make an inventory about standards and metrics that are used in this field. Searching the web, I found standards like: Good practices for IoT and Smart ...
0
votes
1answer
73 views

How to distribute bash scripts to multiple IOT devices securely

Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source. Our customers however will have to buy separate IOT devices ...
1
vote
1answer
77 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
1
vote
0answers
60 views

How cameras receive Wi-Fi credentials from App?

I bought a wifi camera and performed the simple startup process: Powered on Discovered the camera through the dedicated App Set the WiFi credentials on the App to pass to the camera After that, the ...
1
vote
2answers
127 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
0
votes
0answers
129 views

How can I implement TLS on a connection with very low throughput?

I'm doing a IoT project therefore want to reduce connection overhead to minimum. We want to secure the communication, especially the authenticity and confidentiality. With a standard TLS protocl, a 2 ...
0
votes
2answers
211 views

Are smart plugs safe? (Xiaomi in particular)

Are smart plugs safe, Xiaomi ones in particular (Zigbee and WI-FI versions)? My main concern is that the plug is connected to Mi account and allows remote management. In case hacker gains access, can ...
0
votes
0answers
66 views

How to secure smart home devices?

I'm interested in how I can secure my IoT devices from hackers. Particularly, I have a Xiaomi hub and a range of child devices for it. Also, how to secure devices that communicate using the Zigbee ...
20
votes
4answers
9k views

Should I only let my TV connect to the guest WiFi?

According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this. Is this true? Is it a ...
1
vote
1answer
63 views

Security assessment of a legacy SSL/TLS implementation on an IoT device

I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation. The mode of assessment is ...
1
vote
1answer
69 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
1
vote
1answer
1k views

Find Ripple20 using nmap or wireshark

Everyone might have heard about Ripple20 vulnerability which has impacted millions of IoT devices. I know that using Nessus or Qualys, it is possible to identify this vulnerability. Is it possible to ...
2
votes
1answer
276 views

What is the purpose of anti-rollback protection in IoT devices?

The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks: C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware. What is ...
1
vote
1answer
91 views

Which security protocols are the todays state of the art in WSN?

WSN (Wireless sensor networks) are mostly distributed low power computer with the sensing task that rely on limited battery life and therefore are not able to implement full size security protocols. ...
3
votes
1answer
569 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
1
vote
2answers
251 views

Authentication Certificates in Embedded System (Microcontroller)

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices. In order to have a proper security I´m thinking about using Authentication Certificates ...
1
vote
0answers
287 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
0
votes
0answers
84 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
0
votes
0answers
40 views

BLE IoT device as platform backdoor for hackers

I have a IoT device that works with BLE and uses a smartphone as a bridge to connect to a digital platform (cloud). The communication between the IoT device and the platform is based in PKI. The IoT ...
0
votes
0answers
31 views

Which kind of attacks could be done on CoAP protocol?

I'm a student and I'm studying the security of the CoAP protocol. So, thinking on the attack-surface my thought was about internal attacks (i.e inside the network) and the external attack (i.e. ...
1
vote
1answer
106 views

How does my ipcamera work despite UPnP disabled on home router? [closed]

Recently I bought an IPcamera in order to test its security. Unfortunately, it just has 2 ports open : 554/tcp RTSP 5000/tcp UPnP I was pretty sure the ipcamera would poke my router and open up ...
1
vote
0answers
173 views

How is eSIM profile cloning prevented?

How are eSIM profiles tied to a particular device? That is, what prevents a bad actor from digitally copying an eSIM profile (or, why is the eUICC chip required; can't we have a soft or emulated SIM)?
2
votes
2answers
3k views

Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?

UPDATE: Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection). I don't know what I am looking for here in Wireshark, but I added the host ...
5
votes
3answers
1k views

What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?

I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
2
votes
2answers
238 views

Using Diffie-Hellman exchange on low power IoT devices

I have almost 0 knowledge of IoT, their protocols and usual device constraints. I had a discussion today with someone that has a fair amount of IoT experience and we were discussing some security ...
0
votes
2answers
170 views

Using unencrypted protocols with IoT devices

Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
4
votes
3answers
656 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
1
vote
0answers
300 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
1
vote
1answer
151 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
1answer
103 views

Local area network multi-device network communication protocol

I am planning to build a local area network that will have one Master device and multiple Slave devices. The communication should be able to handle only ON/OFF functionality of the devices (devices ...
-1
votes
1answer
985 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
1
vote
5answers
878 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
1
vote
1answer
84 views

Risk of giving untrusted IOT Device access to wifi

My issue isn't so common and I can't find an answer in the see of other IoT security issues. Let's say I have an IP cam, but I'm not even worried about someone being able to view the live stream, or ...
5
votes
3answers
358 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
1
vote
2answers
216 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
6
votes
2answers
101 views

CCM for IoT - choosing L and M

Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
1
vote
2answers
89 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
4
votes
3answers
152 views

How do I secure my networked printers?

I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...