Questions tagged [iot]
Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.
146
questions
1
vote
0
answers
49
views
Possible attacks againts head unit of contemporary cars
I purchased a new car this week. It has multimedia unit (sometimes called head unit of car). It has FM/AM/DAB radio functions (with its radio antenna) ,bluetooth 5.0,Wireless CarPlay – Android Auto, ...
0
votes
0
answers
39
views
Asking for Offensive Cybersecurity Tool Ideas [closed]
I’m exploring the world of offensive security and looking for small tool ideas that I could develop to improve my skills. My focus is primarily on reverse engineering and cracking, and I’m also ...
- 1
9
votes
3
answers
3k
views
What techniques are there for preventing radio-signal replay attacks?
I am now researching RF security on IoT devices such as doors, cars, etc. I have a HackRF device for performing RF-signal manipulations such as replay attacks. It is very easy to record the signals ...
1
vote
1
answer
134
views
Why does AWS strongly recommend a non-self-signed, code-signing certificate?
I am developing a hardware device that utilizes AWS IoT OTA via FreeRTOS. On this AWS web page, it says
We recommend that you purchase a code-signing certificate from a
company with a good ...
- 113
0
votes
0
answers
100
views
AWS IoT - Use a temporary certificate created at build time to authenticate a device for self-enrolment
Let's say we produce IoT devices and want them to access AWS IoT Core.
The best solution is something like: every device has a (unique) private key and a public X.509 certificate signed by a valid ...
- 101
0
votes
1
answer
848
views
How can one use HTTPS without a domain name, or on a local network?
I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
- 103
0
votes
1
answer
126
views
How to resolve an issue with potential mismatch between device certificate and CA certificate?
I have an IoT device which is failing to establish a connection with the cloud. The problem is related to the device X509 certificate (to the best of my understanding). I've posted a version of this ...
- 113
0
votes
0
answers
112
views
TLS Certificate life for IoT System
I'm developing an IoT product's software, where it runs HTTPS client.
Given that the certificate of servers are renewed every year, it's not that issue while we're authenticating against the ...
- 23
1
vote
1
answer
127
views
Write message that can be verified by any member of a group
I am trying to develop a scheme for publishing a message to a group of recipients. Any recipient needs to be able to verify who the message was sent by.
There may be tens of messages generated each ...
- 111
0
votes
2
answers
203
views
Hosting a Honeypot to collect data [closed]
I want to collect IoT botnets in order to analyze them. Are there any good VPS providers who allow to do that? - I'm a little cautious about this because of possible misconfigurations that could ...
- 103
2
votes
1
answer
263
views
Next movement in IoT pentest when you have restricted information
I am a newbie cyber security engineer working on IoT. Today, a task is given to me. The task was making pentest to a cooker. Because of the privacy, I cannot share the brand of the cooker. The cooker ...
0
votes
1
answer
569
views
Can a simcard's public IP be accessed?
I am in a discussion with someone about IoT devices.
We use private IPs for simcards, but the other organisation is using public IPs.
I think it is possible for a hacker to access these public IPs to ...
0
votes
0
answers
153
views
Providing encryption and password for an IOT device over gRPC
I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online.
My IOT device servers will run on the client network and may be accessed over it or over the ...
- 101
0
votes
1
answer
2k
views
How secure are tp link kasa devices?
When setting up a kasa smart device, say a wifi smart plug, it asks for the wifi credentials and then it connects to the network.
Since these devices can be controlled remotely via the kasa app, one ...
- 35
2
votes
2
answers
932
views
WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks
While WPA2-PSK and WPA3-SAE are really secure once a connection has been established, my understanding is that if you have access to the Wi-Fi password you can impersonate the AP without any problems. ...
- 81
1
vote
3
answers
365
views
Is it possible to restrict individual devices connected to a home router from communicating outside the local network?
I have a device which I don't want to have any communication with the outside world sans any initial updates/etc (say, an IoT device that would otherwise phone home). I would still like to be able to ...
- 113
3
votes
4
answers
283
views
Can IoT connect to each other forming their own network?
I recently purchased a fairly sleek LED lamp. Like most new-fangled furnishings it comes with a pile of unnecessary features including bluetooth, wifi, and a mobile app.
Hence my new-found paranoia. I ...
- 203
0
votes
1
answer
276
views
Are there IoT devices that send data home despite blocked internet connection (with the detour via bluetooth on the phone)?
I am increasingly buying IoT aka smart devices for my household.
All these devices need to be connected to WLAN and proprietary app (via bluetooth on iPhone). I do this initial step, but then block ...
- 1,481
0
votes
2
answers
220
views
How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?
This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets.
Also, most of the persistence methods I have seen tend to be ...
- 15
0
votes
2
answers
551
views
How do IoT devices know the checksum of firmware upgrades?
As I understand, some IoT devices verify the integrity of firmware updates downloaded from the internet using the checksum of the file before installing the update, making it impossible for attackers ...
- 3
2
votes
1
answer
2k
views
TPM use without secure boot
I've been asked to improve the security of my company's iot device, and encrypt a storage partition. It's a general purpose arm based device, and currently can boot from a variety of sources (USB, ...
- 121
0
votes
0
answers
119
views
Secure logs on an embedded IoT device
I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development.
Since logs will be primarily event & data logs, the size of the log ...
- 183
2
votes
2
answers
256
views
Am I authenticating devices securely?
I'm building a IOT platform for my home as a hobby. Currently, I'm trying to implement device authentication. A device in my case could be a Raspberry Pi, Arduino, Jetson Nano. To authenticate devices ...
- 123
0
votes
1
answer
184
views
Collect traffic from mobile app to IoT device [closed]
I have a mobile app that connects to a IoT device over port 8888 to send commands. I'm not sure how to intercept this. MITMproxy was not able to capture the data as the app would not load behind a ...
5
votes
2
answers
3k
views
How can I make an SSL certificate for an IoT device trusted on all browsers?
I have a web server running on an IoT device, more specifically, on an ESP32.
This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
- 53
0
votes
1
answer
273
views
How to secure microphones on smart home devices?
I have a number of smart home devices in my house. Some of which are a Samsung refrigerator, a Whirlpool washer, a Bose Bluetooth speaker with wifi and a Roku TV all of which I assume have microphones....
- 597
0
votes
0
answers
170
views
Spoofing a server to intercept my IoT device's data
I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
- 101
22
votes
6
answers
6k
views
When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?
I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
- 331
2
votes
0
answers
162
views
IoT Device Authentication
I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/
I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
- 21
0
votes
0
answers
173
views
Routing attacks on Peer 2 Peer networks?
I've started creating a framework that aims to make anything into an IoT device. In order to stay online, a peer 2 peer layer needs to be implemented. On top of it, common point services will give the ...
- 1
0
votes
1
answer
231
views
Sensor device web interface certificate
I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
- 101
0
votes
1
answer
1k
views
HDMI with Ethernet: Network Security Risk?
I recently found out that HDMI cables (v1.4 and over) have ethernet capabilities for higher res output, so I want to know one thing:
Say I have a PC/laptop connected to the internet, and a monitor (...
- 1
0
votes
1
answer
146
views
Why would device manufacturer refuse to publish root CA that signs devices but provides the CA via support ticket attachment
Background:
We got a few new model SIP phones. Each phone has built-in unique certificate issued by the manufacturer.
Previous models had certs issued by a different CA and that CA cert was published, ...
- 103
1
vote
1
answer
506
views
RSA vs ECC certificate for IoT device client side certificate authentication
I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA.
There are the provisions of ...
- 183
9
votes
3
answers
5k
views
Key differences between X509 TLS Client certificate and server certificate
Is there any difference between a X509 TLS client cert and a server cert?
I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
- 183
2
votes
1
answer
448
views
Validation of server identity via SSL certificate in during SSL connection handshake
My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
- 183
1
vote
1
answer
267
views
Securing IoT application
I'm designing an IoT product, I'm searching solutions to secure the system.
The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities.
I've read enough to come with this ...
- 23
1
vote
2
answers
128
views
Securing APIs used by remote devices
We have desktop software that we install and run on remote, unattended machines. The software needs to hit API endpoints on our server. What is the best way to secure those endpoints to ensure that ...
- 113
1
vote
0
answers
202
views
What data can be sniffed in a LoRaWAN network at various points?
What data or metadata can be sniffed in a LoRaWAN network at various points like the end-device (node), the gateway, the network server and the application server? Is there exists a standardized data ...
- 11
3
votes
1
answer
835
views
Setup network with IoT devices
I bought a new router and I'm thinking to make my network a bit smarter from the security aspect.
My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
- 133
3
votes
2
answers
620
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
- 131
0
votes
1
answer
246
views
How to distribute bash scripts to multiple IOT devices securely
Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source.
Our customers however will have to buy separate IOT devices ...
- 687
1
vote
1
answer
160
views
Why the need to hardcode passwords? [closed]
Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices.
Why don't they store the hashed password instead?
For what functionality do they need the plaintext ...
- 2,483
1
vote
1
answer
202
views
How cameras receive Wi-Fi credentials from App?
I bought a wifi camera and performed the simple startup process:
Powered on
Discovered the camera through the dedicated App
Set the WiFi credentials on the App to pass to the camera
After that, the ...
- 129
1
vote
2
answers
379
views
Do some IoT devices connect to your wifi without you knowing it?
I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
- 11
3
votes
2
answers
706
views
How can I implement TLS on a connection with very low throughput?
I'm doing a IoT project therefore want to reduce connection overhead to a minimum. We want to secure the communication, especially the authenticity and confidentiality. With a standard TLS protocol, a ...
- 31
0
votes
2
answers
590
views
Are smart plugs safe? (Xiaomi in particular)
Are smart plugs safe, Xiaomi ones in particular (Zigbee and WI-FI versions)?
My main concern is that the plug is connected to Mi account and allows remote management. In case hacker gains access, can ...
- 127
0
votes
0
answers
154
views
How to secure smart home devices?
I'm interested in how I can secure my IoT devices from hackers. Particularly, I have a Xiaomi hub and a range of child devices for it. Also, how to secure devices that communicate using the Zigbee ...
- 127
20
votes
4
answers
15k
views
Should I only let my TV connect to the guest WiFi?
According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this.
Is this true? Is it a ...
- 635
1
vote
1
answer
172
views
Security assessment of a legacy SSL/TLS implementation on an IoT device
I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation.
The mode of assessment is ...
- 183