Questions tagged [iot]

Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.

Filter by
Sorted by
Tagged with
0
votes
1answer
53 views

Which security protocols are the todays state of the art in WSN?

WSN (Wireless sensor networks) are mostly distributed low power computer with the sensing task that rely on limited battery life and therefore are not able to implement full size security protocols. ...
1
vote
1answer
65 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
0
votes
2answers
52 views

Authentication Certificates in Embedded System (Microcontroller)

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices. In order to have a proper security I´m thinking about using Authentication Certificates ...
1
vote
0answers
30 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
1
vote
2answers
614 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
0
votes
1answer
73 views

How to secure an IoT device

Which is the proper way to prevent users to read sensible information stored inside an IoT device (e.g. source code / private keys...)? Fully disk encryption is of course an option, but is it ...
0
votes
0answers
32 views

BLE IoT device as platform backdoor for hackers

I have a IoT device that works with BLE and uses a smartphone as a bridge to connect to a digital platform (cloud). The communication between the IoT device and the platform is based in PKI. The IoT ...
0
votes
0answers
25 views

Which kind of attacks could be done on CoAP protocol?

I'm a student and I'm studying the security of the CoAP protocol. So, thinking on the attack-surface my thought was about internal attacks (i.e inside the network) and the external attack (i.e. ...
5
votes
3answers
368 views

What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?

I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
1
vote
1answer
56 views

How does my ipcamera work despite UPnP disabled on home router? [closed]

Recently I bought an IPcamera in order to test its security. Unfortunately, it just has 2 ports open : 554/tcp RTSP 5000/tcp UPnP I was pretty sure the ipcamera would poke my router and open up ...
1
vote
2answers
85 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
1
vote
0answers
135 views

How is eSIM profile cloning prevented?

How are eSIM profiles tied to a particular device? That is, what prevents a bad actor from digitally copying an eSIM profile (or, why is the eUICC chip required; can't we have a soft or emulated SIM)?
2
votes
1answer
313 views

Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?

UPDATE: Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection). I don't know what I am looking for here in Wireshark, but I added the host ...
2
votes
2answers
150 views

Using Diffie-Hellman exchange on low power IoT devices

I have almost 0 knowledge of IoT, their protocols and usual device constraints. I had a discussion today with someone that has a fair amount of IoT experience and we were discussing some security ...
3
votes
1answer
1k views

Port-forwarding to a web server on Raspberry Pi

I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip. In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
0
votes
1answer
460 views

How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?

ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN. Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...
4
votes
1answer
290 views

What are security problems with hole punching technique in the context of IoT?

Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented ...
0
votes
0answers
48 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
0
votes
2answers
137 views

Using unencrypted protocols with IoT devices

Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
5
votes
3answers
255 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
3
votes
3answers
352 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
0
votes
0answers
74 views

Side channel resistant of Intel TinyCrypt library

Is the TinyCrypt library side channel resistant. I found a mentioned in the "Genral Remarks" on github. But it is mentioned that it is not fully side channel resistant. Does anyone know the extend ...
2
votes
2answers
176 views

Secure operation of IoT equipment?

In the light of recent events around Mirai not being the only IoT botnet, but being joined by IoTroop / IoT_reaper (see here and here ), I wondered what steps need to be taken to securely operate an ...
1
vote
0answers
224 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
1
vote
1answer
110 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
1answer
94 views

Local area network multi-device network communication protocol

I am planning to build a local area network that will have one Master device and multiple Slave devices. The communication should be able to handle only ON/OFF functionality of the devices (devices ...
-1
votes
1answer
425 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
1
vote
5answers
449 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
1
vote
1answer
68 views

Risk of giving untrusted IOT Device access to wifi

My issue isn't so common and I can't find an answer in the see of other IoT security issues. Let's say I have an IP cam, but I'm not even worried about someone being able to view the live stream, or ...
6
votes
2answers
819 views

IoT devices with public IP?

My understanding of worms like Mirai is the following: Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers If you get in, do Bad Things™. It ...
1
vote
2answers
119 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
6
votes
2answers
83 views

CCM for IoT - choosing L and M

Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
0
votes
2answers
1k views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...
4
votes
3answers
136 views

How do I secure my networked printers?

I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...
1
vote
1answer
87 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
0
votes
1answer
137 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
0answers
111 views

Monitoring and Securing IoT devices [closed]

I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
2
votes
2answers
345 views

Proper security for IoT device

I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module. How do I make it secure? More specifically, how do I ...
-2
votes
1answer
227 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
2
votes
1answer
83 views

Lightweight terminal protocol for IoT

For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP): It might be useful to have a ...
1
vote
1answer
97 views

What is the risk of running a IOT device exposed to the internet using non https port?

I have a IOT device in my home that controls my security system and let me enable/disable it. It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may ...
1
vote
2answers
89 views

Do I need Gateway Firewall for IoT network? [closed]

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec? Even if there is need that can be implemented at cloud. Is there any need for it to ...
2
votes
0answers
260 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
0
votes
1answer
254 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
1
vote
1answer
472 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
2
votes
3answers
529 views

What kind of IoT devices use certificates?

I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are: SCEP (Simple Certificate Enrollment Protocol) EST (...
-1
votes
2answers
387 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
3
votes
1answer
68 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
1
vote
2answers
82 views

Which are the most common vulnerabilities for poor crafted IoT devices? [closed]

I'm learning about securing IoT devices and starting to learn how to develop my own software for them. I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit ...
1
vote
0answers
29 views

Secure pairing support in various RF standards

I would like to understand if secure pairing can be implemented in all (or none)? IoT RF standards. For example: BLE provides Out-of-band possibility, which seems like only really secure option to me....