Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iot]

The tag has no usage guidance.

0
votes
0answers
30 views

Honeypot emulating CoAP, MQTT, LwM2M [closed]

I'm starting a project with the end goal of building a honeypot dedicated for IoT applications. As it is for university and for learning purposes, I need to find an open-source implementation with ...
3
votes
1answer
212 views

What are security problems with hole punching technique in the context of IoT?

Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented ...
1
vote
2answers
470 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
2
votes
2answers
154 views

Secure operation of IoT equipment?

In the light of recent events around Mirai not being the only IoT botnet, but being joined by IoTroop / IoT_reaper (see here and here ), I wondered what steps need to be taken to securely operate an ...
1
vote
0answers
91 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
0
votes
1answer
43 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
1answer
77 views

Local area network multi-device network communication protocol

I am planning to build a local area network that will have one Master device and multiple Slave devices. The communication should be able to handle only ON/OFF functionality of the devices (devices ...
0
votes
0answers
74 views

Google Home Hub Network Traffic on Port 8009

I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the ...
-1
votes
1answer
94 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
4
votes
2answers
90 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
1
vote
5answers
174 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
0
votes
0answers
24 views

Communicating with things on AWS IoT without certificates problem

Is "IAM" access the only method to gain access AWS? I'm asking because I'm using AWS IoT. With AWS IoT we create things such as devices on AWS IoT Core. However, with IAM access, after creating a "...
0
votes
1answer
51 views

Risk of giving untrusted IOT Device access to wifi

My issue isn't so common and I can't find an answer in the see of other IoT security issues. Let's say I have an IP cam, but I'm not even worried about someone being able to view the live stream, or ...
5
votes
2answers
708 views

IoT devices with public IP?

My understanding of worms like Mirai is the following: Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers If you get in, do Bad Things™. It ...
1
vote
2answers
78 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
6
votes
2answers
72 views

CCM for IoT - choosing L and M

Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
0
votes
2answers
874 views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...
1
vote
1answer
27 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
4
votes
3answers
121 views

How do I secure my networked printers?

I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...
1
vote
1answer
66 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
0
votes
1answer
84 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
0answers
73 views

Monitoring and Securing IoT devices [closed]

I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
2
votes
2answers
208 views

Proper security for IoT device

I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module. How do I make it secure? More specifically, how do I ...
-2
votes
1answer
96 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
1
vote
1answer
65 views

Lightweight terminal protocol for IoT

For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP): It might be useful to have a ...
1
vote
1answer
83 views

What is the risk of running a IOT device exposed to the internet using non https port?

I have a IOT device in my home that controls my security system and let me enable/disable it. It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may ...
1
vote
2answers
70 views

Do I need Gateway Firewall for IoT network? [closed]

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec? Even if there is need that can be implemented at cloud. Is there any need for it to ...
1
vote
0answers
240 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
0
votes
1answer
160 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
1
vote
1answer
293 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
2
votes
3answers
328 views

What kind of IoT devices use certificates?

I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are: SCEP (Simple Certificate Enrollment Protocol) EST (...
-1
votes
2answers
350 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
3
votes
1answer
65 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
0
votes
2answers
77 views

Which are the most common vulnerabilities for poor crafted IoT devices? [closed]

I'm learning about securing IoT devices and starting to learn how to develop my own software for them. I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit ...
1
vote
0answers
25 views

Secure pairing support in various RF standards

I would like to understand if secure pairing can be implemented in all (or none)? IoT RF standards. For example: BLE provides Out-of-band possibility, which seems like only really secure option to me....
0
votes
0answers
70 views

IoT Device user needs to perform task requiring Windows admin privilege

Our IoT device runs only our application and the device users can not launch additional apps. The IoT device users and IoT device admins both run under normal (non-admin) accounts with identical ...
0
votes
1answer
110 views

Does LoraWan protocol's Over The Air Activation run Diffie Hellman?

I am looking at the LoraWan protocol specification and I want to capture the over the air activation of a device. So far I have seen the: https://zakelijkforum.kpn.com/lora-forum-16/over-the-air-...
3
votes
5answers
207 views

How to keep Internet of Things projects secure? [closed]

I want to experiment with the use of sensors for data logging and potentially for automated actions based on data properties. An example of the latter is if a value being monitored exceeds a threshold ...
27
votes
8answers
6k views

Should firmware images for IoT be encrypted for security reasons?

When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder. (They should be signed of course)
1
vote
1answer
79 views

How do you change the password of an IoT device like a DVR box?

The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet. My ...
1
vote
0answers
91 views

I am looking for a new firewall [closed]

I am looking for help on purchasing a firewall and some information on firewall recommendation. I am not really technically savvy but, I understand a bit about networking so bear with me. I have been ...
18
votes
1answer
4k views

Is a PKI for the IoT really a good idea?

I am reading a bit about the security of IoT devices and found quite a lot of articles describing how a PKI would be an improvement for the current infrastructure. I am, however, not convinced if ...
56
votes
10answers
11k views

Does the local network need to be hacked first for IoT devices to be accessible?

I completely understand how IoT devices were used in the massive DDoS attacks because they are easily manipulated due to lack of firewalls, default passwords, etc. What I don't understand is although ...
2
votes
0answers
89 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
4
votes
0answers
105 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
0
votes
1answer
80 views

Is it safe to use an auto pay feature on my smart watch that stores card info?

(So guess what I got for Christmas...) While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially ...
3
votes
1answer
992 views

Port-forwarding to a web server on Raspberry Pi

I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip. In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
0
votes
1answer
1k views

What are some interesting project ideas that use machine learning to solve issues in IOT security? [closed]

I am interesting in IOT security and machine learning/deep learning. I am looking for good project ideas to work on. example: http://projectabstracts.com/20138/a-malicious-pattern-detection-engine-...
2
votes
2answers
126 views

How to ensure a new key has propagated

I have a hub that communicates with an IoT device and needs to change the encryption key on that device at frequent intervals. Messages are AES-256-CBC encrypted using the old key, and the new key is ...
0
votes
1answer
370 views

How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?

ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN. Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...