Questions tagged [iot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
56
votes
10answers
11k views

Does the local network need to be hacked first for IoT devices to be accessible?

I completely understand how IoT devices were used in the massive DDoS attacks because they are easily manipulated due to lack of firewalls, default passwords, etc. What I don't understand is although ...
50
votes
6answers
11k views

How safe are wifi enabled talking toys?

There have been ads on the radio recently for a wifi enabled toy called Talkies, which are advertised as being able to communicate with app enabled phones, with a "trusted circle" that other phones ...
27
votes
8answers
6k views

Should firmware images for IoT be encrypted for security reasons?

When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder. (They should be signed of course)
18
votes
1answer
4k views

Is a PKI for the IoT really a good idea?

I am reading a bit about the security of IoT devices and found quite a lot of articles describing how a PKI would be an improvement for the current infrastructure. I am, however, not convinced if ...
12
votes
4answers
633 views

Is there a common standard for evaluating the Security of an IoT device?

When you write a paper about an implementing a classifying computer-vision/machine-learning algorithm, you can simply count the number of positive (correct) negatives/positives, and the number of ...
7
votes
1answer
612 views

How can IoT and other network devices access the internet if my router works as a firewall?

My understanding is that routers act as natural firewalls. In that context, how can an IoT device receive commands from the WAN if they are not initiated from within the LAN? In a specific example, ...
6
votes
2answers
76 views

CCM for IoT - choosing L and M

Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
6
votes
1answer
136 views

secure IoT device/brand publication [closed]

I came across this article: 75 Percent of Bluetooth Smart Locks Can Be Hacked when I was looking for IoT stuff for my home. tl;dr is they tested 16 bluetooth smart locks and eventually only two were ...
5
votes
2answers
736 views

IoT devices with public IP?

My understanding of worms like Mirai is the following: Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers If you get in, do Bad Things™. It ...
5
votes
3answers
165 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
5
votes
0answers
211 views

What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?

In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
4
votes
1answer
1k views

How does Mirai infect IoT?

Since every IoT device uses different operating system, and has different hardware architecture, with so many possible platforms, how does Mirai infect them?
4
votes
3answers
127 views

How do I secure my networked printers?

I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...
4
votes
2answers
553 views

Does still make sense to use SHA1?

I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
4
votes
0answers
115 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
3
votes
5answers
2k views

Could IOT Botnets be Stopped by Static IP addressing the Devices?

I followed the recent IOT DDOS against Dyn and noticed that the attack seemed have three rounds of attack and mitigation. Since I'm not well versed in infosec I did some reasearch around DDOS ...
3
votes
3answers
253 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
3
votes
5answers
209 views

How to keep Internet of Things projects secure? [closed]

I want to experiment with the use of sensors for data logging and potentially for automated actions based on data properties. An example of the latter is if a value being monitored exceeds a threshold ...
3
votes
5answers
545 views

How can I secure my security cameras?

I have dozens of cheap security cameras in my offices. I was under the assumption that, once I changed the admin password, disabled the insecure "P2P Mode", disabled UPNP, disabled guest access and ...
3
votes
1answer
1k views

Port-forwarding to a web server on Raspberry Pi

I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip. In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
3
votes
2answers
181 views

Are there established and/or curated security benchmarks/best practices for home appliances and networks?

I have seen several security standards and best practices for organizations (CIS, HIPPAA, PCI DSS) but are there any for homes? If yes, where can I find them? It would be nice for homeowners to have ...
3
votes
1answer
176 views

How would an external attacker utilise universal plug and play to bypass a firewall?

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
3
votes
1answer
173 views

Are there any IoT Systematic Creation Security Checklists?

Are you aware of any publicly available documents that would help IoT/Connected product creators develop a systematic/programmatic approach and/or process to securing such new age devices?
3
votes
1answer
65 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
3
votes
1answer
2k views

How to brute force a login page of an IP camera created in .asp?

I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the ...
3
votes
1answer
239 views

What are security problems with hole punching technique in the context of IoT?

Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented ...
2
votes
2answers
1k views

Detecting IOT Devices on Corporate Network? [closed]

I'm looking at trying to identify IOT devices which is sitting on my network. Any suggestions on what I can look for? Common ports being open? User agents?
2
votes
2answers
259 views

Proper security for IoT device

I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module. How do I make it secure? More specifically, how do I ...
2
votes
3answers
385 views

What kind of IoT devices use certificates?

I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are: SCEP (Simple Certificate Enrollment Protocol) EST (...
2
votes
2answers
193 views

Managing https security for IoT gateways

My company is a IoT-Gateway manufacturer. Customers are increasingly getting serious about security issues in the IoT domain. Additionally, governments require dedicated security features as HTTPS for ...
2
votes
1answer
107 views

Why do cellphones not use software to simulate a NAT router between the phone and the internet?

Connecting through wifi adds the benefit of being behind NAT. Why do cellphones not simulate being behind a nat network when connecting directly to the internet to limit the attack surface? Or, is ...
2
votes
1answer
103 views

What should be in top-down IoT Security Policy for companies engineering products to market? [closed]

You are a company creating consumer-facing IoT Devices, What things should go in a IoT product/data security policy? Initial thoughts: Privacy, Control Gates, cryptography, vulnerability/decision ...
2
votes
2answers
126 views

How to ensure a new key has propagated

I have a hub that communicates with an IoT device and needs to change the encryption key on that device at frequent intervals. Messages are AES-256-CBC encrypted using the old key, and the new key is ...
2
votes
0answers
90 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
2
votes
2answers
162 views

Secure operation of IoT equipment?

In the light of recent events around Mirai not being the only IoT botnet, but being joined by IoTroop / IoT_reaper (see here and here ), I wondered what steps need to be taken to securely operate an ...
2
votes
0answers
43 views

Protecting smart devices on my local network [closed]

I have a network of smart devices I have created, I wish to make more secure from attackers. I have implemented a Gateway on a Data Stream Network (DSN) to allow users to access these devices and ...
2
votes
1answer
67 views

What strategy would one utilise in order to breach an entire network, after gaining access to an embedded device on said network?

I am currently researching IoT security and am trying to find out about how a single device with poor password security on a network could be utilised to gain access to the other components of said ...
2
votes
0answers
66 views

One set of security standards for IoT devices?

In a recent hearing in the House of Representatives the question was asked whether it is feasible to create one set of security standards for all IoT devices. One of the panellists said yes and the ...
1
vote
1answer
152 views

How to secure JavaScript-enabled login page without TLS

I am involved in an IoT project with single pager web UI. Unfortunately, as it was discovered in a hard way, TLS stack is not viable on the selected platform. The alternatives I've found for securing ...
1
vote
2answers
84 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
1
vote
1answer
69 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
1
vote
1answer
86 views

How do you change the password of an IoT device like a DVR box?

The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet. My ...
1
vote
2answers
449 views

Updating the SSL fingerprint on an IoT device

I'm currently in the process of designing the security model for an IoT product my company is developing. The device will be connected to the internet via WiFi and shall communicate with our company'...
1
vote
1answer
29 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
1
vote
1answer
71 views

Lightweight terminal protocol for IoT

For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP): It might be useful to have a ...
1
vote
2answers
77 views

Do I need Gateway Firewall for IoT network? [closed]

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec? Even if there is need that can be implemented at cloud. Is there any need for it to ...
1
vote
1answer
267 views

Additional risks to home network in exposing (raspberry pi) honeypot to the internet

While I would like to contribute piping of logs from a home-deployed honeypot to the DSHIELD project using a raspberry pi, I am concerned that the additional exposure of the port to the internet would ...
1
vote
1answer
85 views

What is the risk of running a IOT device exposed to the internet using non https port?

I have a IOT device in my home that controls my security system and let me enable/disable it. It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may ...
1
vote
1answer
334 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
1
vote
0answers
134 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...