Questions tagged [iot]
Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.
142
questions
57
votes
10
answers
12k
views
Does the local network need to be hacked first for IoT devices to be accessible?
I completely understand how IoT devices were used in the massive DDoS attacks because they are easily manipulated due to lack of firewalls, default passwords, etc.
What I don't understand is although ...
- 623
50
votes
6
answers
11k
views
How safe are wifi enabled talking toys?
There have been ads on the radio recently for a wifi enabled toy called Talkies, which are advertised as being able to communicate with app enabled phones, with a "trusted circle" that other phones ...
- 611
27
votes
8
answers
8k
views
Should firmware images for IoT be encrypted for security reasons?
When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder.
(They should be signed of course)
- 481
22
votes
6
answers
6k
views
When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?
I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
- 331
20
votes
4
answers
15k
views
Should I only let my TV connect to the guest WiFi?
According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this.
Is this true? Is it a ...
- 635
18
votes
1
answer
5k
views
Is a PKI for the IoT really a good idea?
I am reading a bit about the security of IoT devices and found quite a lot of articles describing how a PKI would be an improvement for the current infrastructure. I am, however, not convinced if ...
- 343
12
votes
4
answers
968
views
Is there a common standard for evaluating the Security of an IoT device?
When you write a paper about an implementing a classifying computer-vision/machine-learning algorithm, you can simply count the number of positive (correct) negatives/positives, and the number of ...
- 223
9
votes
3
answers
4k
views
Key differences between X509 TLS Client certificate and server certificate
Is there any difference between a X509 TLS client cert and a server cert?
I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
- 183
7
votes
1
answer
1k
views
How can IoT and other network devices access the internet if my router works as a firewall?
My understanding is that routers act as natural firewalls. In that context, how can an IoT device receive commands from the WAN if they are not initiated from within the LAN? In a specific example, ...
- 71
6
votes
3
answers
4k
views
What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?
I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
- 207
6
votes
2
answers
213
views
CCM for IoT - choosing L and M
Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
- 292
6
votes
2
answers
1k
views
IoT devices with public IP?
My understanding of worms like Mirai is the following:
Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers
If you get in, do Bad Things™.
It ...
6
votes
1
answer
432
views
How can I properly secure the WiFi setup process of an IoT device?
My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
- 195
6
votes
0
answers
305
views
What is the meaning if all IoT hacked by Mirai all over the world identify themselves on my server since 15 days in the rhythm of 180 unique IoT/h?
In the past 15 days 57,000 unique Mirai IoT devices have attempted to connect and it’s constantly growing (180 new IPs/h). 88.9% come one time and never come back. We have checked. It’s Mirai botnet, ...
- 61
6
votes
1
answer
203
views
secure IoT device/brand publication [closed]
I came across this article: 75 Percent of Bluetooth Smart Locks Can Be Hacked when I was looking for IoT stuff for my home.
tl;dr is they tested 16 bluetooth smart locks and eventually only two were ...
anon
5
votes
3
answers
1k
views
Password hashing algorithms suitable for IoT devices?
What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
- 51
5
votes
2
answers
2k
views
How can I make an SSL certificate for an IoT device trusted on all browsers?
I have a web server running on an IoT device, more specifically, on an ESP32.
This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
- 53
5
votes
3
answers
611
views
How to do TLS on embedded devices in a home network?
If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
- 30.6k
5
votes
1
answer
693
views
What are security problems with hole punching technique in the context of IoT?
Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented ...
- 153
4
votes
1
answer
1k
views
How does Mirai infect IoT?
Since every IoT device uses different operating system, and has different hardware architecture, with so many possible platforms, how does Mirai infect them?
- 263
4
votes
1
answer
2k
views
Self-signed certificates in embedded IoT device
I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC).
These IoT nodes would be deployed and, during ...
- 103
4
votes
3
answers
9k
views
Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?
UPDATE:
Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection).
I don't know what I am looking for here in Wireshark, but I added the host ...
- 175
4
votes
3
answers
273
views
How do I secure my networked printers?
I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...
- 83
4
votes
2
answers
1k
views
Does still make sense to use SHA1?
I'm working with Arduino and hash-based signatures which are signature schemes that use only hash functions. Due to the constraints of an Arduino I was thinking about using SHA1 as the underlying ...
- 55
4
votes
1
answer
236
views
Are there any IoT Systematic Creation Security Checklists?
Are you aware of any publicly available documents that would help IoT/Connected product creators develop a systematic/programmatic approach and/or process to securing such new age devices?
- 693
3
votes
5
answers
2k
views
Could IOT Botnets be Stopped by Static IP addressing the Devices?
I followed the recent IOT DDOS against Dyn and noticed that the attack seemed have three rounds of attack and mitigation. Since I'm not well versed in infosec I did some reasearch around DDOS ...
- 908
3
votes
5
answers
703
views
How can I secure my security cameras?
I have dozens of cheap security cameras in my offices. I was under the assumption that, once I changed the admin password, disabled the insecure "P2P Mode", disabled UPNP, disabled guest access and ...
- 213
3
votes
4
answers
220
views
Can IoT connect to each other forming their own network?
I recently purchased a fairly sleek LED lamp. Like most new-fangled furnishings it comes with a pile of unnecessary features including bluetooth, wifi, and a mobile app.
Hence my new-found paranoia. I ...
- 203
3
votes
2
answers
1k
views
Authentication Certificates in Embedded System (Microcontroller)
I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices.
In order to have a proper security I´m thinking about using Authentication Certificates ...
- 103
3
votes
5
answers
338
views
How to keep Internet of Things projects secure? [closed]
I want to experiment with the use of sensors for data logging and potentially for automated actions based on data properties. An example of the latter is if a value being monitored exceeds a threshold ...
- 373
3
votes
1
answer
2k
views
Port-forwarding to a web server on Raspberry Pi
I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip.
In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
- 1,605
3
votes
2
answers
644
views
How can I implement TLS on a connection with very low throughput?
I'm doing a IoT project therefore want to reduce connection overhead to a minimum. We want to secure the communication, especially the authenticity and confidentiality. With a standard TLS protocol, a ...
- 31
3
votes
2
answers
1k
views
Updating the SSL fingerprint on an IoT device
I'm currently in the process of designing the security model for an IoT product my company is developing.
The device will be connected to the internet via WiFi and shall communicate with our company'...
- 195
3
votes
2
answers
275
views
Are there established and/or curated security benchmarks/best practices for home appliances and networks?
I have seen several security standards and best practices for organizations (CIS, HIPPAA, PCI DSS) but are there any for homes? If yes, where can I find them?
It would be nice for homeowners to have ...
- 3,276
3
votes
1
answer
229
views
Lightweight terminal protocol for IoT
For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP):
It might be useful to have a ...
- 131
3
votes
4
answers
827
views
What kind of IoT devices use certificates?
I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are:
SCEP (Simple Certificate Enrollment Protocol)
EST (...
- 2,032
3
votes
1
answer
368
views
How would an external attacker utilise universal plug and play to bypass a firewall?
I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
- 63
3
votes
1
answer
719
views
Setup network with IoT devices
I bought a new router and I'm thinking to make my network a bit smarter from the security aspect.
My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
- 133
3
votes
2
answers
587
views
Proper security for IoT device
I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module.
How do I make it secure? More specifically, how do I ...
- 133
3
votes
1
answer
340
views
Why do cellphones not use software to simulate a NAT router between the phone and the internet?
Connecting through wifi adds the benefit of being behind NAT. Why do cellphones not simulate being behind a nat network when connecting directly to the internet to limit the attack surface? Or, is ...
- 460
3
votes
1
answer
140
views
ESP8266 Dash Button Security
I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
- 31
3
votes
1
answer
9k
views
How to brute force a login page of an IP camera created in .asp?
I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the ...
- 31
3
votes
2
answers
545
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
- 131
3
votes
1
answer
389
views
Malware Analysis for Internet of Things Malware
How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
- 31
2
votes
1
answer
279
views
Self-signed CA certificates - Can we throw away the private keys
I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion.
I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
- 277
2
votes
1
answer
722
views
What is the purpose of anti-rollback protection in IoT devices?
The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks:
C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware.
What is ...
- 30.6k
2
votes
1
answer
401
views
Validation of server identity via SSL certificate in during SSL connection handshake
My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
- 183
2
votes
2
answers
2k
views
Detecting IOT Devices on Corporate Network? [closed]
I'm looking at trying to identify IOT devices which is sitting on my network. Any suggestions on what I can look for? Common ports being open? User agents?
- 1,155
2
votes
2
answers
646
views
WPA(2/3)-PSK-compatible per-device Wi-Fi passwords to prevent AP MITM on IoT networks
While WPA2-PSK and WPA3-SAE are really secure once a connection has been established, my understanding is that if you have access to the Wi-Fi password you can impersonate the AP without any problems. ...
- 71
2
votes
2
answers
236
views
Am I authenticating devices securely?
I'm building a IOT platform for my home as a hobby. Currently, I'm trying to implement device authentication. A device in my case could be a Raspberry Pi, Arduino, Jetson Nano. To authenticate devices ...
- 123