Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [iot]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
1
vote
2answers
521 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
0
votes
2answers
117 views

Using unencrypted protocols with IoT devices

Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
5
votes
3answers
190 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
3
votes
3answers
267 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
3
votes
1answer
244 views

What are security problems with hole punching technique in the context of IoT?

Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented ...
0
votes
0answers
53 views

Side channel resistant of Intel TinyCrypt library

Is the TinyCrypt library side channel resistant. I found a mentioned in the "Genral Remarks" on github. But it is mentioned that it is not fully side channel resistant. Does anyone know the extend ...
2
votes
2answers
166 views

Secure operation of IoT equipment?

In the light of recent events around Mirai not being the only IoT botnet, but being joined by IoTroop / IoT_reaper (see here and here ), I wondered what steps need to be taken to securely operate an ...
1
vote
0answers
165 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
1
vote
1answer
66 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
1answer
89 views

Local area network multi-device network communication protocol

I am planning to build a local area network that will have one Master device and multiple Slave devices. The communication should be able to handle only ON/OFF functionality of the devices (devices ...
0
votes
0answers
120 views

Google Home Hub Network Traffic on Port 8009

I noticed my desktop, that has never been used for anything related to google home or signed into the google account used to manage the Home Hub, that is on the same subnet was sending traffic to the ...
-1
votes
1answer
201 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
1
vote
5answers
241 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
0
votes
0answers
30 views

Communicating with things on AWS IoT without certificates problem

Is "IAM" access the only method to gain access AWS? I'm asking because I'm using AWS IoT. With AWS IoT we create things such as devices on AWS IoT Core. However, with IAM access, after creating a "...
0
votes
1answer
57 views

Risk of giving untrusted IOT Device access to wifi

My issue isn't so common and I can't find an answer in the see of other IoT security issues. Let's say I have an IP cam, but I'm not even worried about someone being able to view the live stream, or ...
5
votes
2answers
756 views

IoT devices with public IP?

My understanding of worms like Mirai is the following: Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers If you get in, do Bad Things™. It ...
1
vote
2answers
88 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
6
votes
2answers
78 views

CCM for IoT - choosing L and M

Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
0
votes
2answers
1k views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...
1
vote
1answer
32 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
4
votes
3answers
129 views

How do I secure my networked printers?

I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...
1
vote
1answer
72 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
0
votes
1answer
105 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
0answers
86 views

Monitoring and Securing IoT devices [closed]

I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
2
votes
2answers
289 views

Proper security for IoT device

I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module. How do I make it secure? More specifically, how do I ...
-2
votes
1answer
144 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
2
votes
1answer
74 views

Lightweight terminal protocol for IoT

For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP): It might be useful to have a ...
1
vote
1answer
85 views

What is the risk of running a IOT device exposed to the internet using non https port?

I have a IOT device in my home that controls my security system and let me enable/disable it. It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may ...
1
vote
2answers
79 views

Do I need Gateway Firewall for IoT network? [closed]

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec? Even if there is need that can be implemented at cloud. Is there any need for it to ...
1
vote
0answers
251 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
0
votes
1answer
224 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
1
vote
1answer
365 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
2
votes
3answers
420 views

What kind of IoT devices use certificates?

I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are: SCEP (Simple Certificate Enrollment Protocol) EST (...
-1
votes
2answers
378 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
3
votes
1answer
66 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
0
votes
2answers
77 views

Which are the most common vulnerabilities for poor crafted IoT devices? [closed]

I'm learning about securing IoT devices and starting to learn how to develop my own software for them. I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit ...
1
vote
0answers
27 views

Secure pairing support in various RF standards

I would like to understand if secure pairing can be implemented in all (or none)? IoT RF standards. For example: BLE provides Out-of-band possibility, which seems like only really secure option to me....
0
votes
0answers
72 views

IoT Device user needs to perform task requiring Windows admin privilege

Our IoT device runs only our application and the device users can not launch additional apps. The IoT device users and IoT device admins both run under normal (non-admin) accounts with identical ...
0
votes
1answer
126 views

Does LoraWan protocol's Over The Air Activation run Diffie Hellman?

I am looking at the LoraWan protocol specification and I want to capture the over the air activation of a device. So far I have seen the: https://zakelijkforum.kpn.com/lora-forum-16/over-the-air-...
3
votes
5answers
215 views

How to keep Internet of Things projects secure? [closed]

I want to experiment with the use of sensors for data logging and potentially for automated actions based on data properties. An example of the latter is if a value being monitored exceeds a threshold ...
27
votes
8answers
6k views

Should firmware images for IoT be encrypted for security reasons?

When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder. (They should be signed of course)
1
vote
1answer
87 views

How do you change the password of an IoT device like a DVR box?

The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet. My ...
1
vote
0answers
98 views

I am looking for a new firewall [closed]

I am looking for help on purchasing a firewall and some information on firewall recommendation. I am not really technically savvy but, I understand a bit about networking so bear with me. I have been ...
18
votes
1answer
4k views

Is a PKI for the IoT really a good idea?

I am reading a bit about the security of IoT devices and found quite a lot of articles describing how a PKI would be an improvement for the current infrastructure. I am, however, not convinced if ...
57
votes
10answers
11k views

Does the local network need to be hacked first for IoT devices to be accessible?

I completely understand how IoT devices were used in the massive DDoS attacks because they are easily manipulated due to lack of firewalls, default passwords, etc. What I don't understand is although ...
2
votes
0answers
94 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
4
votes
0answers
117 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
0
votes
1answer
86 views

Is it safe to use an auto pay feature on my smart watch that stores card info?

(So guess what I got for Christmas...) While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially ...
3
votes
1answer
1k views

Port-forwarding to a web server on Raspberry Pi

I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip. In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...