Questions tagged [iot]

Questions about the Internet of Things: network-connected devices whose core functions do not include general-purpose interactive computing (e.g. cars, home appliances, consumer-grade routers) and whose potential software vulnerabilities are often overlooked by both users and manufacturers.

Filter by
Sorted by
Tagged with
5
votes
3answers
258 views

What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?

I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
1
vote
1answer
50 views

How does my ipcamera work despite UPnP disabled on home router? [closed]

Recently I bought an IPcamera in order to test its security. Unfortunately, it just has 2 ports open : 554/tcp RTSP 5000/tcp UPnP I was pretty sure the ipcamera would poke my router and open up ...
1
vote
2answers
85 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
1
vote
0answers
130 views

How is eSIM profile cloning prevented?

How are eSIM profiles tied to a particular device? That is, what prevents a bad actor from digitally copying an eSIM profile (or, why is the eUICC chip required; can't we have a soft or emulated SIM)?
2
votes
1answer
151 views

Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?

UPDATE: Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection). I don't know what I am looking for here in Wireshark, but I added the host ...
2
votes
2answers
131 views

Using Diffie-Hellman exchange on low power IoT devices

I have almost 0 knowledge of IoT, their protocols and usual device constraints. I had a discussion today with someone that has a fair amount of IoT experience and we were discussing some security ...
1
vote
2answers
592 views

Is using both client side certificate and JWT for IoT device redundant?

Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device? Are JWTs good enough (assuming following of the specs)? And if client side certs are truly ...
3
votes
1answer
1k views

Port-forwarding to a web server on Raspberry Pi

I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip. In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
0
votes
1answer
446 views

How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?

ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN. Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...
4
votes
1answer
280 views

What are security problems with hole punching technique in the context of IoT?

Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented ...
0
votes
0answers
47 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
0
votes
2answers
135 views

Using unencrypted protocols with IoT devices

Old IoT devices and some low-power devices are not capable of doing encryption or use weak encryption methods like TLSv1.0. What could be the risks of using such devices and unencrypted protocols like ...
5
votes
3answers
234 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
3
votes
3answers
324 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
0
votes
0answers
70 views

Side channel resistant of Intel TinyCrypt library

Is the TinyCrypt library side channel resistant. I found a mentioned in the "Genral Remarks" on github. But it is mentioned that it is not fully side channel resistant. Does anyone know the extend ...
2
votes
2answers
174 views

Secure operation of IoT equipment?

In the light of recent events around Mirai not being the only IoT botnet, but being joined by IoTroop / IoT_reaper (see here and here ), I wondered what steps need to be taken to securely operate an ...
1
vote
0answers
207 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
1
vote
1answer
105 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
1
vote
1answer
92 views

Local area network multi-device network communication protocol

I am planning to build a local area network that will have one Master device and multiple Slave devices. The communication should be able to handle only ON/OFF functionality of the devices (devices ...
-1
votes
1answer
345 views

How to execute Command Injection without forward slash? [closed]

I have a blind command injection vulnerability on an embedded device. I have tested ping, reboot and sleep and they work. But whenever there is a forward slash in the input ( / ), the program crashes ...
1
vote
5answers
390 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
1
vote
1answer
67 views

Risk of giving untrusted IOT Device access to wifi

My issue isn't so common and I can't find an answer in the see of other IoT security issues. Let's say I have an IP cam, but I'm not even worried about someone being able to view the live stream, or ...
6
votes
2answers
799 views

IoT devices with public IP?

My understanding of worms like Mirai is the following: Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers If you get in, do Bad Things™. It ...
1
vote
2answers
110 views

Risk and probability from CVE

How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14), The cost is derived from the attack tree, and risk and probability are based on CVE ...
6
votes
2answers
79 views

CCM for IoT - choosing L and M

Other developers have developed a custom in-house RF protocol for our upcoming IoT devices. I would like to replace our use of AES-CTR with AE - our encryption library supports CCM which should ...
0
votes
2answers
1k views

How to eavesdrop and decrypt the HTTPs communication of an IoT device?

I am trying to setup a MitM scenario between an IoT device and WAN. It is possible and quite easy to achieve same thing for the application run on a mobile device by setting my proxy server(Fiddler)'s ...
4
votes
3answers
136 views

How do I secure my networked printers?

I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires ...
1
vote
1answer
86 views

Self-signed CA certificates - Can we throw away the private keys

I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion. I'm working with Amazon AWS IoT, and in order to create our own certificates on a device ...
0
votes
1answer
130 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
0answers
101 views

Monitoring and Securing IoT devices [closed]

I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
2
votes
2answers
332 views

Proper security for IoT device

I'm developing a product with simple Cortex-M MCU (with no OS on board, firmware on bare metal) and internet connectivity via external module. How do I make it secure? More specifically, how do I ...
-2
votes
1answer
195 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
2
votes
1answer
81 views

Lightweight terminal protocol for IoT

For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP): It might be useful to have a ...
1
vote
1answer
93 views

What is the risk of running a IOT device exposed to the internet using non https port?

I have a IOT device in my home that controls my security system and let me enable/disable it. It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may ...
1
vote
2answers
86 views

Do I need Gateway Firewall for IoT network? [closed]

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec? Even if there is need that can be implemented at cloud. Is there any need for it to ...
2
votes
0answers
257 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
0
votes
1answer
239 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
1
vote
1answer
453 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
2
votes
3answers
504 views

What kind of IoT devices use certificates?

I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are: SCEP (Simple Certificate Enrollment Protocol) EST (...
-1
votes
2answers
384 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
3
votes
1answer
68 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
1
vote
2answers
82 views

Which are the most common vulnerabilities for poor crafted IoT devices? [closed]

I'm learning about securing IoT devices and starting to learn how to develop my own software for them. I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit ...
1
vote
0answers
28 views

Secure pairing support in various RF standards

I would like to understand if secure pairing can be implemented in all (or none)? IoT RF standards. For example: BLE provides Out-of-band possibility, which seems like only really secure option to me....
0
votes
0answers
72 views

IoT Device user needs to perform task requiring Windows admin privilege

Our IoT device runs only our application and the device users can not launch additional apps. The IoT device users and IoT device admins both run under normal (non-admin) accounts with identical ...
0
votes
1answer
136 views

Does LoraWan protocol's Over The Air Activation run Diffie Hellman?

I am looking at the LoraWan protocol specification and I want to capture the over the air activation of a device. So far I have seen the: https://zakelijkforum.kpn.com/lora-forum-16/over-the-air-...
3
votes
5answers
219 views

How to keep Internet of Things projects secure? [closed]

I want to experiment with the use of sensors for data logging and potentially for automated actions based on data properties. An example of the latter is if a value being monitored exceeds a threshold ...
27
votes
8answers
7k views

Should firmware images for IoT be encrypted for security reasons?

When working with Internet of Things devices, is it recommend to obfuscate or encrypt firmware images pushed to clients? This to make reverse engineering harder. (They should be signed of course)
1
vote
1answer
97 views

How do you change the password of an IoT device like a DVR box?

The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet. My ...
1
vote
0answers
103 views

I am looking for a new firewall [closed]

I am looking for help on purchasing a firewall and some information on firewall recommendation. I am not really technically savvy but, I understand a bit about networking so bear with me. I have been ...
18
votes
1answer
5k views

Is a PKI for the IoT really a good idea?

I am reading a bit about the security of IoT devices and found quite a lot of articles describing how a PKI would be an improvement for the current infrastructure. I am, however, not convinced if ...