security
play

Security Evaluation of Home-based IoT Deployments Astrolavos - PowerPoint PPT Presentation

Feb 11, 2024 •10 likes •340 views

Omar Alrawi Security Evaluation of Home-based IoT Deployments Astrolavos Research Lab at Georgia Tech We specialize in Network Security Measurements Work is presented on behalf of my team Omar Alrawi PhD Student (me) About

  1. Omar Alrawi Security Evaluation of Home-based IoT Deployments

  2. • Astrolavos Research Lab at Georgia Tech • We specialize in Network Security Measurements • Work is presented on behalf of my team • Omar Alrawi – PhD Student (me) About Us • Chaz Lever – Research Scientist • Manos Antonakakis – PI and my advisor • Fabian Monrose – Collaborator PI from UNC Chapel Hill

  3. This work looks at commodity smart home IoT deployments

  4. Presentation Outline • Why is the evaluation of IoT deployment important? Motivation • Components of an IoT deployment • Attacks, mitigations, and stakeholders Past Research • How we go about objectively evaluating heterogeneous devices Methods • What we found applying our methodology to 45 devices . Findings • https://YourThings.info portal and publicly available evaluation data • Collaboration/partnership with industry Moving Forward

  5. Market demand for home IoT devices is sky rocketing Some vendors lack expertise Building secure IoT is hard (distributed Motivation systems) Attack surface is large (several componenets) Example of attacks: DynDNS

  6. • Device • Mobile App • Cloud Endpoints • Network IoT Components

  7. Past and Current Research

  8. • Divided research based on • Device, Cloud, Mobile App, and Network • Cross compare against • Attacks, Mitigations, and Stakeholders • Answering the following: • What is the focus of the community? • What attack surfaces are studied? • What defenses are proposed? • Who is responsible for fixes? Past Research

  9. Research Directions • Focus in Device and Network security • Attacks are Device oriented, very few in Mobile App and Cloud • Defenses propose Patching and few propose Frameworks • Responsible party is the Vendor in most cases

  10. Example of Device Research • Echo exposed hardware debug pins • SmartTV unauthenticated services leads to Ransomware • Vendor backdoors (Arris) • Static master key in firmware (LIFX) • Side-channel and vulnerable firmware – going nuclear (Hue)

  11. Examples of Network Research • Devices use IP to talk over the Internet • UPnP • Privacy issues (DNS) • TLS/SSL bugs • Devices use low-energy protocols for nearby communication • Insecure rejoin (ZigBee) • ZWave master key • Bluetooth

  12. Examples of Cloud Research • Vulnerable cloud endpoints • Integration services • Cloud endpoint vulnerabilities • Expose PII • Control devices • Escalate privilege

  13. Examples of Mobile Research • Common permissions problem • Incorrect use of cryptographic protocols • Hardcoded keys • Malicious apps • IoT device fuzzing using mobile apps

  14. Overview of Past Research Studied Componenets Mitigations Unexplored Directions Devices Patching bugs Mobile app Cloud integration services Vendor responsibility Cloud services Network (by association) Network discovery protocols User control and visibility

  15. Reality Check: Research vs Market • Evaluate IoT devices with a practical approach • Objective • Transparent • Measurable • Reproducible • Device Representation • Media devices vs appliances • Easy to understand • Consumer oriented

  16. Methods: Deployment Evaluation

  17. • Get a comprehensive view of deployments Our Approach • Account for all components • Module design to accommodate for heterogeneity

  18. Overview of Approach • Device • Internet pairing, configuration, updateable, exposed services • Mobile app • permissions, crypto errors, hardcoded keys/secrets • Cloud endpoints • types and counts, TLS/SSL, vulnerable software, insecure protocols • Network • Device from/to cloud • Device from/to mobile app • Mobile app from/to cloud

  19. Lab Setup • The lab has over 65+ devices • Media devices, cameras, appliances, home security, home assistant, light bulbs, hubs, TVs, game consoles • Network: single /24 private IPs with Linux (Debian) gateway • ASUS AC5300 as a Wireless AP • 48 Port Switch • Ports are mirrored • Device configuration • Minimal, keep default settings • Turn off auto-update, if possible • iPad Mini and Samsung Tablet with companion mobile apps

  20. Lab Setup

  21. Tools • Device • Network service scan • Nessus scanner • Mobile App • Static and dynamic analysis for iOS and Android apps • Kryptowire (Thank You!) • Cloud endpoints • Extract and label DNS traffic • Network service scan • Nessus scanner • Network • Protocol analysis • Man-in-the-middle attack on TLS/SSL • SSLSplit, ntop-ng, iptables

  22. Findings

  23. Findings • Devices • Insecure exposed services • Weak/no authentication on services • Network communication • Encrypted over the Internet, TLS/SSL vulnerabilities • Most LAN communication lack encryption • Cloud endpoints • Exposed services (some vulnerable) • Misconfigured • Mobile apps • Over provisioned with permissions • Cases of incorrect use of crypto • Hard coded API/secret keys

  24. Case Study: Device MiCasa Verde VeraLite • Bridge hub with ZWave • Door/window/motions sensors, door locks • Cloud/device pairing • pre-printed pin (MAC address) • Manual updates • notifies users of available updates • Exposed services • DNS, UPnP, web, and SSH • Default configurations out of the box • UPnP services RCE vulnerability • CVE-2012-5958-65 • Dropbear SSH RCE vulnerability • CVE-2013-4863

  25. Case Study: Network - Sonos Play 1 • Firmware version 8.3 (prior to 10) • Wireless speaker • UPnP on LAN • Custom protocol over the Internet, port 3401 • Unencrypted communication between components • Susceptible to man-in-the-middle • Passive snooping • Active interception

  26. Case Study: Cloud - Belkin Netcam • Cloud controlled indoor camera • Motion detection • Cloud endpoint allows SSLv2,v3 • Vulnerable to downgrade attack • Web app exposes running processes on server • Open basic auth over HTTP • JBoss vulnerable to unauthenticated RCE

  27. Case Study: Mobile App - Koogeek • Android v1.2.2 • WiFi lightbulb • Mobile app controls lights • State (on/off), color, timer, and dimmer • Hardcoded crypto keys • API key and secret key for cloud services • Requests excess permissions • More than 10 requested app permissions that are not used

  28. Moving Forward

  29. Putting it Together – YourThings.info Created a Rating for Independent Modular and scorecard system components scoring customizable Documented

  32. Moving Forward – YourThings.info • Evaluation data is public • Packet capture includes • Device activity • Scans (request/response) • Mobile App interactions • Network attacks (MiTM) • List of devices with IP mapping • Raw scores in CSV format • Evaluation single snapshot • Network traffic collection continuous

  33. Moving Forward - Collaboration/Partnership • Feel free to reach out: • Request specific device evaluation • Sponsor devices for evaluation • Additional questions • Download our data • https://YourThings.info • Contact email: • contact@YourThings.info

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security

Effective Security for the Post-compliance Era Security Awareness and Training for Security Specialists M. ANGELA SASSE, RUHR UNIVERSITY BOCHUM & UCL The problem MENSCHLICH WELTOFFEN LEISTUNGSSTARK 2 ENISA Report December 2018

362 views • 33 slides
Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security:

Material and some slide content from: - Software Architecture: Foundations, Theory, and Practice - Krzysztof Czarnecki Security as a Architectural Concern Reid Holmes [TAILOR ET AL.] NFP: Security Security: The protection a ff orded a

160 views • 4 slides
Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too

Defining Encryption (ctd.) Lecture 3 CPA/CCA security Computational Indistinguishability Pseudo-randomness, One-Way Functions Security of Encryption Security of Encryption Perfect secrecy (IND-Onetime security) is too strong (though too

1.36k views • 113 slides
Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security

Outline Security Principles and Policies Security terms and concepts CS 239 Security policies Computer Security Basic concepts Peter Reiher Security policies for real systems January 13, 2005 Lecture 2 Lecture 2 Page 1

347 views • 9 slides
Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security

Chapter 9 Cloud Security Contents Security in an interconnected world, cloud security risks. Attacks in a cloud environment, top threats. Security, a major concern for cloud users. Privacy. Trust. Operating systems

661 views • 38 slides
Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election

Election Security and Integrity What is election security? What is election integrity? Election Security = Physical Security + Cybersecurity Physical Security Security plans Secure storage of voting machines and electronic pollbooks

341 views • 13 slides
Computer Security environment, without compromising functionality or security? Three parts

Computer Security environment, without compromising functionality or security? Three parts

9/7/2013 Some topics Im working on Computing on encrypted data Information flow: Dynamic IFC in Haskell, web Sandboxing Untrusted JavaScript Third party web tracking and other web security stories Practical web security

572 views • 21 slides
Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon

Network Security Where we are in the Course Security crosses all layers Applicatjon Transport Network Link Physical CSE 461 University of Washington 2 Security Threats Security is like performance Means many things

1.12k views • 92 slides

More recommend