Io t slides_iotvillage
- 2. Hello! I am Aaron Guzman Pentester Chapter Leader for OWASP CSA HTCIA You can find me at: @scriptingxss
- 3. Agenda The Basics IoT? The concepts Digging a little deeper Supply Chain Push out those ideas to market The realities Numbers on the rise The issues Pfft...whats security? But wait, my privacy The Resolutions Saving the world
- 4. The Basics IoT What Exactly is IoT?
- 5. “The Internet of Things (IoT) is the network of physical objects that contain embedded technology to communicate and sense or interact with their internal states or the external environment..Source: http://www.gartner.com/it-glossary/internet-of-things/
- 7. The Concepts IoT Digging a little deeper
- 8. Hardware
- 9. IoT OS and Frameworks
- 10. Platform = The Cloud
- 12. Protocols for Communication ❏ Zigbee ❏ Wi-Fi ❏ NFC ❏ Z-Wave ❏ CoAP ❏ 6LoPAN ❏ XMPP ❏ BLe ❏ SOAP ❏ REST ❏ MQTT ❏ Lutron ❏ RFID ❏ GSM
- 14. Hubs
- 15. 4.9 Billion Connected Devices in 2015 Source:http://www.gartner.com/newsroom/id/2905717
- 16. Pads Leads Traces Silkscreens Analog vs Digital Layers (4) Reflow PCB source: https://learn.sparkfun.com/tutorials/electronics-assembly
- 17. ❏ VxWorks ❏ Marvell ❏ Broadcom ❏ Texas Instruments ❏ Intel ❏ AMD ❏ NXP ★ Create the device drivers Board Support Packages (BSP)
- 18. Original Design Manufacturer (ODM) ❏ designs and manufactures a product ❏ eventually rebranded by another firm for sale ❏ allow the brand firm to produce (either as a supplement or solely) without having to engage in the organization or running of a factory. ❏ own cloud infrastructures for customers ❏ Provide SDKs ★ Many ODMs in China ★ A dime a dozen http://en.wikipedia.org/wiki/Original_design_manufa cturer
- 19. Cloud Service Providers ❏ Amazon ❏ Microsoft ❏ Google ❏ Thingsworx ❏ ODM Clouds ❏ Have their own SDKs ❏ Who knows where else? http://en.wikipedia.org/wiki/Original_design_manufa cturer
- 20. Original Equipment Manufacturer (OEM) ❏ Manufacturers who resell another company's product under their own name and branding. ❏ Offers its own warranty, support and licensing of the product. http://en.wikipedia.org/wiki/Original_design_manufa cturer
- 21. IoT Supply Chain Process BSP ODM OEM ★ Each likely to outsource development work and have multiple teams CSP
- 22. Keep in Mind
- 23. Hardware comes from everywhere
- 25. Supply Chain Process (Cont) Sales ★ Get the business ★ Outreach ★ Create relationships PM’s ★ Prioritizes ★ Objective Based ★ Project specific to engineer team Engineers ★ Write Code ★ May not be a big team ★ Different workflows per dev team ★ Split up into features. I.E UI team, UX team, backend, Android, iOS
- 29. Vectors ❏ UART ❏ JTAG ❏ EEPROM ❏ SPI ❏ SOIC ❏ I2C Tools ❏ Shikra (UART SPI JTAG) ❏ Bus Pirate ❏ JTagulator ❏ GoodFET ❏ flashrom ❏ EE Tools ❏ Chipquick Hardware Security (Exploitation) Source:my linksys 1900ac :)
- 30. Common ❏ TCP ❏ ToolChains (Libs) ❏ UART ❏ JTAG ❏ Layer 7 ❏ EEPROM ❏ Bluetooth Less Common ❏ TCP ❏ Flash ❏ GSM ❏ GPS ❏ I2C ❏ Kernel (115 CVEs 2014) Embedded Security Source:http://lwn.net/talks/2015/kr-lca- 2015.pdf
- 31. Wireless Security aka RF ❏ Zigbee (2.4GHZ 915MHZ) ❏ Killerbee Framework ❏ Soon Xipiter’s “RFCat Zigbee” ❏ Atmel ❏ 802.11 ❏ Hundreds of tools ❏ Z-Wave ❏ Z-force ❏ Bluetooth LE ❏ nRF51822 - v1.0 ❏ Proprietary bands ❏ TI C1111
- 32. First time sniffing BLE traffic source:http://securityreactions.tumblr.com/
- 33. Android App Security ❏ Webview Security ❏ Privacy ❏ Client-side Inject ❏ AndroidManifest.xml ❏ Permissions ❏ Activities, Broadcast Receivers, Services ❏ Android APIs ❏ Memory Security ❏ addJavascriptInterface ❏ Secure Storage ❏ Transport Security ❏ SSL Pinning
- 34. iPhone App Security ❏ UIWebView Security ❏ Privacy ❏ Client-side Inject ❏ Data Protection ❏ Cloud API security ❏ iOS SDK API ❏ Memory Security ❏ Injection Attacks ❏ Memory Corruption ❏ Transport Security ❏ SSL Pinning ❏ Blackbox Assessments ❏ Logging ❏ Homekit
- 35. ❏ Network Security ❏ ACLs ❏ Systems ❏ DB ❏ Web servers ❏ LBs ❏ Daemons ❏ Application Security ❏ Language ❏ Frameworks ❏ 3rd Party Libs Web App / Operational Security A lot of work!!!....
- 36. ❏ Windows ❏ OSX ❏ Old School CD setup ❏ Data storage ❏ Data permissions ❏ Persistence Desktop Apps
- 41. “Because computers go through so many hands before they’re delivered to you, there’s a serious concern that anyone could backdoor the computer without your knowledge Source: Jonathan Brossard-http://resources.infosecinstitute.com/hardware-attacks- backdoors-and-electronic-component-qualification/
- 42. What not to do ❏ UART pins exposed unauthenticated or using simple passwords ❏ Manufacturing Debugging Scripts ❏ Backdoors using secret user agents ❏ Private Keys on devices (Dont rely on obscurity) ❏ Default Passwords ★ Ton of other backdoors from software down to HDL code in the chipset
- 43. Secure It Already (Embedded) ❏ Restrict Shell with tamper resistant epoxy and silk screen ❏ Very long passwds ❏ Update Kernel and Packages ❏ Harden OS by removing unused code ❏ Secure updates ❏ Secure C Functions ❏ Verify and test code
- 46. “Implement “security by design.” Rather than grafting security on as an afterthought, build it into your products or services at the outset of your planning process Source:https://www.ftc.gov/system/files/documents/plain-language/pdf0199- carefulconnections-buildingsecurityinternetofthings.pdf
- 47. FTC and EU Commission ❏ Privacy By Design ❏ Security By Design ❏ Categorization of IoT devices ❏ Biggest Consumer Protection http://www.ftc.gov/news-events/press-releases/2013/04/ftc-seeks- input-privacy-and-security-implications-internet-things
- 54. IoT Supply Chain How can we make it more secure?
- 55. Fixing The IoT ❏ LIABILITY! ❏ Security service agreements with ODMs ❏ Legal repercussions ❏ Community Projects ❏ Security Awareness ❏ Security Processes into SDLC ❏ A common certification standard (Wi-FI & Zigbee) ★ Realistic? ……… Maybe
- 57. How to help
- 59. Thanks! Any questions? You can find me at: @scriptingxss aaron.guzman@owasp.org
Editor's Notes
- #18: In embedded systems, a board support package (BSP) is implementation of specific support code (software) for a given (device motherboard) board that conforms to a given operating system. It is commonly built with a bootloader that contains the minimal device support to load the operating system and device drivers for all the devices on the board. Some suppliers also provide a root file system, a toolchain for making programs to run on the embedded system (which would be part of the architecture support package), and configurators for the devices (while running). http://en.wikipedia.org/wiki/Board_support_package
- #31: RTOS - vxworks
- #32: http://www.ti.com/tool/packet-sniffer https://code.google.com/p/z-force/
- #37: Common in cameras, routers malware worms?
- #48: First, companies should build security into their devices at the outset, rather than as an afterthought. As part of the security by design process, companies should consider: (1) conducting a privacy or security risk assessment; (2) minimizing the data they collect and retain; and (3) testing their security measures before launching their products. Second, with respect to personnel practices, companies should train all employees about good security, and ensure that security issues are addressed at the appropriate level of responsibility within the organization. Third, companies should retain service providers that are capable of maintaining reasonable security and provide reasonable oversight for these service providers. Fourth, when companies identify significant risks within their systems, they should implement a defense-indepth approach, in which they consider implementing security measures at several levels. Fifth, companies should consider implementing reasonable access control measures to limit the ability of an unauthorized person to access a consumer’s device, data, or even the consumer’s network. Finally, companies should continue to monitor products throughout the life cycle and, to the extent feasible, patch known vulnerabilities.
- #56: Liability
- #59: lets keep rippin them!!!