Securing the Internet of Things
- 1. SECURING THE INTERNET OF THINGS Christopher Frenz
- 2. THE NEED FOR IOT SECURITY???
- 3. MIRAI BOTNET AND DDOS
- 4. ATTACK ON DYN • 1.2 Tbps DDoS Attack from 100K malicious endpoints • Brought down Twitter, Netflix, Reddit, CNN, Paypal, and others • 145K domains affected • Dyn lost 14.5 domains as customers Image – downdetector.com
- 7. PRIVACY ISSUES AS WELL
- 8. MIRAI • What makes these attacks so scary is not the level of sophistication of the malware itself, but actually its lack of sophistication in how it gains control of IoT devices. • The source code or Mirai is available: • https://github.com/jgamblin/Mirai-Source-Code • Mirai and the related Bashlight malware make use of default usernames and passwords
- 9. SCANNER.C • This Mirai source code file scanner.c lists a combination of 62 default user names and passwords • Sophos estimates that this simple list of passwords is enough to compromise hundreds of thousands IoT devices User Name Password User Name Password User Name Password root xc3511 admin 1111 root zlxx. root vizxv root 666666 root 7ujMko0vizxv root admin root password root 7ujMko0admin admin admin root 1234 root system root 888888 root klv123 root ikwb root xmhdipc Administrator admin root dreambox root default service service root user root juantech supervisor supervisor root realtek root 123456 guest guest root 0 root 54321 guest 12345 admin 1111111 support support guest 12345 admin 1234 root (none) admin1 password admin 12345 admin password administrator 1234 admin 54321 root root 666666 666666 admin 123456 root 12345 888888 888888 admin 7ujMko0admin user user ubnt ubnt admin 1234 admin (none) root klv1234 admin pass root pass root Zte521 admin meinsm admin admin1234 root hi3518 tech tech root 1111 root jvbzd mother fucker admin smcadmin root anko
- 10. OWASP IOT TOP 10 Vulnerability Rank Vulnerability Name 1 Insecure Web Interface 2 Insufficient Authentication/Authorization 3 Insecure Network Services 4 Lack of Transport Encryption/Integrity Verification 5 Privacy Concerns 6 Insecure Cloud Interface 7 Insecure Mobile Interface 8 Insufficient Security Configurability 9 Insecure Software/Firmware 10 Poor Physical Security
- 11. IOT CRUSHER
- 12. WHERE IS ALL MY DATA? • Organizations should have a map of where all of their data assets are and where their data flows to • This effort needs involve more than just IT. A surprising amount of sensitive data may not be under the control of IT (HR, Finance, etc) • Finance sending data to an external vendor for revenue cycle management or collections • Paper based records such as a morgue logbook may still have PII • Shadow IT, BYOD, etc • This map should include data collected and distributed by IoT devices like security cameras, medical devices, etc.
- 13. INTERNAL FIREWALLS, NETWORK SEGMENTATION, INTERNAL IDS • Traffic to and from IoT devices should be isolated as much as possible from the rest of your network – VLANs, ACLs, etc. • In healthcare it is becoming common to place a firewall in front of network enabled medical equipment to restrict traffic flows • IDS and threat detection is not just a good idea at the perimeter – it should be used to examine internal traffic as well
- 14. ZERO TRUST • With increasing virtualization of servers and desktops security at the virtual machine level should not be ignored • Software Defined Networking and security products like NSX and Hyper-V network virtualization make approaching zero trust networks more feasible
- 15. TOP 10 IOT SECURITY CONTROLS FOR IOT DEVELOPERS • No default passwords or hardcoded passwords post initial setup • Account Lockouts after 3-5 failed logins • Password complexity filters • No unsecured connections • No administrative access on internet facing interfaces • Network level access controls • Update Mechanisms • Encryption at rest • Differing account access levels • Privacy by Design Principles http://www.codeguru.com/IoT/ understanding-iot-security-for- iot-developers.html
- 16. HOW DO WE GET MANUFACTURERS TO CARE • Consumers need to put economic pressure on manufacturers to produce secure devices • Customers need to vote with their wallet and not purchase products that cannot be properly secured • The average consumer does not know enough about security to make good decisions as to which products are secure and which are not
- 17. IOT NUTRITION LABEL Makes it easy for non- savvy consumers to compare the security of IoT devices If enough industry backing can be gained where the use of such labelling becomes commonplace vendors will strive to eliminate red Xs from their label
- 18. ENOUGH MOMENTUM?