Y20151003 IoT 資訊安全_趨勢科技分享
- 1. IoT Security Solution Trend Micro Consumer CBU Director, Global Consumer Sales Enablement and Business Development Steven Hsu (steven_hsu@trend.com.tw)
- 2. Agenda q Trend Micro Introduction q Company Profile q SPN (Smart Protection Network) q IoT Overview and Security Solution q Year 2020 and Sharing Economy q IoT Service, Technology and Echo System q IoT Security challenges q IoT Hacking Case Study q Trend IoT security solutions Overview q Trend Micro Strengths in IoT q Q&A Copyright 2015 Trend Micro Inc. 2
- 3. Founded Headquarters Market Cap 2014 Sales Customers 1988, United States Tokyo, Japan 5B USD $1.05B USD 500,000 businesses, Millions of consumers A world safe for exchanging digital information 3 The world’s largest pure-‐play security software company Copyright 2015 Trend Micro Inc. Small Business Midsize Business EnterpriseConsumers 5200+ Employees, 38 Business units worldwide
- 4. Copyright 2015 Trend Micro Inc. 4 Trend Micro leads the world in security Global 500 accounts l48 of the top 50 global corporations l10 of the top 10 automotive companies l10 of the top 10 telecom companies l8 of the top 10 banks l9 of the top 10 oil companies Trust Trend Micro Security Solutions Trend Micro protects 96% of the top 50 global corporations. Trend Micro protects 100% of the top 10 automotive companies. Trend Micro protects 100% of the top 10 telecom companies. Trend Micro protects 80% of the top 10 banks. Trend Micro protects 90% of the top 10 oil companies. • AV Test awarded Internet Security with "Best Protection" in 2015, March 2015 • ICSA Labs awards Trend Micro for 15 Year Excellence in Testing Award 2015, April 2015 Market Leadership Position In the industry With partners • CRN 5 STAR Partner Program Guide Winner 2015, February 2015 In the cloud • Simply Security was rated #1 in Best Cloud Security Blogs in 2015, March 2015 • #1 Server Security Market Share Worldwide Corporate Endpoint Server Security Revenue Share by Vendor, 2013 Source : IDC, 2014 • SC Magazine Award Finalist for Best Security Company 2015, January 2015
- 5. GLOBAL SENSOR NETWORK Collects More Information in More Places • Hundreds of millions of sensors • 16 billion threat queries daily GLOBAL THREAT INTELLIGENCE Accurately Analyzes & Identifies Threats Faster • Identifies new threats 50x faster than average (NSS Labs) PROACTIVE PROTECTION Blocks Real-‐World Threats Sooner • 250M threats blocked daily • 500k new threats identified per day Copyright 2014 Trend Micro Inc. Source: All values from Trend Micro Smart Protection Network statistics, July 2014
- 6. Copyright 2015 Trend Micro Inc. 6 Trend Micro Consumer Vision Enjoy your digital life safely as a family! End Point Security to Family Protection Device care to Peoplecare Solution to Service
- 7. 7Confidential | Copyright 2015 TrendMicro Inc. IoT Overview and Security Solution 2020 and Sharing Economy IoT Service, Technology and Echo System Market Challenges IoT Security Concern Trend Micro Solution
- 8. What will happen in 2020? Copyright 2015 Trend Micro Inc. 8 33 billion objects will be linked together globally. (included PC, Mobile, Smartphone - Gartner) Globally, in average each person will have more than 3 IoT devices. Total data amount will be 40,206 exabytes and 37% will in cloud (IDC) IDC estimated IoT marketing will reach to US$ 7,065 billion.
- 9. 物聯網的精髓 - 有效率的資源運用與分配 分享 (Sharing) 使用權優於擁有權，使用商品服務化 最大的內容網站， Facebook 不擁有內容; 最大的運輸服務公司，Uber 沒有計程車； 最大的電子商務商，阿里巴巴並沒有任何的倉儲; Airbnb 也不擁有飯店。 互動 (Interacting) 你在看手機，手機也在看你 設備上的感應器或是螢幕會追蹤我們的情緒，地點，觀察你觀看內容的時候是高興、 是悲傷或是憤怒，並據此適合你當前情緒的內容。 流動 (Flowing) 所有的商業都是數據的商業 客戶的資料和客戶一樣重要。 不僅僅要收集資料，還應該讓資料動起來，讓資料和 其它資料聯繫起來並分享出去，沒有分享出去的資料是沒用的。 認知 (Cognifying) 把智慧賦予事物，AI將會服務人類 AI 將會成為一種服務。 我們並不需要自己研發 AI，而是通過網路使用 AI 的説明解決 一些事務。 共享經濟 Source: Kevin Kelly speech in CoWork event 2015 June
- 10. 物聯網對製造業的機會 Copyright 2015 Trend Micro Inc. 10 改變遊戲規則現況 提高市值與降低風險 與目前電子商務商做比較，製造業必需承擔庫存與產品生產過程中的所有 風險，但是反觀電子商務商的市值卻遠高過於傳統製造業許多。電子商務 商除了掌握產品價格談判與其物流管理的優勢之外，最主要的是他們掌握 了消費者的資料與資訊，例如購買歷史資料與信用卡資料等。 洞悉你的客戶需求 延伸產品生命週期管理至消費者使用習慣的回饋 網際網路所帶來的便利使得產品價格透明化與全球化，這也導致如何有效 的管理產品生命週期以降低產品生產風險，透過物聯網的設置，產品所回 饋的資料彙整，再利用大數據資料的分析就可以充分了解消費者使用習慣 並轉化成未來產品功能需求於產品生命管理系統內。 商品服務化 掌握優質客戶 提供優良服務是掌握優質客戶的首要條件，透過物聯網的機制與CRM的整 合，產商可以早一步預想客戶所渴望的服務內容為何，進而在對的時間提 供給予消費者，並轉換成優質客戶，此舉可以大大降低一次性購買的客戶 數，提高客戶重複購買的機會。
- 11. 市值比較 – 高風險低市值，Why? Copyright 2015 Trend Micro Inc. 11 阿里巴巴 市值 6.2 兆臺幣 海爾 市值 2 千億臺幣 市值 4 百億臺幣 網路家庭 市值 2 百億臺幣 大同 市值 7.5 千億臺幣 樂天 市值 9.5千億臺幣 松下 亞馬遜 市值 7.4 兆臺幣 沃爾瑪 市值 7 兆臺幣 改變遊戲規則現況
- 12. Copyright 2015 Trend Micro Inc. 12 洞悉你的客戶需求 電子商務PLM CRMSCM ERP 生產製造 通路銷售 消費者 零售市場 倉儲 量販 信用卡資料 消費行為 消費者資訊 會員募集 產品促銷 季節活動 電子商務PLM CRMSCM ERP 零售市場 倉儲 量販 信用卡資料 消費行為 消費者資訊 會員募集 產品促銷 季節活動 IoT IoT 產品使用行為 產品功能數據 物聯網平台 產品使用年限 IoT IoT IoT
- 13. Copyright 2015 Trend Micro Inc. 13 生產製造 通路銷售消費者 電子商務PLM CRMSCM ERP 零售市場 倉儲 量販 信用卡資料 消費行為 消費者資訊 會員募集 產品促銷 季節活動 IoT IoT 產品使用行為 即時性售後服務 物聯網平台 產品使用年限 IoTIoTIoT 商品服務化 產品功能數據 商品更新服務 舊換新服務 新產品試用服務
- 14. 14Confidential | Copyright 2015 TrendMicro Inc. IoT Service, Technology and Echo System
- 15. Copyright 2015 Trend Micro Inc. 15 IoT Services and Technology
- 16. IoT Ecosystem Challenges Copyright 2015 Trend Micro Inc. 16 Volume Variety Velocity Intel machine to machine ecosystem graphic
- 17. IoT Market Challenges Copyright 2015 Trend Micro Inc. 17 Source: Worldwide and Regional Internet of Things (IoT) 2014–2020 Forecast: A Virtuous Circle of Proven Value and Demand
- 18. Copyright 2015 Trend Micro Inc. 18 Tizen Android Fire OS iOSWindows Phone MeeGo Palm OS webOS BlackBerry symbian FireFox Sounds Familiar?
- 19. 19Confidential | Copyright 2015 TrendMicro Inc. IoT Security Challenges Security Concerns
- 20. IoT Security Research Findings Copyright 2015 Trend Micro Inc. 20 Source: HP Internet of Things Research http://www8.hp.com/h20195/V2/GetPDF.aspx/4AA5-‐4759ENW.pdf of devices collected at least one piece of personal information via the device, the cloud, or its mobile application of devices used unencrypted network service. of devices along with their cloud and mobile application enable an attacker to identify valid user accounts through account enumeration of devices along with their cloud and mobile application components failed to require passwords of a sufficient complexity and length. devices that provide user interfaces were vulnerable to a range of issues such as persistent XSS and weak credentials. Privacy Encryption HACK HACK AAA
- 21. An Expanded Attack Surface Increases the Challenge of Securing IoT Products Copyright 2015 Trend Micro Inc. 21Source: http://ebooks.capgemini-‐consulting.com/security-‐in-‐the-‐internet-‐of-‐things/IoT_infograph.pdf 60% 55% 50% Securing access to the end-‐Point device Securing the communication channel Deploying security updates remotely on end-‐ point devices Key Challenges to Securing IoT Products: % of respondents
- 22. PC Security vs. IoT Security Copyright 2015 Trend Micro Inc. 22 PC Add-‐on security Powerful Client/Server Decline 10% Build in security IoT Constrain Cloud Gateway Embedded Growth 40-‐50%
- 23. 23Confidential | Copyright 2015 TrendMicro Inc. Cars Hack Study Case
- 24. Jeep Cherokee Hack Case Study Copyright 2015 Trend Micro Inc. 24 Fiat Chrysler Automobiles recall of 1.4 million vehicles with a potential cybersecurity flaw
- 25. Man-‐in-‐the-‐Middle Attack • Samy Kamkar creator of OwnStar has presented a new gadget that could be exploited to hacks GM Cars (OnStar App), BMW Remote, Mercedes-‐Benz mbrace, and Chrysler Uconnect apps. • The tool allows to locate, Unlock, and Start Them http://securityaffairs.co/wordpress/39375/hacking/ownstar-‐attack-‐bmw-‐chrysler-‐mercedes.html • Marc Rogers and Kevin Mahaffey disclosure Tesla's Model S with 5 vulnerabilities • But both hackers said Tesla deserved credit for what it had got right about car software security because Tesla's fleet could be updated "over the air"
- 26. 26Confidential | Copyright 2015 TrendMicro Inc. Other Case Study
- 27. Rifle Hack Case Study Copyright 2015 Trend Micro Inc. 27
- 28. Integrated Toilet hack • The Satis is a "smart" toilet. It is controlled using LIXIL's "My Satis” Android application, which communicates with the toilet using Bluetooth. • Vulnerability allow attacker to mess up with your toilet seat, flush out of water, lift up/down the toilet seat http://technews.tw/2013/08/13/high-‐tech-‐toilet-‐gets-‐hacker-‐warning-‐nothing-‐is-‐safe/ • The "My Satis" Android application has a hard-‐coded Bluetooth PIN of "0000” as can be seen in the following line of decompiled code from the application.
- 29. Could your fridge send you spam? • Proofpoint says that between 23 December, 2013 and 6 January, 2014, the 100,000-‐ strong botnet sent out more than 750,000 “malicious email communications” with more than “25 per cent of the volume sent by things that were not conventional laptops, desktop computers or mobile devices.” http://www.independent.co.uk/life-‐style/gadgets-‐and-‐tech/news/could-‐your-‐fridge-‐send-‐you-‐spam-‐security-‐researchers-‐report-‐internet-‐of-‐things-‐ botnet-‐9072033.html
- 30. Hacker hijacks wireless Foscam baby monitor, talks and freaks out nanny • A hacker used the Foscam security camera to talk to the nanny of a one-‐year-‐old girl. She heard talking coming from the security camera, a man saying, "Oh, that's a beautiful baby.” • Foscam has been reported three instance for these kind of hacking due to password vulnerability (empty user name required no password) and people using default user name/password http://www.computerworld.com/article/2878741/hacker-‐hijacks-‐wireless-‐foscam-‐baby-‐monitor-‐talks-‐and-‐freaks-‐out-‐nanny.html
- 31. 九陽智慧豆漿機 • With Wi-‐Fi function connect to Mobile App and Cloud. • Using network sniffer found out, Mobile IEMI is the Mobile ID to get the session key thru the cloud, then get the device ID thru the session key. • Once go the device ID can send HTTP command to cloud and mess up with different devices Copyright 2015 Trend Micro Inc. 31 http://www.freebuf.com/articles/terminal/78196.html
- 32. Shodan Expose on-‐line device • The Shodan search engine is the Google for the Internet of Things, a playground for hackers and terrorists -‐-‐ and, maybe, a useful tool for companies looking to lock down their own environment Copyright 2015 Trend Micro Inc. 32
- 33. Even the FBI is worried about Internet of Things security Copyright 2015 Trend Micro Inc. 33 • FBI Sep. 10, 2015 issued a public service announcement regarding cybercrime opportunities posed by the connecting of all sorts of data-‐enabled devices, from medical gear to entertainment gadgets, to the Internet. • The FBI cites "deficient security capabilities and difficulties for patching vulnerabilities in these devices, as well as a lack of consumer security awareness," with giving cybercrooks an opening to plot attack and steal information. http://www.computerworld.com/article/2983793/data-security/even-the-fbi-is-worried-about-internet-of-things- security.html?phint=newt%3Dcomputerworld_security&phint=idg_eid%3D7e21d0a5c7c13c7adbc9bf097fb770ab#tk.CTWNLE_nlt_security_2015-09-14 http://www.ic3.gov/media/2015/150910.aspx
- 34. Typical attack Copyright 2015 Trend Micro Inc. 34 AAA Penetration Steal Key Certification Fake Firmware Cloud Penetration Backdoor Credentials Default Name/Password Direct Web Access Man in the Middle Get device fix key and certification to break the encryption and get access right Modify Firmware and signed with steal Key Control device for further penetration Attack Cloud system for backend valuable data 1 2 3 4 Attack authentication authorization accounting Interface Device Web App Mobile App Cloud
- 35. 35Copyright 2015 Trend Micro Inc. Trend Micro IoT Security Solutions Overview
- 36. Copyright 2015 Trend Micro Inc. 36
- 37. Copyright 2015 Trend Micro Inc. 37 Solution Deployment
- 38. Trend Micro Strength in IoT Copyright 2015 Trend Micro Inc. 38 1Top 3 worldwide security company with 26+ years experience and with full dedication in the security field. Security 2 Comprehensive Operation Infra 3 Cloud Technology 4 Big Data Analysis Full experiences in different OS development with API creation and integration. Completed SOP for security update infra and data storage. World first one create Cloud based security. Partners with Amazon AWS and Microsoft Azure with full experience in Cloud infra constriction. Few company has the real experience in Hadoop deployment and apply in the real business operation.
- 39. Q&A 39Copyright 2015 Trend Micro Inc.
- 40. Thank you! Copyright © 2015 Trend Micro Incorporated. All rights reserved. 40
- 41. OWASP IoT Top 10 Security Concerns Copyright 2015 Trend Micro Inc. 41 Security concerns 1. Insecure Web Interface HACK Category 2. Insufficient Authentication/Authorization AAA 3. Insecure Network Services HACK 4. Lack of Transport Encryption AAA 5. Privacy Concerns PRIVACY 6. Insecure Cloud Interface HACK 7. Insecure Mobile Interface HACK 8. Insufficient Security Configurability AAA 9. Insecure Software/Firmware HACK 10. Poor Physical Security PHYSICAL Source: https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 ! ! ! ! ! ! ! ! ! !