# IoT Security

## Summary


The Internet of Things brings together not just computers but also sensors, cameras and controllers that are connected to vehicles, medical devices, power grids, nuclear plants, and many more critical infrastructure. Securing IoT is therefore a big concern since an attack can be life threatening. An insecure IoT system leads to lower safety, privacy and availability.

Since the mid-2010s, researchers have analyzed IoT systems to identify potential vulnerabilities and possible solutions for the same. Given IoT's large attack surface, better security can be achieved only by securing all parts of the system: from devices to apps, from APIs to network endpoints. 

In 2018, Gartner reported that 40% of smart home appliances are in use for botnet attacks. In 2021, 84% of surveyed companies reported an IoT security breach. Clearly, there's much work to be done.

## Discussion

### What are some potential attacks in various IoT verticals?

IoT systems can be hacked regardless of the vertical in which they operate. Consumer appliances,  industrial facilities, connected cars, drones, video surveillance systems, power grids and utilities, smart buildings, city infrastructure and transportation systems, medical devices and hospitals, and retail stores are some examples of what can be attacked. We describe a few of these.

In a connected home, an attacker can see sensitive data sent from a wearable, perform illegal video surveillance, profile individuals, gain control over door locks and sensors, or render appliances inoperable. 

With connected and semi-autonomous cars, hackers can remotely steal vehicles. They can also gain control of a vehicle when it's on a freeway. 

In industrial systems, PLCs and SCADA systems could be targeted. This can halt critical operations, cause accidents or install spyware. Attacks on critical infrastructure such as nuclear power plants can be catastrophic. In one experiment, a software-enabled gun was configured to prevent firing or miss its target. 

In hospitals, patient data could be stolen. Interfering with the operation of a pacemaker or changing dosage can cause death. 


### Could you mention some real-world attacks on IoT devices and systems?

Researchers have studied vulnerabilities and possible exploits on IoT devices and systems. Some of these include St. Jude Medical's cardiac implants, Owlet Wi-Fi baby heart monitors, TRENDnet webcams, and Jeep SUVs. Ignoring these research findings, we focus on real-world attacks instead.

In October 2016, Dyn servers experienced a DDoS attack by the Mirai botnet, affecting many commercial websites. Mirai made use of digital cameras and DVR players. The attack involved 100,000 malicious endpoints resulting in an attack strength of 1.2Tbps.  

Stuxnet (botnet) attacked industrial systems back in 2010. . In 2015, 230,000 people were without power in Western Ukraine when an electrical power grid was attacked. In 2021, an attack on the water supply to Oldsmar, Florida changed the level of sodium hydroxide. Fortunately, operators spotted the change and took corrective action. 

Ring doorbells come with a mobile app. In January 2020, the app was reported to leak personally identifiable information to third parties. In December 2020, we came to know of attacks on Ring smart cameras. Hackers could speak to their victims "screaming obscenities, demanding ransoms, and threatening murder and sexual assault." 


### What are the common security vulnerabilities in IoT?

We note the following vulnerabilities: 

    + **Weak, guessable, or hardcoded passwords**: Dictionary and brute force attacks can exploit this vulnerability. Devices many also have unchangeable credentials and firmware backdoors.
    + **Insecure network services**: Connected devices may have ports open or services running that aren't required.
    + **Insecure ecosystem interfaces**: Outside the device, there's an ecosystem of interfaces, APIs, gateways, cloud services and mobile apps. Any of these can be compromised.
    + **Lack of secure update mechanism**: Updates are risky if done without firmware validation, payload is unencrypted, there's no rollback or notifications. In many cases, vendors don't patch the firmware even for known vulnerabilities.
    + **Use of insecure or outdated components**: Third-party components are commonly used in today's systems. Software and hardware supply chains could be compromised.
    + **Insufficient privacy protection**: Personal information is stored insecurely or used improperly.
    + **Insecure data transfer and storage**: Data is not encrypted during storage, transmission or processing.
    + **Lack of device management**: This concerns asset management, update management, secure decommissioning, monitoring and response.
    + **Insecure default settings**: Factory settings are often insecure or even disallow changes to more secure settings.
    + **Lack of physical hardening**: Devices are hacked in close proximity, thereby enabling remote hacking.

### Could you elaborate on the different types of IoT security attacks?

IoT attacks can be broadly classified by the layer in which they occur:  

    + **Physical Attacks**: Concern hardware elements and happen in close proximity to the device. Device tampering, physical damage, or draining battery via sleep deprivation are examples.
    + **Software Attacks**: Buffer overflows, code injection and cross-site scripting are typical techniques. A hacker typically scans for vulnerable devices, infects them, and then steals data or makes devices inoperable.
    + **Network Attacks**: Can attack remotely via network connections. Sinkhole attack discard packets rather than forwarding them. Man-in-the-middle attack is often employed to attack Wi-Fi routers. Spoofing is another technique in which a malicious devices presents itself as an authenticated one.
    + **Encryption Attacks**: Even when data is encrypted, side-channel and cryptanalysis attacks are techniques to figure out encryption keys.Ultimately, IoT's attack surface is large. An attack can happen on an end device such as a connected thermostat, on its wireless network, on the network's access point, on the ISP gateway or an app that's communicating with the thermostat. 


### Could you share some best practices for better IoT security?

Many of the best practices can be directly derived from the common IoT security vulnerabilities. Security is an **end-to-end concern** and devices, network, APIs, cloud services and apps — all need to be secured. 

Network endpoints and interfaces should be secured with firewalls, anti-malware, and intrusion prevention and detection systems. For authenticating users and devices, use two-factor authentication, biometrics, Public Key Infrastructure (PKI) and X.509 digital certificates. Data should be encrypted along with mature key lifecycle management. Analytics must be specialized for IoT security with a plan to recover from attacks.  Minimize device bandwidth. 

**Security by Design** is an approach to factor in security at the start of an IoT project. Device IDs and credentials can be embedded during manufacturing. This may be called the Root-of-Trust (RoT) from which other keys and credentials are generated. Micron's Authenta is an example of securing flash memory, thus "hardening" the device against attacks. 

Systems should be designed with countermeasures against Simple Power Analysis (SPA) and Differential Power Analysis (DPA) that exploit emissions from semiconductor devices. 


### What are some challenges in securing IoT systems?

One challenge with securing IoT is the sheer number and variety of devices, in their billions. The IoT ecosystem is complex and consists of sensor devices, network nodes, many communication protocols, and regulations. If an attack should occur, it's also not clear who should be held accountable: equipment vendor, system integrator, service provider, or the user. 

Businesses are rushing to implement or adopt IoT-enabled data collection and analytics. They're doing this without considering security. When new ventures fail, their devices are abandoned without support or security updates. Even otherwise, many consumers have never done updates on their devices. Worse still, many devices don't even have a user interface to perform updates. 

Many IoT devices are designed to be cheap and disposable, wearables in particular. IoT devices have constraints on processing, storage, battery and communication. As a result, vendors prioritize cost and efficiency over security.  One way to mitigate risks is for communication service providers (CSPs) to "harden" their networks in a device-independent manner. 

## Milestones

Jun  
2010

The **Stuxnet** worm is discovered. It targeted Microsoft Windows systems and a Windows-based Siemens software used in industrial control systems. One of attacked sites was an uranium enrichment plant in Iran. In subsequent years, more related worms and spyware such as Duqu, Flame, and Gauss are discovered. Given their sophistication, security researchers believe that these are state-sponsored. 

Sep  
2014

Security expert David Jacoby of Kaspersky Lab tries to hack into his own home's electronics devices and consumer appliances. He discovers a number of vulnerabilities. He's able to easily get into his smart TV, game console and storage devices. At the Security Analyst Summit (Feb 2015), other researchers explain how they could hack into police surveillance systems, car washes and fitness bands. 

Oct  
2016

**Mirai** botnet launches DDoS attack on Dyn servers, affecting many commercial websites. Digital cameras and DVR players are used for this attack. It becomes the largest such attack to date. The process involves scanning for vulnerable devices, reporting them to the ScanListen server, installing Mirai, registering the malware with the Command and Control (C&C) server, and executing attack commands initiated by a botmaster. 

2017

Forrester Research looks at a number of critical technologies that contribute to more secure IoT systems. All of them are still in the survival or growth stages. Some of these relate to network security, API security, authentication, device hardening, threat detection and device user privacy controls. 

Dec  
2018

OWASP releases a list of top 10 IoT vulnerabilities. This is an initiative of *The OWASP Internet of Things Project* that was started in 2014. The research community subsequently uses this list to evaluate the security of IoT systems. 

Nov  
2019

Recognizing the threat to IoT systems, the European Union Agency for Cybersecurity (ENISA) publishes a report describing best practices for IoT security with an emphasis of Software Development Life Cycle (SDLC). This report is meant for IoT developers, integrators and system engineers. 

Aug  
2020

Under the ioXt Alliance Certification Program, about a dozen IoT devices become the **first devices to be certified from a security standpoint**. Certified devices include Google Pixel 4, Silicon Labs xG22 for Bluetooth connectivity, and T-Mobile home internet gateway. The Alliance launched the certification program in April 2020 and it aims to establish a global standard for IoT security. The certification program is based on *ioXt Pledge* but includes device-specific profiles such as Android-enabled devices and smart speakers.