The 1.5 Billion Dollar Market: IoT Security

https://blog.paessler.com/investments-in-iot-security-are-set-to-increase-rapidly-in-2018
The two biggest challenges in 2018 will continue to be protecting against unauthorized access, and patching/updating the software of the device. Companies must not neglect the security problems of IoT and IIoT devices. Cyberattacks on the Internet of Things (IoT) are already a reality.

According to Gartner‘s market researchers, global spending on IoT security will increase to $1.5 billion this year.

122 Comments

  1. Tomi Engdahl says:

    ​4 best practices to combat new IoT security threats at the firmware level
    https://www.techrepublic.com/article/4-best-practices-to-combat-new-iot-security-threats-at-the-firmware-level/#ftag=RSS56d97e7

    Firmware may be the next frontier for IoT hacks. See below how the healthcare industry addresses these threats.

    How do you combat new IoT security threats at the firmware level, which traditional IT security is not designed for? Here are four best practices:

    1. Secure physical premises
    2. Engage in continuous security dialogs with vendors
    3. During the RFP process, evaluate prospective IoT vendors for best practices
    4.Perform beneficial hacking on your own

    By regularly testing your machine with “friendly hacks,” you can probe for security holes and fix what you find.

    Reply
  2. Tomi Engdahl says:

    Open-source hardware could defend against the next generation of hacking
    https://theconversation.com/open-source-hardware-could-defend-against-the-next-generation-of-hacking-104473

    Lessons from open-source software
    Software users and developers already embrace computer software whose source code is publicly accessible. All supercomputers, 90 percent of cloud servers, 82 percent of smartphones and 62 percent of embedded systems – like those inside consumer electronics – run on open-source operating systems. More than 70 percent of “internet of things” devices also use open-source software.

    Open-source software isn’t inherently or automatically more secure. But it creates more possibilities, and market pressure, for improving security. Just as when choosing a safe to store a secret document in, customers must decide – should they pick a system whose security is vouched for by the company that makes it, or a system that can be explored, examined and tested?

    Open-source software users choose not to trust a program unless they can verify it independently.

    Reply
  3. Tomi Engdahl says:

    How open source hardware increases security
    https://opensource.com/article/18/10/cybersecurity-demands-rapid-switch-open-source-hardware?sc_cid=7016000000127ECAAY

    Want to boost cybersecurity at your organization? Switch to open source hardware.

    Reply
  4. Tomi Engdahl says:

    Germany proposes router security guidelines
    https://www.zdnet.com/article/germany-proposes-router-security-guidelines/

    German government would like to regulate what kind of routers are sold and installed across the country.

    Reply
  5. Tomi Engdahl says:

    Going Above and Beyond Basic Cybersecurity Authentication Chips
    https://www.eeweb.com/profile/scottbest/articles/going-above-and-beyond-basic-cyber-security-authentication-chips

    Cryptographic ICs come with different features, protections, and algorithms, so it’s challenging for design engineers to get a good handle on choosing the right one

    Given today’s ongoing system counterfeiting assaults, design engineers from all sectors of industry, military/aerospace, business, and technology are searching out the best cryptographic authentication ICs to safeguard their advanced system designs against counterfeiting.

    Unfortunately, while there are many choices to select from, most of them provide only minimal security coverage. In some cases, design engineers are unwittingly prone to select ones that severely limit the anti-counterfeiting (ACF) umbrella that they’re expecting.

    There are two types of authentication ICs: fixed-function “state machine designs” and software-programmable devices that include a wealth of different security protocols.

    The challenge/response protocol is at the heart of anti-counterfeiting. This is best explained using a Challenge-Handshake Authentication Protocol (CHAP) example. In a CHAP system, the authenticating server issues a challenge to the user in the form of a large series of random bits. The user’s password — a secret value — is used to encrypt the challenge, and the encrypted result is returned to the server. Once the server receives the user response, it can verify that the response matches what it was expecting, meaning that the user must have entered the correct password. When that match is confirmed, the user is authenticated; hence, the “challenge/response protocol” moniker.

    Reply
  6. Tomi Engdahl says:

    Cybersecurity Storms: Visibility is Key to Cyber Protections
    https://www.securityweek.com/cybersecurity-storms-visibility-key-cyber-protections

    Security Teams Need to Maintain Packet-level Visibility Into All Traffic Flowing Across Their Networks

    The most destructive disaster is the one you do not see coming. Before modern meteorology, settlers along the Atlantic coast had no warning when a hurricane was upon them. There was no way to escape from the titanic forces of wind and rain. Now, scientific instruments such as radar, barometers and satellites can see trouble brewing halfway across the ocean, giving residents time to evacuate and save lives.

    While there is no evacuating cyberspace to avoid a storm of hackers, prior warning gives security teams a chance to stop cybercriminals before they can wreak havoc and make off with sensitive customer data or company secrets. There is an all too common adage that it is not a question of if a company will be hacked, but when they will find the hack. The realities of the cyberspace make it too difficult to reliably keep hackers out of corporate networks. That is not to say security teams should give up, but rather that they need to shift their goals.

    Reply
  7. Tomi Engdahl says:

    M2M Protocols Expose Industrial Systems to Attacks
    https://www.securityweek.com/m2m-protocols-expose-industrial-systems-attacks

    Some machine-to-machine (M2M) protocols can be abused by malicious actors in attacks aimed at Internet of Things (IoT) and industrial Internet of Things (IIoT) systems, according to research conducted by Trend Micro and the Polytechnic University of Milan.

    The security firm has analyzed two popular M2M protocols: Message Queuing Telemetry Transport (MQTT), which facilitates communications between a broker and multiple clients, and the Constrained Application Protocol (CoAP), a UDP-based server-client protocol that allows HTTP-like communications between nodes.

    In the case of MQTT, Trend Micro researchers discovered vulnerabilities in both the protocol itself and its implementations. The flaws can allow malicious actors to execute arbitrary code or cause a denial-of-service (DoS) condition, which, as experts have often warned, can pose a serious risk to industrial systems. The flaws have been reported to the developers of the affected software and patches have been released.

    Reply
  8. Tomi Engdahl says:

    Machine-to-Machine (M2M) Technology Design Issues and Implementation Vulnerabilities
    https://blog.trendmicro.com/trendlabs-security-intelligence/machine-to-machine-m2m-technology-design-issues-and-implementation-vulnerabilities/

    MQTT Payload Remaining Length (CVE-2018-17614)

    The vulnerability is an unbounded write-in caused by a missing check on the “remaining length” field in a popular MQTT library. This allows an attacker to execute arbitrary code on vulnerable devices that implement an MQTT client. An attacker here must either control a rogue MQTT broker, or the broker must be missing proper checks for the remaining length field and just relay MQTT packets “as they are” from publishers to subscribers. The vulnerability can be triggered during the parsing routine for an MQTT PUBLISH packet, and precisely when reading the “remaining length” and “topic length” fields.

    There was a fix for this vulnerability. However, the developers could not agree on the best way to implement it.

    CoAP: IP address spoofing on UDP and the risk of amplification (PoC)

    Reply
  9. Tomi Engdahl says:

    MQTT and CoAP: Security and Privacy Issues in IoT and IIoT Communication Protocols
    https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/mqtt-and-coap-security-and-privacy-issues-in-iot-and-iiot-communication-protocols

    We looked into MQTT brokers and CoAP servers around the world to assess IoT protocol security. Learn how to prevent risks and secure machine-to-machine (M2M) communications over MQTT and CoAP in our research.

    Reply
  10. Tomi Engdahl says:

    7 Non-Computer Hacks That Should Never Happen
    From paper to IoT, security researchers offer tips for protecting common attack surfaces that you’re probably overlooking.
    https://www.darkreading.com/vulnerabilities—threats/7-non-computer-hacks-that-should-never-happen/d/d-id/1333194

    Reply
  11. Tomi Engdahl says:

    The CoAP protocol is the next big thing for DDoS attacks
    CoAP DDoS attacks have already been detected in the wild, some clocking at 320Gbps.
    https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/

    RFC 7252, also known as the Constrained Application Protocol (CoAP), is about to become one of the most abused protocols in terms of DDoS attacks, security researchers have told ZDNet.

    CoAP was designed as a lightweight machine-to-machine (M2M) protocol that can run on smart devices where memory and computing resources are scarce

    In a very simplistic explanation, CoAP is very similar to HTTP, but instead of working on top of TCP packets, it works on top of UDP, a lighter data transfer format created as a TCP alternative.

    Just like HTTP is used to transport data and commands (GET, POST, CONNECT, etc.) between a client and a server,

    But just like any other UDP-based protocol, CoAP is inherently susceptible to IP address spoofing and packet amplification, the two major factors that enable the amplification of a DDoS attack.

    An attacker can send a small UDP packet to a CoAP client (an IoT device), and the client would respond with a much larger packet.

    The people who designed CoAP added security features to prevent these types of issues, but as Cloudflare pointed out in a blog post last year, if device makers implement these CoAP security features, the CoAP protocol isn’t so light anymore, negating all the benefits of a lightweight protocol.

    That’s why most of today’s CoAP implementations forgo using hardened security modes for a “NoSec” security mode that keeps the protocol light, but also vulnerable to DDoS abuse.

    TLS 1.3 is going to save us all, and other reasons why IoT is still insecure
    https://blog.cloudflare.com/why-iot-is-insecure/

    Reply
  12. Tomi Engdahl says:

    Exploiting an RCE bug in the UDP Protocol implemented in FreeRTOS
    https://www.fortinet.com/blog/threat-research/exploiting-an-rce-bug-in-the-udp-protocol-implemented-in-freerto.html

    Recently, I saw a report about several bugs that were found on FreeRTOS. Curiosity got the best of me, and I started to take a look to see what can be done from the IPS side to protect our customers because of importance of IoT devices and the popularity of this operating system. (Since the initial report more details have been made available here, CVE-2018-16525.)

    Reply
  13. Tomi Engdahl says:

    DARPA to brief industry on initiatives in trusted computing, secure chip use, semiconductor manufacturing
    https://www.militaryaerospace.com/articles/2018/12/trusted-computing-semiconductor-manufacturing-secure-chip.html

    U.S. military researchers will brief industry later this month on a new initiative to help develop secure integrated circuit technology for trusted computing applications, ranging from manufacturing to systems integration.

    Reply
  14. Tomi Engdahl says:

    Dodging The Next Generation Of Car Thieves
    How a hardware Root of Trust can thwart attacks on ever more complex vehicles.
    https://semiengineering.com/dodging-the-next-generation-of-car-thieves/

    Reply
  15. Tomi Engdahl says:

    Five steps to successful threat modeling
    How to build a security plan and put it into action.
    https://semiengineering.com/five-steps-to-successful-threat-modeling/

    The Internet of Things (IoT) is changing the way we interact with the world around us. Over the next few years, billions more connected devices will enable us to drive efficiency, boost productivity, and enhance comfort and convenience in our personal and professional lives. And we’re not the only ones to see the potential of this market.

    Simplifying security
    To meet the challenges of operating in this ever-changing and connected world, security can no longer be considered a separate component. It must be embedded in every element and process, starting with the product development phase. Arm’s Platform Security Architecture (PSA) framework simplifies this activity and makes it quicker and easier to build a secure device.

    Identifying the right level of security for your device
    To design-in security, Arm PSA recommends developers and manufacturers start by analyzing the operating environment and understanding and documenting the ways each device could be attacked. It is a process known as Threat Models and Security Analyses (TMSA), or an English Language Protection Profile, and it has been used in the mobile industry for some time but is rarely carried out in the IoT space.

    The TMSA will highlight critical issues you need to address and challenge you to consider important questions, such as:

    – What are your most valuable assets?
    – What are the potential threats to your device?
    – What type of attack do you need to protect against?
    – How severe are the threats?
    – What counter-measures could you implement?
    – What are your security requirements?
    – How does your device meet your security requirements?

    Who will benefit from Threat Models and Security Analyses (TMSA)?
    You can apply the methodology to any device, from simple, low-cost or even disposable applications, through to the most advanced edge and gateway devices.

    The TMSA documentation is intended to make threat modeling more accessible to all, so you can secure your device even if you do not have access to dedicated security knowledge or expertise.

    Step 1 checklist
    2. Identify potential adversaries, the attack surface and threats
    3. Identify high-level security objectives to address threats
    4. Define security requirements for each security objective
    5. Consolidate all information into a threats summary table

    Continuing the security journey
    The Threat Model and Security Analysis (TMSA) is just the first of three stages in Arm’s Platform Security Architecture (PSA).

    After you have completed your TMSA documentation and established your security requirements, the next step is to put them into action.

    Stage 2: Architect
    This stage of the PSA includes architecture specifications for firmware and hardware.

    Stage 3: Implement
    This gives you access to high quality reference code and documents.

    Reply
  16. Tomi Engdahl says:

    Building Security into the Smart Home Devices with a Hardware Root of Trust
    Best practices for protecting personal assets from cyber criminals.
    https://semiengineering.com/building-security-into-the-smart-home-devices-with-a-hardware-root-of-trust/

    Building security into the device
    One approach to IoT security is to build protection directly into the device. This provides a critical security layer, and the devices are no longer dependent on the Internet gateway or a home router as their primary protection. A security solution for smart home devices must ensure the device firmware has not been tampered with, be able to secure the data stored by the device, secure in and outbound communications, and it must detect and report attempted cyber-attacks. This only can be achieved by including security in the early stages of design.

    Trust in embedded security refers to an expectation of integrity that a smart home device is operating as designed. Software trusts that hardware is operating as it should be. Applications trust that the operating system is not corrupting files. Remote systems trust in the device’s identity to which it’s connected. This process of establishing trust is called authentication. A device’s root-of-trust is the point where authentication starts and then extends through each layer. For critical smart home applications, a hardware root of trust is an important building block to secure endpoints and services.

    Design for security from the ground up using Hardware-Enforced Root of Trust

    Reply
  17. Tomi Engdahl says:

    Open-Source RISC-V Hardware And Security
    https://semiengineering.com/security-and-open-source-hardware/

    Experts at the Table, Part 1: The advantages and limitations of a new instruction set architecture.

    SE: Is open-source hardware more secure, or does it just open up vulnerabilities to a much wider audience of cyber criminals?

    Newell: We deal a lot with governments and defense customers. They have a tendency to believe everything should be secret. I take more of a middle ground view, which recognizes that complex systems are going to have bugs. In that case, secrecy can improve your security. But security systems can be protected by open source and improved. Any real security has to include simpler elements that protect the more complex systems.

    Handschuh: With open source, you have the opportunity to review it and come up with comments, feed it back to the community, and as a group you can advance maybe not faster but better. You have more hands. Everybody is available to give you constructive comments, and then you can work together to make it better. That means you start from something that is open and published, and then you evolve it together by adding things and creating white papers.

    Kiniry: Our government trends toward not having artifacts being public, but they definitely want to see everything. Openness helps with them as a client.

    SE: If you are updating open source that is public, that may be great. But when hackers find vulnerabilities, they don’t necessarily publish those. So now a lot more is exposed for everyone to see. Is that worse than proprietary instruction set architectures?

    Handschuh: By publishing the interfaces you get more people to look at it. Hiding things behind the scenes is worse because then you don’t know what’s going on.

    Newell: There are different ways to analyze this. Formal analysis is certainly a good way. A lot of eyes on it is another good way. We are going down a formal route. We have a formal committee that is providing a description of the ISA interface. And then you need to look at the microkernel. But as soon as you get to a rich OS like Linux, you’re never going to be able to solve the bugs. If you look at set-top boxes, a lot of those hacks happened because the software was reverse-engineered. There is a place for secrecy, at least as a road bump to slow down these guys.

    Kiniry: The struggle I see is at the intersection of policy and technology. With our current leadership, there is a tendency to hold vulnerabilities close to the vest. If the government finds problems, especially with hardware, we’re not guaranteed we will learn about them—even in the case of open systems. That’s problematic.

    Reply
  18. Tomi Engdahl says:

    Synopsys’ Taylor Armerding warns that air gaps, a valuable barrier against cyberattacks, are disappearing from industrial control systems and considers what that means for the global shipping industry.

    Air gaps in ICS going, going … and so is security
    https://www.synopsys.com/blogs/software-security/smart-shipping-ics-air-gap/

    As smart shipping and other network-connected industrial control systems (ICS) grow, the air gap loses value as a barrier against cyber attacks. What’s next?

    Reply
  19. Tomi Engdahl says:

    “Kysy myyjältä” – Uusi merkki kertoo tietoturvasta
    https://www.tivi.fi/Kaikki_uutiset/kysy-myyjalta-uusi-merkki-kertoo-tietoturvasta-6752355

    Tilannetta kenties helpottaa ensi vuonna käyttöön tuleva Viestintäviraston Kyberturvallisuuskeskuksen luoma tietoturvamerkki, jonka

    avulla kuluttajien on helppo tunnistaa riittävän tietoturvallinen laite.

    Tietoturvasta kertova merkki tulee aluksi valittujen pilottikumppanien käyttöön. “Kannattaa ottaa heti yhteyttä Viestintävirastoon, jos

    toiminta IoT-verkostossa tai merkin käyttöönotto kiinnostaa”, Viestintäviraston kehityspäällikkö Joonas Orkola sanoo tiedotteessa.

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

*

*