The document discusses some of the challenges of IoT security and provides recommendations. It notes that IoT security is difficult because devices often lack secure boot processes, have undocumented backdoors, and debugging can be done over unencrypted network connections. It recommends hiring engineers trained in security, prioritizing security over features, performing regular penetration testing, and providing indicators if a device becomes hacked. However, it acknowledges that no security is impossible to break, so the focus should be on choosing important battles.

1. What I learned about IoT Security…
and why it’s so hard!
@timescaledb

2. Chris Engelbert
Developer Advocacy @TimescaleDB
Previous fun companies:
- Ubisoft / Blue Byte
- Hazelcast
- Instana
- clevabit
Interests:
- Developer Relations
- Anything Performance Engineering
- Backend Technologies
- Fairy Tales (AMD / Intel, AMD / Nvidia, AMD / Nvidia)
@noctarius2k

5. The 🐘 in the Room

6. No Internet Connection
https://www.redbubble.com/i/poster/You-are-o
ffl
ine-by-dbengati/50499607.LVTDI#&gid=1&pid=2

7. Remove Gunk
https://taz.de/Sperrmuell-auf-Gehwegen/!5713115/

8. https://keasigmadelta.com/blog/why-you-shouldnt-write-your-own-encryption-algorithm/

9. https://www.authgear.com/post/password-hashing-salting

10. Forget
Factory
Passwords
https://www.online-tech-tips.com/cool-websites/reset-bios-password/

11. Undocumented
“Backdoors”
Are Not Secure
https://bdtechtalks.com/2020/04/27/deep-learning-mode-connectivity-adversarial-attacks/

12. Secure Your Build System:
Isolate Environments https://yokell.artstation.com/projects/8rOYx

13. https://reciprocity.com/blog/most-common-types-of-cybersecurity-vulnerabilities/
Check For Vulnerabilities

14. https://www.ohio.edu/orgs/glass/looking_glass1.html
https://stock.adobe.com/search/images?k=
fi
rmware+icon&asset_id=378400523
https://altitudetvm.com/es/software/2366-pengertian-
fi
rmware-beserta-fungsi-dan-contoh-penggunaan-
fi
rmware-pada-perangkat-elektronik.html

15. 🔐
https://www.ohio.edu/orgs/glass/looking_glass1.html
https://stock.adobe.com/search/images?k=
fi
rmware+icon&asset_id=378400523
https://altitudetvm.com/es/software/2366-pengertian-
fi
rmware-beserta-fungsi-dan-contoh-penggunaan-
fi
rmware-pada-perangkat-elektronik.html
• Cryptographically Sign Your Firmware Files

16. 🔐
https://www.ohio.edu/orgs/glass/looking_glass1.html
https://stock.adobe.com/search/images?k=
fi
rmware+icon&asset_id=378400523
https://altitudetvm.com/es/software/2366-pengertian-
fi
rmware-beserta-fungsi-dan-contoh-penggunaan-
fi
rmware-pada-perangkat-elektronik.html
🔐
• Cryptographically Sign Your Firmware Files
• Cryptographically Sign Firmware Updates

17. 🔐
• Cryptographically Sign Your Firmware Files
• Cryptographically Sign Firmware Updates
• Check The Signature of Firmware Updates!
🔐
https://www.ohio.edu/orgs/glass/looking_glass1.html
https://stock.adobe.com/search/images?k=
fi
rmware+icon&asset_id=378400523
https://altitudetvm.com/es/software/2366-pengertian-
fi
rmware-beserta-fungsi-dan-contoh-penggunaan-
fi
rmware-pada-perangkat-elektronik.html
🔐

18. 🔐
• Cryptographically Sign Your Firmware Files
• Cryptographically Sign Firmware Updates
• Check The Signature of Firmware Updates!
🔐
https://www.ohio.edu/orgs/glass/looking_glass1.html
https://stock.adobe.com/search/images?k=
fi
rmware+icon&asset_id=378400523
https://altitudetvm.com/es/software/2366-pengertian-
fi
rmware-beserta-fungsi-dan-contoh-penggunaan-
fi
rmware-pada-perangkat-elektronik.html
🔐
🙏

19. https://docs.cashlink.de/more-information/set-up-ledger-nano-s
Require Pairing To Be Con
fi
rmed

20. Let The Fun Begin

21. Boot Process

22. Secure Boot

23. Secure Boot
BOOT ROM Code
pubkey 1

24. Secure Boot
BOOT ROM Code
Bootloader (UBoot / Barebox)
pubkey 1
pubkey 2
Signature Veri
fi
cation

25. Secure Boot
BOOT ROM Code
Bootloader (UBoot / Barebox)
Linux Kernel / RootFS (FIT)
pubkey 1
pubkey 2
pubkey 3
Signature Veri
fi
cation
Signature Veri
fi
cation

26. Secure Boot
BOOT ROM Code
Bootloader (UBoot / Barebox)
Linux Kernel / RootFS (FIT)
Additional Filesystems
pubkey 1
pubkey 2
pubkey 3
pubkey 4
Signature Veri
fi
cation
Signature Veri
fi
cation
Signature Veri
fi
cation

27. BOOT ROM Code
Bootloader (UBoot / Barebox)
Linux Kernel / RootFS (FIT)
Additional Filesystems
pubkey 1
pubkey 2
pubkey 3
pubkey 4
Signature Veri
fi
cation
Signature Veri
fi
cation
Signature Veri
fi
cation
Trusted Boot

28. BOOT ROM Code
Bootloader (UBoot / Barebox)
Linux Kernel / RootFS (FIT)
Additional Filesystems
pubkey 1
pubkey 2
pubkey 3
pubkey 4
Signature Veri
fi
cation
Signature Veri
fi
cation
Signature Veri
fi
cation
PCR Register
Trusted Boot

29. BOOT ROM Code
Bootloader (UBoot / Barebox)
Linux Kernel / RootFS (FIT)
Additional Filesystems
pubkey 1
pubkey 2
pubkey 3
pubkey 4
Signature Veri
fi
cation
Signature Veri
fi
cation
Signature Veri
fi
cation
PCR Register
Checksum BL
Checksum OTP
Checksum FIT
Checksum Kernel
Checksum Policy
Trusted Boot

30. Trusted Boot
https://security.stackexchange.com/questions/258649/usage-of-tpm-pcrs-in-linux

31. ⋊> ~/D/Trusted-Platform-Module-Library-Family-2.0-Level-00-Revision-1.59_pub du -ah
14:16:05
3.6M ./TCG_TPM2_r1p59_Part1_Architecture_pub.pdf
3.7M ./TCG_TPM2_r1p59_Part3_Commands_pub.pdf
2.1M ./TCG_TPM2_r1p59_Part2_Structures_pub.pdf
1.1M ./TCG_TPM2_r1p59_Part4_SuppRoutines_pub.pdf
10M .
Document:
Trusted Platform Module Library, Part 1: Architecture
Trusted Platform Module Library, Part 2: Structures
Trusted Platform Module Library, Part 3: Commands
Trusted Platform Module Library, Part 4: Supporting Routines
Pages:
306
177
498
146
1127
Trusted Boot
TPM
Speci
fi
cation

32. Trusted Execution Environment
https://embeddedbits.org/introduction-to-trusted-execution-environment-tee-arm-trustzone/

33. https://www.silabs.com/security/secure-attestation
Device Attestation

34. https://www.silabs.com/security/secure-attestation
Device Attestation

35. https://www.silabs.com/security/secure-attestation
Device Attestation

36. Device Updates - Redundancy and Atomicity
https://rauc.readthedocs.io/en/latest/updating.html

37. Device Updates - Redundancy and Atomicity
https://rauc.readthedocs.io/en/latest/updating.html

38. Device Updates - Redundancy and Atomicity
https://rauc.readthedocs.io/en/latest/updating.html

39. Device Updates - Redundancy and Atomicity
https://rauc.readthedocs.io/en/latest/updating.html

40. Device Updates - Redundancy and Atomicity
https://rauc.readthedocs.io/en/latest/updating.html

41. Ports / Firewalls

42. https://blog.cloud
fl
are.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/
Firewall Ports

43. https://blog.cloud
fl
are.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/
Firewall Ports

44. Common Sense
https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console

45. Common Sense
https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console

46. Common Sense
https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console

47. Debugging via Network

48. Debugging via Network
Scan for Devices (mDNS / Avahi)

49. Debugging via Network
Scan for Devices (mDNS / Avahi)
Get Signed Debugging Request

50. Debugging via Network
Scan for Devices (mDNS / Avahi)
Get Signed Debugging Request
Debugging Request
Flags: uint8
Address: byte[4|16]
Port: uint8
Seed: uint16

51. Debugging via Network
Scan for Devices (mDNS / Avahi)
Get Signed Debugging Request
Send the Signed Debugging Request
Debugging Request
Flags: uint8
Address: byte[4|16]
Port: uint8
Seed: uint16

52. Debugging via Network
Scan for Devices (mDNS / Avahi)
Get Signed Debugging Request
Send the Signed Debugging Request
Connect to the Debugger
Debugging Request
Flags: uint8
Address: byte[4|16]
Port: uint8
Seed: uint16

53. 😱 🥶 😓

54. So What Does That Mean?

55. Hire Engineers Trained For Device Security
https://www.incibe-cert.es/en/blog/hardware-hacking-industrial-control-systems

56. >
Prioritize Security Over Features

57. Regular Penetration Testing
https://www.fracturelabs.com/posts/2020/hardware-hacking-lab-physical-tools/

58. Regular Penetration Testing
https://www.fracturelabs.com/posts/2020/hardware-hacking-lab-physical-tools/

59. Provide an Indicator that the Device may be Hacked
https://patrickspokemonpalace.wordpress.com/2010/06/30/internet-explorer-8-toolbars/

63. Whatever You Do
Somebody Will Break The Security

64. Whatever You Do
Somebody Will Break The Security
😱😱😱

65. Whatever You Do
Somebody Will Break The Security
Choose Your Battles!

66. https://en.wikipedia.org/wiki/Co
ff
ee#/media/File:Latte_and_dark_co
ff
ee.jpg

67. Thank
You!
www.timescaledb.com
@timescaledb
@noctarius2k
Questions?