IoT Security

1. www.advstar.org
AdvSTAR Laboratory
1
Threat Intelligence for IoT Security
Dr. Joe C.L. Chan, AdvSTAR Laboratory

2. www.advstar.org
AdvSTAR Laboratory
2
Network Technology Information Technology
Embedded Devices
The Internet of Things (IoT)

3. www.advstar.org
AdvSTAR Laboratory
3
Summary of IoT incidents in 2017
Date Event Type Damage
Feb 2017 CloudPets the toy bear Spy Surveillance 800,000 user account details leaked from database and
voice messages were exposed.
March 2017 Web services
vulnerability in Dahua’s
IOT products
Full remote control of devices Second largest IoT device manufacturer (USD$3B
revenue in 2017) reported to contain vulnerability in
most of its IoT products.
April 2017 Hajime malware Full remote control of devices 300,000 IoT devices formed new large scale botnet, but
no malicious activity detected?
May 2017 (discovered) Weeping Angel malware Spy Surveillance Unknown number of Samsung Smart TV being used as
spy surveillance station.
July 2017 GSOAP Vulnerability
(Devil’s Ivy)
Full control of IP cameras Over a million of Axis IP cameras were found to be
exploitable.

4. www.advstar.org
AdvSTAR Laboratory
4
Why IoT Security is difficult?
VERY DIFFICULT to maintain up-to-date vulnerabilities information for all devices.
● Too many IoT devices in the same company
● Insufficient information about the devices
Enterprises
● Too many components in IoT devices
● Not all developers are aware of latest security
issues
Vendors

5. www.advstar.org
AdvSTAR Laboratory
5
Technologies used in IoT Devices
Hardware
● Sensors (e.g. Camera, Thermometer)
● Actuators
● Network Interfaces
Software
● Operating Systems
● Interface (e.g. Web services)
● Data store
● Digital Certificate
● Supporting Software Libraries (Dependency)

6. www.advstar.org
AdvSTAR Laboratory
6
Technologies used in IoT Devices
Belkin Wemo Switch
Dependencies Version
autoconf 2.62
automake 1.10
binutils 2.19.1
Bison 2.3
Busy Box 1.22.1
c-ares 1.9.1
Curl 7.29.0
dmalloc 5.5.2
dnsmasq 2.52
dropbear 0.52
e2fsprogs 1.41.11
GCC Libgcc2.c 4.3.3
genext2fs 1.4.1
gmp 4.3.1
gnupg 1.4.7
hotplug2 1.0-alpha
OpenWRT_backfire 10.03
opkg 513
pjproject 1.8.10
sed 4.1.2
Dependencies Version
Iperf 2.0.5
ipkg-utils 1.7
libpcap 1.0.0
libtool 1.5.26
libupnp 1.6.19
Linux Kernel 2.6.21.x
list_threads.sh n/a
lua 5.1.4
lzma 4.32
M4 1.4.5
mklibs 0.1.29
mpfr 2.4.1
mtd 20090505
mxml 2.9
NatClient 1
ncurses 5.7
ntpclient 2007_365
OpenSSL 1.0.0
pkg-config 0.22
quilt 0.47

7. www.advstar.org
AdvSTAR Laboratory
7
Technologies used in IoT Devices
LG WebOS TV (Curved 4K UHD Smart LED TV - 105” Class 105UC9)
Dependencies
Operating System Version
WebOS TV
(Linux kernel based OS)
3.5

8. www.advstar.org
AdvSTAR Laboratory
8
Technologies used in IoT Devices
LG WebOS TV (Curved 4K UHD Smart LED TV - 105” Class 105UC9)
Dependencies
shadow, alsa-utils, bluedroid, bluez4, BusyBox, connman, dbus-gpl, e2fsprogs, ecryptfs-utils, flac, fuse, ginga-ncl, gphoto2, gphotofs,
gptfdisk, gzip, iproute2, iptables, iputils, jfsutils, keyutils, libnih, Linux Kernel, lsb, lzo, makedevs, netbase, ntpclient, opkg, pciutils,
portal, ppp, procps, psmisc, pulseaudio, readline, rp-pppoe, sg3-utils, shadow-gpl, syslogd, sysvinit, tar, tinylogin, udev, upstart,
usb-modeswitch, usbutils, utelnetd, Util-Linux, Wifi USB Layer Driver, LWUIT, gSOAP, alsa-lib, alsa-plugins, ATK, bluez4-lib, DirectFB,
e2fsprogs-e2p, e2fsprogs-ext2fs, fribidi, gail, gdk-pixbuf, gettext, GLib, glib-networking, glibc, glibmm, gmp, GnuTLS, gst-plugins-bad,
gst-plugins-base, gst-plugins-good, gst-plugins-lp, gst-plugins-ugly, GstOpenMax, Gstreamer, GTK+, gtkmm-utils, hunspell, hunspell
dictionary, imhangul, JavaScriptCore, libasn, libattr, libconfig, libexif, libfuse, libgcrypt, libgpg-error, libgphoto, libgphoto2, libhangul,
libintl, libkmod, libmikmod, libmms, libnl, libprocps, libsigc++-2.0, libsndfile1, libsoup, libtasn1, libtool, libusb, libusb-compat, LIM
OpenMax Implementation, maliit-framework, OpenAL, pango, ptmalloc3, pulseaudio-lib, PyEnchant, qtbase, qtdeclarative,
qtgraphicaleffects, qtjsbackend, qtquick1, qtscript, qtsensors, qtwayland, qtxmlpatterns, SDL_image 2.0, SDL_mixer 2.0, smpeg, taglib,
uclibc, udev-lib, util-linux-lib, webkit, xz, Cairo Vector Graphics Library, libmicro-toolkit, mozilla-sdk, nspr, uchardet, XULRunner, zziplib,
dbus, activitymanager, AdpaterBase, Android platform, Apache Xerces-C++ XML Parser, audiod, bootplate, configurator, cordova,
cpushareholder-stub, crashd, db8, Droid, enyo, enyo-ilib, enyojs-framework, filecache, handler, ilib, layout, less, libpbnjson, librolegen,
libsandbox, libthrift 0.8.0, luna-init, luna-prefs, luna-service2, luna-sysmgr-common, luna-sysmgr-ipc, luna-sysmgr-ipc-messages,
luna-sysservice, luna-system-manager, lunaSysMgr, mojoloader, mojoservicelauncher, moonstone, nettools,
nodejs-module-webos-dynaload, nodejs-module-webos-pmlog, nodejs-module-webos-sysbus, Noto Sans Khmer, Noto Sans Lao, Noto
Sans Myanmar, Noto Sans Sinhala, nyx-lib, nyx-modules, nyx-utils, pmcertificatemgr, pmcertificatemgrservice, pmklogd, pmlogctl,
pmlogdaemon, pmloglib, powerd, serviceinstaller, Skype Encoding Camera Specification, sleepd, smartkey-hun, spotlight, Tinos,
webappmanager-bundle, webappmanager2, webos-connman-adapter, Boost, Brian Gladman, Android - platform - bionic, libev, lz4,
sax-js, UglifyJS, AllJoyn About, AllJoyn Notification, amdefine, axTLS Embedded SSL, Chromium, CSSMin, gtest, hdparm, jemalloc,
jQuery Easing, leveldb, libcap, libflac, libjpeg-turbo, libogg, libpam, libpcre, libupnp, libvorbis, libwebp, lighttpd, Mersenne Twister
random number generator, Neptune C++ Runtime Library, OpenBSD, OpenCV, Protocol Buffers, sanos, sdparm, shelljs, snappy,
source-map, speex, sqlcipher, tremor, uriparser, wpa supplicant, XySSL, yajl, portmap, bzip2, e2fsprogs-uuid, flex, FreeBSD, curl,
expat, FFT, freetype, AllJoyn, JM h264 video decoder reference software, jpeg-6b, libjpeg, libmng, abbrev-js, alsa-state, async, cJSON,
class-js, e2fsprogs-ss, fastlz, iniparser, jquery, jQuery Easing Compatibility, jQuery Transit, JsonCPP, libffi, libjson, libnsbmp, Lua,
minimist, Mongoose, mootools, node-mkdirp, node-optimist, node-uuid, node-wordwrap, node-xml2js, nodejs, nopt, OpenCL,
OpenMAX IL API, opkg-collateral, option-js, Pixman, Q in javascript, RetroBSD, Socket.IO, udev-extraconf, underscore, webos-events,
webOSExt, ws, XCB, xkeyboard-config, all.js, c-ares, EGL, Font config, glibcurl, ICU - International Components for Unicode, Intel/DVI
ADPCM codec, Kazlib, libunwind, libxkbcommon, libxml2, libxslt,
Linux_RGX_Family_OGLES_1_1_3_0_OCL_1_1_UM_DDK_Source_1_2_Beta_2600732, ncurses, popt, Strtod, util-macros, Wayland,
xproto, openssl, PCCTS, python, The MD5 Message-Digest Algorithm, OpenGL-ES 1.0, OpenGL-ES 2.0, OpenGL-ES 3.0, RFC 3174 -
US Secure Hash Algorithm 1, AnjaliOldLipi, Lohit, NanumGothic, libtiff, CVTUTF, x.org, Aladdin Enterprises, libpng, minizip, SDL 2.0,
SDL_net 2.0, SDL_ttf 2.0, tinyxml, zlib
Operating System Version
WebOS TV
(Linux kernel based OS)
3.5

9. www.advstar.org
AdvSTAR Laboratory
9
Product A
Developers
Quality Assurance
Penetration Test
End User
Simplified Product Development Cycle
Vendor A

10. www.advstar.org
AdvSTAR Laboratory
10
Developers/
QA
Product 1
Firmware Ver. 1.00
Dependency 1
Dependency 2
Dependency 3
Dependency n
:
:
Product 2
Firmware Build 54fe08a0
Dependency 1
Dependency 2
Dependency 3
Dependency n
:
:
Routine Vulnerabilities
Monitoring
Vulnerabilities of Dependencies
:
:

11. www.advstar.org
AdvSTAR Laboratory
11
Vendors End Users
Security advisory in
vendors’ website
Product A-Z
● Firmware Version
● Specification
● Dependency List
Threat Intelligence for Vendors
Vulnerability report and alerts
Dependency Version Safe CVSS Score
ipkg-utils 1.7 ✓ —
libpcap 1.0.0 ✓ —
libtool 1.5.26 ✗ 6.9
libupnp 1.6.19 ✗ 7.5
Linux Kernel 2.6.21.x ✗ 4.9
Threat
Intelligence

12. www.advstar.org
AdvSTAR Laboratory
12
Vulnerability
Report

13. www.advstar.org
AdvSTAR Laboratory
13
Vendor A Product
0001
Vendor C Product
A002
Vendor N Product
M
Security Officers / Risk Management Team
Browse Vendor A
Product 0001 Page
Browse Vendor C
Product A002 Page
Browse Vendor N
Product M Page
...
...
Notify infrastructure team for action
Vulnerabilities Found
Daily
Manual
Routine
Daily Operations
Enterprise B

14. www.advstar.org
AdvSTAR Laboratory
14
Enterprise B
Deliver to SIEM or alert SOC team
Patch and notify
related unit
Infrastructure List
● Vendor A Product 0001 (FW Ver. 1.01)
● Vendor C Product A002 (Rev 1a)
● Vendor N Product M (Build 2390cb14)
Threat Intelligence for Enterprises
New vulnerability found
Update Infrastructure Item
● Vendor C Product A002 (Rev 2a)
Threat
Intelligence

15. www.advstar.org
AdvSTAR Laboratory
15
Statistics

16. www.advstar.org
AdvSTAR Laboratory
16
Filtering
Vendor A
Vendor B
Vendor C
Enterprise D
Enterprise E
Enterprise F
Monitoring and Alerts
Collect Information From
External Sources
Dependency List
Intelligence Aggregation
Threat
Intelligence
⋮
Issue Tracker
CVE
Product Security
Advisory Pages
More
Mailing List
IRC
Classification
Malware
Analysis
Manual
Analysis

17. www.advstar.org
AdvSTAR Laboratory
17
Threat Intelligence
Wide Coverage of Information
Actionable Items
Hacking Tools
Known Vulnerabilities
Threat Actor
Risk Level Indicator
IP Addresses Malware Hashes / Yara
Rules
Attack Case

18. www.advstar.org
AdvSTAR Laboratory
18
Automation
More effective and accurate
process through automation
Consolidation
Consolidate information
from multiple sources
Threat Intelligence
Relevant and reliable information about technology risks of an organization
Identification
Identify facts that requires
attention

19. www.advstar.org
AdvSTAR Laboratory
19
Trust requires better understanding
Tracking of latest vulnerabilities of their products
Identify new targeted attacks
Vendors
Keep track of vulnerabilities in their devices
Review track record of vendors
Provide mitigation and actionable intelligence
Enterprise
Threat Intelligence
Reveal hidden risks
Improve transparency

20. www.advstar.org
AdvSTAR Laboratory
20
Laboratory
Shatin, Hong Kong.
220 Photonics Centre,
Hong Kong Science Park,
Contact Us
(852) 3172-1110
info@advstar.org
https://advstar.org