A discussion of what the Internet of Things will really mean for the future.

1. The Real Internet of Things
How universal daemonization will change everything
Daniel Miessler
HouSecCon
October 2014

2. Me
- Practice Principal at HP Fortify on Demand
- Lead the research and development team
- Web and mobile pentesting focus
- 15 years in infosec
- OWASP project leader (IoT, Mobil…)
- danielmiessler.com
- @danielmiessler

3. The Internet of Things
Image from cloudtimes.com

4. Common IoT Narrative
Image from navigantresearch.com
- analog things go online
- toasters, microwaves, cameras
- device to device interaction
- your alarm starts your coffee maker
- your car opens your garage
- a factory floor self-optimizes

5. Actual
IoT
IoT Narrative

7. Agriculture

8. Start the press

9. Industrial

10. Tubes

11. IoT

12. Personal Servers
Avatars by iconizeme.com

13. Personal Servers: Julie
Avatars by iconizeme.com
- single
- loves coffee
- favorite movie: sneakers
- went to Aldrin high school
- hates sand
- dog person
- afraid of owls
- wishes she was Arya
Everyone will be broadcasting a geo-based daemon

14. Personal Servers: Chris
Avatars by iconizeme.com
- single
- loves coffee
- favorite movie: chaos theory
- favorite band is Zao
- hates sponges
- cat person
- afraid of owls
- has broken 19 bones
Everyone will be broadcasting a geo-based daemon

15. Personal Servers: Interaction
- single
- loves coffee
- afraid of owls
The power comes from the continuous interaction between daemons

16. Personal Assistants
Avatars by iconizeme.com
Siri and Google Now will become integral to our lives
- managing calendar
- texting
- emailing
- finding you movies
- picking food for you
- filtering mates
- parsing daemons

17. Personal Assistants: Burden--
- single
- loves coffee
- afraid of owls
We won’t be managing those interactions—our PAs will

18. Personal Daemons + AssistantsConstant managed interactions between personal daemons

19. Businesses are people, tooBusinesses will have daemons as well, powerfully extending their functionality

20. Businesses + RDF = PowerBusinesses will have daemons as well, powerfully extending their functionality

21. Business Daemon AttributesThink of what a business would want to broadcast in their daemons

22. Business Daemon AttributesBusinesses will have daemons as well, powerfully extending their functionality
- Menu
- Item1
- Item2
- Safety
- Allergies
- Construction
- Hiring
- Openings
- Music
- Current
- Playlist
- Recommend
- Climate
- Raise
- Lower
- Condiments
- Request

23. Business Daemon InputsEach business will have different types of APIs that are useful for customers
- Menu
- Item1
- Item2
- Safety
- Allergies
- Construction
- Hiring
- Openings
- Music
- Current
- Playlist
- Recommend
- Climate
- Raise
- Lower
- Condiments
- Request

24. Business Daemon APIsNot just read-only
https://stores.bww.api/8941/api/climate

25. Rich Business API FunctionalityBusinesses will expose powerful functionality that our PAs can manage for us

26. Sync
1. Personal Daemons broadcast information about us

27. Sync
1. Personal Daemons broadcast information about us
2. Businesses will have daemons as well

28. Sync
1. Personal Daemons broadcast information about us
2. Businesses will have daemons as well
3. Our personal assistants will broker on our behalf

30. Sensors will be on everything…
- Video
- Audio
- Vibration
- Air Quality
- Air Pressure
- Radiation

31. - Architect
- Built
- Materials
- Certification
- /api/climate
- /api/doors
- /api/cameras
- /api/pool
- /api/cameras
- /api/windows
House

32. - Birthday
- Gender
- Ancestry
- Profession
- Books
- Movies
- Education
- /api/connect
Human

33. - Make
- Model
- VIN
- Features
- /api/climate
- /api/music
- /api/voice
- /api/video
- /api/cameras
- /api/sensors
Car

34. - Brand
- Model
- Version
- Features
- /api/battery
- /api/video
- /api/audio
- /api/sensors
Watch

35. - Type
- Age
- Planted By
- Birthday
- /api/status
- /api/water
- /api/camera
Tree

36. Baby Clothes
- Video
- Audio
- Vibration
- Air Quality
- Air Pressure
- Radiation

37. Furniture
- Video
- Audio
- Vibration
- Air Quality
- Air Pressure
- Radiation

38. Park Benches
- Video
- Audio
- Vibration
- Air Quality
- Air Pressure
- Radiation

39. - City
- Street
- Geo
- Hours
- /api/pay
- /api/tickets
- /api/camera
- /api/sensors
Parking Meter

40. - Brand
- Model
- Version
- BuildDay
- BulbStatus
- /api/light
- /api/audio
- /api/video
- /api/air
Lamp

41. Character Sheet
- Shoes
- Pants
- Watch
- Purse
- Total CPU cycles
- Total memory
- Brands
- Year
- Season
- Gucci
- Louboutin

42. - Owner
- Height
- Architect
- Materials
- /api/climate
- /api/video
- /api/audio
- /api/sensors
- /api/security
Building

43. Sensors + Daemon + API
- Video
- Audio
- Vibration
- Air Quality
- Air Pressure
- Radiation

45. Ubiquitous Customization

46. Ubiquitous CustomizationYour business experiences will be customized based on constant PA-to-daemon interaction
/api/purchase
/api/music /api/tv
/api/connect
/api/browse
/api/test

47. Also, much will be recorded
- Video
- Audio
- Vibration
- Air Quality
- Air Pressure
- Radiation

48. “Computer: Show me video of this location
between the hours of midnight and 4am.”
Official Investigations

49. Public access to events

50. TCP/IP vs. victimUniversal Daemonization

51. Universal Daemonization
Ubiquitous
Customization
Personal
AssistantsUniversal
Daemonization
- Everything is an object
- Everything has a daemon
- Everything has an API

52. Ok, now what?

53. Options

54. What’s the protocol?
- Security?
- Privacy?

55. ?
How do we handle auth?
- Owner
- Height
- Architect
- Materials
- /api/climate
- /api/video
- /api/audio
- /api/sensors
- /api/security
- Google?
- Facebook?
- Local/State/Federal/Global?

56. How do we maintain privacy?
- Killswitches?
- Do-not-monitor?
- Darkzones?

57. How do we disconnect?

58. What we're doing
-OWASP Internet of Things Top 10
https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project
-HP FoD Top 10 IoT Device Research Report
http://fortifyprotect.com/HP_IoT_Research_Study.pdf
-Offering IoT assessments using the IoT Top 10

59. What you can do
-Reach out and help on the IoT Top 10
daniel.miessler@owasp.org
- I am the Cavalry (https://www.iamthecavalry.org)

60. Wizard Wars
Wizard Wars
http://www.dilbert.com/blog/entry/wizard_wars/

62. daniel@hp.com