Internet of Things (IoT) devices are being used by bot net builders to target high profile applications with Distributed Denial of Service (DDoS) attacks. There are some very basic steps an IoT developer can take to ensure their devices are not suspect to takeover from a malicious intruder. Learn what those steps are and help battle the bot net builders.

1. @adam_englander
IoT Lock Down
Battling the Bot Net Builders
Adam Englander, iovation

2. @adam_englander
What happened on
October 21, 2016?

3. @adam_englander

4. @adam_englander
Dyn DNS DDOS Attack
• Up to 380,000 IoT devices
• Generating up to 1.2 terabits per second of DNS
request data
• Producing 50x normal traffic after mitigation
• One month after similar Krebs on Security attack

5. @adam_englander
It is our job to prevent this from
ever happening again.

6. @adam_englander
IoT Benefits of Embedded Linux
• Making IoT
development and
manufacturing more
accessible
• Enables rapid
prototyping and
reduces time to market

7. @adam_englander
Security Benefits of Embedded Linux
• Linux provides
facilities for fantastic
security
• Numerous resources
exist for implementing
super secure Linux

8. @adam_englander
Remember Two Things
1. You will be attacked
2. You will be exposed
to a Zero Day
vulnerability

9. @adam_englander
Know Your Adversary
• Lone Gunmen
• Local Criminals
• Hactivist Groups
• Competitors
• Organized Crime
• Nation States

10. @adam_englander
Security is like an
Ogre. It has layers.

11. @adam_englander
Layered Security
Defense in Depth

12. @adam_englander
Network
Application
Services
File System
OS

13. @adam_englander
Operating System Security
• Patching strategy
• Minimal distribution
• Randomize default
usernames and
passwords
• Require strong
passwords via PAM
Network
Application
Services
File System
OS

14. @adam_englander
File System Security
• Named application user
• Remove “everyone”
access where possible
• Restrict application user
to files necessary to run
• Avoid write access
where possible
Network
Application
Services
File System
OS

15. @adam_englander
Service Security
• Reduce local service
dependencies
• Remove all non-essential
services (SSH, FTP, SMTP,
etc)
• Require authentication
• Be as secure as possible
with service data
Network
Application
Services
File System
OS

16. @adam_englander
Network Layer Security
• Outbound connections
only
• Restrict inbound and
outbound IP traffic
• Prefer paired Bluetooth
• Pair Bluetooth with
challenge-response
Network
Application
Services
File System
OS

17. @adam_englander
Application Security
• Know what you are
preventing
• Do as much as is
reasonable
• Patching/update
strategy
Network
Application
Services
File System
OS

18. @adam_englander
What you are preventing
Sensitive
Data
Exposure
Escalation
of
Privilege
Account
Hijacking
Denial of
Service
Remote
Code
Execution

19. @adam_englander
Sensitive Data Exposure
• Protect data in transit
via encryption and
available network
protocol options
• Protect data at rest
with encryption

20. @adam_englander
Certificate Verification via Fingerprint
• Also called certificate
pinning
• Prevents man in the
middle attacks over
TLS/SSL

21. @adam_englander
Encrypting Data
• Encrypt data you do
not want to give to
attackers
• Use the strongest
encryption that is
feasible

22. @adam_englander
Digital Signatures
• Send signature with
data in transit
• Store signature on the
file system for data in
the file system.

23. @adam_englander
Account Hijacking
• Secure application with
passwords using strong
hashing: Argon2i, scrypt,
bcrypt, or PBKDF2
• Secure initial setup via
hardware or force wipe
• Alert for changes to
accounts

24. @adam_englander
Nonces
• Single use token
• Used for CSRF tokens
• Must be
cryptographically
random
• Should expire

25. @adam_englander
Replay/Denial of Service
• Identify bad actors
either by tracking
utilization or with a
Honey Pot
• Mitigate by not
responding to the
request or with minimal
processing

26. @adam_englander
Remote Code Execution
• Do not execute
unverified code ever
ever ever!
• Database specific
mitigation to prevent
SQL injection

27. @adam_englander
Tools
Don’t try to do all of this yourself

28. @adam_englander
Internet Engineering Task Force
• Javascript Object
Signing and
Embedding (JOSE)
• CBOR Object Signing
and Embedding
(COSE)

29. @adam_englander
Open Web Application Security Project
• Testing guides
• Attack surface areas
• Top 10 security
vulnerability studies
• https://www.owasp.org

30. @adam_englander
Bug Bounty
• Pay ETHICAL hackers to test the
security of your devices and systems
• Attract experts in the field for a little
money and recognition
• Can be managed internally or
externally

31. @adam_englander
Me Things
• @adam_englander
• adam.englander@iovation.com
• https://www.iovation.com/blog/author/aenglander