IoT Security – Executing an Effective Security Testing Process

•Download as PPT, PDF•

1 like•2,178 views

Deral Heiland CISSP, serves as a the Research Lead (IoT) for Rapid7. Deral has over 20 years of experience in the Information Technology field, and has held multiple positions including: Senior Network Analyst, Network Administrator, Database Manager, Financial Systems Manager and Senior Information Security Analyst. Over the last 10+ years Deral’s career has focused on security research, security assessments, penetration testing, and consulting for corporations and government agencies. Deral also has conducted security research on a numerous technical subjects, releasing white papers, security advisories, and has presented the information at numerous national and international security conferences including Blackhat, Defcon, Shmoocon, DerbyCon, RSAC, Hack In Paris. Deral has been interviewed by and quoted by several media outlets and publications including ABC World News Tonight, BBC, Consumer Reports, MIT Technical Review, SC Magazine, Threat Post and The Register.

IoT Security – Executing an Effective
Security Testing Process

Introduction
Deral Heiland – IoT Research Lead Rapid7
•25+ years IT
•15 years security
•8+ years security consultant pentesters
www.hackerhalted.com

IoT Ecosystem
IoT Testing Methodologies
IoT Research & Results
Questions
Agenda

Embedded Hardware
Mobile & Control Applications
Cloud APIs & Web Services
Network Communication
Data
IoT Ecosystem

Help Identify exposure footprint
Threat modeling for risk
Determine Impact across ecosystem
Conducting security testing
Ecosystem Approach

Functional Evaluation
Device Reconnaissance
Cloud & Web APIs
Mobile & Control Applications
Network
Physical Embedded hardware Inspection
Physical Device Attacks
Radio (RF)
Testing Methodology Structure

Standard deployment
Two environments
Map out
Features
Functions
Components
Communication paths
Functional Evaluation

Welcome to my real world lab
Use the product to its full capacity
Functional Evaluation

Component versions
Software versions
Vulnerability history
Open source data
White labeled product history
User Manuals
Component data/spec sheets
FCC Data
Device Reconnaissance

Eview Panic Button Reconnaissance
User manual very revealing

Encryption (storage and transfer)
Authentication
Access rights
Communication protocols
SSL pinning
Mobile & Control Applications

Mobile Application
Wink Hub 2 Unencrypted Storage of Credentials

Insteon Smart Hub
Unencrypted Storage of Credentials

Encryption (storage and transfer)
Authentication and session management
Common web vulnerabilities
XSS
CSRF
Injection attacks ( SQLi etc..)
Business logic attacks
Cloud & Web APIs

Cloud API’s
Wink Hub 2 Failure to Revoke Oauth Token

Exposed services
Authentication
Access rights
Encryption
Intra product “ecosystem” communication
Network

Network
Device Local Mode Security
Loss of internet access
Lack of authentication
Lack of encryption

Osram Lightify
Over The Air (OTA) Firmware Captures with Wireshark

Chips
CPU
Memory
Communication
Physical ports
Ethernet
USB
Serial
Circuitry connection
UART
JTAG
SPI
Physical Embedded hardware Inspection

JTAG/SWD
UART
SPI
Memory extraction
Firmware
configurations
Physical Device Attacks

Gathering RF Configuration Data
from Inter Chip Communication

1100101010000001
1100110001100111
1000000000111110
1010011111011000
1100010001110111
1100001001101100
1001011010000000
1001100001000100
1000001000011000
1100000011100000
Gathering RF Configuration Data
from Inter Chip Communication

Firmware Extraction
embedded Multi-Media Controller (eMMC)

Encryption
Pairing
Access control
Command and control
Replay attacks.
Radio (RF)

RF Analysis
Insteon Vulnerable to Replay Attacks

Circle back around for more Insteon RF recon
•Peter Shipley
•Defcon23 (False Security and Deceptive Documentation)
•https://github.com/evilpete/insteonrf
Appears this issues have never been correctly, specially the
unencrypted communication – even on their own products
Insteon RF Analysis Reconnaissance

Reduced issues
Reduced risk
Better products
Deeper understanding
Conclusion

Questions
Deral Heiland - Research Lead (IoT)
deral_heiland@rapid7
@percent_x
http://www.rapid7.com

This document provides an introduction to IoT security. It discusses key components of IoT including sensors, actuators, microcontrollers, communication capabilities, and identification. The document outlines the ITU-T IoT reference model and describes security challenges at different levels including devices, fog networks, core networks, and data centers. It also discusses common IoT security issues such as unpredictable behavior, device similarity, problematic deployments, lack of upgrades, and lack of transparency. Finally, the document summarizes common IoT security tools including encryption, passwords, hardware security modules, two-factor authentication, and public key infrastructure certificates.

wireless communication security PPT, presentation

Nitesh Dubey

IoT security (Internet of Things)

Sanjay Kumar (Seeking options outside India)

SSL & TLS Architecture short

Avirot Mitamura

Security in the Internet of Things

ForgeRock

Fundamentals of IoT Security

SHAAMILIVARSAGV

The document discusses fundamentals of IoT security. It defines IoT as the interconnection of physical devices to the internet to share and exchange data. IoT security protects connected devices from cyberattacks by securing the network functionality and data privacy. The need for IoT security increased after hacking attacks showed catastrophic consequences. The document outlines eight principles of IoT security including no universal passwords, secured interfaces, proven cryptography, security by default, signed software updates, and a vulnerability reporting scheme.

Ethical hacking

Naveen Sihag

Ethical hacking involves performing penetration testing to locate security weaknesses and implement countermeasures in order to secure IT systems. There are three main types of hackers: white hat hackers who perform ethical hacking, black hat hackers who hack illegally for malicious purposes, and grey hat hackers who sometimes act legally and sometimes not. The steps a hacker may perform include reconnaissance, scanning, gaining access, maintaining access, and covering their tracks. IP addresses are classified into ranges and tracing IP addresses can help identify locations. Security measures like confidentiality, integrity, availability, and proper access controls can help protect against hacking threats.

This document provides an overview of security and hacking. It defines security as protection from harm and defines differences between security and protection. It then discusses what hacking and hackers are, provides a brief history of hacking from the 1960s to present day, and describes different types of hackers like white hat and black hat hackers. The document also outlines the hacking process and some common tools used. It lists some famous hackers and recent news stories about hacking.

Ethical hacking

Institute of Information Security (IIS)

Ethical hacking also known as penetration testing or white-hat hacking, involves the same tools, tricks, and techniques that hackers use, but with one major difference that Ethical hacking is legal. Ethical hacking is performed with the target’s permission. The intent of ethical hacking is to discover vulnerabilities from a hacker’s viewpoint so systems can be better secured. It’s part of an overall information risk management program that allows for ongoing security improvements. Ethical hacking can also ensure that vendors’ claims about the security of their products are legitimate.

Network Security

Manoj Singh

Network security is important to protect vital information while allowing authorized access. Key aspects of network security include identifying vulnerabilities, threats like hackers and methods of attack, and implementing appropriate countermeasures. Common attacks include password attacks, viruses, and packet sniffing. Effective countermeasures include firewalls to control access, intrusion detection systems to monitor for exploits, IPsec and encryption to secure communications, and user education to address social engineering vulnerabilities. Comprehensive security requires backups, encryption, virus protection, firewalls, monitoring, training, and testing defenses.

Inetsecurity.in Ethical Hacking presentation

Joshua Prince

This document provides an overview of hacking and ethical hacking. It discusses different types of hackers like white hat, black hat and gray hat hackers. It explains why people hack and the hackers' language. The document describes the process of ethical hacking which includes preparation, footprinting, vulnerability identification, attacks, gaining access and escalating privileges. It discusses what hackers do after hacking like patching vulnerabilities, hiding themselves and installing backdoors. The document provides tips on system protection and recovery steps to take after being hacked. It identifies web vulnerabilities as prone to hacking attacks. In conclusion, it provides contact information for campus workshops on additional hacking topics.

Ethical hacking

Goutham Shetty

Ethical hacking involves legally hacking into computer systems and networks to identify security vulnerabilities for clients, with their permission. It is part of an overall security program. Ethical hackers have strong programming and networking skills. There are three types of hackers - white hat hackers who use skills for defense, black hat hackers who engage in malicious activities, and grey hat hackers who work both offensively and defensively. Ethical hacking is important for security testing and system hardening to improve security and prevent breaches. However, there is a risk that ethical hackers could misuse knowledge or sensitive information.

Cybersecurity Basics - Aravindr.com

Aravind R

Network security

Nandini Raj

Network security involves securing computer networks from threats and attacks. There are four main types of attacks: interruption, interception, modification, and fabrication. An attack generally involves initial information gathering, network probing, unauthorized access, capturing the network, and grabbing or destroying data. Intrusion detection systems monitor network activity for signs of intrusion and report alerts. There are two main types of IDS: knowledge-based which uses signatures, and behavior-based which monitors for anomalies. Virtual private networks provide a secure channel over untrusted networks using protocols like SSL and IPSec to authenticate users and encrypt data.

Fundamentals of Network security

APNIC

cyber security presentation.pptx

kishore golla

Port of Visakhapatnam is known as the "Eastern Gateway of India". The document discusses cyber security awareness and defines key terms like computer, cyber security, data, electronic form, electronic record, digital signature, and intermediary. It explains why cyber security is important, defines privacy and security in the context of information, and outlines common cyber attacks like denial of service attacks, DNS attacks, router attacks, sniffers, firewalls, and vulnerability scanners. The document also discusses network-based attacks, web attacks like phishing and pharming, email attacks, social network attacks, and types of malware like spam, cookies, adware, and spyware.

IOT Security

Sylvain Martinez

Overview of the Cyber Kill Chain [TM]

David Sweigert

William F. Crowe presented on the cybersecurity kill chain, which models the stages of a cyber attack based on military doctrine. The model developed by Lockheed Martin includes stages of reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. ISACA and the European Union Agency for Network and Information Security also use similar kill chain models to analyze the process of advanced persistent threats targeting critical systems and data.

Internet of Things (IoT) Security and Privacy Recommendations by Jason Living...

CableLabs

As IoT insecurity creates vulnerabilities, policymakers become concerned about the health of the Internet. How can public policy address these concerns in a smart way, targeting their efforts to improve IoT security without imposing unnecessary costs across the Internet ecosystem or creating unintended effects? What is the role of government versus industry? Jason Livingood Vice President, Technology Policy & Standards, Comcast https://www.cablelabs.com/informed/

Topics in network security

Nasir Bhutta

This document discusses various topics related to network security including Secure Socket Layer/Transport Layer Security (SSL/TLS), Virtual Private Network (VPN), firewall, malware analysis, penetration testing, and digital forensics. SSL/TLS provides security at the transport and session layers. A VPN extends private networks across public networks like the internet. Firewalls control incoming and outgoing network traffic based on rules. Malware analysis involves reverse engineering malware to understand its capabilities and behavior. Penetration testing involves authorized hacking to test security. Digital forensics applies scientific principles to the collection, examination, and analysis of digital evidence.

IoT Security

Peter Waher

Cyber kill chain

Ankita Ganguly

The cyber kill chain describes cyber attacks from an attacker's perspective through distinct phases: (1) reconnaissance, (2) weaponization, (3) delivery, (4) exploitation, (5) installation, (6) command and control, and (7) actions on objectives. Each phase of the kill chain can be mapped to defensive tools and actions to prevent attacks. Understanding the kill chain stages gives analysts insight into what is being attempted and how to respond appropriately. The kill chain was developed by Lockheed Martin as a method to describe intrusions and prevent advanced persistent threats by highly trained adversaries targeting sensitive information.

CyberSecurity

divyanshigarg4

Cybersecurity involves protecting computers, networks, programs, and data from digital attacks. It includes topics like hacking, denial of service attacks, cyber terrorism, and software piracy. Some key aspects of cybersecurity are using antivirus software, anti-spyware, firewalls, secure passwords, and maintaining regular backups to protect private information and systems from viruses, malware, and unauthorized access. Understanding different types of hackers like white hat, grey hat, and black hat is also important for cybersecurity.

Iot Security

MAITREYA MISRA

The document discusses Internet of Things (IoT) security challenges and countermeasures. It begins with basics of IoT and sensors, then discusses how IoT connects to the internet. It outlines several approaches to securing IoT, including restricted access, encryption of network and data, managing default APIs, addressing human elements of security, and learning from past exploits. Specific threats like denial of service attacks, man-in-the-middle attacks, and brute force/dictionary attacks are examined. The document concludes that IoT security design must enable open yet secure infrastructure while respecting user privacy through individual policies.

IoT security-arrow-roadshow #iotconfua

Andy Shutka

This document discusses security issues related to the Internet of Things (IoT). It notes that as the number of connected devices grows, so too will cyber attacks targeting IoT devices, as they often contain personal information and have existing vulnerabilities. Common IoT security threats mentioned include denial of service attacks, malware, data breaches, and weakening of security perimeters. The document advocates addressing IoT security across all levels from devices to cloud infrastructure. It presents Intel's IoT security portfolio as providing comprehensive protection from physical attacks and cyber threats, including features like secure boot, whitelisting, encryption, and centralized management of devices and data.

Removing Security Roadblocks to IoT Deployment Success

Microsoft Tech Community

1) The document discusses securing IoT devices and infrastructure through X.509 certificate-based identity and attestation, TLS-based encryption, and secure provisioning and management. 2) It describes securing the cloud infrastructure with Azure Security Center, Azure Active Directory, Key Vault, and policy-based access controls. 3) The document promotes building security into devices and infrastructure from the start through standards-based and custom secure hardware modules.

What's hot

Overview of IoT and Security issues

Anastasios Economides

What is Penetration Testing?

btpsec

Security in IoT

gr9293

Ethical hacking presentation

Suryansh Srivastava

Ethical hacking

Institute of Information Security (IIS)

Network Security

Manoj Singh

Inetsecurity.in Ethical Hacking presentation

Joshua Prince

Ethical hacking

Goutham Shetty

Cybersecurity Basics - Aravindr.com

Aravind R

Network security

Nandini Raj

Fundamentals of Network security

APNIC

cyber security presentation.pptx

kishore golla

IOT Security

Sylvain Martinez

Overview of the Cyber Kill Chain [TM]

David Sweigert

Internet of Things (IoT) Security and Privacy Recommendations by Jason Living...

CableLabs

Topics in network security

IoT Security

Cyber kill chain

CyberSecurity

Iot Security

What's hot (20)

Overview of IoT and Security issues

What is Penetration Testing?

Security in IoT

Ethical hacking presentation

Ethical hacking

Network Security

Inetsecurity.in Ethical Hacking presentation

Ethical hacking

Cybersecurity Basics - Aravindr.com

Network security

Fundamentals of Network security

cyber security presentation.pptx

IOT Security

Overview of the Cyber Kill Chain [TM]

Internet of Things (IoT) Security and Privacy Recommendations by Jason Living...

Topics in network security

IoT Security

Cyber kill chain

CyberSecurity

Iot Security

Similar to IoT Security – Executing an Effective Security Testing Process

IoT security-arrow-roadshow #iotconfua

Andy Shutka

Removing Security Roadblocks to IoT Deployment Success

Microsoft Tech Community

The 300 Leonidas Solution

matthew.maisel

Mobile Devices & BYOD Security – Deployment & Best Practices

Cisco Canada

Endpoint Security for Mobile Devices

David Shepherd

IoT summit - Building flexible & secure IoT solutions

Eric Larcheveque

1) Building secure IoT solutions requires establishing trust between the physical world and blockchain through a trusted layer. 2) There are security challenges in developing, deploying, and upgrading IoT devices including provisioning secrets, verifying device authenticity, and protecting against software exploits and physical attacks. 3) Ledger's BOLOS architecture builds security into hardware oracles and secure elements like their ST31G480 chip to provide a stateless and tamper-evident solution for IoT security.

IoT-Device-Security-DRAFT-slide-presentation

AuliaArifWardana

Towards a Holistic Framework for Secure, Privacy-aware, and Trustworthy Inter...

Mahmud Hossain

Practical Security Assessments of IoT Devices and Systems

Ollie Whitehouse

This talk briefly discusses strategies and methodologies than can be employed when assessing IoT devices. We look at how to develop credible threat scenarios for different IoT device and systems, perform static and dynamic attack surface mapping, perform static firmware analysis, perform static hardware analysis, undertake a dynamic device security analysis, sources of supporting information, supporting capability requirements and establishment, Execution of dynamic device analysis and approaches around network protocol analysis.

BooT-IoT: A Privacy-Aware Authentication Scheme for Secure Bootstrapping of I...

Mahmud Hossain

The document presents Boot-IoT, a privacy-aware authentication scheme for secure bootstrapping of IoT nodes. Boot-IoT uses combined public key cryptography to enable secure network admission and authentication based on elliptic curve cryptography. It also provides a lightweight certificateless mutual authentication scheme for secure access to services. Experimental results show that Boot-IoT has lower communication and computation costs compared to other authentication methods like EAP, making it more efficient for resource-constrained IoT devices.

IoT Device Hacking and New Direction of IoT Security Evaluation Using Common ...

Seungjoo Kim

It’s All In The Name - Deral Heiland

IoT Security – Executing an Effective Security Testing Process

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to IoT Security – Executing an Effective Security Testing Process

Similar to IoT Security – Executing an Effective Security Testing Process (20)

More from EC-Council

More from EC-Council (20)

Recently uploaded

Recently uploaded (20)

IoT Security – Executing an Effective Security Testing Process

Editor's Notes