Your Thing is Pwned - Security Challenges for the IoT
•Download as PPTX, PDF•
5 likes•1,605 views
The Internet of Things and Machine to Machine are growing areas, and security and privacy are prime issues. In this session security challenges are examined around using M2M devices with protocols such as MQTT & CoAP - encryption, federated identity and authorisation models in particular. On the topic of encryption, we’ll examine securing MQTT with TLS, challenges with Arduino, and using hardware encryption for microcontrollers. A key privacy requirement for user-centric IoT use cases will be giving users control over how their things collect and share data. On the Internet, protocols like OAuth 2.0, OpenID Connect & User Managed Access have been defined to enable a privacy-respecting user consent & authorization model. We'll look at the issues with applying these protocols to the M2M world and review existing proposals & activity for extending the above M2M protocols to include federated identity concepts. The session included a live demonstration of Arduino and Eclipse Paho inter-operating secured by OAuth 2.0.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Your Thing is Pwned - Security Challenges for the IoT
Similar to Your Thing is Pwned - Security Challenges for the IoT (20)
More from WSO2
More from WSO2 (20)
Recently uploaded
Recently uploaded (6)
Your Thing is Pwned - Security Challenges for the IoT
- 1. Your Thing is pwnd Security Challenges for the Internet of Things Paul Fremantle CTO, WSO2 (paul@wso2.com) PhD researcher, Portsmouth University (paul.fremantle@port.ac.uk) @pzfreo #wso2 #iotconf @iotconf
- 2. Firstly, does it even matter?
- 5. My three rules for IoT security • 1. Don’t be stupid • 2. Be smart • 3. Think about what’s different
- 6. My three rules for IoT security • 1. Don’t be stupid – The basics of Internet security haven’t gone away • 2. Be smart – Use the best practice from the Internet • 3. Think about what’s different – What are the unique challenges of your device?
- 12. So what is different about IoT? • The longevity of the device – Updates are harder (or impossible) • The size of the device – Capabilities are limited – especially around crypto • The fact there is a device – Usually no UI for entering userids and passwords • The data – Often highly personal • The mindset – Appliance manufacturers don’t think like security experts – Embedded systems are often developed by grabbing existing chips, designs, etc
- 13. Physical Hacks A Practical Attack on the MIFARE Classic: http://www.cs.ru.nl/~flaviog/publications/Attack.MIFARE.pdf Karsten Nohl and Henryk Plotz. MIFARE, Little Security, Despite Obscurity
- 17. Or try this at home? http://freo.me/1g15BiG
- 19. Hardware recommendations • Don’t rely on obscurity
- 20. Hardware recommendations • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity
- 21. Hardware Recommendation #2 • Unlocking a single device should risk only that device’s data
- 22. The Network
- 23. Crypto on small devices • Practical Considerations and Implementation Experiences in Securing Smart Object Networks – http://tools.ietf.org/html/draft-aks-crypto-sensors-02
- 24. ROM requirements
- 25. ECC is possible (and about fast enough)
- 26. Crypto Borrowed from Chris Swan: http://www.slideshare.net/cpswan/security-protocols-in-constrained-environments/13
- 27. Won’t ARM just solve this problem?
- 28. Cost matters 8 bits $5 retail $1 or less to embed 32 bits $25 retail $?? to embed
- 29. Another option?
- 30. SIMON and SPECK https://www.schneier.com/blog/archives/2013/07/simon_and_speck.html
- 31. Datagram Transport Layer Security (DTLS) • UDP based equivalent to TLS • https://tools.ietf.org/html/rfc4347
- 32. Key distribution
- 33. How do you distribute keys to devices? • Usually at manufacture time • Complex to update • What about expiration?
- 35. Passwords • Passwords suck for humans • They suck even more for devices
- 38. MQTT
- 40. Why Federated Identity for IoT? • Can enable a meaningful consent mechanism for sharing of device data • Giving a device a token to use on API calls better than giving it a password – Revokable – Granular • May be relevant for both – Device to cloud – Cloud to app
- 42. Device to Cloud • Put an OAuth2 token on the device • Set the “scope” to be limited – This device can publish to this topic • Support refresh model
- 44. Quick Demo • Apologies…. This is not a “slick” demo!
- 46. Cloud to App • The same technology can be used to enable some app to subscribe to a specific topic • Much easier than with Arduino!
- 47. Lessons learnt • OAuth2 Token lengths are usually ok (no promise though) – OpenId Connect much larger • Registration is hard • MQTT and MPU / I2C code is 97% of Duemilanove – Adding the final logic to do OAuth2 flow pushed it to 99% – No TLS in this demo is a big issue • Different OAuth2 implementations behave differently – Need to disable updating the refresh token with every refresh • Need to be able to update the scope of token if this will work for long term embedded devices • MQTT needs some better designed patterns for RPC – Standardised
- 48. More information http://pzf.fremantle.org/2013/11/using-oauth- 20-with-mqtt.html http://siot-workshop.org/
- 49. OpenId Connect
- 51. Are you creating the next privacy breach?
- 53. Summary • Think about security with your next device • We as a community need to make sure that the next generation of IoT devices are secure • We need to create exemplars – Shields – Libraries – Server software – Standards
- 54. WSO2 Reference Architecture for the Internet of Things http://freo.me/iotra
Editor's Notes
- “Lots of people are emailing me and joking about what they’d do if they hacked the device,” said Way. “We believe this device is not hackable. But even if somebody managed to get in, the worst consequence would be lots of women having orgasms in unusual places.”