security and IoT

copyright ©2016,2019 arden henderson

for the want of a (digital) nail

Loosely paraphrasing the famous centuries-old proverb [1]nail,
a timely update herein:

For want of security-by-design, IoT security was lost;
For want of IoT security, IoT control was lost;
For want of IoT control, the internet was lost;
For want of the internet, infrastructure was lost;
For want of infrastructure, the nation was lost;
And all for the want of security-by-design.

a not so hypothetical bad day for the internet

Imagine, if one might, this scenario, one from the worst-case scenarios. First, there is the critical mass. And the point of diminishing returns. On some bright, clear day in the near future, critical mass has been reached over multiple botnets comprised of corrupted things on the internet. Many of the IoT botnets are running their own show, executing their missions of capturing and herding IoT. Other IoT botnets are under state control, for state agendas. The IoT botnets are a bubbling sulfur-and-brimstone stew of IP cameras, smartphones, and thousands of other internet-connected devices no one ever imagined would be compromised.

There are the routine IoT botnet-launched Distributed Denial of Service (DDoS) attacks, cutting off social media and news sites. As events unfold, people rush to their usual news sources for more information only to find silence. Then, control of multiple compromised motoring IoT devices, formerly known as automobiles, is wrested from hapless drivers as they speed down the freeways, by-ways, across bridges and through the woods to grandmother’s house. Off in the distance, dark plumes of smoke begin to rise as smart appliances are instructed to self-destruct.

Events cascade. The world that depends on the internet grinds to a slow, miserable stumble. People are hurt. Bank accounts are emptied. Chaos.

“Dogs and cats living together, mass hysteria!”
Dr. Peter Venkmann, Ghostbusters (1984)

Okay, so what is the Internet of Things (IoT) anyway? [2]iot And what is DDoS? [3]ddosdef And why is the IoT vulnerable to exploits? Let’s take a quick dive, deep enough, in the next sections.

IoT isn’t just a fitness band

In the news today is the Internet of Things [4]mouser, everything from refrigerators to fitness bands to TVs to IP cameras connected to the internet. But the IoT is more than just consumer goods. IoT includes devices controlling industry. Like things controlling nuclear plants. [5]nuclear

Or things wrecking Iranian nuclear centrifuge equipment, even in the air-gapped Natanz refining facility. But worms and viruses and such can be wily forces, migrating to other things, escaping into the wild to invoke unexpected, unintended havoc. [6]iran

Modern automobiles are also now internet-connected things. Masayoshi Son, CEO and Chairman of the Board, SoftBank Group, commented in his keynote for ARM TechCon 2016 that no car today has encrypted chips or communication. He also notes that IoT has become the center of the internet and in the next two years, the number of IoT devices will cross over mobile. [7]masa

Charlie Miller notes in his keynote for ARM TechCon 2016 that it was a gradual process, as computers were deployed in vehicles and then connected to the internet, implemented with no security in mind, compounded by apparent disinterest of automotive manufacturers, which in some cases, believed car hacking somehow was mitigated with electromagnetic shielding. [8]miller Charlie Miller and Chris Valasek proved a Jeep could be hacked from anywhere via the internet, establishing control, such as applying or disabling brakes. [9]miller2

Aside from someone, or some state, taking over one’s car, there are the Distributed Denial of Service (DDoS) attacks that occur all the time, at all hours. The really big DDoS attack [10]ddos – and they are getting bigger – are the ones that make the news, primarily because thousands of users suddenly realize they can’t access their favorite social media site and want to know why. [11]dark All of the vulnerable things [12]fodder on the internet, for example, IP cameras [13]cameras, can be herded into botnets [14]botnet to launch massive DDoS attacks against websites, infrastructure – essentially rendering multiple services on the internet inaccessible.

Even if not exploited (yet), IP cameras with peer-to-peer (P2P) capability (meaning cameras that are present on the internet with an IP address) are quietly “phoning home” and seeking peers [15]peerseeking. Manufacturers create devices like this on-purpose, as a “feature,” their devices connecting back to, say, China, and hunting for their peers to create a huge network. Furthermore, since the cameras can be seen, and controlled, from afar, one might end up seeing themselves on their own camera, along with everyone else. It’s this unadvertised, built-in behavior that is slowly creating a prudent fear of IoT. [16]fear

It’s not just cameras phoning home and joining peer networks. Something trivial as a smart plug that allows the user to switch power on and off to appliances through their cellphone will do the same thing. [17]smartplug Basically, if a device is connected to the internet, it can, and more often than not does, connect back to the manufacture, sending data and also connect to other devices like itself. And that’s when it’s not exploited and pressed into a botnet; the phoning home is by design.

One group of internet things pressed into botnet servitude are Android cellphones. [18]android Users install malware-drenched Androids apps and, as if by magic, their phone is suddenly exploited and herded into a Android botnet. Android botnets are useful for DDoS attacks [19]headless, with sheer numbers overshadowing the huge October and November 2016 Mirai [20]mirai DDoS attacks. [21]miraidwarfed

The list of things connected to the internet is growing every day by leaps and bounds. While we usually think of the aforementioned consumer devices as IoT, infrastructure devices also are connected to the internet, often with no security whatsoever. For example, smart meters. [22]meters It has been shown that smart meters can be easily exploited to shut off power or steal electricity. [23]meterhacking Unlike customer choice of IoT consumer products, smart meters are usually not an elective.

And then there are the appliance routers/firewalls. Routers have been found with a back door port straight into the device, unprotected by even the most trivial of methods, such as no password required. [24]routerbackdoors Apparently, some router manufacturers leave these back doors either for “maintenance” or as a forgotten development debugging path. Router DNS settings can be compromised, short-circuiting domain name requests resulting in bogus IP address replies to divert traffic. [25]routerdns (Safety Tip: One should build their own gateway to the internet, for business or home.)

home invasion

But it gets worse. Much worse. IoT in the home means potential invasion of the home. Smart TVs can watch people watching TV. [26]smarttv

Internet-connected baby monitors infamously lacking of security, allow the monitor camera and microphone to be used for listening and watching from afar, even allowing the watcher to speak through the speaker. [27]babymonitors

Internet-connected toys interact and literally listen to children (without consent), recording conversations between child and toy, sending the data to far away places, including a defense contractor in one case. [28]defensecontractor Consumer groups are raising the alarms about listening-eavesdropping internet-connected toys. [29]toys Even the venerable Barbie, now connected and listening, has achieved one group’s Worst Toy award. [30]worsttoy

the unicorn has already left the barn

Notably, it’s notoriously difficult to fix security failures in shipped IoT devices in the wild. The failure could be because of a bug or because security just wasn’t really thought-out and implemented properly in the first place. The latter is usually not fixable. The former requires a patch but getting the patch into the device is the rub.

It’s difficult to get the word out. Even if the IoT device is an automobile, informing the customer is problematic and creating a fix that can be easily installed by customer base with a wide-ranging technical expertise presents a wide array of logistical and practical problems. (Tesla is an exception to this with software upgrades automatically downloaded to vehicles. [31]tesla) Therefore, once shipped and in use, many IoT devices will forever be vulnerable until unplugged and discarded, either because the security holes are baked-in or the customer never finds out the device is vulnerable.

Add to the mix that the bad guys are always cooking up new ways to exploit any given number of IoT devices. If careful, deliberate security was not part of the design from the beginning, the manufacturer will always be running one or two patches behind – presuming the IoT device can be patched in the first place. Or, if fixable, will receive the patch in time.

real people can get hurt

It’s not about just the inconvenience of social media crashing, unable to post kitten photos on Facebook or tweet what one had for breakfast. There are risks of identity theft, bank account vacuuming, physical danger from lost of control of an automobile or losing electrical power or natural gas during a blizzard, and house fires can set by smart outlet control.

As things on the internet send data to vast big data warehouses, and things are hacked so that portions of people’s personal data can be collected, risk multiples of assembling enough metadata [#metadata] along with publicly available social media information to fill in the gaps, creating a full profile, more or less.

And listening or watching or speaking the inside homes or businesses without the knowledge of the occupants is a quantum leap of risk in addition to producing stress, anxiety, and fear.

how do we stay secure in a connected world?

It’s important to be aware of the many ways insecurity is introduced in the connected world, and in particular with IoT. Let’s hit a few highlights.

The most trivial and least expensive way to exploit machines is simply phish the user. Phishing is a simply creating an authentic-looking HTML-based email and relying on naive users clicking links. Or, with some exploited email client bugs, just opening the email. (Chilling Note: Many emailers open email automatically in the preview.)

Phishing [32]phishdef still is the main attack vector for reaping easily-harvested usernames and passwords, a cascading effect since many use the same password for multiple accounts. It’s how the DNC email was vacuumed up via John Podesta’s Gmail account, a simple phishing attack with malicious links lurking under authentic-appearing HTML. [33]phish (Safety Tip: Don’t do HTML-based email. Not even once. Plain text is the path to happiness.) It could have been worse – now phishers are going after chicken. [34]chicken

Aside from gaining passwords, phishing can also “automagically” install malware on the user’s machine with the click of the link or the simple viewing of the email. Phishing is both extraordinarily low-tech but stunningly successful.

Enter the Internet of Things which don’t receive email. They are just machines. No fooling them with HTML-based email. But, it turns out, manufacturers have a long, checkered history of leaving them wide-open with development debugging backdoors, default usernames and passwords, and vulnerable hardware lacking security-by-design.

Additionally, there is the potential of corrupted software tools used to build the software, the horrifying notion that the very compiler or other tools used to create the software has been compromised and now is cheerfully installing malware in the product. Or itself, corrupted tools building more corrupted tools. Source code can be reviewed and lurking danger discovered. Not so much with binary code, which is the nefarious advantage of such an exploit. This is known as the “trusting trust” attack and has been the stuff of developer nightmares – and PhD dissertations – for some time now. [35]trustingtrust Obviously, to ensure clean tools building product, all sorts of best practices and due diligence must be put into play, often the very things discarded in the rationalized, frantic, top-pressure, pell-mell race to market.

Securing the silicon, as the phrase goes, is becoming the next trendy thing in cybersecurity. It’s dawning on IoT manufacturers, of everything from toasters to automobiles, that IoT should be made secure [36]industrysec, and security should start at the deepest level. Attacks are moving down the hardware stack [37]hardwaresec and security should start with the silicon. [38]siliconsec

And yet, any IoT security strategy might seem willy-nilly with the lack of any standards. [39]where In December, 2016, Commission on Enhancing National Cybersecurity published its “Report on Securing and Growing the Digital Economy.” Report on improving cybersecurity specifically mentions, among other useful topics, default username/passwords in Action Item 2.1.4:

Initial best practices should include requirements to mandate that IoT devices be rendered unusable until users first change default usernames and passwords.

That this report exists and says such things is good news. Take the long view. It’s been a long time coming. Default user names and default passwords have been an enduring problem, a red flag consistently brought up again and again over the years, as for example, the 2007 SANS Technology Institute “The Risk of Default Passwords” article. [40]passwords It’s a good sign that such notions are entering the main dialogue, surfacing in government reports and re-surfacing in the tech media. Since many people struggle with usernames and passwords in their own computing adventures, the concept that IoT has the same sticky wicket, and can be brought down the same way, is easily grasped by the public.

So, security starts with awareness. Awareness on part of the developer, who begins to start every idea with security in mind. Soon, design is driven from both the top-down and the bottom-up by security.

Awareness starts with the consumer as well. The more awareness of IoT, the more awareness of dangers of no security-by-design, the better. An informed public will not support IoT with flimsy security (or no security at all) with their hard-earned dollars. In fact, as awareness grows, the informed, IoT-savvy consumer will be able to ask the hard questions before hopping into some swoopy internet-connected automobile or purchasing a cool, “smart” refrigerator. Or snapping up a huge “smart” TV on Black Friday, and therefore make good IoT purchasing choices. Okay, well, it’s something to work toward, anyway. And, the point is, the trends indicate the right path to awareness.

We’ll touch on some specific common-sense prudent ways to move from awareness to action later on, for developer and consumer. Before that, let’s visit securing the silicon.

secure silicon with what?

Securing IoT devices starts with the hardware.

First, securing the boot is important. Secure boot is also called “a root of trust.” [41]secureboot It’s where everything begins. Boot code should be in ROM. The microprocessor should be able to boot from this internal, immutable memory without loading it elsewhere. If the boot code must be loaded into RAM first, for example, already the device is essentially open to low-level attack vectors. Imagine a tiny MITM (Man-In-The-Middle) bit of code that can be squirreled away somewhere else, intercepting the boot code as it transferred to RAM.

Signing code is important as well. The binary executable code for the secure boot and application code – any code that runs on the device – should be signed. Public key cryptology is an essential level of security. [42]publickey

Boot, load, and verify from a trusted point is the first line of defense against exploitation and corruption. [43]edgenodes. To that end, chip manufacturers are bringing the power of encryption and security-by-design to market at the chip level, moving IoT device development to a stage where security is built-in, such as the Atmel Certified-ID security platform [44]atmel, Synopsys DesignWare ARC SEM Security Processors [45]arc, and Maxim’s DeepCover[46]maxim embedded security solutions.

lack of IoT security seems endless. what to do?

What, then, is lack of IoT security? It’s leaving permanent development debugging backdoors in devices. It is manufacturing thousands of IoT devices with the same default password. It is building in “features” like phoning home and peer-to-peer hunt-and-connect. It is interacting with children, recording conversations, and sending that data back to unknown vast data warehouses.

By now, readers of this article may be thinking of taking a sledgehammer to all of their new, bright and shiny IoT devices they just brought home. Or received as a gift. (Environmental Tip: Take all shattered IoT device pieces to the friendly, neighborhood electronics recycler.) Some might mull over going off the grid, disconnecting from all things electric and electronic. That would be one way to avoid IoT shenanigans and skulduggery. Let’s touch on what users (consumers) of IoT can do and what IoT developers should do.

IoT customers

Such extremes can be avoided; IoT security risk can be managed. As mentioned before, security awareness is the starting point. Common sense is a big deal here, too. Add a healthy dash of skepticism. Think security first and last. And in-between.

Look for the red flags. If the manufacturer’s privacy agreement is in tiny text requiring a magnifying glass, that’s a red flag. If the phrase “data may be shared with 3rd parties,” that’s another red flag. If no privacy and security policies can be found, that’s a huge red flag.

Avoid appliance routers, firewalls, and other related gear for the home or business gateway. Best to “roll your own.” [47]gateway OpenBSD is the go-to OS. [48]openbsd Packet Filter (PF) is the way. [49]openbsdpf Such is surprisingly reachable on many levels. One advantage to building a gateway rather than grabbing an over-the-counter appliance is the control over all aspects of the gateway, including the firewall. With a custom firewall is entire countries can be blocked. For example, blocking Korean and Chinese IP addresses outgoing and incoming not only prevents IoT from phoning home to manufacturers, it provides useful logging of activity. Having access to useful, detailed, and user-configurable firewall logs will tell the story. (If an IoT device must reach servers outside the country, that’s a cause for pause and a red flag.)

If an over-the-counter product, such as a router, must be purchased, for the home and small-to-middle business, find a used pro-grade unit. Read up on the product first, do some research. Ensure the product can provide detailed firewall logs and provides the user with detailed control.

Point IoT scanners at one’s own IP address(es) to see what’s cooking inside the business or home. Use your favorite search engine to search for “Miria scanner” and “IoT scanner” and “Shodan.” (Miria scanner caveat: A properly configured firewall blocking the scans may give false positives, even if there are no IoT devices behind the firewall.) Scanners will have varying levels of technical complexity. One fairly new wide-audience scanner (with useful background info) is the BullGuard scanner. [50]iotscanner

There are websites that will also do an extensive port scan of the reader’s IP address(es) to determine if there are unexpected open ports. Steve Gibson’s venerable ShieldsUp site is a recommended go-to for online port scanning. [51]shieldsup (Safety Tip: One will have complete control over a custom-built gateway, including the firewall. Unexpected ports won’t be a problem.)

IoT developers

It turns out developers of IoT devices can do everything described above as part of their security-by-design best practices.

The entire developer team must do security, breathe security, practice on-going learning of security, go to sleep thinking of security and wake up thinking security. All team members must be on the same security page, even if this means taking time out for in-house security seminars to bring everyone up to the same speed.

Secure the development realm. In the case of offshored manufacturing of internally designed IoT, appropriately blocked firewalls will provide logs showing any unexpected creeping “featurism” added by the manufacturers. Secure the tools.

Careful, deliberate authoring of specific written product privacy and security policies (and “Terms and Conditions”) will inform developer practices. In fact, it’s prudent to spell out the product privacy and security policies that will accompany the product and/or be published to a product website before starting design and development. The privacy and security policies will become the overarching top-down documents informing design and development.

The rest of security-by-design has straightforward, obvious best practices, learned the hard way by the industry. That is to say, leave no backdoors whatsoever. Stop shipping devices with default login name and passwords. Indeed, create devices that will not operate until the user changes the password and login name. And add just a little special sauce to reject the usual lazy easily-guessed passwords.

Ship no devices with P2P (peer-to-peer). If the IoT device must connect to servers for outside access by the customer, ensure all traffic is encrypted and access is only via a unique public key assigned to the customer. Never allow access to the device without a password – just say no to telnet. [52]notelnet Notably, it is an incredible testament to some IoT manufacturers’ naivete and laziness that, in the two-thousand-tens, IoT devices can be hacked by ancient ways dating back to the mainframe era. [53]ancient

Design and implement IoT from the hardware up for security. Use signed code. Think of every possible attack vector, starting with the hardware. Bug bounties are a good idea before product release. Bug bounties are big deal. For example, Apple offers $200,000 to crack iOS secure boot components and one can be sure people are working on that every step of the way. [54]tweet [55]ios Design in easy, straightforward ways to fix problems found after shipping.

And stop manufacturing IoT devices that are basically trojan horses to collect customer data.

The track record is clear; IoT developers and manufacturers, as a whole, can do better. Security-by-design, building secure tools to create useful, secure products, and protecting the customers, starts here. It’s the right thing to do, done the right way.

Written for Mouser Electronics back in the day.

bibliography