IOT Security

IoT Attack Surface Areas

IoT Attack Surface Areas
Attack Surface Vulnerability
Ecosystem (general)
  • Interoperability standards
  • Data governance
  • System wide failure
  • Individual stakeholder risks
Ecosystem Access Control
  • Implicit trust between components
  • Enrolment security
  • Decommissioning system
  • Lost access procedures
Device Memory
  • Cleartext usernames
  • Cleartext passwords
  • Third-party credentials
  • Encryption keys
Device Physical Interfaces
  • Firmware extraction
  • User CLI
  • Admin CLI
  • Privilege escalation
  • Reset to insecure state
  • Removal of storage media
  • Tamper resistance
  • Debug port
  • Device ID/Serial number exposure
Device Web Interface
  • SQL injection
  • Cross-site scripting
  • Cross-site Request Forgery
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
Device Firmware
  • Hardcoded credentials
  • Sensitive information disclosure
  • Sensitive URL disclosure
  • Encryption keys
  • Encryption (Symmetric, Asymmetric)
  • Firmware version display and/or last update date
  • Backdoor accounts
  • Vulnerable services (web, ssh, tftp, etc.)
  • Security related function API exposure
  • Firmware downgrade
Device Network Services
  • Information disclosure
  • User CLI
  • Administrative CLI
  • Injection
  • Denial of Service
  • Unencrypted Services
  • Poorly implemented encryption
  • Test/Development Services
  • Buffer Overflow
  • UPnP
  • Vulnerable UDP Services
  • DoS
  • Device Firmware OTA update block
  • Replay attack
  • Lack of payload verification
  • Lack of message integrity check
Administrative Interface
  • SQL injection
  • Cross-site scripting
  • Cross-site Request Forgery
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Security/encryption options
  • Logging options
  • Two-factor authentication
  • Inability to wipe device
Local Data Storage
  • Unencrypted data
  • Data encrypted with discovered keys
  • Lack of data integrity checks
  • Use of static same enc/dec key
Cloud Web Interface
  • SQL injection
  • Cross-site scripting
  • Cross-site Request Forgery
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Transport encryption
  • Insecure password recovery mechanism
  • Two-factor authentication
Third-party Backend APIs
  • Unencrypted PII sent
  • Encrypted PII sent
  • Device information leaked
  • Location leaked
Update Mechanism
  • Update sent without encryption
  • Updates not signed
  • Update location writable
  • Update verification
  • Update authentication
  • Malicious update
  • Missing update mechanism
  • No manual update mechanism
Mobile Application
  • Implicitly trusted by device or cloud
  • Username enumeration
  • Account lockout
  • Known default credentials
  • Weak passwords
  • Insecure data storage
  • Transport encryption
  • Insecure password recovery mechanism
  • Two-factor authentication
Vendor Backend APIs
  • Inherent trust of cloud or mobile application
  • Weak authentication
  • Weak access controls
  • Injection attacks
  • Hidden services
Ecosystem Communication
  • Health checks
  • Heartbeats
  • Ecosystem commands
  • Deprovisioning
  • Pushing updates
Network Traffic
  • LAN
  • LAN to Internet
  • Short range
  • Non-standard
  • Wireless (WiFi, Z-wave, Zigbee, Bluetooth)
  • Protocol fuzzing
Authentication/Authorization
  • Authentication/Authorization related values (session key, token, cookie, etc.) disclosure
  • Reusing of session key, token, etc.
  • Device to device authentication
  • Device to mobile Application authentication
  • Device to cloud system authentication
  • Mobile application to cloud system authentication
  • Web application to cloud system authentication
  • Lack of dynamic authentication
Privacy
  • User data disclosure
  • User/device location disclosure
  • Differential privacy
Hardware (Sensors)
  • Sensing Environment Manipulation
  • Tampering (Physically)
  • Damaging (Physically)