What is IoT?
A.k.a. Internet of Everything. Refers to the network of devices with an IP address, that have the capability of sensing, collecting, and analyzing data. A thing is referred to as the device implanted on natural man-made or machine-made objects and having the functionality of communicating over the network.
How does IoT work?
- Sensing Technology: Sensors embedded in the device sense a wide variety of info.
- IoT Gateways: Used to bridge the gap between the IoT device (internal network) and the end user (external network) allowing them to communicate with each other.
- Cloud Server/Data Storage: Data is stored in the cloud and undergoes data analysis.
- Remote Control using Mobile App: End user uses remote control in order to monitor, control, retrieve data and take specific action on IoT devices from a remote location.
What is the architecture of IoT?
- Application Layer: Delivery of various apps to different users
- Middleware Layer: Device and information management
- Internet Layer: Connection between endpoints
- Access Gateway Layer: Protocol translation and messaging
- Edge Technology Layer: Sensors, devices, machines, intelligent edge nodes of all types.
What are the different IoT technologies and protocols?
- Short Range Wireless Communication:
- Bluetooth Low Energy: Wireless personal network
- Light Fidelity (Li-Fi): Household lightbulbs
- Near Field Communication (NFC): Uses magnetic field induction to enable communication between 2 devices.
- QR Codes and Barcodes
- RFID
- WiFi
- Medium Range Wireless Communication:
- HaLow: Extended range WiFi
- LTE-Advanced
- Long Range Wireless Communication:
- LPWAN: Low Power Wide Area Network
- Sigfox: Uses in devices that small battery life
- Cellular: Type of communication that is used over a long distance.
- Wired Communication:
- Ethernet: Type of LAN
- Multimedia over Coax Alliance (MoCa): Provides high def video of home and content.
- Power-Line Communication (PLC): Where electrical wires are used to transmit power and data from one end point to another.
- IoT Operating Systems:
- RIOT OS: Less resource intensive, uses energy efficiently.
- ARM mbed OS: Mostly used for low powered devices like watches.
- RealSense OS X: Used in Intel’s depth sensing technology.
- Nucleus RTOS: Primarily used in aerospace, medical, and industrial
- Brillo: Android based embedded OS
- Contiki: Used in low power wireless devices.
- Zephyr: Used in low power and resources constrained devices.
- Ubuntu Core: Aka Snappy, used in robots and drones, etc.
- Integrity RTOS: Primarily used in aerospace, medical, and industrial
- Apache Mynewt: Supports devices that work on Bluetooth Low Energy protocol.
What are the IoT Communication Models?
- Device-to-Device Model: Where devices interact with each other through the internet.
- Device-to-Cloud Model: Where devices communicate with the cloud directly.
- Device-to-Gateway Model: Where device communicates with intermediate device called a Gateway which could provide security features.
- Back-end Data-Sharing Model: Extends Device-to-Cloud communication type by allowing IoT devices to be accessed by 3rd parties for analysis.
What are the challenges/concerns of IoT security?
- Lack of privacy and security
- Vulnerable web interfaces
- Legal issues
- default, weak creds
- Clear text protocols and unnecessary open ports
- Coding errors
- Storage issues
- Difficult to update firmware and OS
- Interoperability standard issues
- Physical theft and tampering
- Lack of vendor support
What are the top 10 IoT Vulnerabilities?
- Insecure Web Interface
- Insufficient Authentication/Authorization
- Insecure Network Services
- Lack of transport encryption/Integrity Verification
- Privacy Concerns
- Insecure Cloud Interface
- Insecure Mobile Interface
- Insufficient Security Config
- Insecure Software/Firmware
- Poor Physical Security
What are the IoT attack surface areas?
- Device Memory: Credentials
- Ecosystem Access Control: Implicit trust between components
- Device Physical Interfaces: Privilege escalation, CLI
- Device Web Interface: SQL injection, XSS
- Device Firmware: sensitive data exposure, creds hardcoded
- Device Network Services: Unencrypted/poorly encrypted services.
- Administrative Interface: SQL Injection, XSS
- Local Data Storage: Data encrypted with discovered keys, lack of integrity checks.
What are some IoT threats?
- DDoS Attack: Converts devices into an army of botnet
- Exploiting HVAC: Gain access to a corporate systems.
- Rolling Code: Attacker jams and sniffs the signal to obtain the code transferred to vehicle’s receiver.
- Blue Borne Attack: Attackers exploit vulnerabilities of Bluetooth protocol.
- Jamming Attack: Attacker jams signal between the sender and the receiver.
- Remote Access using Backdoor: Attackers turn device into backdoor.
- Remote Access using Telnet: Attackers exploit an open telnet port to obtain info.
- Sybil Attack: Attacker uses multiple forged identities to create strong illusion of traffic congestion.
- Exploit Kits: Malicious scripts used to exploit poorly patched devices.
- MitM Attack: Attacker pretends to be a legit sender who intercepts all communication between sender and receiver.
- Replay Attack: Attackers send intercepted messages to target device to perform DoS
- Forged Malicious Device: Attackers replace authentic IoT devices with malicious device.
- Side Channel Attack: Attackers extract info about encryption keys by observing the emission signals (side channels) from IoT devices.
- Ransomware Attack: Type of malware that uses encryption to block user’s access to his/her device.
What is the IoT Hacking Methodology?
- Information Gathering
- Vulnerability Scanning
- Launch Attack
- Gain Access
- Maintain Access
How can you defend against IoT Hacking?
- Disable Guest or Demo user accounts
- Use Lockout feature to disable multiple login attempts
- Implement strong authentication mechanisms.
- Implement IPS/IDS in the network
- Implement end-to-end encryption
- Use VPN architecture
- Allow only trusted IP’s to access device from internet
- Disable Telnet
- Disable UPnP port on routers
- Prevent the devices against physical tampering
- Patch vulnerabilities
- Monitor traffic on port 48101 for infected traffic
What are general guidelines for IoT device manufacturing companies?
- SSL/TLS should be used for communications
- Check SSL certs
- Use of strong passwords
- Implement account lockout mechanisms
- Check device for unused tools
- Use secure boot chain
What are the IoT Vulnerabilities?
- Username Enumeration
- Weak Passwords
- Account Lockout
- Unencrypted Services
- 2FA
- Poorly Implemented Encryption
- Update Sent Without Encryption
- Update Location Writable
- Denial of Service
- Removal of Storage Media
- No Manual Update Mechanism
- Obtaining Console Access
What are SDR-Based Attacks on IoT?
Attackers use Software Defined Radio (SDR) to examine the communication signals in the IoT network and sends spam content or texts to the interconnected devices. Can also change the transmission and reception of signals between the devices.
- Replay Attack: The attacker obtains the specific frequency used for sharing information between connected devices and captures the original data when a command is initiated by these devices.
- Cryptanalysis Attack: The attacker uses the same procedure as that followed in a replay attack, along with reverse engineering of the protocol to capture the original signal.
- Reconnaissance Attack: Attacker obtains info about the target device from the device’s specification.
What is DNS rebinding?
A process of gaining access over the victim’s router using a malicious JavaScript code injected on a web page. After that, an attacker can assault any device activated using the default password.
What are Fault Injection Attacks?
(aka Perturbation attacks), Occur when a perpetrator injects any faulty or malicious program into the system to compromise the system security.
- Optical, Electro Magnetic Fault Injection (EMFI), Body Bias Injection (BBI): Injection using projecting lasers and electromagnetic pulses.
- Power/Clock/Reset/Glitching: Injections into power supply and clock network of the chip.
- Frequency/Voltage Tampering: Tampering with clock frequency of the chip
- Temperature Attacks: Attackers alter the temp for the operating the chip.
What is FCC ID Search?
Helps in finding the details and granted certification of the devices. Contains 2 elements: Grantee ID and Product ID. Attacker can find underlying vulnerabilities.
What is OT (Operational Technology)?
The software and hardware designed to detect or cause changes in industrial operations through direct monitoring and/or controlling of industrial physical devices. Consists of Industrial Control Systems (ICS) that include Supervisory Control and Data Acquisition (SCADA), Remote Terminal Units (RTU), Programmable Logic Controllers (PLC), Distributed Control System (DCS), etc., to monitor and control operations.
What are some important OT terms?
- Assets: OT systems consist of physical assets such as sensors, etc.
- Zones and Conduits: A network segregation technique used to isolate the networks and assets.
- Industrial Network: A network of automated control systems.
- Business Network: It comprises of a network of systems that offer information infrastructure
- Industrial Protocols: Protocols used for serial communication and communication over standard Ethernet.
- Network Perimeter: It is the outermost boundary of a network zone.
- Electronic Security Perimeter: It is referred to as the boundary between secure and insecure zones.
- Critical Infrastructure: A collection of physical or logical systems and assets that the failure or destruction of which will severely impact the security, safety, economy , or public health.
What is IT/OT convergence?
The integration of IT computing systems and OT operation monitoring systems to bridge the gap between IT/OT technologies for improving overall security, efficiency, and productivity. Can enable smart manufacturing known as industry 4.0. Using this IoT can be referred to as Industrial Internet of Things (IIoT).
What is the Purdue Model?
Used to describe internal connections and dependencies of important components in the ICS networks. Consists of 3 zones: IT, OT, and DMZ.
What are the challenges of OT?
- Lack of visibility
- Plain-text passwords
- network complexity
- Legacy tech
- Lack of AV protection
- Lack of skilled security professionals
- Rapid pace of change
- Outdated systems
- Haphazard modernization
- Insecure connections
- Usage of rogue devices
- Convergence with IT
- Organizational Challenges
- Vulnerable Communication protocols
What is the Industrial Control System (ICS)?
A collection of a different types of control systems. Consists of several types of control systems like SCADA, DCS, BPCS, SIS, HMI, PLCs, RTU, IED, etc. Can be configured in 3 modes: Open mode, closed loop, and manual mode.
- SCADA: Centralized Supervisory Control System
- PLC (Programmable Logic Controller): Small solid-state control computer where instructions can be customized to perform a specific task. Consists of CPU Module, Power Supply Module, and I/O modules.
- Basic Process Control System (BPCS): Responsible for process control and monitoring of the industrial infrastructure.
- Safety Instrumented Systems (SIS): An automated control system designed to safeguard the manufacturing environment in case of any hazardous incident in the industry.
What are the OT vulnerabilities?
- Publicly Accessible OT systems
- Insecure Remote Connections
- Missing Security Updates
- Weak Passwords
- Insecure Firewall Configuration
- OT Systems Placed within the Corporate IT Network
- Insufficient Security for Corporate IT Network from OT systems
- Lack of Network Segments
- Lack of Encryption for Authentication
- Unrestricted Outbound Internet Access from OT Networks
-
15 - SQL Injection37
-
16 - Hacking Wireless Networks40
-
17 - Hacking Mobile Platforms30
-
18 - IoT Hacking30
-
19 - Cloud Computing35
-
20 - Cryptography38
-
1 - Intro to Ethical Hacking39
-
2 - Footprinting and Reconnaissance16
-
3 - Scanning Networks23
-
4 - Enumeration22
-
5 - Vulnerability Analysis12
-
6 - System Hacking52
-
10 - Wireless Pen Testing17
