IoT Security

Question 1

Typical IoT Ecosystem

Answer 1

• Command Relay Server
• Update CDN
• Web GUI
• Cloud Storage
• External API
• Internal API
• Authentication Server
• Heartbeat Server

Question 2

IoT Common Vulnerabilities

Answer 2

• Same pre-shared key
• No authentication of updates
• Open services (telnet)
• Old software version
• Default passwords
• Identification using MAC
• Attacks on voice UI
• Unencrypted traffic

Question 3

Attacks on Voice Assistants

Answer 3

• Cocaine Noodles
  -> Analyze voice recognition software
  -> Create mangled voice commands
  -> Unrecognizable by humans but understandable by assistants
• Dolphin attack
  -> Record voice command
  -> Shift audio into ultrasonic spectrum
  -> Control different voice assistants inaudibly
• Lying Alexa
  -> Utilize skills to return information
  -> Inaudible command injection redirects to different skill
  -> Alexa returns misinformation while user is talking to it

Question 4

Mirai

Answer 4

• IoT botnet appearing for the first time in 2016
• Infects typical IoT devices
• Actively scans the network and propagates to any vulnerable devices it finds
• Has been used to perform one of the largest DDoS attacks in history

Question 5

Why is Mirai possible?

Answer 5

• Vulnerabilities: Manufacturers expose sensitive services access to their devices
• Weak credentials: Poor default passwords, password change not enforced
• Poor network management: Users do not have proper network configuration leading to exposure of IoT devices on Internet
• Always online

Question 6

Mirai: Defense Mechanisms: Mitigation

Answer 6

• Limit exposure to external adversaries (use of firewalls and NAT, closing open ports not needed for functionality)
• Ensure correct security configuration (set the admin password)
• Remove device vulnerabilities (security patches)

Question 7

Mirai: Defense Mechanisms: Detection

Answer 7

• Signature-based intrusion detection
  -> System monitors communications or device behaviour for known patterns of attack
  -> Fast and reliable, widely deployed
• Anomaly-based intrusion detection
  -> Detects deviations from normal behaviour as anomalies
  -> Able to detect also previously unknown attacks

Question 8

Mirai: Defense Mechanisms: Recovery

Answer 8

• Network isolation
  -> Traffic filtering rules used to isolate infected device from others
  -> Prevent further injections in the network
  -> Prevent device from attacking remote victims
• Reset device
  -> Most IoT malware don’t maintain persistent state
  -> Simple reboot will remove possible infections (requires manual intervention in many cases)
  -> Vulnerability is however only removed through SW patch

Question 9

Mirai process

Answer 9

1) Scan
2) Report IP + credentials to Listener Server
3) Listener Server adds new device with Loader Server
4) Load (Infect)
5) Recruited (Infect)
6) Send command to C&C server
7) Dispatch (Versende) command
8) Attack