IoT devices were popular gifts again this holiday season. An acronym for Internet of Things, IoT is more than a buzzword. The trend represents a huge shift in how products are made and used, as network connectivity is added to products that were not previously intended to have this functionality.
So, your refrigerator that sends you a text message when you’re out of milk: IoT. Your thermostat that provides usage graphs on your phone: yep, IoT. Basically, any consumer device capable of connecting to a network other than a computer, phone, tablet, or router is considered an IoT device, says Fleming Shi, CTO of Barracuda Networks.
Security has been a big concern with IoT devices, though. Although improvements have been made, new types of vulnerabilities remain. For example, the Barracuda Labs teams recently used an IoT security camera to help illustrate a new threat: IoT credential compromise, which uses web and mobile application vulnerabilities to compromise IoT devices.
IoT credential compromise
Attackers can use vulnerabilities in the web applications and mobile applications used by certain IoT devices to acquire credentials, which can then be used to view the video feed, set/receive/delete alarms, remove saved video clips from cloud storage, and read account information. Attackers can also use the credentials to push their own firmware update to the device, changing its functionality and using the compromised device to attack other devices on the same network.
The details
To illustrate this threat, the Barracuda Labs team recently conducted research on a connected security camera and identified multiple vulnerabilities in the camera’s web app and mobile app ecosystem:
- Mobile app ignores server certificate validity
- Cross-site scripting (XSS) in the web app
- File traversal in a cloud server
- User controls device update link
- Device updates are not signed
- Device ignores server certificate validity
Using these vulnerabilities, the team was able to perform the following attacks to acquire credentials and compromise an IoT device, all without a direct connection to the device itself.
Acquiring credentials from the mobile app
If an attacker can intercept traffic to the mobile app by using a compromised or hostile network, they can easily acquire the user password. Here’s how it works:
1. The victim connects to a compromised/hostile network with a mobile phone.
2. The connected camera app will try to connect to the vendor’s servers over https.
3. The hostile/compromised network will route the connection to the attacker’s server, which will use its own SSL certificate and proxy the communication to the vendor’s server.
4. The attacker’s server now holds an unsalted, MD5 hash of the user password.
5. The attacker can also tamper the communication between the vendor’s server and the app.
Acquiring credentials from the web app
This type of attack relies on functionality that allows users to share device access to the connected camera with other users. To share a device, the receiver needs to have a valid account with the IoT vendor, and the sender needs to know the receiver’s username, which happens to be an email address.
1. The attacker will embed an XSS exploit in a device name and then share that device with the victim.
2. Once the victim logs into his account using the web app, the XSS exploit will execute and share the access token (which is stored as a variable on the web app) with the attacker.
3. With that access token, the attacker can access the victim’s account and all its registered devices.
Through this research, the Barracuda Labs team managed to compromise an IoT device (connected camera) without any direct connection to the device itself. This makes life easier for attackers. No more scanning on Shodan for vulnerable devices.
Instead, the attack will be performed against the vendor’s infrastructure. It’s a threat that could affect other types of IoT devices as well, regardless of their function, because it takes advantage of the way the device communicates with the cloud.
After all, bugs are not inherent to products, rather to processes, skills, and awareness of the developers. As access and access controls for IoT devices shifted to cloud services, so did the vulnerabilities, making possible the types of attacks uncovered by the Barracuda Labs team.
Lessons for IoT manufacturers
Vendors creating IoT solutions need to protect all aspects of the applications used to run those devices. IoT devices are sensors distributed in homes, schools, and offices, and they’re potential entry points for attackers. Each customer’s network is an opening to the server core and to other customers.
A web application firewall, one of the most critical protections IoT vendors need to put in place, is designed to protect servers from HTTP traffic at layer 7. Manufacturers also need to ramp up protection against network layer attacks and phishing.
Cloud security is also important, providing visibility, protection, and remediation of IoT applications and the infrastructures they run on. The potential for lateral-movement exposure is large and complex, so taking proper security precautions is key.
How to protect yourself as a consumer
When buying an IoT device, consumers need to think about security, in addition to convenience and, price. Here are a few tips to consider:
- Research the device manufacturer — A few companies that produce IoT devices understand software security. Most are either existing companies whose expertise lies in making the physical products that are being connected or startups trying to bring devices to market as quickly as possible. In both cases, proper software and network security measures are often overlooked.
- Look for existing vulnerabilities in a vendor’s other devices — If one device has a vulnerability, it’s likely other devices with similar features from the same company are also vulnerable. Ultimately, a vendor that has a history of secure devices will likely build secure devices going forward.
- Evaluate responses to past vulnerabilities — If a vendor is responsive to people reporting a vulnerability and quickly resolves it with firmware update, it bodes well for their outlook on security and future products they make.
Unfortunately, the amount of information available about the security posture of IoT devices is astonishingly low. Ideally, we need to get a world where IoT products are all scored with a safety rating, just like cars. Consumers should be informed before they invest in IoT devices.
The author of this blog is Fleming Shi, CTO of Barracuda Networks
Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow
