The security of Internet of Things solutions is critical for the growth and safe development of almost any business on the planet, especially the ones that extensively rely on smart infrastructures. Let’s be clear straight from the start, IoT product security is complex and goes far beyond setting reliable passwords and using VPN, though those measures would not hurt either. There are numerous ways in which hackers can exploit weaknesses of your IoT security products, and you need to be aware of the risks.
Each product is unique, and its individual features would define the possible lines of defense and potential security risks that might occur. Today, we will take a look at the number of IoT security threats and types of attacks that might occur at three levels of your IoT infrastructure and offer some IoT security solutions and recommendations to mitigate those threats.
How to mitigate potential risks from the get-go
Understanding the potential weaknesses of Internet of Things security begins with understanding the specifications of a particular product. We map the potential vulnerabilities of the product right at the discovery phase as that is where we build a vision for what the product is going to look like and what IoT security solutions it is going to need.
The goal of the discovery phase is not to just determine the specifications of the future product, it is also about finding the ways to secure it and ensure its continuous functioning. That is why it is vital to consider all the IoT product security risks from the get-go and take adequate measures. We implement the right set of solutions during the development stage to ensure robustness of the final product.
Protect your system on all levels
Hackers do not waste time coming up with the new ways to breach into IoT ecosystems of all types. This issue concerns IoT home security products, industrial IoT, autonomous vehicles, and more. A successful attack might compromise the integrity of the system, leave sensitive data exposed, and even threaten lives. There are three levels of the IoT ecosystem that can be threatened by the hackers, and each of those layers has its vulnerable spots and needs.
How to ensure IoT security on a device Level
The device level consists of all the devices that are connected to your IoT ecosystem. These are products that are embedded with processors, sensors, actuators, and are able to send and/or receive data via the Internet.
Types of attacks to be aware of
Physical attack
An IoT device can be physically accessed by attackers, which is the most straightforward type of IoT security threat. Many cyber-attacks happen from within the company, and keeping your devices in safe areas is the core of your IoT security initiative. If the assailant can physically access the device, they can spread malicious code across the system, access sensitive data, and even gain control over other devices. That is why physical security is the first critical line of defense you need to think about.
Installing malware
Also known as the malware injection attack is the instance of an attacker trying to install malicious applications and services into the system. The attackers might use different methods to access the device and breach IoT security. First of all, the attackers produce their own malicious application. Then, they try to pose as a valid instance and redirect the user to the malicious application, so that the user would download the malware. If the attackers are successful in tricking the user to install the malware, they would access user data and resources for further manipulations.
Stealing firmware code
Firmware is the type of software that defines the behavior of the devices, which means that the hacker who can access your firmware coders will gain ultimate control over your devices. The hacker will then be able to define the behavior of your devices according to their malicious intent. The attackers can go multiple routes here and try to put ransomware into your devices, put a backdoor for the future attacks, use the device for crypto mining, become a user with higher permission level, and more.
Stealing sensitive data
As the continuation of stealing the firmware code, the attacker can go as far as to steal the data and user passwords stored on the device. Having access to the device, the offender can gain access to all kinds of sensitive data stored on that particular device, which will result in critical data leaks.
System remote access/remote control
Having the firmware codes, the attacker basically controls the behavior of the device. The hacker would be able to turn the device on and off, control its basic functionality, and even damage it beyond repair.
How to prevent them
There are ways to address all of those threats and the needs of Internet of Things in security, and the N-iX team has the knowledge and tools to improve the security of the device level of your ecosystem.
Firmware read protection
First of all, you need to protect the firmware on your device from being read by the hackers. The main chip has to have the read protection feature so that assailants cannot access the firmware data. This can be a critical problem because somebody might steal some valuable assets and replicate them to build cheap copies of your devices. Basically, this is a kind of copyright protection for your firmware that helps the business keep its innovations to themselves.
Secure sensitive data storage
It is not safe to store your data on a removable drive as it can be accessed from the outside in case somebody steals it. That is why you need encrypted data storage that cannot be accessed from the outside.
FW update security and digital signature
It is critical to get all of your firmware updates from trusted sources, from the legit update distributor. Each firmware update must have its unique digital signature, and each package of firmware has to have a proper signature. Usually, firmware updates are not encrypted, as these packages contain large amounts of data, but the signature allows the user to verify the package. This signature lets you know that the update package comes from a reliable source and is safe for use. Digital signatures for firmware updates are the best solution for ensuring the safety of firmware updates.
SIM card IMEI lock
SIM cards can also be vulnerable to attacks, in which case the valid SIM card is replaced by the hacker’s card to collect sensitive data. IMEI lock allows you to quickly react to the changes in the SIM card’s functioning and lock it remotely to prevent data theft.
No debug access on production
When a dedicated development team works on a certain IoT product, they would sometimes leave a backdoor debug interface. This is really convenient for the software engineers, as in case something goes wrong within your system, they can quickly access it via the debug interface and check what happened there. Such a backdoor debug interface, however, can also be highly convenient for the hackers as they can just brute-force the password and access that interface. That is why such backdoor access points must be disabled before the product goes live. Such a move might make it more challenging for the software engineers to debug the product, but it would also prevent critical threats from the outside.
Periodic encryption key refresh
There’s no such password that cannot be brute-forced, which is a major threat to IoT product security. The only question is how fast would the hackers be able to do that. That is why it is critical that you refresh passwords from time to time. If your password is strong already, it might take months or even years for the would-be hackers to guess it, but if they commit to it, they will eventually find the key. That is why it is reasonable that you periodically refresh the password.
Attacks on the Network Level
In IoT, the network level refers to all the communication technologies that are used by the devices to spread the data to other devices or interfaces they can reach or are intended to reach.
Man in the Middle
The man in the middle attack occurs when a hacker accesses communications between two systems. By intercepting and manipulating the communication between two separate systems or parties, this type of assault allows the hacker to communicate with both parties tricking them into thinking they are communicating with one another. That way, the hacker can fish out valuable information, send phishing emails, and do further damage to the users.
Eavesdropping
Eavesdropping allows the hacker to intercept the network traffic to steal sensitive information in transit. This might happen between the device and gateway layers of your infrastructure. This is similar to sniffing out sensitive data, and the hacker can then use it for malicious purposes. If the hacker manages to breach the encryption, they will parse the data packages knowing what kind of data is stored there for a variety of purposes.
Replay attacks
In this type of attack, the hacker sniffs out the data packages without knowing what data is stored there. In this case, the hacker cannot access any sensitive data, but they can use replay attacks to annoy you and even do some considerable damage. For instance, if the hacker sniffs out data packages that turn some of your devices on and off, they can cause some serious headache by shutting your devices down while you run some critical processes. The hacker can then send those data packages to your devices whenever they want, shutting them off at will.
Trash-can attacks
Hackers have all kinds of tricks up their sleeves to compromise IoT security products, each dirtier than the next. As an instance, you might have decided to upgrade some equipment at your office and throw away the old equipment. The hackers would try to find that used equipment, basically salvage it from the trash-cans, and access your network via those old devices. This is also a problem for the IoT home security products as the assailants might literally try to steal devices from your trash can.
Brute-force key attacks
In this type of attack, the attacker uses a virtual machine (VM) from its old snapshot without the user being aware. Basically, it will force the user to roll back, which can disable IoT security measures or certain patches used in the current version opening the doors for the attack. After that, the attacker may use brute force technique to find logs and passwords to the virtual machine, even if the valid user has a restriction on the number of failed login attempts.
Alternatively, brute-forcing can be manifested in a form of annoying attacks that create certain undesired disruptions in the functioning of your devices. Such attacks might not result in data theft, but they can surely cause some headache for the business and its customers.
How to prevent them
There are solutions that address the threats to the network level. The N-iX IoT product security experts can implement a number of solutions that will secure your network. Here are some of the IoT security products and solutions that you can benefit from.
Device authentication
Whenever you connect new devices to the system during the provisioning stage, you need to make sure they are the right devices and not some external devices that might have been brought in by potential attackers. This can be done via the server that controls the devices. You can send certain commands to the devices, and see how the device responds. These must be some specific commands the hacker would not be able to replicate.
Device authentication is especially useful for preventing man in the middle type of attack. Usually, there are certain visual indicators on each device, and authentication can be performed by sending certain commands that the device would react to and give you visual signals. If the device does not respond as you have commanded, this might indicate the presence of a man in the middle.
Secure provisioning and commissioning
You need to have unique keys for each device before you provision and commission them. In most cases, the business owner or a person responsible for provisioning and commissioning would get a set of keys for the devices. This will allow you to provision only the devices you need to add to the system and prevent any unwanted devices from entering the system.
Several levels of encryption
IoT systems usually have several levels – network, application, and device. You might have several applications each controlling different aspects of your ecosystem and function within a single network. Each application serves its own purposes, but they are a part of that same network, which is why it is critical to secure and encrypt each level of that ecosystem with the right IoT security products. You will need to encrypt the data traffic for the network and application levels to make sure malicious access to one of your applications does not compromise the entire network and all of your devices.
Large enough sequence number for each data package
Sequence number protection is essential for IoT product security and preventing replay attacks that can create all kinds of disturbances within your system, from mild annoyances to serious shutdowns. We can assign a serial number to each data package, so each time the hacker sends the data package to commit a certain action, the package number will change, and the hacker will not be able to send that package again. The sequence of numbers has to be large enough so that the same number would not repeat and the hacker would not be able to strike again.
Unique encryption key for every device
Each device has to have its own unique access key. This might take time, but it is essential to have a unique key for each and every device to protect the system from attacks. We talked about the trash-can attack in which the hacker obtains the old device and enters the system via such device. Unique encryption is meant to prevent such attacks – whenever the device is compromised or is excluded from the system, the system will know and remember it and will not allow access from that device again.
Separate network/subnetwork for system
Smart ecosystems often have a single network connection cable that connects the entire system to the web. This is not a critical problem, but it would be wise to have a separate subnetwork for the system. Such subnetwork will exclude any external devices eliminating most IoT security threats.
Secured communications
Another recommendation is to use secure communications like HTTPS or MQTT to ensure safety of sensitive online transactions.
Secure the Cloud Level
Cloud is a massive network that stores and processes the data through the Internet and a massive part of your IoT product security. It is essential for real-time operations as it supports the underlying data storage and exchange infrastructure. It is a natural target for the attackers, and they can use different approaches to disrupting the functioning of a cloud layer or stealing data from your storages.
Denial of Service (DoS attack)
A DoS attack is primarily aimed at bringing a particular service, such as a website, down to make it unavailable for the users. Basically, the attackers use a large number of systems to attack a single target via the botnet forcing the devices to request service at the same time. This type of assault is not meant to capture any data, the sole purpose here is to crash the service and make it unavailable for a prolonged period of time.
Information breach or loss
Data or information breach is a kind of attack on IoT security in which information is stolen or taken from the system without the knowledge of an authorized system owner. Data breaches can occur on any level, and cloud level is vulnerable to such attacks as well. This can also result in data loss, which can also be damaging to the business even if the hackers do not get access to it either. Losing sensitive data or having it stolen for ransom can result in significant financial losses.
Service or Account Hijacking
Services and accounts can be hijacked by the hackers and further used for malicious purposes. This is a kind of identity theft in which the attacker would use somebody else’s identity for unauthorized activities. If the identity of an entire business is stolen, hackers would be able to do immense damage to all of its clients.
Applications and API attacks
An application and API attack is a manipulative or abusive use of APIs to breach the data or manipulate certain applications to achieve malicious goals. This can be done via DDoS attacks, SQL injection attacks, unencrypted communications, and other methods commonly used by the hackers.
Malicious Insider
Cloud-based systems are more susceptible to social interaction and phishing attacks than a traditional on-premise system. It is possible to trick the members of an organization to disclose their login data via phishing links and then gain access to the critical data. Attacking from within the organization, such a malicious insider can deal catastrophic damage. This can be a former or existing employee or a person who can compel such an employee to disclose some information and help launch an attack. Such attacks are hard to track and prevent as such logins would be considered a routine access and no alarm would be triggered. This calls for better access management, setting up more access points, and improved monitoring.
Abuse and nefarious use of cloud services
Hackers may use cloud computing to attempt different types of attacks and target their victims through the nefarious use of cloud services. This could be anything: DoS attacks, spam, phishing mails, cryptocurrency mining, and more. If the abuser gains the access to the cloud service through any of the possible means, they can deal an immense damage to the system.
Insufficient diligence
While migrating to cloud and maintaining their cloud infrastructure, the organizations might fall victims to insufficient due diligence. Moving the data to the cloud without understanding the whole scope of transaction and the Internet of Things security measures leaves the data vulnerable to attacks. The perpetrator might try to catch the data in transit and gain access to the sensitive data.
Shared technology
Cloud computing relies on the use of shared technology such as cloud orchestration or visualization. The attacker might exploit the weaknesses in any part of shared technologies to gain access to the cloud infrastructure. This would allow the hacker to control the VM, and by executing control over the VM, the hacker may gain access to the host through the shared resources.
How to prevent attacks on the Cloud
Using the right set of IoT security products and precautions can make a big difference for your cloud infrastructure.
Secure provisioning new device to cloud
Similar to the network provisioning, you need to make sure only authenticated devices are connected to the cloud. That process is similar to the one that happens on the network level and involves sending certain commands to the device to make sure it is the device you want to connect. The provisioning experts will then connect it to the cloud. Any device that has not been intended for provisioning will not be able to access the cloud.
End-to-end encryption
An unencrypted device is vulnerable to the so-called sniffers, a type of hackers who capture the data from unencrypted IoT devices. Once the data is obtained and the encryption keys unlocked, the sniffer can install their own algorithms and obtain control over your system. Encryption is a vital part of the IoT security and the security of your system as a whole.
Use VPN
Using a virtual private network (VPN) allows you to send and receive data via a secure network. This is a straightforward approach and one of the basic security recommendations but it can make a real difference in creating a secure IoT landscape.
Track unsuccessful login attempts
You need to know whether somebody tried to enter the system unsuccessfully. There are solutions that send notifications and provide reports whenever somebody has tried to log into the system and failed. This could be somebody making a mistake while entering the password or could be a potential attacker who tried to brute-force the system. Whatever the case, it is better to be safe than sorry.
Keep system up to date
Keeping your system up to date is one of the key components of Internet of Things security. The firmware itself, though, can be compromised by hackers, and you should always check that your updates come from a verified source. Otherwise, the assailants can hijack the firmware and spread malicious software across your system.
Use firewall
Firewall is a security system that controls and monitors incoming and outgoing traffic based on certain security rules. This is basically a barrier, a wall between trusted and untrusted networks that only allows predetermined data exchanges.
Security testing - how ethical hacking helps us deal with the threats
It is hard to be sure your product is safe without QA and software testing, and that is exactly why our experts run so-called penetration tests. This is a form of ethical hacking in which skilled professionals run authorized attack simulations to see whether the system can stand up to it.
Such simulated attacks allow us to conduct a vulnerability assessment to identify, quantify, and prioritize the weak spots of the system. Knowing the specifics of the product beforehand, we can test it for the most probable types of attacks it might be subjected to and use the right set of IoT security products. The combination of penetration testing and vulnerability assessment allows the businesses to drive the chance of a successful attack close to zero.
Final Thoughts
IoT product security is indeed complicated, and it might feel slightly overwhelming at first glance. However, it is vital that you pay attention to the needs of Internet of Things in security and all the possible threats that the hackers might pose to your business. That is exactly why here at N-iX, we have a systematic approach to identifying threats to each particular IoT product, its security needs, and the ways we can mitigate both external and internal risks.
Knowing how and where the hackers might strike is the key to knowing how to deal with the threat, and you would need a reliable partner who will help you with that. Security must always be one of the top priorities on your list, and N-iX can help you build and test a secure and robust IoT infrastructure.
Have a question?
Speak to an expert
