Ways of testing IoT sensor security

Question

I am supervising a group of students and their task is to build iot sensors for a few different tasks (ie temperature, movement). I want to score them on how securely they design their sensors among other things, since security seems to be such a big problem... hoping that by making this a challenge, it will inspire them to pay more attention to security, and I am not going to warn them beforehand that security will be tested.

How can I test the sensors to see if they are vulnerable to common problems?

Device specifications - all the devices are based on Raspberry Pi 3s and have to connect by Wifi to a router to send some data to a server. I will be able to connect to the same access point as the sensors, but I don't have any knowledge of the code used by the devices.

Has anyone got some ideas how I could test if the devices could be vulnerable to:

• DoS attacks (like brickerbot: http://hackaday.com/2017/04/08/brickerbot-takes-down-your-iot-devices-permanently/)

• snooping (I told the students that the data should be confidential, and left them to keep it secure in their own ways)

Can anyone describe ways for me to probe the security of my students' sensors? Any pentesting frameworks perhaps? Lists of passwords to try? Other tips/tricks?

Answer 1

In addition to the answer of Sean Houlihane, I would like to add a few things. I don't mean to sound arrogant, but I think that you don't want to test the security of the sensors themselves, because I assume that temperature and movement sensors are bought from OEMs. These sensors are simply used by students in order to record information on the Raspberry Pi. I think what you want to test is the security of the software implementation of the students on the Raspberry Pi, right?

If so, then there is a very promising new project on IoT Testing on the OWASP web page https://www.owasp.org/index.php/IoT_Testing_Guides There you can find a list of aspects that you may want to test.

PS: To be fair the students should know that security aspects are graded. Transparency in grading is always better than surprises.

Answer 2

Rather than explaining how to secure a system like this, I'll list the points that I think are important. I'm sure I've missed some.

• Transmission over TLS (so it can't be snooped or replayed)
• Protection against nodes being cloned (assume the TLS implementation can be broken)
• Protection against man-in-the-middle attacks (assume the target device is vunerable, and it's certificate store can be updated)
• sanitising all inputs (protecting against spoofing the sensors)

I think the easiest way to test this is to ask for a specification of all of the protections applied - as a open review, rather than attempting to hack the devices yourself. Then you can check they have implemented what they say they have. So for example, ask for proof of the way they handle certificates and keys.

I don't know if the Raspberry Pi has secure storage (maybe there is some internal flash which is trustzone protected - don't know). Without that, they will struggle to pass a thorough security review...