Questions tagged [security]

For questions relating to the security of IoT devices (especially those connected directly to the internet) and how to mitigate these issues or avoid them altogether. Do not confuse this with device safety (If it gets hacked it's a security question, if it explodes it's a safety question).

Filter by
Sorted by
Tagged with
126
votes
4answers
14k views

How can I stop Alexa from ordering things if it hears a voice on TV?

According to The Register, lots of Amazon Echo devices were accidentally triggered by a presenter saying 'Alexa ordered me a dollhouse'. Telly station CW-6 said the blunder happened during a Thursday ...
53
votes
8answers
2k views

Securing small home automation setup

I have a small home automation lab (that I keep saying I'll expand, but haven't). In this setup, I have a control system to control lights (utilizing the x10 protocol), blinds, a Nest thermostat and ...
36
votes
5answers
2k views

Can I monitor my network for rogue IoT device activity?

In order to mitigate or manage the risk from having some of the devices on my home network compromised, is it feasible to monitor network traffic so as to detect a compromise? I'm specifically ...
28
votes
2answers
1k views

Intercepting web traffic going over cellular network

If you can plug a device into the wall, or use it in Wi-Fi, it's easy to see the traffic with software like WireShark. But it seems more tricky to do it with a device that uses LTE/3G or other ...
27
votes
3answers
624 views

What are the best security practices to secure a remote IoT camera?

I have done a bit of home automation such as building a remote camera that can be turned on via SSH locally and publishes images on a Raspberry Pi run Linux server. I'm curious, though, as to what ...
27
votes
4answers
4k views

How can I check if my IoT devices are infected with the Mirai worm?

I've recently heard about the Mirai worm, which infects vulnerable routers, IoT devices and other internet-connected appliances with insecure passwords. Mirai is suspected of being the cause of some ...
25
votes
7answers
4k views

Could a blockchain really prevent malware in the Internet of Things?

This article claims that using a blockchain-based security system for an IoT network would prevent some types of attacks: Blockchain technology may help offer an answer. Gada observes that blockchain ...
20
votes
5answers
951 views

Is there any advantage in encrypting sensor data that is not private?

Some sites, such as this article on end-to-end encryption for IoT, suggest that all traffic sent across the IoT network should be encrypted, saying: Enterprises, government agencies and other ...
19
votes
4answers
4k views

Is my Samsung Smart TV vulnerable to the “weeping angel” attack?

On CNet, there's a report about Samsung UNF 8000 smart TVs being vulnerable to a hack developed by the CIA: In June 2014, the CIA and UK's MI5 held a joint workshop to improve the "Weeping Angel" ...
18
votes
2answers
2k views

How do I secure communication between app and IoT device?

I am currently working on a project that includes Bluetooth communication between a mobile application (currently using the Ionic platform) and an embedded device. For comparison, our product is ...
16
votes
3answers
165 views

Is the Subscriber-Publisher pattern applicable also to actuators?

There are tons of tutorials on the web, especially with RabbitMQ, on how to publish sensor data; for example, temperature, humidity, etc. Just publish the value to a message queue and anybody can ...
16
votes
1answer
698 views

Secure Home Network Partition for IoT Devices

What is the best approach to partitioning IoT devices from non-IoT devices at home? I have heard that setting up separate networks, one for IoT devices and one for everything else, is a good ...
16
votes
1answer
555 views

How to implement Wi-Fi for a headless IoT device?

Recently I purchased a TP-Link HS100 smart plug which I configured using an app and all is working well. Now I am trying to understand the underlying software and hardware architecture for such an ...
15
votes
3answers
5k views

What is the difference between a DDoS attack and a PDoS attack?

I've read a certain amount about the Mirai worm, a virus that attacks Internet of Things devices using default usernames and passwords and essentially is wired to produce a Distributed Denial of ...
15
votes
2answers
2k views

How do consumer IoT devices typically enable Internet connection?

As far as I know there are 2 general methods for enabling remote (Internet, not LAN) access to IoT devices: Via a server that the device polls periodically (e.g. MQTT) Direct remote access I'm ...
14
votes
1answer
283 views

How to stop these toys from sending what my kids say to the cloud?

As reported by several news outlets like the Verge or ConsumerAffairs, the connected toys My Friend Cayla and the i-Que record what the kids say and send it back to a server to help answer kids' ...
13
votes
4answers
1k views

Can programs loaded onto NodeMCU board be extracted?

I am using a NodeMCU board with WiFi capabilities to build a simple asset tracker. I have managed to find a few Arduino sketches that enables connectivity to Azure IoT Hub and post messages. One of ...
13
votes
3answers
326 views

Should I use a different password on each IoT device?

According to cmswire.com, one of the major security risks with the Internet of Things is Insufficient Authentication/Authorization. When it comes to the Internet of Things, should I use a different ...
13
votes
4answers
809 views

How do I protect my home from IoT devices being compromised and being used for DDoS attacks?

I am trying to understand the vulnerability of my home IoT devices. From what I understand, the big DDoS last year was caused by compromised IoT devices with generic or default usernames and passwords....
13
votes
2answers
828 views

What simple security tests can I perform on my MQTT network?

I am about to set up an MQTT network at home. I want to build up some knowledge by practical exercises. It would be a small network with the broker hosted on my laptop (Windows 7) and some Raspberry ...
12
votes
4answers
2k views

Is it a bad practice to keep certificates on external memory?

We're working on AWS-IoT using an STM32 microcontroller. Till today, we were writing the certificates to the flash and locking the flash from external reading. As the application code increases, we'...
12
votes
4answers
413 views

Would using a Tor wifi router make IoT more secure?

Would using a Tor wifi router make IoT more secure from attacks etcetera? These routers provide a Tor client, and also tunnel all internet traffic through a VPN. This anonymises your internet access ...
12
votes
4answers
340 views

How can I use 2FA in an MQTT network?

How can I use 2FA (two factor authentication) when I connect a new device to the broker, if it is even possible? Because it seems easier, the second factor can be a software solution first but I ...
12
votes
4answers
1k views

Securing 433 MHz wall light switch

I'm planning to use a simple light switch, that is placed on the wall. The switch gets power from the battery or piezo and sends unique sequences of data (on on- and on off-events) over 433 MHz to the ...
12
votes
1answer
198 views

Cryptographic algorithms for PIC16 microcontrollers

I'm planning to implement my own home automation system. In will contain the central Raspberry PI server and a number of sensors and switches based on 8-bit PIC16 microcontrollers which are ...
12
votes
1answer
948 views

What, exactly, makes SPECK and SIMON particularly suitable for IoT devices?

For some IoT devices, the data that needs to be sent is confidential, and hence sending it in plain text is not acceptable. Therefore, I've been considering how to encrypt data sent between IoT ...
12
votes
1answer
362 views

Can I implement a (weak) entropy source in FPGA?

I'm working with an IoT platform in FPGA for evaluation and prototyping. I need to provide support for TLS, and for that I need an entropy source. I understand that true random noise sources are ...
11
votes
4answers
4k views

Are There Energy Monitoring Smart Plugs That Don't Compromise my Privacy/Security?

It seems like every Smart Plug I see on Amazon (including well-reviewed ones) require me to sign up, giving a lot of device, location, and personal information to a company I don't know or trust (...
11
votes
2answers
192 views

Is there a certificate to indicate the security level of IoT devices?

Is there any reliable certificate for IoT devices, which can be used to compare the provided security of these devices?1 Currently, the IoT landscape is completely scattered with different protocols, ...
10
votes
3answers
2k views

Performance of MQTT over TLS vs. MQTT

While MQTT is quite versatile it is also not secured on itself. This is by design. According to Stanford-Clark, security was consciously left out of the protocol initially because he and Nipper ...
10
votes
1answer
522 views

Should I build isolated networks for IoT devices vs. regular computers? [duplicate]

In a home environment that will have both traditional computing activities (desktop and laptop computers, NAT storage devices, printers, etc.) and IoT devices (internet connected thermometers, ...
10
votes
1answer
452 views

When is Z-Wave S2 Security Mandatory?

When Z-Wave had security problems last year, I was pleased to see it announced that S2 Security would be mandatory for all new certifications as of April and that they didn't back off at that time. ...
9
votes
5answers
349 views

Are there any ready cloud services or frameworks for firmware update over the air?

I have prototype of the resource constrained-device (8-bit MCU with no-OS firmware), interacting with a web server. I wonder are there any solutions, frameworks or cloud services for updating my ...
9
votes
3answers
3k views

How to protect Raspberry Pi from attack in an IoT setup connected through a Broadband network?

The Setup: I have a Raspberry Pi as the master node which is connected to the internet through a broadband connection, the raspberry pi connects several sensors and other microcontrollers. The Pi is ...
9
votes
2answers
709 views

Connect IoT devices directly to Wi-Fi or through a VLAN?

I have a bunch of IoT switches connected to my Wi-Fi. I am aware of three possibilities to connect and control them. Through the Wi-Fi directly (like Samsung SmartThings does) Connect them to a ...
9
votes
2answers
510 views

How do car insurance tracking devices connect to the internet?

There are these devices that you can plug into your car and the insurance company can get real time data to "lower" your insurance cost. Image from U.S.News, 2016. How do they connect to ...
9
votes
2answers
261 views

Will multiple simultaneous biometric sensors create unbreakable security for devices?

This article quotes the CEO of Image Ware, [The solution] according to Miller, is multi-modal biometrics which he claims makes it virtually impossible for the wrong person to access computer ...
9
votes
2answers
518 views

Can One-way SSL secure an IoT device?

I am considering an IoT device connected to my local network (default settings, no VPN, no NAT, no DMZ) with or without Internet access. My device will run as a HTTP server offering a RPC mechanism ...
9
votes
2answers
483 views

Ways of testing IoT sensor security

I am supervising a group of students and their task is to build iot sensors for a few different tasks (ie temperature, movement). I want to score them on how securely they design their sensors among ...
9
votes
1answer
1k views

Harmony Hub Security

Today I—likely—stumbled upon a major security leak in my home automation setup. Scenario I installed the ha bridge github project on my Raspberry Pi, mainly to see what it can do. I literally just ...
9
votes
1answer
412 views

How do I generate a Time-based One-time Password with IFTTT?

I recently registered with IFTTT, which seems like a fantastic service to chain events together in order to create a smart home or automate various services. I've just found the Maker channel which ...
8
votes
2answers
58 views

Rogue Start-Up of Robot sweeper

I have an Xiaomi Mi robot sweeper and at 7:00:40pm each day it is being started up by a rogue internet message. I saved the active IP table from the DD-WRT router firmware immediately before and ...
8
votes
1answer
526 views

Best practices for secure Over The Air updates [closed]

What are the best security practices to follow when issuing an OTA update to a fleet of IoT devices? What are the significant causes for concern? For example, preventing an update from being ...
8
votes
3answers
522 views

Standards for keeping devices' security up-to-date

With IoT devices typically being built with low profit margins and low power specifications, functionality is typically limited to that which is needed. But for a device that is expected to last a ...
8
votes
1answer
168 views

How do Smart Home Security Boxes work?

With the increased security risks against IoT based smart homes, many security appliances have been commercialized. These appliances or boxes claim to protect the home network from malware, cyber-...
8
votes
2answers
1k views

Set Arlo Mode with SmartThings

If it's possible, how can I set the "Mode" for an Arlo device using a SmartThings Routine? Ideally, I would simply set the camera modes when SmartThings goes into various security modes. I've found ...
8
votes
2answers
171 views

Using OpenIoT for detecting sensor node attacks

I just read about OpenIoT project. There are some points which I want to be clear about. I want to perform SYN-Flood attack detection in wireless sensor nodes. A transmitter module is made from ...
8
votes
1answer
219 views

Quantum mechanics and Blockchain to secure IoT

I came across this article on IoT Security with Blockchain and Quantum mechanics. So, what's a quantum-secure blockchain and why is it more secure in an IoT setting?
8
votes
1answer
606 views

Will replacing the firmware secure my Foscam IP camera?

I was thinking about bringing my Foscam FI8910W back into service (assuming it still works), but I've just come across this rather extensive vulnerability disclosure list. I was wondering if there was ...
8
votes
1answer
436 views

How can I set up IP whitelisting on an IP camera without support for whitelists?

The camera in question is a Ring Stick Up Cam. I want to add an additional layer of security and prevent anyone from peeking (listening) into my home. I thought that it might be good if I could set ...