Questions tagged [security]

For questions relating to the security of IoT devices (especially those connected directly to the internet) and how to mitigate these issues or avoid them altogether. Do not confuse this with device safety (If it gets hacked it's a security question, if it explodes it's a safety question).

Filter by
Sorted by
Tagged with
1
vote
0answers
12 views

LoRaWAN end-to-end security with Over The Air Activation

We are planning to connect several thousands of door opening and other home security sensors to a public LoRaWAN network country-wide, but our concern is, that in theory our public LoRaWAN network ...
0
votes
1answer
27 views

How can I identify what kind of IoT device is in my network?

I am trying to build a system in which IoT devices can connect and are classified without the need for manual checks by the system administrator. In this system, IoT devices will send data, and on the ...
2
votes
2answers
48 views

Are there Arduino boards that can be used as a small web server, supporting HTTPS?

I would like to control a relay from over the internet. I was thinking of making this using an Arduino and some wifi/ethernet shield. Searching the internet, I see a lot of shields and modules that ...
2
votes
2answers
59 views

How can I make a topic/action to be allowed only to authorized users?

This is the scenario: I have a machine connected to a MQTT AWS-IoT Core broker. This machine is authorized with the AWS certificates to publish in the topic P/serialnb/deleterecords/record_id. This ...
30
votes
3answers
1k views

Intercepting web traffic going over cellular network

If you can plug a device into the wall, or use it in Wi-Fi, it's easy to see the traffic with software like WireShark. But it seems more tricky to do it with a device that uses LTE/3G or other ...
3
votes
1answer
84 views

Bare minimum infrastructure to keep a fleet of IoT devices running and ensure updates to OS and applications?

The number of currently available tools to run and maintain a fleet of IoT devices is staggering. To compare all is not feasible, however a list of the bare minimum required features to look for would ...
5
votes
1answer
87 views

Why does LoRaWAN 1.1 use MAC-then-encrypt for Join-Accept messages?

In the LoRaWAN 1.1. standard it says on Page 16 "For Join-Accept frame, the MIC field is encrypted with the payload and is not a separate field". In other scenarios the message integrity code is a ...
-1
votes
1answer
26 views

How to fix this problem "connection to this site is not secure"? [closed]

I tried to access this website http://www.oaic.dz:9001/forms/frmservlet many times, but it denied me accessing (only white page) as it shows in the attached file (screenshot) I tried installing Java, ...
1
vote
0answers
18 views

IoT Malware and Botnets

According to Wikipedia, A botnet is a logical collection of Internet-connected devices such as computers, smartphones or Internet of things (IoT) devices whose security have been breached and control ...
0
votes
0answers
33 views

Security concerns

I'm not very versed in WiFi technology and jargon, so please keep this simple. Suppose you have an item that you don't want to give access to your main WiFi network, for security reasons. Suppose ...
0
votes
0answers
37 views

How to authenticate a device in the IoT platform?

I am building an IoT platform that should receive data from a Raspberry Pi over a REST API. Assuming the platform could in the future be used to manage multiple devices of multiple users, my question ...
0
votes
0answers
29 views

Does my local home automation system have to use secure communication?

I am creating (programming) my own home automation system. It will consist of 3 apps: Client app, which will communicate (update) database in the cloud Server on Raspberry pi, which will listen to ...
6
votes
1answer
55 views

Securing first connection of non provisioned IoT device

Assumptions The IoT Device is actually a software installable on supported operating system, e.g. Windows or Linux. Lets named it Software-Device. The Software-Device is available to download by ...
0
votes
1answer
34 views

Can I disable read access to an SD card by removing the read wire? [closed]

I want an internet connected host, such as a Raspberry Pi, to be able to write uploaded files to a directly-connected SD card, but I don't want it to be able to read the card. This is for protection ...
126
votes
4answers
14k views

How can I stop Alexa from ordering things if it hears a voice on TV?

According to The Register, lots of Amazon Echo devices were accidentally triggered by a presenter saying 'Alexa ordered me a dollhouse'. Telly station CW-6 said the blunder happened during a Thursday ...
15
votes
2answers
1k views

What simple security tests can I perform on my MQTT network?

I am about to set up an MQTT network at home. I want to build up some knowledge by practical exercises. It would be a small network with the broker hosted on my laptop (Windows 7) and some Raspberry ...
4
votes
0answers
133 views

Monitor Eufy Homebase from iPhone Apple Home?

I have a Eufy Homebase 2 with 6 EufyCam 2C and a wired doorbell connected. The Homebase is setup as a “room” in Apple HomeKit. The Homebase is Ethernet connected to Xfinity new router, with wifi ...
6
votes
1answer
62 views

Do I need different certificates for every thing?

I'm learning AWS and I created a new thing with the required certificates to access it via MQTT: root-CA.crt .private.key .cert.pem If I'm not wrong the root-CA.crt file will be the same for all the ...
4
votes
1answer
46 views

Smart Locks with Alert feature

Are there any smart lock products that are capable of sending out alerts: Alert via text/email when lock is opened with code Alerts when lock is forcefully opened Alerts when lock becomes unreachable ...
2
votes
0answers
448 views

How to have a Nedis smart device to connect to WiFi network without app and registering?

I have a Nedis WIFIHTPL20FWT Smart conversion heater. It seems that I need to register to Nedis cloud service and only then using Nedis SmartLife App this device could be connected to my local WLAN. I ...
2
votes
0answers
37 views

Guidance for a data logger and radio

I've currently been working with a consultant, whom recommended we utilize an architecture that is based off the Microchip ATMELAVR 8 bit Arduino framework. The board is called a Mayfly, picture ...
2
votes
1answer
44 views

Prevent a remote MQTT client from connecting to a broker

I am a newbie to MQTT, I was wondering how could one prevent a client who is not running in the same processor, where the broker is also running, to connect with the broker. In other way, restricting ...
3
votes
1answer
54 views

MQTT Client Broker communication - can a malicious client masquerade as a legitimate one after being connected with credentials

I would like to ask a question that I have about MQTT client broker communication. Let's say, a client C1 is connected to the broker with user name and password (with no encryption). What happens when ...
1
vote
0answers
66 views

OOB pairing without NFC

I'm building a medical device with NFC capability. This medical device can be connected to a mobile phone/tablet over Bluetooth and operated by an App. During the pairing process, the App asks the ...
4
votes
2answers
100 views

Testing security of IoT devices

Searching the archives for "fuzz" and "pentest" only results in 2-3 relevant threads on this topic and they are all from 2016/2017. I would really like to subject my IoT devices (e....
0
votes
0answers
32 views

What does the abbreviation "SPINS" for the security protocol for WSN mean?

Since the protocol SPINS is as far as I understand it commonly spread I would like what exactly the abbreviation means in the paper "SPINS: Security Protocols for Sensor Networks" by Perrig et al. he ...
3
votes
1answer
48 views

Creating a secure MQTT session with TLS while employing smartphone gateway

My IoT device creates a BLE connection with a smartphone from which it connects to cloud. When integrating a TLS, should it be above MQTT or below? All implementation I have reviewed so far does it ...
26
votes
7answers
4k views

Could a blockchain really prevent malware in the Internet of Things?

This article claims that using a blockchain-based security system for an IoT network would prevent some types of attacks: Blockchain technology may help offer an answer. Gada observes that blockchain ...
1
vote
1answer
31 views

Tools to generate Access Tokens for Devices without the use of platforms

According to the present IoT landscape the Users of the data can either use the following interfaces to access IoT information: Web Apps Smart Phone Apps However with the user of new technologies as ...
1
vote
0answers
36 views

High level architecture for cloud/iot solution with multiple customers/users

We're at the early planning stage for a new cloud IOT solution and i'm looking for some guidance or direction for the high level architecture for our use case: Assume we sell 10,000 edge devices to ...
11
votes
4answers
5k views

Are There Energy Monitoring Smart Plugs That Don't Compromise my Privacy/Security?

It seems like every Smart Plug I see on Amazon (including well-reviewed ones) require me to sign up, giving a lot of device, location, and personal information to a company I don't know or trust (...
6
votes
2answers
162 views

Encrypting sensor data on Raspberry Pi?

I am sending sensor data between two Raspberry Pis via lora. I am using two Lora Radios and NOT using a LoraWan network like The Things Network. How should I encrypt my data? Are there any open source ...
2
votes
0answers
36 views

Secure External Network Control of a MQTT Server on a Raspberry Pi

I'm trying to build a home automation system using MQTT. I'm using a Raspberry Pi as the broker. Everything works great as far as controlling it when connected to the same network. But I want to have ...
4
votes
2answers
118 views

OS for Orange Pi zero plus

I bought an orange pi zero plus and want to make a wifi access point that passes all traffic of the connected devices through tor. Simply I wanted a dev board that has gigabit ethernet and wifi for ...
7
votes
2answers
5k views

How to prevent access to a Sonos system

I have a Sonos in a pub (although this applies to any public place which shares the wifi). The router (TP-LINK Archer VR4000) has a guest network and this is locked to not share the local network. ...
2
votes
2answers
52 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
9
votes
2answers
803 views

Can One-way SSL secure an IoT device?

I am considering an IoT device connected to my local network (default settings, no VPN, no NAT, no DMZ) with or without Internet access. My device will run as a HTTP server offering a RPC mechanism ...
13
votes
4answers
391 views

How can I use 2FA in an MQTT network?

How can I use 2FA (two factor authentication) when I connect a new device to the broker, if it is even possible? Because it seems easier, the second factor can be a software solution first but I ...
5
votes
1answer
659 views

Solutions to secure MQTT-SN over UDP with DTLS (or alternatives)

We want to secure the transport of MQTT-SN messages send over UDP e.g. with DTLS. Searching the internet showed that there are considerations and activities on using DTLS to secure the transport of ...
15
votes
2answers
2k views

How do consumer IoT devices typically enable Internet connection?

As far as I know there are 2 general methods for enabling remote (Internet, not LAN) access to IoT devices: Via a server that the device polls periodically (e.g. MQTT) Direct remote access I'm ...
1
vote
1answer
164 views

How enrollment list in Azure IoT Hub Device Provisioning Service isolate tenant specific configuration?

Some documentation and videos regarding Device Provisioning Service (DPS) says it can handle multitenancy but, it seem there is a confusion about how one tenant's configuration/data is isolated from ...
2
votes
1answer
162 views

Should there be one device provisioning service for one IoT hub if it is associated with one tenant?

I have a multi-tenancy situation where I have created one IoT hub per tenant. Now if I have 5 tenants, and I create 5 Iot hub, should I also create 5 device provisioning service for those 5 IoT hubs (...
3
votes
1answer
75 views

IoT <-> Cloud communication method

I am struggling with creation of multiple IoT devices (NanoPi like) which will be controlled via cloud server. I wish to use MQTT as I see this is the best method for small footprint. I know MQTT has ...
2
votes
0answers
84 views

What is the most safe and easy way to send a command to a remote Raspberry Pi? [closed]

I would like to send a command with some predetermined number of arguments to a Raspberry Pi and get the output back from it. I was thinking of using restricted ssh key but was wondering if that is ...
6
votes
1answer
633 views

Is "Insecure Rejoin" still enabled by default for Samsung SmartThings hubs?

According to Cognosec, there is a critical vulnerability with ZigBee (one of the protocols supported by the SmartThings hub) which allows attackers to gain access to a ZigBee network by abusing a ...
8
votes
2answers
63 views

Rogue Start-Up of Robot sweeper

I have an Xiaomi Mi robot sweeper and at 7:00:40pm each day it is being started up by a rogue internet message. I saved the active IP table from the DD-WRT router firmware immediately before and ...
5
votes
0answers
121 views

Provisioning "things" on AWS IoT without certificates confusion

I am new to AWS IoT. I wish to use AWS IoT's feature called JITP (Just In Time Provisioning) to provision my gateways automatically. I am using BeagleBone boards as device gateways. I followed the ...
8
votes
1answer
258 views

Privacy with Voice Assistants

I am interested in getting a Smart Home system with a good voice assistant, but my wife refuses to allow a voice assistant like Google Home or Amazon Alexa because she does not want ANY recordings ...
9
votes
2answers
685 views

How do car insurance tracking devices connect to the internet?

There are these devices that you can plug into your car and the insurance company can get real time data to "lower" your insurance cost. Image from U.S.News, 2016. How do they connect to ...
4
votes
1answer
318 views

Entropy depletion in /dev/random on Beaglebone

I have a Beagleblone Black with an ARMv7 SoC. /proc/cpuinfo says the hardware is Generic AM33XX. It is running Debian and the 4.1.15-ti-rt-r40 kernel. I run a lot of stress tests as part of my ...