Questions tagged [security]

For questions relating to the security of IoT devices (especially those connected directly to the internet) and how to mitigate these issues or avoid them altogether. Do not confuse this with device safety (If it gets hacked it's a security question, if it explodes it's a safety question).

Filter by
Sorted by
Tagged with
11
votes
3answers
2k views

Performance of MQTT over TLS vs. MQTT

While MQTT is quite versatile it is also not secured on itself. This is by design. According to Stanford-Clark, security was consciously left out of the protocol initially because he and Nipper ...
9
votes
3answers
3k views

How to protect Raspberry Pi from attack in an IoT setup connected through a Broadband network?

The Setup: I have a Raspberry Pi as the master node which is connected to the internet through a broadband connection, the raspberry pi connects several sensors and other microcontrollers. The Pi is ...
8
votes
1answer
489 views

How can I set up IP whitelisting on an IP camera without support for whitelists?

The camera in question is a Ring Stick Up Cam. I want to add an additional layer of security and prevent anyone from peeking (listening) into my home. I thought that it might be good if I could set ...
5
votes
2answers
220 views

Is a 'chain reaction' of ZigBee bulbs being hacked feasible?

I recently saw this video, in which some students attached an 'attack kit' to a drone and flew it near office blocks. According to their paper: We managed to tie a fully autonomous attack kit ...
54
votes
8answers
2k views

Securing small home automation setup

I have a small home automation lab (that I keep saying I'll expand, but haven't). In this setup, I have a control system to control lights (utilizing the x10 protocol), blinds, a Nest thermostat and ...
9
votes
5answers
417 views

Are there any ready cloud services or frameworks for firmware update over the air?

I have prototype of the resource constrained-device (8-bit MCU with no-OS firmware), interacting with a web server. I wonder are there any solutions, frameworks or cloud services for updating my ...
16
votes
3answers
5k views

What is the difference between a DDoS attack and a PDoS attack?

I've read a certain amount about the Mirai worm, a virus that attacks Internet of Things devices using default usernames and passwords and essentially is wired to produce a Distributed Denial of ...
8
votes
2answers
1k views

Set Arlo Mode with SmartThings

If it's possible, how can I set the "Mode" for an Arlo device using a SmartThings Routine? Ideally, I would simply set the camera modes when SmartThings goes into various security modes. I've found ...
2
votes
1answer
202 views

Which virus infected IoT devices in a university and brought down their network by sending requests to seafood websites?

According to this article from The Register, a university network was recently brought down by what was essentially a DDoS attack from various connected devices on the network campus (specifically ...
9
votes
1answer
595 views

Best practices for secure Over The Air updates [closed]

What are the best security practices to follow when issuing an OTA update to a fleet of IoT devices? What are the significant causes for concern? For example, preventing an update from being ...
6
votes
1answer
150 views

Keep my Teddy Bear from being hacked

I recently ran across an article on arstechnica.com which outlines a recently discovered hack for teddy bears. Apparently, Spiral Toys, the manufacturer of Cloud Pets Stuffed Animals, implemented a ...
8
votes
1answer
732 views

Will replacing the firmware secure my Foscam IP camera?

I was thinking about bringing my Foscam FI8910W back into service (assuming it still works), but I've just come across this rather extensive vulnerability disclosure list. I was wondering if there was ...
19
votes
4answers
4k views

Is my Samsung Smart TV vulnerable to the "weeping angel" attack?

On CNet, there's a report about Samsung UNF 8000 smart TVs being vulnerable to a hack developed by the CIA: In June 2014, the CIA and UK's MI5 held a joint workshop to improve the "Weeping Angel" ...
9
votes
2answers
802 views

Connect IoT devices directly to Wi-Fi or through a VLAN?

I have a bunch of IoT switches connected to my Wi-Fi. I am aware of three possibilities to connect and control them. Through the Wi-Fi directly (like Samsung SmartThings does) Connect them to a ...
12
votes
4answers
2k views

Is it a bad practice to keep certificates on external memory?

We're working on AWS-IoT using an STM32 microcontroller. Till today, we were writing the certificates to the flash and locking the flash from external reading. As the application code increases, we'...
10
votes
1answer
452 views

How do I generate a Time-based One-time Password with IFTTT?

I recently registered with IFTTT, which seems like a fantastic service to chain events together in order to create a smart home or automate various services. I've just found the Maker channel which ...
13
votes
3answers
410 views

Should I use a different password on each IoT device?

According to cmswire.com, one of the major security risks with the Internet of Things is Insufficient Authentication/Authorization. When it comes to the Internet of Things, should I use a different ...
2
votes
1answer
1k views

Will disabling my network's SSID broadcast cause my WPA encryption to be disabled? [closed]

I encountered this message when I tried to disable the SSID broadcast of my home network. Does this mean that my router's Wi-Fi connection will no longer be encrypted? Sorry I'm pretty new to ...
21
votes
5answers
1k views

Is there any advantage in encrypting sensor data that is not private?

Some sites, such as this article on end-to-end encryption for IoT, suggest that all traffic sent across the IoT network should be encrypted, saying: Enterprises, government agencies and other ...
6
votes
1answer
157 views

Why does this whitepaper say MQTT usernames/passwords "do not provide enough entropy"?

This whitepaper comparing MQTT and AMQP says that MQTT's username/password restrictions make it far less secure than AMQP: MQTT requires short user names and short passwords that do not provide ...
29
votes
3answers
683 views

What are the best security practices to secure a remote IoT camera?

I have done a bit of home automation such as building a remote camera that can be turned on via SSH locally and publishes images on a Raspberry Pi run Linux server. I'm curious, though, as to what ...
7
votes
1answer
144 views

What can I do if a smart DVR camera only supports default passwords?

An awful lot of devices on the market for home automation have severe security flaws, such as hard-coded passwords (or no passwords at all!). To make it worse, it's hard to find information on the ...
7
votes
1answer
135 views

Which D-Link IP cameras are affected by the FTC complaint, and what can I do about them?

The FTC have filed a legal complaint against D-Link alleging that their routers and IP cameras have critical security vulnerabilities and are misleading consumers into believing they are safe. ...
13
votes
1answer
214 views

Cryptographic algorithms for PIC16 microcontrollers

I'm planning to implement my own home automation system. In will contain the central Raspberry PI server and a number of sensors and switches based on 8-bit PIC16 microcontrollers which are ...
8
votes
1answer
2k views

Disadvantages of decentralized peer-to-peer networks in IoT

I have recently read an article about why IoT should switch from the now dominant centralized (server - client) model to a decentralized peer-to-peer solution. Reasons against centralization: ...
19
votes
2answers
2k views

How do I secure communication between app and IoT device?

I am currently working on a project that includes Bluetooth communication between a mobile application (currently using the Ionic platform) and an embedded device. For comparison, our product is ...
17
votes
1answer
975 views

Secure Home Network Partition for IoT Devices

What is the best approach to partitioning IoT devices from non-IoT devices at home? I have heard that setting up separate networks, one for IoT devices and one for everything else, is a good ...
13
votes
1answer
1k views

What, exactly, makes SPECK and SIMON particularly suitable for IoT devices?

For some IoT devices, the data that needs to be sent is confidential, and hence sending it in plain text is not acceptable. Therefore, I've been considering how to encrypt data sent between IoT ...
11
votes
1answer
578 views

Should I build isolated networks for IoT devices vs. regular computers? [duplicate]

In a home environment that will have both traditional computing activities (desktop and laptop computers, NAT storage devices, printers, etc.) and IoT devices (internet connected thermometers, ...

1 2
3