Questions tagged [security]

For questions relating to the security of IoT devices (especially those connected directly to the internet) and how to mitigate these issues or avoid them altogether. Do not confuse this with device safety (If it gets hacked it's a security question, if it explodes it's a safety question).

Filter by
Sorted by
Tagged with
-2
votes
1answer
249 views

How is LTE organized in NB-IoT [closed]

How is LTE organized in NB-IoT? And can one find vulnerabilities in NB-IoT technology (security)?
6
votes
1answer
208 views

Creating a Tor 'hidden service' on Windows IoT Core

The Background I'm prototyping some basic home automation software using Windows IoT Core and Azure. I have built a Windows Universal Application that sends data to a Web App hosted in Azure via Web ...
8
votes
1answer
354 views

How to secure a Samsung Smart Refrigerator against BlueBorne?

Armis Labs lately revealed a new attack vector that attacks essentially all major OS including those used on IoT devices via Bluetooth. BlueBorne is reported to spread malware laterally to adjacent ...
13
votes
4answers
1k views

Can programs loaded onto NodeMCU board be extracted?

I am using a NodeMCU board with WiFi capabilities to build a simple asset tracker. I have managed to find a few Arduino sketches that enables connectivity to Azure IoT Hub and post messages. One of ...
8
votes
2answers
171 views

Using OpenIoT for detecting sensor node attacks

I just read about OpenIoT project. There are some points which I want to be clear about. I want to perform SYN-Flood attack detection in wireless sensor nodes. A transmitter module is made from ...
3
votes
0answers
176 views

What's the difference between Jackdaw and KillerBee on RZ Raven USB Stick [closed]

What is the difference between Jackdaw and KillerBee on ZigBee USB Stick, both seem to be sniffing packet, but Jackdaw can act as a network interface, and KillerBee is only used for pentest? As far as ...
8
votes
1answer
225 views

Quantum mechanics and Blockchain to secure IoT

I came across this article on IoT Security with Blockchain and Quantum mechanics. So, what's a quantum-secure blockchain and why is it more secure in an IoT setting?
4
votes
1answer
161 views

How to limit SmartThings Lock to prevent accidental unlock?

I have a Schlage Connect Z-Wave door lock. I can control it via my SmartThings App but I do not feel secure knowing that someone who hacked my account or my phone can easily gain access to my home. ...
6
votes
2answers
237 views

Is it ever a good idea to 'roll your own' protocol for IoT device communication?

I've heard many people mention that their embedded IoT devices aren't powerful enough to process known protocols, like HTTPS or even TLS security for sockets. Instead, they turn to creating their own ...
11
votes
3answers
2k views

Performance of MQTT over TLS vs. MQTT

While MQTT is quite versatile it is also not secured on itself. This is by design. According to Stanford-Clark, security was consciously left out of the protocol initially because he and Nipper ...
7
votes
2answers
5k views

How to prevent access to a Sonos system

I have a Sonos in a pub (although this applies to any public place which shares the wifi). The router (TP-LINK Archer VR4000) has a guest network and this is locked to not share the local network. ...
5
votes
1answer
234 views

Secure access to IoT small device

I'm building a small server at home, and I'd like to have a sort of "smart" board to control its power. This board will have, at the beginning, to simply turn it on or off (more features will be added ...
9
votes
3answers
3k views

How to protect Raspberry Pi from attack in an IoT setup connected through a Broadband network?

The Setup: I have a Raspberry Pi as the master node which is connected to the internet through a broadband connection, the raspberry pi connects several sensors and other microcontrollers. The Pi is ...
5
votes
2answers
212 views

Is a 'chain reaction' of ZigBee bulbs being hacked feasible?

I recently saw this video, in which some students attached an 'attack kit' to a drone and flew it near office blocks. According to their paper: We managed to tie a fully autonomous attack kit ...
8
votes
2answers
1k views

Set Arlo Mode with SmartThings

If it's possible, how can I set the "Mode" for an Arlo device using a SmartThings Routine? Ideally, I would simply set the camera modes when SmartThings goes into various security modes. I've found ...
6
votes
2answers
3k views

Does Arlo Pro communicate via WiFi?

I just setup an Arlo Pro security camera (made by Netgear) and found it interesting that the system didn't explicitly have me configure a WiFi connection. The setup process consists of hard-wiring the ...
6
votes
2answers
225 views

How to secure root on IoT device while remaining open to tinkerers

I'm currently spitballing ideas for an Internet of Things device. It will be running Linux on a widely available development board, I'm not too concerned about physical security or the end user doing ...
16
votes
3answers
5k views

What is the difference between a DDoS attack and a PDoS attack?

I've read a certain amount about the Mirai worm, a virus that attacks Internet of Things devices using default usernames and passwords and essentially is wired to produce a Distributed Denial of ...
9
votes
2answers
491 views

Ways of testing IoT sensor security

I am supervising a group of students and their task is to build iot sensors for a few different tasks (ie temperature, movement). I want to score them on how securely they design their sensors among ...
6
votes
1answer
147 views

Keep my Teddy Bear from being hacked

I recently ran across an article on arstechnica.com which outlines a recently discovered hack for teddy bears. Apparently, Spiral Toys, the manufacturer of Cloud Pets Stuffed Animals, implemented a ...
9
votes
5answers
354 views

Are there any ready cloud services or frameworks for firmware update over the air?

I have prototype of the resource constrained-device (8-bit MCU with no-OS firmware), interacting with a web server. I wonder are there any solutions, frameworks or cloud services for updating my ...
19
votes
4answers
4k views

Is my Samsung Smart TV vulnerable to the “weeping angel” attack?

On CNet, there's a report about Samsung UNF 8000 smart TVs being vulnerable to a hack developed by the CIA: In June 2014, the CIA and UK's MI5 held a joint workshop to improve the "Weeping Angel" ...
15
votes
2answers
2k views

How do consumer IoT devices typically enable Internet connection?

As far as I know there are 2 general methods for enabling remote (Internet, not LAN) access to IoT devices: Via a server that the device polls periodically (e.g. MQTT) Direct remote access I'm ...
8
votes
1answer
631 views

Will replacing the firmware secure my Foscam IP camera?

I was thinking about bringing my Foscam FI8910W back into service (assuming it still works), but I've just come across this rather extensive vulnerability disclosure list. I was wondering if there was ...
13
votes
4answers
811 views

How do I protect my home from IoT devices being compromised and being used for DDoS attacks?

I am trying to understand the vulnerability of my home IoT devices. From what I understand, the big DDoS last year was caused by compromised IoT devices with generic or default usernames and passwords....
9
votes
2answers
729 views

Connect IoT devices directly to Wi-Fi or through a VLAN?

I have a bunch of IoT switches connected to my Wi-Fi. I am aware of three possibilities to connect and control them. Through the Wi-Fi directly (like Samsung SmartThings does) Connect them to a ...
4
votes
1answer
2k views

How to modify Mosquitto's Windows Firewall Inbound Rule to only allow connections from specific IP addresses?

I am trying to set up IP whitelisting for my Mosquitto broker on Windows 7. To do so I have performed the following steps, based on this article: How to Whitelist Your IP - Windows Dedicated. Open ...
2
votes
1answer
198 views

Which virus infected IoT devices in a university and brought down their network by sending requests to seafood websites?

According to this article from The Register, a university network was recently brought down by what was essentially a DDoS attack from various connected devices on the network campus (specifically ...
12
votes
1answer
363 views

Can I implement a (weak) entropy source in FPGA?

I'm working with an IoT platform in FPGA for evaluation and prototyping. I need to provide support for TLS, and for that I need an entropy source. I understand that true random noise sources are ...
12
votes
4answers
2k views

Is it a bad practice to keep certificates on external memory?

We're working on AWS-IoT using an STM32 microcontroller. Till today, we were writing the certificates to the flash and locking the flash from external reading. As the application code increases, we'...
7
votes
1answer
3k views

Connect to Chevrolet Cruze Hot-Spot Wi-Fi

The Chevrolet Cruze (2016) is supposed to have a Wi-Fi hot-spot. I do see it showing up in my available network connections, but how do I find the password? From my memory, the dealer didn't say ...
7
votes
1answer
241 views

Will changing my user name and password block Mirai attacks?

I've recently been reading about Mirai, malware whose source has been revealed which is designed to infect IoT devices. It is appears to be a serious threat to security compromised Internet of ...
2
votes
1answer
1k views

Will disabling my network's SSID broadcast cause my WPA encryption to be disabled? [closed]

I encountered this message when I tried to disable the SSID broadcast of my home network. Does this mean that my router's Wi-Fi connection will no longer be encrypted? Sorry I'm pretty new to ...
13
votes
3answers
343 views

Should I use a different password on each IoT device?

According to cmswire.com, one of the major security risks with the Internet of Things is Insufficient Authentication/Authorization. When it comes to the Internet of Things, should I use a different ...
8
votes
1answer
446 views

How can I set up IP whitelisting on an IP camera without support for whitelists?

The camera in question is a Ring Stick Up Cam. I want to add an additional layer of security and prevent anyone from peeking (listening) into my home. I thought that it might be good if I could set ...
6
votes
1answer
571 views

Is “Insecure Rejoin” still enabled by default for Samsung SmartThings hubs?

According to Cognosec, there is a critical vulnerability with ZigBee (one of the protocols supported by the SmartThings hub) which allows attackers to gain access to a ZigBee network by abusing a ...
6
votes
1answer
148 views

Why does this whitepaper say MQTT usernames/passwords “do not provide enough entropy”?

This whitepaper comparing MQTT and AMQP says that MQTT's username/password restrictions make it far less secure than AMQP: MQTT requires short user names and short passwords that do not provide ...
7
votes
1answer
140 views

What can I do if a smart DVR camera only supports default passwords?

An awful lot of devices on the market for home automation have severe security flaws, such as hard-coded passwords (or no passwords at all!). To make it worse, it's hard to find information on the ...
25
votes
7answers
4k views

Could a blockchain really prevent malware in the Internet of Things?

This article claims that using a blockchain-based security system for an IoT network would prevent some types of attacks: Blockchain technology may help offer an answer. Gada observes that blockchain ...
126
votes
4answers
14k views

How can I stop Alexa from ordering things if it hears a voice on TV?

According to The Register, lots of Amazon Echo devices were accidentally triggered by a presenter saying 'Alexa ordered me a dollhouse'. Telly station CW-6 said the blunder happened during a Thursday ...
7
votes
1answer
133 views

Which D-Link IP cameras are affected by the FTC complaint, and what can I do about them?

The FTC have filed a legal complaint against D-Link alleging that their routers and IP cameras have critical security vulnerabilities and are misleading consumers into believing they are safe. ...
12
votes
4answers
420 views

Would using a Tor wifi router make IoT more secure?

Would using a Tor wifi router make IoT more secure from attacks etcetera? These routers provide a Tor client, and also tunnel all internet traffic through a VPN. This anonymises your internet access ...
7
votes
3answers
1k views

How does the Norton Core increase the security of a “smart home”?

Symantec is releasing a new router, the Norton Core, which they describe as "The secure router for your connected home." I found out about this while reading an article on Engadget, but their ...
9
votes
1answer
1k views

Harmony Hub Security

Today I—likely—stumbled upon a major security leak in my home automation setup. Scenario I installed the ha bridge github project on my Raspberry Pi, mainly to see what it can do. I literally just ...
20
votes
5answers
964 views

Is there any advantage in encrypting sensor data that is not private?

Some sites, such as this article on end-to-end encryption for IoT, suggest that all traffic sent across the IoT network should be encrypted, saying: Enterprises, government agencies and other ...
12
votes
1answer
199 views

Cryptographic algorithms for PIC16 microcontrollers

I'm planning to implement my own home automation system. In will contain the central Raspberry PI server and a number of sensors and switches based on 8-bit PIC16 microcontrollers which are ...
12
votes
4answers
349 views

How can I use 2FA in an MQTT network?

How can I use 2FA (two factor authentication) when I connect a new device to the broker, if it is even possible? Because it seems easier, the second factor can be a software solution first but I ...
9
votes
2answers
262 views

Will multiple simultaneous biometric sensors create unbreakable security for devices?

This article quotes the CEO of Image Ware, [The solution] according to Miller, is multi-modal biometrics which he claims makes it virtually impossible for the wrong person to access computer ...
13
votes
2answers
863 views

What simple security tests can I perform on my MQTT network?

I am about to set up an MQTT network at home. I want to build up some knowledge by practical exercises. It would be a small network with the broker hosted on my laptop (Windows 7) and some Raspberry ...
7
votes
1answer
2k views

Disadvantages of decentralized peer-to-peer networks in IoT

I have recently read an article about why IoT should switch from the now dominant centralized (server - client) model to a decentralized peer-to-peer solution. Reasons against centralization: ...