Questions tagged [security]

For questions relating to the security of IoT devices (especially those connected directly to the internet) and how to mitigate these issues or avoid them altogether. Do not confuse this with device safety (If it gets hacked it's a security question, if it explodes it's a safety question).

Filter by
Sorted by
Tagged with
1
vote
0answers
13 views

Guidance for a data logger and radio

I've currently been working with a consultant, whom recommended we utilize an architecture that is based off the Microchip ATMELAVR 8 bit Arduino framework. The board is called a Mayfly, picture ...
1
vote
1answer
22 views

Prevent a remote MQTT client from connecting to a broker

I am a newbie to MQTT, I was wondering how could one prevent a client who is not running in the same processor, where the broker is also running, to connect with the broker. In other way, restricting ...
2
votes
1answer
34 views

MQTT Client Broker communication - can a malicious client masquerade as a legitimate one after being connected with credentials

I would like to ask a question that I have about MQTT client broker communication. Let's say, a client C1 is connected to the broker with user name and password (with no encryption). What happens when ...
1
vote
0answers
22 views

OOB pairing without NFC

I'm building a medical device with NFC capability. This medical device can be connected to a mobile phone/tablet over Bluetooth and operated by an App. During the pairing process, the App asks the ...
4
votes
2answers
88 views

Testing security of IoT devices

Searching the archives for "fuzz" and "pentest" only results in 2-3 relevant threads on this topic and they are all from 2016/2017. I would really like to subject my IoT devices (e....
0
votes
0answers
28 views

What does the abbreviation “SPINS” for the security protocol for WSN mean?

Since the protocol SPINS is as far as I understand it commonly spread I would like what exactly the abbreviation means in the paper "SPINS: Security Protocols for Sensor Networks" by Perrig et al. he ...
3
votes
1answer
38 views

Creating a secure MQTT session with TLS while employing smartphone gateway

My IoT device creates a BLE connection with a smartphone from which it connects to cloud. When integrating a TLS, should it be above MQTT or below? All implementation I have reviewed so far does it ...
1
vote
1answer
25 views

Tools to generate Access Tokens for Devices without the use of platforms

According to the present IoT landscape the Users of the data can either use the following interfaces to access IoT information: Web Apps Smart Phone Apps However with the user of new technologies as ...
1
vote
0answers
31 views

High level architecture for cloud/iot solution with multiple customers/users

We're at the early planning stage for a new cloud IOT solution and i'm looking for some guidance or direction for the high level architecture for our use case: Assume we sell 10,000 edge devices to ...
11
votes
4answers
4k views

Are There Energy Monitoring Smart Plugs That Don't Compromise my Privacy/Security?

It seems like every Smart Plug I see on Amazon (including well-reviewed ones) require me to sign up, giving a lot of device, location, and personal information to a company I don't know or trust (...
2
votes
0answers
31 views

Secure External Network Control of a MQTT Server on a Raspberry Pi

I'm trying to build a home automation system using MQTT. I'm using a Raspberry Pi as the broker. Everything works great as far as controlling it when connected to the same network. But I want to have ...
6
votes
2answers
93 views

Encrypting sensor data on Raspberry Pi?

I am sending sensor data between two Raspberry Pis via lora. I am using two Lora Radios and NOT using a LoraWan network like The Things Network. How should I encrypt my data? Are there any open source ...
4
votes
2answers
75 views

OS for Orange Pi zero plus

I bought an orange pi zero plus and want to make a wifi access point that passes all traffic of the connected devices through tor. Simply I wanted a dev board that has gigabit ethernet and wifi for ...
2
votes
2answers
50 views

Are nodes that are mobile in a IoT network more vulnerable to certain types of attacks?

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has ...
6
votes
0answers
39 views

Securing first connection of non provisioned IoT device

Assumptions The IoT Device is actually a software installable on supported operating system, e.g. Windows or Linux. Lets named it Software-Device. The Software-Device is available to download by ...
3
votes
1answer
67 views

IoT <-> Cloud communication method

I am struggling with creation of multiple IoT devices (NanoPi like) which will be controlled via cloud server. I wish to use MQTT as I see this is the best method for small footprint. I know MQTT has ...
1
vote
1answer
113 views

How enrollment list in Azure IoT Hub Device Provisioning Service isolate tenant specific configuration?

Some documentation and videos regarding Device Provisioning Service (DPS) says it can handle multitenancy but, it seem there is a confusion about how one tenant's configuration/data is isolated from ...
2
votes
1answer
125 views

Should there be one device provisioning service for one IoT hub if it is associated with one tenant?

I have a multi-tenancy situation where I have created one IoT hub per tenant. Now if I have 5 tenants, and I create 5 Iot hub, should I also create 5 device provisioning service for those 5 IoT hubs (...
2
votes
0answers
80 views

What is the most safe and easy way to send a command to a remote Raspberry Pi? [closed]

I would like to send a command with some predetermined number of arguments to a Raspberry Pi and get the output back from it. I was thinking of using restricted ssh key but was wondering if that is ...
4
votes
0answers
70 views

Why does LoRaWAN 1.1 use MAC-then-encrypt for Join-Accept messages?

In the LoRaWAN 1.1. standard it says on Page 16 "For Join-Accept frame, the MIC field is encrypted with the payload and is not a separate field". In other scenarios the message integrity code is a ...
5
votes
0answers
107 views

Provisioning “things” on AWS IoT without certificates confusion

I am new to AWS IoT. I wish to use AWS IoT's feature called JITP (Just In Time Provisioning) to provision my gateways automatically. I am using BeagleBone boards as device gateways. I followed the ...
8
votes
1answer
240 views

Privacy with Voice Assistants

I am interested in getting a Smart Home system with a good voice assistant, but my wife refuses to allow a voice assistant like Google Home or Amazon Alexa because she does not want ANY recordings ...
8
votes
2answers
58 views

Rogue Start-Up of Robot sweeper

I have an Xiaomi Mi robot sweeper and at 7:00:40pm each day it is being started up by a rogue internet message. I saved the active IP table from the DD-WRT router firmware immediately before and ...
4
votes
1answer
230 views

Entropy depletion in /dev/random on Beaglebone

I have a Beagleblone Black with an ARMv7 SoC. /proc/cpuinfo says the hardware is Generic AM33XX. It is running Debian and the 4.1.15-ti-rt-r40 kernel. I run a lot of stress tests as part of my ...
4
votes
0answers
51 views

How to use dedicated cryptochips

I have a chip that needs to send arbitrary data to a server that I do not control. We're using mbed TLS at the moment, however the binary is quite large. So, we introduced a dedicated cryptographic ...
6
votes
1answer
54 views

How can I view the website from the Maker Pro IoT Smoke Alarm?

https://maker.pro/arduino/projects/iot-smoke-alarm-arduino-esp8266-gas-sensor I'm a layman who wants to do this. Have completed it as shown in the link. But I don't know how to see the website and ...
3
votes
1answer
46 views

Possibility of integrating secure elements with sensor networks?

Assume we need to do a type of digital signature such as ECDSA with sensors used in sensor networks. So, is there a secure and possible approach to store the keys in these sensors? For example, is ...
8
votes
2answers
263 views

How can I use End-to-end encryption in sensors network?

I have been reading about XMPP and its extensions. One of them called (XEP-xxxx: Sensor-Over-XMPP) which is really interesting. I have read also about another XMPP extension which is OMEMO protocol ...
6
votes
2answers
111 views

By what mechanism are IoT widgets vulnerable to hacking?

I hear news stories that millions of thermostats and fridges have not been properly secured by their manufacturers. I could understand how something running linux with sshd running (as it might well ...
4
votes
1answer
314 views

How to configure Wifi on a headless smart device?

I am looking to build a smart device with no external controls (no buttons, display, etc.) and am trying to figure out how to most easily allow a user to supply Wifi configuration to it. A specific ...
6
votes
1answer
555 views

How to register an IoT device to a user account

I'm designing on an IoT device that connects to a web server and publishes/subscribes to the MQTT service. Users download an iOS app to setup/register/use their device. Question: What's the ...
9
votes
2answers
558 views

Can One-way SSL secure an IoT device?

I am considering an IoT device connected to my local network (default settings, no VPN, no NAT, no DMZ) with or without Internet access. My device will run as a HTTP server offering a RPC mechanism ...
5
votes
1answer
534 views

Solutions to secure MQTT-SN over UDP with DTLS (or alternatives)

We want to secure the transport of MQTT-SN messages send over UDP e.g. with DTLS. Searching the internet showed that there are considerations and activities on using DTLS to secure the transport of ...
4
votes
1answer
474 views

mosquitto - allow_anonymous false shows connected message

I have set the acl_file property in /etc/mosquitto/mosquitto.conf to /home/ubuntu/my.acl. In the ACL file, I have allow_anonymous false to disallow connections from clients that do not have user name. ...
7
votes
2answers
2k views

Are there any surveillance cameras/devices that are EU General Data Protection Regulation (GDPR) compliant?

I recently came across the EU General Data Protection Regulation (GDPR) meant for data privacy regulation. The final Version of GDPR was released December/2015. Any surveillance camera or devices ...
5
votes
0answers
40 views

Home intrusion detection system - UltraSync 1347 - reliability

Does anyone have information about UltraSync 1347, a system that allows you to control a home intrusion system remotely from your smartphone (receive alerts, arm or disarm the system)? I could not ...
5
votes
1answer
57 views

Secure pairing support in various RF standards

I would like to understand if secure pairing can be implemented in all (or none?) IoT RF standards. For example: BLE provides Out-of-band possibility, which seems like only really secure option to ...
6
votes
2answers
566 views

How does URL Remote Access method work?

Unfortunately, I still have no answer to my question: Techniques of remote access to non IP IoT devices. Even though, I made some researches and I found two remote access techniques that do not ...
8
votes
1answer
169 views

How do Smart Home Security Boxes work?

With the increased security risks against IoT based smart homes, many security appliances have been commercialized. These appliances or boxes claim to protect the home network from malware, cyber-...
6
votes
2answers
652 views

Techniques of remote access to non IP IoT devices

I have asked a question about Port Forwarding for non IP IoT Devices I understand that the hub is the controller of non IP devices attached to it, and each group of devices with the same wireless ...
4
votes
1answer
294 views

Port Forwarding for non IP IoT devices

A smart home contains both IP and non-IP devices (figure). My questions are: Does a smart hub have an IP address ? To access IoT devices from the outside, is the port forwarding only for IP devices ...
3
votes
1answer
476 views

Secure EEPROM Reading from Another Device [closed]

We are working on some Embedded device (Tag, the Tag hardware is: MCU, external EEPROM, Temperature and Humidity sensors) that collects temperature and humidity, the Tag save the samples in the ...
10
votes
1answer
453 views

When is Z-Wave S2 Security Mandatory?

When Z-Wave had security problems last year, I was pleased to see it announced that S2 Security would be mandatory for all new certifications as of April and that they didn't back off at that time. ...
9
votes
2answers
523 views

How do car insurance tracking devices connect to the internet?

There are these devices that you can plug into your car and the insurance company can get real time data to "lower" your insurance cost. Image from U.S.News, 2016. How do they connect to ...
1
vote
2answers
180 views

Build a “Smart Home”—Lack of Security [closed]

I am preparing to make my home smarter and for some reasons I am not happy. I read several articles about secure the smart home, but there was no clear solution. I don't know why, but it seems that ...
8
votes
1answer
377 views

Set up home Wi-Fi access for a device without a screen

I'm building a connected device without a screen that needs to be connected to home Wi-Fi. WPS is not an option. The device will have a Bluetooth module in addition to Wi-Fi hardware. QR codes can be ...
8
votes
3answers
525 views

Standards for keeping devices' security up-to-date

With IoT devices typically being built with low profit margins and low power specifications, functionality is typically limited to that which is needed. But for a device that is expected to last a ...
-2
votes
1answer
249 views

How is LTE organized in NB-IoT [closed]

How is LTE organized in NB-IoT? And can one find vulnerabilities in NB-IoT technology (security)?
6
votes
1answer
205 views

Creating a Tor 'hidden service' on Windows IoT Core

The Background I'm prototyping some basic home automation software using Windows IoT Core and Azure. I have built a Windows Universal Application that sends data to a Web App hosted in Azure via Web ...
8
votes
1answer
353 views

How to secure a Samsung Smart Refrigerator against BlueBorne?

Armis Labs lately revealed a new attack vector that attacks essentially all major OS including those used on IoT devices via Bluetooth. BlueBorne is reported to spread malware laterally to adjacent ...