74 votes
Accepted

How can I stop Alexa from ordering things if it hears a voice on TV?

Interesting, even though I have 1-Click purchasing activated my voice purchasing options have been deactivated by default. I have to actually activate them to buy stuff. Currently Alexa cannot ...
  • 8,125
27 votes
Accepted

Could a blockchain really prevent malware in the Internet of Things?

Blockchain, Gada explains, is “a suitable solution in at least three aspects of IoT, including big data management, security and transparency, as well as facilitation of micro-transactions based ...
  • 386
26 votes
Accepted

Is there any advantage in encrypting sensor data that is not private?

Absolutely, because: A secure device and channel means that you can trust the data. Yes, the actual temperature is not very private, but an attacker can provide false temperatures and cause an ...
  • 1,483
24 votes

Securing small home automation setup

The absolute most common issue with IoT devices is default passwords. So change all the passwords. Pick a unique, random password for every device and write it down on paper (paper is safe from remote ...
23 votes

Could a blockchain really prevent malware in the Internet of Things?

Blockchains have applications on IoT devices, but there's nothing about IoT which makes blockchains more or less applicable. The specific threats mentioned in the article are: Malware. Blockchain ...
22 votes

Securing small home automation setup

As always, a big part of security with "connect from anywhere" setups is ensuring the security of your account information. The usual rules apply: Don't share your password Avoid using cookies to ...
  • 1,807
19 votes
Accepted

What are the best security practices to secure a remote IoT camera?

PuTTY is actually quite secure - the session itself is encrypted. That's part of what SSH gives you "out of the box". I do a lot of this type of thing myself, and here are a few hit-points I would ...
  • 782
19 votes
Accepted

Is my Samsung Smart TV vulnerable to the "weeping angel" attack?

Weeping Angel No, you were with a probability bordering on certainty not spied on by the Weeping Angel at least as described in the leaked documents. Why? The attack involved a physical component—"...
  • 8,125
18 votes
Accepted

Can I monitor my network for rogue IoT device activity?

This is not a straightforward topic. Detecting a compromise, as you put it, can happen in many forms and result in multiple outcomes in terms of system or network behavior. Observing that may require ...
  • 294
17 votes

Intercepting web traffic going over cellular network

I have been professionally developing a "device that use LTE/3G or other cellular networks" for decades now, and WireShark is one of our major test tools. Data can be encrypted (generally at layer 2, ...
17 votes
Accepted

Secure Home Network Partition for IoT Devices

What is the best approach to partitioning IoT device in the home? I have heard of setting up separate networks, one for IoT devices and one for everything else. Is this approach secure enough? Well, ...
  • 431
17 votes
Accepted

How can I check if my IoT devices are infected with the Mirai worm?

Detecting the infected device These devices-turned-botnet will still function correctly for the unsuspecting owner, apart from the occasional sluggish bandwidth, and their botnet behavior may go ...
  • 8,125
17 votes
Accepted

What is the difference between a DDoS attack and a PDoS attack?

DDoS vs. "PDoS" 1. DDoS (for reference) A conventional distributed denial of service attack (DDos) is a class of denial of service (DoS) attacks in which a distributed system (botnet) consisting of ...
  • 680
16 votes

Can I monitor my network for rogue IoT device activity?

This is beyond trivial. Every somewhat sophisticated IoT device will communicate via HTTPS making it not too easy to know what it is talking about, even if you do have a not compromised internet ...
  • 8,125
14 votes

What are the best security practices to secure a remote IoT camera?

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies. A DMZ is your friend - In almost every case where you have ...
  • 409
13 votes

Securing small home automation setup

Adding to the most basic IoT security rule Gilles details, the first rule of security at home is to secure your entry gate adequately. Proper settings on your router will stop most attacks in their ...
  • 8,125
13 votes

How do I secure communication between app and IoT device?

If you can have end-to-end TCP, then use end-to-end TLS (e.g. with HTTPS). Don't reinvent the wheel, especially when it comes to cryptography — most people get it wrong. Unless the device is too ...
13 votes
Accepted

How do I secure communication between app and IoT device?

To ensure that your device is secure enough, I have several tips: Add some encryption to the Bluetooth communication. I'd recommend keeping the encryption keys off air. For example, you might ask the ...
  • 431
13 votes

Are There Energy Monitoring Smart Plugs That Don't Compromise my Privacy/Security?

There are plenty of smart plugs, based on ESP8266 chips, which can be flashed with new firmware relatively easily. A popular (open source) firmware that has a lot of users and community support is ...
  • 350
12 votes
Accepted

What simple security tests can I perform on my MQTT network?

Some ideas - I've not covered all combinations of with/without username/TLS, hopefully you can see where they are missing. Can a client connect anonymously, no TLS? mosquitto_sub -t test/topic -h &...
  • 830
12 votes
Accepted

How do consumer IoT devices typically enable Internet connection?

I think you'll find a fairly high percentage of "#5, Other", because the list is missing one of the most common consumer IoT architectures: indirect communications via an in-home gateway. All the ...
  • 2,422
12 votes

Is my Samsung Smart TV vulnerable to the "weeping angel" attack?

I'm drawing primarily from this article on ibtimes.com. There are several things you should realise: Weeping Angel can only infect Samsung TV's from 2012 and 2013. From the article referenced: The ...
  • 4,622
12 votes
Accepted

Can programs loaded onto NodeMCU board be extracted?

[disclaimer: I'm a security / crypto professional and deal with security architecture questions like this every day.] You have stumbled onto the problem of storing credentials in such a way that an ...
11 votes

Can I monitor my network for rogue IoT device activity?

At this point, the complexity of what you want is beyond "cheap, single-board computer" levels. The easiest solution available is to set up something like SNORT, which is an intrusion detection system....
  • 782
11 votes

Is there a certificate to indicate the security level of IoT devices?

UL (formerly Underwriters Laboratories) provide the Cybersecurity Assurance Program to certify that an Internet of Things device is, in their opinion, secure from most major threats. UL seem to be ...
  • 18.1k
11 votes

How to stop these toys from sending what my kids say to the cloud?

For the My Friend Cayla toy, you can use it without an Internet connection. The FAQ states: Do I need an internet connection to play with Cayla? An internet connection will be required to ...
  • 18.1k
11 votes

Is my Samsung Smart TV vulnerable to the "weeping angel" attack?

To answer your second question, yes, this attack was publicized in 2013 at Black Hat. Two Korean researchers demonstrated an attack that was developed against Android. Attacking TVs was easier than ...
  • 2,422
11 votes

Are there any surveillance cameras/devices that are EU General Data Protection Regulation (GDPR) compliant?

It's not possible to make any device GDPR compliant, as it is the rest of the system that is responsible for complying with GDPR. A camera could, or couldn't, marketed as GDPR compliant, but it ...
  • 1,483
10 votes

Intercepting web traffic going over cellular network

3g v Wifi Security Standard wifi v LoRaWan/LPWAN If I'm worried about a device that could send some personal information without my consent is unplugging it and returning it to the store the only ...
  • 1,215
10 votes
Accepted

Securing 433 MHz wall light switch

Yes, you can significantly improve the security of pretty much any low level protocol using software - but any home-brew solution is always likely to have some flaws. You need to consider at least 3 ...

Only top scored, non community-wiki answers of a minimum length are eligible