73

Interesting, even though I have 1-Click purchasing activated my voice purchasing options have been deactivated by default. I have to actually activate them to buy stuff. Currently Alexa cannot discern between different voices. Either way there is the option to enable an optional confirmation code that can be set to be required for voice purchasing. (...


27

Blockchain, Gada explains, is “a suitable solution in at least three aspects of IoT, including big data management, security and transparency, as well as facilitation of micro-transactions based on the exchange of services between interconnected smart devices.” Big data management: I couldn't disagree more. Blockchains are inherently inefficient at ...


25

Absolutely, because: A secure device and channel means that you can trust the data. Yes, the actual temperature is not very private, but an attacker can provide false temperatures and cause an undesirable response (e.g turning heating on unneccesarily). This is how stuxnet worked, by misreporting the speed of the centrifuges, causing the control system to ...


24

The absolute most common issue with IoT devices is default passwords. So change all the passwords. Pick a unique, random password for every device and write it down on paper (paper is safe from remote attackers and hard drive failures). 12 random (i.e. computer-generated) lowercase letters represent a good compromise between security and being hard to type. ...


23

Blockchains have applications on IoT devices, but there's nothing about IoT which makes blockchains more or less applicable. The specific threats mentioned in the article are: Malware. Blockchain does nothing to prevent this. The router/camera/DVR vulnerabilities were mostly due to poor design. Firmware verification (when implemented, which is rare) is ...


21

As always, a big part of security with "connect from anywhere" setups is ensuring the security of your account information. The usual rules apply: Don't share your password Avoid using cookies to save passwords (although cookies are always hard to resist) Regularly change passwords Be aware of other breaches via email (phishing, scams, etc.) including ...


19

Weeping Angel No, you were with a probability bordering on certainty not spied on by the Weeping Angel at least as described in the leaked documents. Why? The attack involved a physical component—"physically plugging a USB cable"—which makes it very unlikely that you were targeted. After all, they would have to deploy an actual physical spy to deploy that ...


18

This is not a straightforward topic. Detecting a compromise, as you put it, can happen in many forms and result in multiple outcomes in terms of system or network behavior. Observing that may require knowing the difference between normal and suspicious in terms of system and network behavior. For a home solution at the network level, the recommended option ...


18

PuTTY is actually quite secure - the session itself is encrypted. That's part of what SSH gives you "out of the box". I do a lot of this type of thing myself, and here are a few hit-points I would suggest: Don't open port 22 to the world - configure your SSH server to listen on a non-standard port (e.g. 22022 or 2222) on your WAN interface Require ...


17

I have been professionally developing a "device that use LTE/3G or other cellular networks" for decades now, and WireShark is one of our major test tools. Data can be encrypted (generally at layer 2, which is an option, or layer 4, by writing code to do so), but much (most?) is not. If I'm worried about a device that could send some personal information ...


17

What is the best approach to partitioning IoT device in the home? I have heard of setting up separate networks, one for IoT devices and one for everything else. Is this approach secure enough? Well, technically, there is no such thing as absolute security. Doing so should be technically safe enough, if we consider that your router doesn't have any ...


17

Detecting the infected device These devices-turned-botnet will still function correctly for the unsuspecting owner, apart from the occasional sluggish bandwidth, and their botnet behavior may go unnoticed indefinitely. Webroot.com: Source Code for Mirai IoT Malware Released This tells us how the device changes its behavior. Occasional sluggish bandwidth ...


16

This is beyond trivial. Every somewhat sophisticated IoT device will communicate via HTTPS making it not too easy to know what it is talking about, even if you do have a not compromised internet gateway in your router. Unfortunately you can't know which end points the IoT device is supposed to talk to and which not. While most of the big consumer ...


16

DDoS vs. "PDoS" 1. DDoS (for reference) A conventional distributed denial of service attack (DDos) is a class of denial of service (DoS) attacks in which a distributed system (botnet) consisting of nodes controlled via some application (Mirai, LizardStresser, gafgyt, etc.) is used to consume the resources of the target system or systems to the point of ...


14

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By ...


13

Adding to the most basic IoT security rule Gilles details, the first rule of security at home is to secure your entry gate adequately. Proper settings on your router will stop most attacks in their tracks. If your router is not properly configured securing the devices behind it is moot. A compromised router means you have the possibility for man-in-the-...


13

If you can have end-to-end TCP, then use end-to-end TLS (e.g. with HTTPS). Don't reinvent the wheel, especially when it comes to cryptography — most people get it wrong. Unless the device is too resource-constrained to support TLS, if you get down to the level of AES, you're doing it wrong. #1 mistake is to encrypt and forget to authenticate — if you have ...


13

To ensure that your device is secure enough, I have several tips: Add some encryption to the Bluetooth communication. I'd recommend keeping the encryption keys off air. For example, you might ask the user to scan a QR code that's on the device, on printed in the box etc. at the initial setup of mobile app, maybe with an AES key? Up to you. This is to ...


12

Some ideas - I've not covered all combinations of with/without username/TLS, hopefully you can see where they are missing. Can a client connect anonymously, no TLS? mosquitto_sub -t test/topic -h <broker address> Can a client connect if it provides a username but no password, no TLS? mosquitto_sub -t test/topic -u <username> -h <broker ...


12

I think you'll find a fairly high percentage of "#5, Other", because the list is missing one of the most common consumer IoT architectures: indirect communications via an in-home gateway. All the other methods you describe have drawbacks in the home: they're hard to configure, they're not secure, or they take a lot of expensive server resources. An in-...


12

I'm drawing primarily from this article on ibtimes.com. There are several things you should realise: Weeping Angel can only infect Samsung TV's from 2012 and 2013. From the article referenced: The Weeping Angel hack only works on Samsung TVs released in 2012 or 2013. From Samsung’s 2012 lineup, the UNES8000F, E8000GF plasma and UNES7550F models are at ...


12

[disclaimer: I'm a security / crypto professional and deal with security architecture questions like this every day.] You have stumbled onto the problem of storing credentials in such a way that an unattended process can access them, but an attacker cannot. This is a well known and very difficult problem to solve. If your IoT device has a hardware keystore ...


12

There are plenty of smart plugs, based on ESP8266 chips, which can be flashed with new firmware relatively easily. A popular (open source) firmware that has a lot of users and community support is Tasmota. This firmware is easily integrated to a locally hosted home-automation ecosystem which can be accessed remotely via the internet. The device also will ...


11

At this point, the complexity of what you want is beyond "cheap, single-board computer" levels. The easiest solution available is to set up something like SNORT, which is an intrusion detection system. Initially, it will alert you to everything that's going on, and you'll get way too many false positives. By training it over time (itself a manual process) ...


11

UL (formerly Underwriters Laboratories) provide the Cybersecurity Assurance Program to certify that an Internet of Things device is, in their opinion, secure from most major threats. UL seem to be highly respected in their certification processes, according to Ars Technica: UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, ...


11

For the My Friend Cayla toy, you can use it without an Internet connection. The FAQ states: Do I need an internet connection to play with Cayla? An internet connection will be required to download the free app which unlocks all of the fun things which Cayla can do. Some functions, such as searching for information on the internet (famous people, ...


11

To answer your second question, yes, this attack was publicized in 2013 at Black Hat. Two Korean researchers demonstrated an attack that was developed against Android. Attacking TVs was easier than phones, because they didn't have to worry about excessive battery draining giving away the existence of the bug. The link above is to the slide presentation. ...


11

It's not possible to make any device GDPR compliant, as it is the rest of the system that is responsible for complying with GDPR. A camera could, or couldn't, marketed as GDPR compliant, but it makes little difference either way. A camera could be connected to a system that deletes data within seconds (as may be used for people counting) and is therefore ...


10

3g v Wifi Security Standard wifi v LoRaWan/LPWAN If I'm worried about a device that could send some personal information without my consent is unplugging it and returning it to the store the only solution. 3g v Wifi Security It is possible to sniff 3G signals, e.g. , however of more concern might be ensuring the packets cannot be decrypted on the cloud ...


10

Yes, you can significantly improve the security of pretty much any low level protocol using software - but any home-brew solution is always likely to have some flaws. You need to consider at least 3 attack possibilities. Denial of service. Maybe there is a fall-back mode of operation you want to use if the radio channel is blocked. You might also be able ...


Only top voted, non community-wiki answers of a minimum length are eligible