74
votes
Accepted
How can I stop Alexa from ordering things if it hears a voice on TV?
Interesting, even though I have 1-Click purchasing activated my voice purchasing options have been deactivated by default. I have to actually activate them to buy stuff.
Currently Alexa cannot ...
- 8,360
27
votes
Accepted
Could a blockchain really prevent malware in the Internet of Things?
Blockchain, Gada explains, is “a suitable solution in at least three
aspects of IoT, including big data management, security and
transparency, as well as facilitation of micro-transactions based ...
- 386
26
votes
Accepted
Is there any advantage in encrypting sensor data that is not private?
Absolutely, because:
A secure device and channel means that you can trust the data. Yes, the actual temperature is not very private, but an attacker can provide false temperatures and cause an ...
- 1,483
24
votes
Securing small home automation setup
The absolute most common issue with IoT devices is default passwords. So change all the passwords. Pick a unique, random password for every device and write it down on paper (paper is safe from remote ...
23
votes
Could a blockchain really prevent malware in the Internet of Things?
Blockchains have applications on IoT devices, but there's nothing about IoT which makes blockchains more or less applicable.
The specific threats mentioned in the article are:
Malware. Blockchain ...
- 331
22
votes
Securing small home automation setup
As always, a big part of security with "connect from anywhere" setups is ensuring the security of your account information. The usual rules apply:
Don't share your password
Avoid using cookies to ...
- 1,867
19
votes
Accepted
What are the best security practices to secure a remote IoT camera?
PuTTY is actually quite secure - the session itself is encrypted. That's part of what SSH gives you "out of the box". I do a lot of this type of thing myself, and here are a few hit-points I would ...
- 782
19
votes
Accepted
Is my Samsung Smart TV vulnerable to the "weeping angel" attack?
Weeping Angel
No, you were with a probability bordering on certainty not spied on by the Weeping Angel at least as described in the leaked documents. Why? The attack involved a physical component—"...
- 8,360
18
votes
Accepted
Can I monitor my network for rogue IoT device activity?
This is not a straightforward topic. Detecting a compromise, as you put it, can happen in many forms and result in multiple outcomes in terms of system or network behavior. Observing that may require ...
- 294
17
votes
Intercepting web traffic going over cellular network
I have been professionally developing a "device that use LTE/3G or other cellular networks" for decades now, and WireShark is one of our major test tools. Data can be encrypted (generally at layer 2, ...
17
votes
Accepted
Secure Home Network Partition for IoT Devices
What is the best approach to partitioning IoT device in the home?
I have heard of setting up separate networks, one for IoT devices and one for everything else.
Is this approach secure enough?
Well, ...
- 431
17
votes
Accepted
How can I check if my IoT devices are infected with the Mirai worm?
Detecting the infected device
These devices-turned-botnet will still function correctly for the unsuspecting owner, apart from the occasional sluggish bandwidth, and their botnet behavior may go ...
- 8,360
17
votes
Accepted
What is the difference between a DDoS attack and a PDoS attack?
DDoS vs. "PDoS"
1. DDoS (for reference)
A conventional distributed denial of service attack (DDos) is a class of denial of service (DoS) attacks in which a distributed system (botnet) consisting of ...
- 680
16
votes
Can I monitor my network for rogue IoT device activity?
This is beyond trivial. Every somewhat sophisticated IoT device will communicate via HTTPS making it not too easy to know what it is talking about, even if you do have a not compromised internet ...
- 8,360
15
votes
What are the best security practices to secure a remote IoT camera?
The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.
A DMZ is your friend - In almost every case where you have ...
- 429
14
votes
Are There Energy Monitoring Smart Plugs That Don't Compromise my Privacy/Security?
There are plenty of smart plugs, based on ESP8266 chips, which can be flashed with new firmware relatively easily. A popular (open source) firmware that has a lot of users and community support is ...
- 360
13
votes
Securing small home automation setup
Adding to the most basic IoT security rule Gilles details, the first rule of security at home is to secure your entry gate adequately. Proper settings on your router will stop most attacks in their ...
- 8,360
13
votes
How do I secure communication between app and IoT device?
If you can have end-to-end TCP, then use end-to-end TLS (e.g. with HTTPS).
Don't reinvent the wheel, especially when it comes to cryptography — most people get it wrong. Unless the device is too ...
13
votes
Accepted
How do I secure communication between app and IoT device?
To ensure that your device is secure enough, I have several tips:
Add some encryption to the Bluetooth communication. I'd recommend keeping the encryption keys off air. For example, you might ask the ...
- 431
12
votes
How to stop these toys from sending what my kids say to the cloud?
For the My Friend Cayla toy, you can use it without an Internet connection. The FAQ states:
Do I need an internet connection to play with Cayla?
An internet connection will be required to ...
- 18.2k
12
votes
Accepted
What simple security tests can I perform on my MQTT network?
Some ideas - I've not covered all combinations of with/without username/TLS, hopefully you can see where they are missing.
Can a client connect anonymously, no TLS?
mosquitto_sub -t test/topic -h &...
- 830
12
votes
Accepted
How do consumer IoT devices typically enable Internet connection?
I think you'll find a fairly high percentage of "#5, Other", because the list is missing one of the most common consumer IoT architectures: indirect communications via an in-home gateway.
All the ...
- 2,442
12
votes
Is my Samsung Smart TV vulnerable to the "weeping angel" attack?
I'm drawing primarily from this article on ibtimes.com. There are several things you should realise:
Weeping Angel can only infect Samsung TV's from 2012 and 2013. From the article referenced:
The ...
- 4,702
12
votes
Accepted
Can programs loaded onto NodeMCU board be extracted?
[disclaimer: I'm a security / crypto professional and deal with security architecture questions like this every day.]
You have stumbled onto the problem of storing credentials in such a way that an ...
- 244
11
votes
Accepted
Is the Subscriber-Publisher pattern applicable also to actuators?
But how about actuators?
Yes pub-sub pattern is applicable to actuators.
Is this the way to go with actuators?
This is one of the ways to go and this is booming because of many cloud providers ...
- 1,530
11
votes
Can I monitor my network for rogue IoT device activity?
At this point, the complexity of what you want is beyond "cheap, single-board computer" levels. The easiest solution available is to set up something like SNORT, which is an intrusion detection system....
- 782
11
votes
Is there a certificate to indicate the security level of IoT devices?
UL (formerly Underwriters Laboratories) provide the Cybersecurity Assurance Program to certify that an Internet of Things device is, in their opinion, secure from most major threats.
UL seem to be ...
- 18.2k
11
votes
Is my Samsung Smart TV vulnerable to the "weeping angel" attack?
To answer your second question, yes, this attack was publicized in 2013 at Black Hat. Two Korean researchers demonstrated an attack that was developed against Android. Attacking TVs was easier than ...
- 2,442
11
votes
Are there any surveillance cameras/devices that are EU General Data Protection Regulation (GDPR) compliant?
It's not possible to make any device GDPR compliant, as it is the rest of the system that is responsible for complying with GDPR.
A camera could, or couldn't, marketed as GDPR compliant, but it ...
- 1,483
11
votes
Are There Energy Monitoring Smart Plugs That Don't Compromise my Privacy/Security?
Electrical expert on diy.se with a public service announcement / context challenge.
Don't buy anything that touches mains power on Amazon
Amazon is a river of cheap Chinese junk. Amazon lets ...
Only top scored, non community-wiki answers of a minimum length are eligible