IoT Threats

IPv6, a foundation of the IoT, is subject to the same attack threats as IPv4, such as smurfing, reconnaissance, spoofing, fragmentation attacks, sniffing, neighbor discovery attacks, rogue devices, man-in-the-middle attacks, and others. Therefore, in the core of the network it requires the same security treatments that exist today for IPv4.

However, the IoT opens a completely new dimension to security. The IoT is where the Internet meets the physical world. This has some serious implications on security as the attack threat moves from manipulating information to controlling actuation (in other words, moving from the digital to the physical world). Consequently, it drastically expands the attack surface from known threats and known devices, to additional security threats of new devices, protocols, and workflows. Many operational systems are moving from closed systems (e.g., SCADA, Modbus, CIP) into IP-based systems which further expands the attack surface

The IoT can be affected by various categories of security threats including the following:

• Common worms jumping from ICT to IoT: Generally limited to things running consumer O/S: Windows, Linux, iOS, Android

• "Script kiddies" or others targeting residential IoT: Unprotected webcams, stealing content, breaking into home control systems

• Organized crime: Access to intellectual property, sabotage, and espionage

• Cyber terrorism: Nuclear plants (For example, Stuxnet virus), traffic monitoring, railways, critical infrastructure

HP researchers tested 10 of the newest connected home security systems and discovered the Internet of Things-connected security systems are full of security FAIL:

HP Fortify found an “alarmingly high number of authentication and authorization issues along with concerns regarding mobile and cloud-based web interfaces.”  Under the category of insufficient authentication and authorization, the researchers reported.

• 100% allowed the use of weak passwords

• 100% lacked an account lockout mechanism that would prevent automation attacks

• 100% were vulnerable to account harvesting, allowing attackers to guess login credentials and gain access

• Four of seven systems that had cameras, gavethe owner the ability to grant video access to additional users, further exacerbating account harvesting issues.

• Two of the systems allowed video to be streamed locally without authentication

• A single system offered two-factor authentication

“Properly configured transport encryption is especially important since security is a primary function of these home security systems.” Yet regarding the encryption that is critical for protecting “sensitive data such as credentials, person information, device security settings and private video to name a few,” they discovered that “50% exhibited improperly configured or poorly implement SSL/TLS.”