What’s Naughty & Nice About The Internet Of Things

The press rightly publicizes the worst IoT security hazards, and there’s a hefty catalogue of what’s wrong. The most recent entry on the naughty list is the “IoT-powered DDoS” traffic-flooding attack, where hackers exploit well-known passwords to control insecure connected devices like cameras and use them en masse to disrupt Internet service. Easily exploitable connected devices pollute the public Internet. The situation begs comparison to Ohio’s much-abused Cuyahoga River, which grew so concentrated with industrial sludge that it actually caught fire at least 13 times over the course of a century.

As was the case with the river, the ultimate solution to public Internet pollution problems may be regulation of access to this public resource, but self-correction on the part of industry and the populace also matters. Reputable companies only stay reputable if their products reliably serve their rightful owners. At minimum, reputable suppliers ship non-polluting IoT products — and feature state-of-the-art security, even if the state-of-the-art is not yet all that it needs to be.

What's Wrong with IoT Security: Insecure Onboarding
Shipping a product with a well-known password is not state-of-the-art security. But it’s part of a more general problem that has long plagued IoT: The earliest IoT specifications set contradictory security goals in an attempt to make things easy and spur adoption. One standards group wanted security to be “transparent during setup” and the “best security possible.” Experience has shown that security can be either transparent or the best, but it’s rarely both. To serve transparency, suppliers have used common pre-shared keying material, dispersed keys over networks in plaintext, or shipped with well-known passwords. All are risky practices that are vulnerable to common attacks such as jamming and malware scripts.

In general, some person or provider must take ownership of an Internet-connected device before it commences operation, and too many do a poor job of locking down this initial step. The problem stems from the desire for simple, universal “plug and play” products. Even today, plenty of home routers operate and move packets as soon as you turn them on, even if their well-known passwords remain unchanged. Such a device may work properly for months or years, but is easily accessible to malware from day one. Few consumer routers or IoT devices offer secure plug-and-play — not yet, anyway.

Secure plug-and-play requires a vendor to “pre-provision” a device; for example, provide a factory-provisioned secret, public key, and signed digital certificate stored in a designated cloud account awaiting automatic enrollment. The cloud service automatically and securely associates the device with the user account when the device is plugged in. The service also puts the device under individual user control if done properly. Obviously, the user/owner of the device must trust the cloud provider explicitly for the model to work — and this is a major drawback for some.

The Middle Way: Security Ceremonies
A responsible alternative is to require a security ceremony, so that the user takes ownership and securely associates a device with a local network or cloud account. Typing in a PIN when installing a network camera, router, or other device is a common ceremony, and one of the best. You could argue that forcing the user to do anything (even entering a short number) is not “plug and play” in the literal sense. But provisioning network devices is necessary to prevent pollution: If a provider cannot provision ownership for the user, then the user must assert ownership of the device. This was true before the 2005 specification on UPnP Device Security and it is true today.

Since the root of all evil in IoT security begins with first use of an insecure device, vendors must be somehow compelled to follow best practices in the secure setup of a new device, such as with public-key cryptography, user-supplied input such as a PIN, or other means. Who or how to determine these practices and compel vendors to follow them is not considered here. But we do see the industry defining best practices in the security of both public and proprietary IoT systems such as Z-Wave, ZigBee, HomeKit, and Thread.

What's Improving: Secure Onboarding
Public-key cryptography is being introduced for better IoT security, though not in order to integrate (often low-powered) IoT devices into a public-key infrastructure (like Web clients or servers). Instead, the goal is to securely setup an IoT device prior to operation, which is variously called “onboarding” or “commissioning.” The use of elliptic-curve cryptography (ECC) by Z-Wave, ZigBee, HomeKit, Thread, and other solid IoT standards, solves today’s problem of securely taking ownership of a device like a camera or light bulb before it is activated and before it can be accessed by attackers via the network.

To wit, one of the newer IoT security systems is Z-Wave’s Security 2 (S2), which is in beta. Two of the people who hacked the Z-Wave system, Behrang Fouladi and Sahand Ghanoun, were subsequently recruited to the S2 design team.

S2 improves secure onboarding of new Z-Wave devices by requiring the installer to input a code from the newly introduced device to the Z-Wave gateway. That code is actually part of the public key of the Z-Wave device. Thus, if the gateway vendor decides to cut corners and skip the user input step, the S2 devices won’t work together. The user must supply part of the public key. Without that input, the key is unusable and the device can’t be commissioned into service.

The introduction of public-key cryptography is one small improvement to IoT security, but an important one. Public standards bodies, software developers, and IoT vendors have an important role to play in promoting best practices, which may greatly reduce the power of IoT botnets and ease our pollution problems.

Related Content: