IoT Security – Executing an Effective Security Testing Process
•Als PPT, PDF herunterladen•
1 gefällt mir•2,178 views
Deral Heiland CISSP, serves as a the Research Lead (IoT) for Rapid7. Deral has over 20 years of experience in the Information Technology field, and has held multiple positions including: Senior Network Analyst, Network Administrator, Database Manager, Financial Systems Manager and Senior Information Security Analyst. Over the last 10+ years Deral’s career has focused on security research, security assessments, penetration testing, and consulting for corporations and government agencies. Deral also has conducted security research on a numerous technical subjects, releasing white papers, security advisories, and has presented the information at numerous national and international security conferences including Blackhat, Defcon, Shmoocon, DerbyCon, RSAC, Hack In Paris. Deral has been interviewed by and quoted by several media outlets and publications including ABC World News Tonight, BBC, Consumer Reports, MIT Technical Review, SC Magazine, Threat Post and The Register.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie IoT Security – Executing an Effective Security Testing Process
Ähnlich wie IoT Security – Executing an Effective Security Testing Process (20)
Mehr von EC-Council
Mehr von EC-Council (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
IoT Security – Executing an Effective Security Testing Process
- 1. IoT Security – Executing an Effective Security Testing Process
- 2. Introduction Deral Heiland – IoT Research Lead Rapid7 •25+ years IT •15 years security •8+ years security consultant pentesters www.hackerhalted.com
- 3. IoT Ecosystem IoT Testing Methodologies IoT Research & Results Questions Agenda
- 5. Embedded Hardware Mobile & Control Applications Cloud APIs & Web Services Network Communication Data IoT Ecosystem
- 6. Help Identify exposure footprint Threat modeling for risk Determine Impact across ecosystem Conducting security testing Ecosystem Approach
- 8. Functional Evaluation Device Reconnaissance Cloud & Web APIs Mobile & Control Applications Network Physical Embedded hardware Inspection Physical Device Attacks Radio (RF) Testing Methodology Structure
- 9. Standard deployment Two environments Map out Features Functions Components Communication paths Functional Evaluation
- 10. Welcome to my real world lab Use the product to its full capacity Functional Evaluation
- 11. Component versions Software versions Vulnerability history Open source data White labeled product history User Manuals Component data/spec sheets FCC Data Device Reconnaissance
- 13. Eview Panic Button Reconnaissance User manual very revealing
- 14. Encryption (storage and transfer) Authentication Access rights Communication protocols SSL pinning Mobile & Control Applications
- 15. Mobile Application Wink Hub 2 Unencrypted Storage of Credentials
- 16. Insteon Smart Hub Unencrypted Storage of Credentials
- 17. Encryption (storage and transfer) Authentication and session management Common web vulnerabilities XSS CSRF Injection attacks ( SQLi etc..) Business logic attacks Cloud & Web APIs
- 18. Cloud API’s Wink Hub 2
- 19. Cloud API’s Wink Hub 2 Failure to Revoke Oauth Token
- 20. Exposed services Authentication Access rights Encryption Intra product “ecosystem” communication Network
- 21. Network Device Local Mode Security Loss of internet access Lack of authentication Lack of encryption
- 22. Osram Lightify Over The Air (OTA) Firmware Captures with Wireshark
- 23. Chips CPU Memory Communication Physical ports Ethernet USB Serial Circuitry connection UART JTAG SPI Physical Embedded hardware Inspection
- 25. Flash Memory Extraction on Wink Hub 2
- 27. Flash Memory Extraction on Wink Hub 2
- 28. Gathering RF Configuration Data from Inter Chip Communication
- 29. Gathering RF Configuration Data from Inter Chip Communication
- 30. 1100101010000001 1100110001100111 1000000000111110 1010011111011000 1100010001110111 1100001001101100 1001011010000000 1001100001000100 1000001000011000 1100000011100000 Gathering RF Configuration Data from Inter Chip Communication
- 31. Firmware Extraction embedded Multi-Media Controller (eMMC)
- 32. Firmware Extraction embedded Multi-Media Controller (eMMC)
- 33. Firmware Extraction embedded Multi-Media Controller (eMMC)
- 34. Encryption Pairing Access control Command and control Replay attacks. Radio (RF)
- 35. RF Analysis Insteon Vulnerable to Replay Attacks
- 36. Circle back around for more Insteon RF recon •Peter Shipley •Defcon23 (False Security and Deceptive Documentation) •https://github.com/evilpete/insteonrf Appears this issues have never been correctly, specially the unencrypted communication – even on their own products Insteon RF Analysis Reconnaissance
- 37. Reduced issues Reduced risk Better products Deeper understanding Conclusion
- 38. Questions Deral Heiland - Research Lead (IoT) deral_heiland@rapid7 @percent_x http://www.rapid7.com
Hinweis der Redaktion
- Use camera to examine and discuss board layout technology
- Use camera to examine and discuss board layout technology
- Use camera to examine and discuss board layout technology
- Demo breakdown of uart on osram device video
- Demo breakdown of uart on osram device video
- Demo breakdown of uart on osram device video
- Demo breakdown of uart on osram device video