Regularly we see the Internet of Things (IoT) automated lighting solutions being overlooked when it comes to security. Often this is facilitated by statements such as “it’s a light bulb what is the worse they can do, turn my lights out”. In this presentation we will have an in-depth discussion on IoT lighting automation ecosystem security. Discussing topics including: The security implications of lighting automations vulnerabilities, the impact of migrating insecure IoT technologies into the enterprise work place, and what are the best practices we can leverage to reduce the risk and impact of these technologies within our enterprise environments.

1. Out Go The Lights
An enlightening discussion of IoT automation security

2. RESEARCH LEAD at
Deral Heiland CISSP

3. Agenda
Understanding IoT
IoT Migration into the enterprise
Lighting automation exploitation
Securing IoT best practices

4. Internet of Things (IoT)

5. Typical traits of an IoT based
technology
Interrelated devices
Collecting and sharing data
Networked together
Embedded electronics

6. Cloud
Mobile
Hardware
NetworkData
The ecosystem approach
allows us to:
The ability to more thoroughly examine the
technologies overall security
Better define the security risk and impact
Deploy IoT solutions in a more secure manner

7. Mobile
Application
Communication
Storage
Authentication

8. Cloud
Authentication
Communication
Encryption
Data storage
Web attacks

9. Network
Protocols
Communications
Encryption
Replay, Spoofing attacks

10. Hardware
CPU
Physical
Firmware

11. IoT Migration into the Enterprise

12. They’re Here
Wearable
Lighting
HVAC
Power Management
Audio Video systems

13. Lighting Automation Exploitation

14. Automation Exploits
Mobile Application
Embedded Web
Communication Protocols
Local / Direct connect services

15. Mobile Applications
Unencrypted storage
Unencrypted communication
IOS home button screen shot
No SSL Pinning

16. Embedded Web
Cross site scripting
Cross site request forgery

18. Communication protocols
Zigbee
Ethernet
Zwave
WiFi

20. Local Connect
Unencrypted
Unauthenticated
#Set up data to send to port 4000
$data1 = "x83x00x00xe3x03x00x00x00x01";
$data2 = pack('a33',"$SSID");
$data3 = pack('a69',"$WPAPSK");
$data4 = "x04x01x00x00x00x00x00x00x00x00x00
x00x00x00x00x00x00x00x00x00x00x00";
$send_data = join "", $data1, $data2, $data3, $data4;
!

21. Securing IoT Best Practices

22. Best Practices
Identification
Business needs
Isolation / Segmentation
Patch management