# Infosys Whitepaper 
Title: IoT Security Assurance 
Author: Infosys Limited 
Format: PDF 1.7 

---

  Page: 1 / 8  

---

 VIEW POINT Abstract IoT is one of the rapidly growing emerging technologies. It is  entering in all walks of our life with connected cars, connected smart  homes, connected healthcare, wearables, etc. and exchanging large  amount of sensitive/PII information over internet. This increases the  security risk of IoT devices. In this document we are proposing an  approach for security assessment of various IoT components.<|endoftext|>IOT SECURITY ASSURANCE 

---

  Page: 2 / 8  

---

 Introduction New testing processes and tools are  developed continuously to improve the  quality of software. Today, the IT industry  is gaining momentum in agile deliveries  and development and operations  (DevOps), which is creating new pos- sibilities by integrating development,  test, and operations teams. To keep pace  with these changes, testing processes  and tools need transformation such that  testing platforms can be accessible to all  stakeholders and made simple.    External Document © 2018 Infosys Limited 

---

  Page: 3 / 8  

---

 User  Interface Application Data Collector Device IoT Applications IoT Systems Architecture It’s evident from the above figure that IoT devices have multi-dimensional usage and are omnipresent. Well, this wide variety of IoT applica- tions poses some interesting use cases with respect to security of data. Suppose you’re using a mobile app for unlocking and controlling  peripherals like air conditioning, music system etc., of a vehicle. If someone is able to intercept into the communication channel, say Wi-Fi,  used between app and peripheral receiver. The attacker would be able to pose threat to the owner as well as the vehicle.<|endoftext|>I. Device - Sensors, actuators for monitoring  and notifying the events.<|endoftext|>II. Collector – systems to collect and  pre-process the data sent by sensors III. Data – repository of data accumulated  after pre-processing, it can be local or  cloud as well IV. Application – processes the data  according to the required usage V. User Interface – Web or mobile app  interface which provides relevant  information to the user VI. Communication Channel – wired or  wireless communication link between two  layers, it may be entirely absent for a locally  connected layer, say when collector and  data layers reside on same system.<|endoftext|>Figure 2: IoT Architecture Communication Channel IoT Applications Ranking Figure 1. Ranking of the IoT applications External Document © 2018 Infosys Limited 

---

  Page: 4 / 8  

---

 Components Attack Surface Devices (Sensors,  Gateways) Device memory, ﬁrmware, physical interfaces like USB ports, web  interfaces, admin interfaces, Update Mechanism Communication  Channel Device Network traﬃc  using LAN, Wireless (Wi-Fi, ZigBee, Bluetooth) Cloud Interface Getting access to sensitive data/PII stored on cloud by Injection attacks,  weak passwords or default credentials, Insecure Transport encryption.<|endoftext|>Application Interface  (Web and mobile) Getting access to sensitive data or PII by exploiting vulnerabilities like  OWASP web and mobile Top 10, in application interfaces.<|endoftext|>Attack Surfaces  The Internet of Things infrastructure can be  divided mainly into four components, 1. Devices (Gateways, Sensors, Actuators) 2. Communication Channel (Wi-Fi,  Bluetooth) 3. Cloud Interface 4. Application Interface (mobile and/or  web)  Latest attacks  The insecure implementation of IoT devices  are routinely being hacked and even used  as accessories in cyber-attacks.<|endoftext|>1. Hotel Room Locks prone to Hacking  Device: -  Onity United Technologies are leading  supplier of electronic locking system. A  Mozilla developer Cody found vul- nerabilities in the locks in 2012. The  device created by Cody reads the lock’s  memory and gets the cryptographic key  information. It sends that information to  the door lock which allows the hacker to  gain access to the room.   2. Massive DDoS attacks zombies 25,513  CCTV cameras: -   Researchers from Sucuri have claimed  that CCTV cameras can and are being  used for DoS attacks. The attackers use  these cameras as botnets. The attack  may last for days and could surge to a  several thousand HTTP requests per  second. Following pie chart depicts the  distribution of CCTV Botnets.<|endoftext|>Table – IoT components are their attack surfaces  Figure 3. CCTV DDoS Botnet Geographic Distribution (Data Courtesy: https://blog.sucuri.net/2016/06/large-cctv-botnet- leveraged-ddos-attacks.html)  25% 24% 12% 9% 8% 6% 5% 5% 2% 2% 2% Rest of the World Taiwan USA Indonesia Mexico Malasia Israel Italy Vietnam France Spain External Document © 2018 Infosys Limited 

---

  Page: 5 / 8  

---

 Infosys security assessment  approach for IoT Following practices should be followed while  designing an IoT system, to ensure security: - If any other protocols like ZigBee is  used, then following methods can be  implemented to mitigate any possible  security issues:  1. Implement AES Encryption. It provides  confidentiality as well as integrity.<|endoftext|>2. Implement Master Keys to secure Key  Establishment Procedure.<|endoftext|>3. Implement Link Keys to encrypt the  information sent across nodes.<|endoftext|>4. Implement Network Keys to authen- ticate and validate each device which  attempts to join the network.<|endoftext|>If MQTT protocol is being used, then follow  following methods.<|endoftext|>1. A firewall with sophisticated ruleset  should be implemented for every  connection to a MQTT broker.<|endoftext|>2. Block all the UDP packets as MQTT  uses TCP.<|endoftext|>3. All the ICMP packets should not be  blocked as response to PING and  TRACEROUTE will be hampered.  Instead, investigation of ICMP packets  is good approach.<|endoftext|>4. Traffic to any ports which are not  needed for the MQTT system should be  blocked. Following are MQTT ports • 1883: This is the default port for MQTT  over TCP.  • 8883: This is the default port for MQTT  over TLS.  • Use MQTT over TLS for all communica- tions.  • Use updated software for all the  component as they will be fixed for  older security vulnerabilities.] • Apart from above guidelines imple- mentation of Demilitarized Zones and  Load Balancers will further strengthen  the security of the system.  3. Nissan Leaf electric cars hack vulnerabil- ity disclosed: -  2016 has proved out to be a bad year  for IoT security after all. In early 2016  Troy Hunt, and Australian web security  expert demonstrated how Nissan Leaf’s  companion app can be used to hack  the vehicle. Even the app was optional,  as a simple web request via a browser  was able to control vehicle AC, Heating  system and may also reveal the owner’s  identity, if its VIN was known. This was  proved by the researcher while sitting  on a computer in Australia, controlling  systems of a vehicle that belonged to an  acquaintance of his in United Kingdom!  Though, the criticality of the issue may  not be life threatening but could still be  used to drain car battery for least to say,  which in turn can leave the owner in  perilous situations.<|endoftext|> Thus, the security incidents discussed  are examples of how lack of security  measures in IoT devices can not only  compromise personal security but also  can be leveraged to impact security of  other internet services as well.<|endoftext|>Figure 4. Extent of attack on Nissan Leaf External Document © 2018 Infosys Limited 

---

  Page: 6 / 8  

---

 Recommended security testing approach for each layer of IOT stack is as follows Sensor : Hardware Security threats Security assessment test case L2: Insuﬃcient Authentication/ 
Authorization L3: Insecure Network Services L5: Privacy Concerns L8: Insuﬃcient Security Conﬁgurability L10:Poor Physical Security Check for Password Complexity and Password Recovery mechanism for device Check for poorly Protected Credentials and ineﬃcient two Factor Authentication Check for Role Based Access Control Check for open ports, check if there are any unnecessary ports utilized.<|endoftext|>Check if getting access to device memory to get sensitive/personal data stored,  encryption keys, certiﬁcates is allowed Check if Firmware extraction and modiﬁcation is possible Check for User or Admin Command Line Interface issues Privilege escalation Check if device can be reset to insecure state or default state Check if device or internal memory can be accessed via USB ports and SD cards Sensor : Software Security threats Security assessment test case L3: Insecure Network Services L9:Insecure Firmware/ Software 