Embed Size (px)
DESCRIPTION
Citation preview
Your Thing is pwnd Security Challenges for the Internet
of Things
Paul Fremantle CTO and Co-‐Founder, WSO2 @pzfreo #wso2 #wso2con
Firstly, does it even maAer?
“Google Hacking”
My three rules for IoT security
• 1. Don’t be dumb
• 2. Think about what’s different
• 3. Do be smart
My three rules for IoT security
• 1. Don’t be dumb – The basics of Internet security haven’t gone away
• 2. Think about what’s different – What are the unique challenges of your device?
• 3. Do be smart – Use the best pracQce from the Internet
http://www.forbes.com/sites/kashmirhill/2013/07/26/smart-homes-hack/
http://freo.me/1pbUmof http://freo.me/1pbUmof
So what is different about IoT?
• The fact there is a device – Yes – its hardware! – Ease of use is almost always at odds with security
• The longevity of the device – Updates are harder (or impossible)
• The size of the device – CapabiliQes are limited – especially around crypto
• The data – OXen highly personal
• The mindset – Appliance manufacturers don’t always think like security experts – Embedded systems are oXen developed by grabbing exisQng chips, designs, etc
Physical Hacks
A Practical Attack on the MIFARE Classic: http://www.cs.ru.nl/~flaviog/publications/Attack.MIFARE.pdf Karsten Nohl and Henryk Plotz. MIFARE, Little Security, Despite Obscurity
Or try this at home? hAp://freo.me/1g15BiG
http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-630.html
Hardware recommendaQons
• Don’t rely on obscurity
Hardware recommendaQons
• Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity • Don’t rely on obscurity
Hardware RecommendaQon #2
• Unlocking a single device should risk only that device’s data
The Network
hAp://ubertooth.sourceforge.net/ hAps://www.usenix.org/conference/woot13/workshop-‐program/presentaQon/ryan
Crypto on small devices
• PracQcal ConsideraQons and ImplementaQon Experiences in Securing Smart Object Networks – hAp://tools.ied.org/html/draX-‐aks-‐crypto-‐sensors-‐02
ROM requirements
ECC is possible (and about fast enough)
Crypto
Borrowed from Chris Swan: http://www.slideshare.net/cpswan/security-protocols-in-constrained-environments/13
Won’t ARM just solve this problem?
Cost maAers
8 bits $5 retail $1 or less to embed
32 bits $25 retail $?? to embed
Another opQon?
SIMON and SPECK
https://www.schneier.com/blog/archives/2013/07/simon_and_speck.html
Datagram Transport Layer Security (DTLS)
• UDP based equivalent to TLS • hAps://tools.ied.org/html/rfc4347
Key distribuQon
Passwords
• Passwords suck for humans • They suck even more for devices
Why Federated IdenQty for Things?
• Enable a meaningful consent mechanism for sharing of device data • Giving a device a token to use on API calls beAer than giving it a
password – Revokable – Granular
• May be relevant for both – Device to cloud – Cloud to app
• “IdenQty is the new perimeter”
MQTT
MQTT and OAuth2
An Open Source IdenQty and EnQtlement Management Server
Apache Licensed LDAP, JDBC, AcQve Directory, SCIM, SPML SAML2, OpenID Connect, WS-‐Trust, Kerberos OAuth 1.0/2.0, XACML 2.0, XACML 3.0 XDAS, Web Console, SOAP Admin MulQ-‐tenant, Clusterable, HA, 24x7 support
39
What is WSO2 IdenQty Server?
Other WSO2 technology to help you
• WSO2 BAM – monitoring • WSO2 CEP – realQme fraud detecQon • WSO2 API Manager – securing API endpoints
Real Qme event processing
41
Are you setting up for the next privacy or
security breach?
Exemplars
• Shields • Libraries • Server Frameworks • Standards and Profiles
Summary
• 1. Don’t be dumb • 2. Think about the differences • 3. Be smart • 4. Create and publish exemplars
WSO2 Reference Architecture for the Internet of Things http://freo.me/iot-ra
Thank You
