PLEASE ROTATE ME
Telink Staff
May 7, 2019
Connect Better
IoT device security is an important concern, but by adhering to best practices and established protocols, an Internet of Things that is as secure as it is usable is possible.
When it comes to the Internet of Things (IoT), there’s a lot of hand-wringing about security. Of course, as IoT devices continue to proliferate, security is becoming an increasingly valid concern, and everyone from manufacturers to developers to end users must do their due diligence to keep their devices safe.
That said, many fears about the IoT’s security vulnerabilities are not well understood. It is, in fact, quite possible to implement a reasonable IoT security protocol that allows for both user accessibility and data protection. While it’s good to keep worst-case scenarios in mind, at the end of the day, strong IoT security is well within reach.
Despite headline-grabbing news stories that highlight their vulnerabilities, the majority of IoT devices have no known security issues. For instance, the Zigbee Pro mesh networking protocol has already been deployed in millions of smart utility meters around the world without causing any known security breaches.
Although the Zigbee Alliance doesn’t focus on standardizing physical security, it does provide security standards for both network and application layers. Both sets of standards offer a distributed security model that is easier for users to configure, though slightly less secure. With this approach, routers issue network security keys for devices to use to encrypt messages between each other.
Alternatively, Zigbee’s centralized security model features a Trust Center that functions as a network security coordinator. This device admits new devices based on credentials and issues a unique Link Key for each device and device pairing.
Similarly, Bluetooth® Mesh networking has specific security standards designed to protect connections between devices. These devices use encryption and authentication to protect data, but network- and application-level security are addressed independently. Bluetooth includes message obfuscation, security key refreshing, replay and trashcan attack prevention, and a security protocol for adding new nodes — all important standards for developers to take into account.
It’s not all good news, however. While, for the most part, home assistant devices have proven to be fairly secure, in one recent incident, a home assistant device reportedly recorded its owner’s private conversation and sent it to one of their contacts. The owner was understandably upset, but the device’s manufacturer explained that the mistake was not actually a security error, but the result of the device’s being activated by hearing its name and misinterpreting background conversation as commands.
The AI at the heart of home assistant devices could — and arguably should — be trained to be more accurate and ask for more specific confirmation to avoid these kinds of mistakes. There’s no reason why an assistant can’t become a “smarter” listener, and be configured to activate only when its name is said with intention. At the end of the day, this particular event was unfortunate, but it doesn’t represent a major security flaw in the device’s design — and therefore doesn’t undercut the idea of IoT security as a whole.
Unfortunately, some IoT devices currently on the market do fall far short of best security practices. Researchers have found that certain WiFi-connected LED lights exhibit a vulnerability that could allow a bad actor to steal the credentials for the network to which the lights are connected — and even control the other connected bulbs.
Another experiment discovered that a common IoT light bulb could easily be hacked to reveal WiFi credentials and unencrypted RSA connection keys — even after it had been disconnected and thrown away. The insecurity of this information could provide hackers with access to a homeowner’s entire network, giving them a direct route to much more sensitive data.
Fortunately, thanks to these researchers’ industriousness, in both of these cases, the bulbs’ manufacturer was able to deliver firmware updates that prevented the distribution of network configuration details over the devices’ mesh radios, and no “real-world” security breaches were reported. But while these lightbulbs’ vulnerabilities didn’t end up causing serious damage, there is always the risk that an IoT security failure will have much bigger implications.
For instance, in 2016, the Mirai botnet attack used a large number of IoT devices with default usernames and passwords to execute a massive distributed denial of service (DDoS) attack. This underscored the importance of changing IoT devices’ default passwords — and served as a reminder for device developers to require end users to take that critical security step.
Ultimately, achieving comprehensive IoT security will require collaboration among device manufacturers, end users, and, especially, developers. Still in its early days, the IoT continues to evolve quickly, meaning wonderful security today may look like woeful security tomorrow.
That said, there are several major pillars of IoT security that will remain important for the foreseeable future. Beyond utilizing a well-known and secure protocol, developers can take the following steps to help ensure IoT devices remain secure as they become progressively more powerful:
