IoT Security and Privacy – Sleep-Walking into a Living Nightmare?

Copyright © 2016 Copper Horse Solutions Ltd. All rights reserved. 1

IoT Security and Privacy – Sleep-Walking into a Living Nightmare?

David Rogers, Copper Horse@drogersukIoTEdinburgh

24th March 2016

http://www.mobilephonesecurity.org

Copyright © 2016 Copper Horse Solutions Ltd. All rights reserved.

Who is Connected to the Future Internet?

2

Source: http://cheezburger.com/8068370944


Who is Connected to the Future Internet? (2)

3

Source: http://spectrum.ieee.org/computing/embedded-systems/on-the-internet-of-things-nobody-knows-youre-a-dog


What is Home Security?

4

Opening up Access to Who?

From: http://www.independent.co.uk/news/world/americas/hacker-takes-control-of-ohio-couples-baby-monitor-and-screams-bad-things-9296986.html Copyright © 2016 Copper Horse Solutions Ltd. All rights reserved. 6

http://www.independent.co.uk/news/world/americas/hacker-takes-control-of-ohio-couples-baby-monitor-and-screams-bad-things-9296986.html




Connected Lightbulbs

7

WiFi password can be extracted – pivot attack


Connected Doorbell

8

WiFi password can be extracted – pivot attack / physical access


Wireless Burglar Alarm

9


Wireless Burglar Alarm Attack

10

Easily subverted by just removing batteries Solution was to reduce alarm alert time to 0 seconds!

– Home owner forced to use key-fob.

https://www.youtube.com/watch?v=WfSDUOBYUFE





Samsung SmartThings Vulnerabilities

11

February 2016 – ZigBee flaws highlighted– Open locks by decrypting signals– Jamming– “Insecure rejoin”

There are other issues!

http://www.forbes.com/sites/thomasbrewster/2016/02/17/samsung-smartthings-vulnerabilities/#ed6d54a4e59d





Smart TV Vulnerabilities

12

Privacy – voice control Webcams Software update issued

Connected Pets

War Kitteh Denial of Service Dog



Smart Meters

14

ZigBee, GSM – meter reading Profiling


Other Devices

15

Radiator and home thermostats Kettles and kitchen appliances Garage door openers / detectors Garden, plant sensors and food dispensers White goods (e.g. washing machines) Etc!


Counterfeit / Substandard Devices


Near Future Devices

17

Amazon Echo - Alexa


Connected Home Updates?

Samsung Smart TV Privacy Policy


221 pages! Plus other Terms, Nuance privacy policy etc.

Plant / Critical Infrastructure


Automotive (not just cars!)



Make it Safe to Connect

https://iotsecurityfoundation.org/




Thanks!

david.rogers [@] copperhorse.co.uk@drogersuk

@copperhorseuk


mailto:david.rogers%7B@%7Dcopperhorse.co.uk

mailto:david.rogers%7B@%7Dcopperhorse.co.uk

IoT Security and Privacy – Sleep-Walking into a Living Nightmare?

Technology

Transcript of IoT Security and Privacy – Sleep-Walking into a Living Nightmare?