Difference between revisions of "OWASP Internet of Things Project"

• Interoperability standards
• Data governance
• System wide failure
• Individual stakeholder risks
• Implicit trust between components
• Enrollment security
• Decommissioning system
• Lost access procedures

• Sensitive data
  • Cleartext usernames
  • Cleartext passwords
  • Third-party credentials
  • Encryption keys

• Firmware extraction
• User CLI
• Admin CLI
• Privilege escalation
• Reset to insecure state
• Removal of storage media
• Tamper resistance
• Debug port
  • UART (Serial)
  • JTAG / SWD
• Device ID/Serial number exposure

• Standard set of web application vulnerabilities, see:
  • OWASP Web Top 10
  • OWASP ASVS
  • OWASP Testing guide
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism

• Sensitive data exposure (See OWASP Top 10 - A6 Sensitive data exposure):
  • Backdoor accounts
  • Hardcoded credentials
  • Encryption keys
  • Encryption (Symmetric, Asymmetric)
  • Sensitive information
  • Sensitive URL disclosure
• Firmware version display and/or last update date
• Vulnerable services (web, ssh, tftp, etc.)
  • Verify for old sw versions and possible attacks (Heartbleed, Shellshock, old PHP versions etc)
• Security related function API exposure
• Firmware downgrade possibility

• Information disclosure
• User CLI
• Administrative CLI
• Injection
• Denial of Service
• Unencrypted Services
• Poorly implemented encryption
• Test/Development Services
• Buffer Overflow
• UPnP
• Vulnerable UDP Services
• DoS
• Device Firmware OTA update block
• Firmware loaded over insecure channel (no TLS)
• Replay attack
• Lack of payload verification
• Lack of message integrity check
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism

• Standard set of web application vulnerabilities, see:
  • OWASP Web Top 10
  • OWASP ASVS
  • OWASP Testing guide
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism
• Security/encryption options
• Logging options
• Two-factor authentication
• Check for insecure direct object references
• Inability to wipe device

• Unencrypted data
• Data encrypted with discovered keys
• Lack of data integrity checks
• Use of static same enc/dec key

• Standard set of web application vulnerabilities, see:
  • OWASP Web Top 10
  • OWASP ASVS
  • OWASP Testing guide
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism
• Transport encryption
• Two-factor authentication

• Unencrypted PII sent
• Encrypted PII sent
• Device information leaked
• Location leaked

• Update sent without encryption
• Updates not signed
• Update location writable
• Update verification
• Update authentication
• Malicious update
• Missing update mechanism
• No manual update mechanism

• Implicitly trusted by device or cloud
• Username enumeration
• Account lockout
• Known default credentials
• Weak passwords
• Insecure data storage
• Transport encryption
• Insecure password recovery mechanism
• Two-factor authentication

• Inherent trust of cloud or mobile application
• Weak authentication
• Weak access controls
• Injection attacks
• Hidden services

• Health checks
• Heartbeats
• Ecosystem commands
• Deprovisioning
• Pushing updates

• LAN
• LAN to Internet
• Short range
• Non-standard
• Wireless (WiFi, Z-wave, XBee, Zigbee, Bluetooth, LoRA)
• Protocol fuzzing

• Authentication/Authorization related values (session key, token, cookie, etc.) disclosure
• Reusing of session key, token, etc.
• Device to device authentication
• Device to mobile Application authentication
• Device to cloud system authentication
• Mobile application to cloud system authentication
• Web application to cloud system authentication
• Lack of dynamic authentication

• User data disclosure
• User/device location disclosure
• Differential privacy

• Sensing Environment Manipulation
• Tampering (Physically)
• Damage (Physicall)

• Administrative Interface
• Device Web Interface
• Cloud Interface
• Mobile Application

• Ability to collect a set of valid usernames by interacting with the authentication mechanism

• Administrative Interface
• Device Web Interface
• Cloud Interface
• Mobile Application

• Ability to set account passwords to '1234' or '123456' for example.
• Usage of pre-programmed default passwords

• Administrative Interface
• Device Web Interface
• Cloud Interface
• Mobile Application

• Ability to continue sending authentication attempts after 3 - 5 failed login attempts

• Device Network Services

• Network services are not properly encrypted to prevent eavesdropping or tampering by attackers

• Administrative Interface
• Cloud Web Interface
• Mobile Application

• Lack of two-factor authentication mechanisms such as a security token or fingerprint scanner

• Device Network Services

• Encryption is implemented however it is improperly configured or is not being properly updated, e.g. using SSL v2

• Update Mechanism

• Updates are transmitted over the network without using TLS or encrypting the update file itself

• Update Mechanism

• Storage location for update files is world writable potentially allowing firmware to be modified and distributed to all users

• Device Network Services

• Service can be attacked in a way that denies service to that service or the entire device

• Device Physical Interfaces

• Ability to physically remove the storage media from the device

• Update Mechanism

• No ability to manually force an update check for the device

• Update Mechanism

• No ability to update device

• Device Firmware

• Current firmware version is not displayed and/or the last update date is not displayed

• JTAG / SWD interface
• In-Situ dumping
• Intercepting a OTA update
• Downloading from the manufacturers web page
• eMMC tapping
• Unsoldering the SPI Flash / eMMC chip and reading it in a adapter

• Firmware contains a lot of useful information, like source code and binaries of running services, pre-set passwords, ssh keys etc.

• JTAG / SWD interface
• Side channel attacks like glitching

• With the help of a JTAG adapter and gdb we can modify the execution of firmware in the device and bypass almost all software based security controls.
• Side channel attacks can also modify the execution flow or can be used to leak interesting information from the device

• Serial interfaces (SPI / UART)

• By connecting to a serial interface, we will obtain full console access to a device
• Usually security measures include custom bootloaders that prevent the attacker from entering single user mode, but that can also be bypassed.

• Software

• Out of date versions of busybox, openssl, ssh, web servers, etc.

• Interoperability standards
• Data governance
• System wide failure
• Individual stakeholder risks
• Implicit trust between components
• Enrollment security
• Decommissioning system
• Lost access procedures

• XML Parsing
  • XSS
• Information Disclosure

• Sensitive data
  • Cleartext usernames
  • Cleartext passwords
  • Third-party credentials
  • Encryption keys

• Firmware extraction
• User CLI
• Admin CLI
• Privilege escalation
• Reset to insecure state
• Removal of storage media
• Tamper resistance
• Debug port
• Device ID/Serial number exposure

• Standard set of web vulnerabilities:
  • SQL injection
  • Cross-site scripting
  • Cross-site Request Forgery
  • Username enumeration
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism

• Sensitive data exposure:
  • Backdoor accounts
  • Hardcoded credentials
  • Encryption keys
  • Encryption (Symmetric, Asymmetric)
  • Sensitive information
  • Sensitive URL disclosure
• Firmware version display and/or last update date
• Vulnerable services (web, ssh, tftp, etc.)
• Security related function API exposure
• Firmware downgrade

• Information disclosure
• User CLI
• Administrative CLI
• Injection
• Denial of Service
• Unencrypted Services
• Poorly implemented encryption
• Test/Development Services
• Buffer Overflow
• UPnP
• Vulnerable UDP Services
• DoS
• Device Firmware OTA update block
• Replay attack
• Lack of payload verification
• Lack of message integrity check
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism

• Standard web vulnerabilities:
  • SQL injection
  • Cross-site scripting
  • Cross-site Request Forgery
  • Username enumeration
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism
• Security/encryption options
• Logging options
• Two-factor authentication
• Inability to wipe device

• Unencrypted data
• Data encrypted with discovered keys
• Lack of data integrity checks
• Use of static same enc/dec key

• Standard set of web vulnerabilities:
  • SQL injection
  • Cross-site scripting
  • Cross-site Request Forgery
• Credential management vulnerabilities:
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known default credentials
  • Insecure password recovery mechanism
• Transport encryption
• Two-factor authentication

• Unencrypted PII sent
• Encrypted PII sent
• Device information leaked
• Location leaked

• Update sent without encryption
• Updates not signed
• Update location writable
• Update verification
• Update authentication
• Malicious update
• Missing update mechanism
• No manual update mechanism

• Implicitly trusted by device or cloud
• Username enumeration
• Account lockout
• Known default credentials
• Weak passwords
• Insecure data storage
• Transport encryption
• Insecure password recovery mechanism
• Two-factor authentication

• Inherent trust of cloud or mobile application
• Weak authentication
• Weak access controls
• Injection attacks
• Hidden services

• Health checks
• Heartbeats
• Ecosystem commands
• Deprovisioning
• Pushing updates

• LAN
• LAN to Internet
• Short range
• Non-standard
• Wireless (WiFi, Z-wave, XBee, Zigbee, Bluetooth, LoRA)
• Protocol fuzzing

• Authentication/Authorization related values (session key, token, cookie, etc.) disclosure
• Reusing of session key, token, etc.
• Device to device authentication
• Device to mobile Application authentication
• Device to cloud system authentication
• Mobile application to cloud system authentication
• Web application to cloud system authentication
• Lack of dynamic authentication

• What data is being captured?
• How does it move within the ecosystem?
• How is it protected in transit?
• How is it protected at rest?
• Who is that data shared with?

• Sensing Environment Manipulation
• Tampering (Physically)
• Damaging (Physically)
• Failure state analysis

Device Firmware Vulnerabilities

• Out-of-date core components
• Unsupported core components
• Expired and/or self-signed certificates
• Same certificate used on multiple devices
• Admin web interface concerns
• Hardcoded or easy to guess credentials
• Sensitive information disclosure
• Sensitive URL disclosure
• Encryption key exposure
• Backdoor accounts
• Vulnerable services (web, ssh, tftp, etc.)

Manufacturer Recommendations

• Ensure that supported and up-to-date software is used by developers
• Ensure that robust update mechanisms are in place for devices
• Ensure that certificates are not duplicated across devices and product lines.
• Ensure supported and up-to-date software is used by developers
• Develop a mechanism to ensure a new certificate is installed when old ones expire
• Disable deprecated SSL versions
• Ensure developers do not code in easy to guess or common admin passwords
• Ensure services such as SSH have a secure password created
• Develop a mechanism that requires the user to create a secure admin password during initial device setup
• Ensure developers do not hard code passwords or hashes
• Have source code reviewed by a third party before releasing device to production
• Ensure industry standard encryption or strong hashing is used

Device Firmware Guidance and Instruction

• Firmware file analysis
• Firmware extraction
• Dynamic binary analysis
• Static binary analysis
• Static code analysis
• Firmware emulation
• File system analysis

Device Firmware Tools

• Firmwalker
• Firmware Modification Kit
• Angr binary analysis framework
• Binwalk firmware analysis tool
• Binary Analysis Tool
• Firmadyne

Vulnerable Firmware

• Damn Vulnerable Router Firmware

• Attempt to Invoke Unsupported HTTP Method
• Unexpected Quantity of Characters in Parameter
• Unexpected Type of Characters in Parameter

• Multiple Failed Passwords
• High Rate of Login Attempts
• Additional POST Variable
• Deviation from Normal GEO Location

• Modifying the Existing Cookie
• Substituting Another User's Valid SessionID or Cookie
• Source Location Changes During Session

• Modifying URL Argument Within a GET for Direct Object Access Attempt
• Modifying Parameter Within a POST for Direct Object Access Attempt
• Forced Browsing Attempt

• Traffic Seen from Disenrolled System
• Traffic Seen from Unenrolled System
• Failed Attempt to Enroll in Ecosystem
• Multiple Attempts to Enroll in Ecosystem

• Device Case Tampering Detected
• Device Logic Board Tampering Detected

• Device Entered Administrative Mode
• Device Accessed Using Default Administrative Credentials

• Double Encoded Character
• Unexpected Encoding Used

• Blacklist Inspection for Common SQL Injection Values
• Abnormal Quantity of Returned Records

• Honey Trap Resource Requested
• Honey Trap Data Used

• Suspicious or Disallowed User Source Location

• Improper Restriction of Operations within the Bounds of a Memory Buffer

• Improper Input Validation

• Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

• Permissions, Privileges, and Access Controls

• Information Exposure

• Credentials Management

• Improper Authentication

• Resource Management Errors

• Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

• Numeric Errors