This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Internet of Things Project"

From OWASP
Jump to: navigation, search
Line 64: Line 64:
  
 
|}
 
|}
 +
 +
= OWASP IoT Attack Surface Areas =
 +
 +
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
 +
 +
 +
The OWASP IoT Attack Surface Areas (DRAFT) are as follows:
 +
 +
{| border="1" class="wikitable" style="text-align: left"
 +
! Attack Surface
 +
! Vulnerability
 +
|-
 +
| '''Ecosystem Access Control'''
 +
|
 +
* Implicit trust between components
 +
* Enrollment security
 +
* Decommissioning system
 +
* Lost access procedures
 +
|-
 +
| '''Device Memory'''
 +
|
 +
* Cleartext usernames
 +
* Cleartext passwords
 +
* Third-party credentials
 +
* Encryption keys
 +
|-
 +
| '''Device Physical Interfaces'''
 +
|
 +
* Firmware extraction
 +
* User CLI
 +
* Admin CLI
 +
* Privilege escalation
 +
* Reset to insecure state
 +
|-
 +
| '''Device Web Interface'''
 +
|
 +
* SQL injection
 +
* Cross-site scripting
 +
* Username enumeration
 +
* Weak passwords
 +
* Account lockout
 +
* Known credentials
 +
|-
 +
| '''Device Firmware'''
 +
|
 +
* Hardcoded passwords
 +
* Sensitive URL disclosure
 +
* Encryption keys
 +
|-
 +
| '''Device Network Services'''
 +
|
 +
* Information disclosure
 +
* User CLI
 +
* Administrative CLI
 +
* Injection
 +
* Denial of Service
 +
|-
 +
| '''Administrative Interface'''
 +
|
 +
* SQL injection
 +
* Cross-site scripting
 +
* Username enumeration
 +
* Weak passwords
 +
* Account lockout
 +
* Known credentials
 +
|-
 +
| '''Local Data Storage'''
 +
|
 +
* Unencrypted data
 +
* Data encrypted with discovered keys
 +
* Lack of data integrity checks
 +
|-
 +
| '''Cloud Web Interface'''
 +
|
 +
* SQL injection
 +
* Cross-site scripting
 +
* Username enumeration
 +
* Weak passwords
 +
* Account lockout
 +
* Known credentials
 +
|-
 +
| '''Third-party Backend APIs'''
 +
|
 +
* Unencrypted PII sent
 +
* Encrypted PII sent
 +
* Device information leaked
 +
* Location leaked
 +
|-
 +
| '''Update Mechanism'''
 +
|
 +
* Update sent without encryption
 +
* Updates not signed
 +
* Update location writable
 +
|-
 +
| '''Mobile Application'''
 +
|
 +
* Implicitly trusted by device or cloud
 +
* Known credentials
 +
* Insecure data storage
 +
* Lack of transport encryption
 +
|-
 +
| '''Vendor Backend APIs'''
 +
|
 +
* Inherent trust of cloud or mobile application
 +
* Weak authentication
 +
* Weak access controls
 +
* Injection attacks
 +
|-
 +
| '''Ecosystem Communication'''
 +
|
 +
* Health checks
 +
* Heartbeats
 +
* Ecosystem commands
 +
* Deprovisioning
 +
* Pushing updates
 +
|-
 +
| '''Network Traffic'''
 +
|
 +
* LAN
 +
* LAN to Internet
 +
* Short range
 +
* Non-standard
 +
|-
 +
|}
 +
 +
__NOTOC__ <headertabs />
 +
 +
[[Category:OWASP_Project]] [[Category:OWASP_Document]] [[Category:OWASP_Download]] [[Category:OWASP_Release_Quality_Document]]

Revision as of 20:34, 7 August 2015

OWASP Project Header.jpg

OWASP Internet of Things (IoT) Project

Oxford defines the Internet of Things as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.”

The OWASP Internet of Things Project is designed to help manufacturers, developers, and consumers better understand the security issues associated with the Internet of Things, and to enable users in any context to make better security decisions when building, deploying, or assessing IoT technologies.

The project looks to define a structure for various IoT sub-projects such as Attack Surface Areas, Testing Guides and Top Vulnerabilities.

Licensing

The OWASP Internet of Things Top 10 is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


Share this:  E-mail this story Bookmark with Facebook Share on Digg.com Share on delicious Share on reddit.com Share on stumbleupon.com Share on LinkedIn.com Share on twitter.com Seed on Newsvine

What is the OWASP Internet of Things Project?

The OWASP Internet of Things Project provides:

  • A list and hierarchy of Internet of Things projects

Project Leaders

  • Daniel Miessler
  • Craig Smith

Related Projects

Email List

Quick Download

News and Events

Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg
OWASP Project Header.jpg


The OWASP IoT Attack Surface Areas (DRAFT) are as follows:

Attack Surface Vulnerability
Ecosystem Access Control
  • Implicit trust between components
  • Enrollment security
  • Decommissioning system
  • Lost access procedures
Device Memory
  • Cleartext usernames
  • Cleartext passwords
  • Third-party credentials
  • Encryption keys
Device Physical Interfaces
  • Firmware extraction
  • User CLI
  • Admin CLI
  • Privilege escalation
  • Reset to insecure state
Device Web Interface
  • SQL injection
  • Cross-site scripting
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known credentials
Device Firmware
  • Hardcoded passwords
  • Sensitive URL disclosure
  • Encryption keys
Device Network Services
  • Information disclosure
  • User CLI
  • Administrative CLI
  • Injection
  • Denial of Service
Administrative Interface
  • SQL injection
  • Cross-site scripting
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known credentials
Local Data Storage
  • Unencrypted data
  • Data encrypted with discovered keys
  • Lack of data integrity checks
Cloud Web Interface
  • SQL injection
  • Cross-site scripting
  • Username enumeration
  • Weak passwords
  • Account lockout
  • Known credentials
Third-party Backend APIs
  • Unencrypted PII sent
  • Encrypted PII sent
  • Device information leaked
  • Location leaked
Update Mechanism
  • Update sent without encryption
  • Updates not signed
  • Update location writable
Mobile Application
  • Implicitly trusted by device or cloud
  • Known credentials
  • Insecure data storage
  • Lack of transport encryption
Vendor Backend APIs
  • Inherent trust of cloud or mobile application
  • Weak authentication
  • Weak access controls
  • Injection attacks
Ecosystem Communication
  • Health checks
  • Heartbeats
  • Ecosystem commands
  • Deprovisioning
  • Pushing updates
Network Traffic
  • LAN
  • LAN to Internet
  • Short range
  • Non-standard
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Internet_of_Things_Project&oldid=198563"