IoT Cyber Security: Ways to help Secure your IoT Application

The fast-paced IoT evolution is a remarkable achievement but it comes along with a lot security measures requiring quick attention.
The U.S. Senate and House members reestablished an IoT-security-focused bill to pass “IoT Cyber security Improvement Act of 2019”. This segment of law-formulation is assumed to take care of the insecurities infecting IoT devices worldwide.

IoT Cyber security issues has been expanding over the past few years as it becomes increasingly clear that IoT devices are likely to be unsecure. In 2015, Kaspersky called IoT the “Internet of Crappy Things” underlining the fact that of the 20 billion IoT devices estimated to exist by 2020. In January 2015, Wind River Systems of California in a paper entitled “Security in The Internet of Things produced a report that grabs attention to a number of IoT security essentials.

The expanding IoT sector is supposed to increase to 20.4 billion devices by the year 2020 and the businesses are assumed to invest $134 billion annually by 2022 just on cybersecurity for IoT devices as declared in a study report by Juniper Research.

IoT applications from smart homes upto smart factories have vulnerable almost every secegment of our life to the internet. IoT devices have designed many access points for hackers who can utilize vulnerabilities in the IoT infrastructure even if they get access only to one device in the network.

As per the Symantec internet security threat report 2018, the number of IoT attacks enhanced from around 6,000 in 2016 to 50,000 in 2017, which is a 600% boost in just one year.

In October 2016, the Internet of Things was the center point of one of the largest DDoS attacks. A botnet called Mirai managed IoT devices and then utilized those devices to send an unmatched number of traffic requests to a large DNS provider.

While there have been many high-profile IoT-related cyber attacks over the last several years the Dyn cyberattack which is a series of distributed denial-of-service attacks indicates the significance of IoT cybersecurity.

IoT Cyber Attacks:

A VPNFilter IoT botnet

In May 2018, the security researchers from Cisco Talos found that more than half a million routers and storage devices in near about 54 countries were affected by a Russian-linked botnet. It was disclosed that the botnet malware, VPNFilter was planned with the purpose to collect personal information, access internet communication and conduct hostile cyber attacks.

The affected devices involved routers and internet-connected storage devices from TP-link, NETGEAR, Linksys and MikroTik.

Prowli malware

Last June, the security researchers found a malicious botnet when it had already affected more than 40,000 servers, routers and IoT devices of various enterprises all over the world. Hackers utilized various attacking methods including password brute-forcing, misuse weak configuration to carry out the attack.

Techniques that attackers used for IoT attacks

There are some ordinary techniques hackers utilize to use infirmities in IoT ecosystems.

Botnets

A botnet is a network of systems associated to manage and spread malware in devices remotely. The botnet operators control this system with the help of Command-and-Control-Servers and hackers use it for many tasks including taking private information, DDoS attacks for spam and trolling emails.

Man-in-the-middle attack

As understood by the name, man-in-the-middle attacks are those in which a hacker breaks in between two separate systems with an intention to break them. These attacks are incredibly frightening when performed through IoT devices especially when the communication includes not gentle items such as smart TVs or garage doors but potentially hazardous industrial equipment and vehicles.

Social engineering

Social engineering is the technique that decides directly IoT users rather than smart devices. By utilizing psychological pressure and duplicity a hacker might be looking for any information to acquire various benefits but the main purpose of manipulating individuals is to obtain passwords or bank details.

To prevent application from IoT violations there are various things you can do:

1. Do Not Set Your IoT Devices with Default Usernames and Password

Majority of IoT cyber security concerns can be bypassed by following one simple rule. Here’s why: A lot of common IoT devices such as a many smart thermostats and security cameras are Linux-based and many are setting out with default usernames and passwords for SSH (Secure Socket Shell) connections which give users a secure way to take a computer over an unsecured network.

If your customer place one of these devices on their network it becomes a very simple target. The Mirai (self-propagating botnet virus) attack particularly explored out devices with this feature. Tools like Shodan and Nmap make it simple for hackers to write a script that detects these devices and tests the default password covering the way for a large-scale attack using botnets.

Where, Shodan is a search engine that lets user find specific types of computers connected to the internet by using a type of filters. And Nmap is a free and open-source network scanner designed by Gordon Lyon.

2. Try to avoid to use an SSH Connection

As many IoT applications run on Linux and most Linux systems facilitate SSH by default. That means the device is following to port 22 for anyone who wants to connect to it via SSH. As 22 is default port that is used by SSH protocol. In case your application doesn’t need SSH to be used its better to kept it as disabled-as it is Major IoT Cyber security deficiencies.

3. If possible, Limit your Applications disclosure to IP-based networks

Chances are more that if someone tries to hack IoT device they’ll do so using an online, script-based attack. It is much rare for a device to be hacked physically. Information exposure is when an application fails to properly prevent sensitive and confidential data that are not supposed to have access to the subject matter in normal situation.

These type of concerns are not available in most cases but are considered as application security concerns because they enables malicious hackers to collect relevant information which can be used later in the attack lifecycle in order to gain more than they could if they didn’t get access to such information.Try to limit your application disclosure to IP networks.

Your connectivity provider may be able to assist. For example Symphony Link which is a wireless solution for industries and industrial customers who require to carefully connect their IoT devices to the cloud that doesn’t have IP-based communication from the end-node to the gateway, so there’s no network-based deficiencies that can strike that link.

4. Create a VPN Tunnel into Backend Network

Allow your IoT devices to create a virtual private network (VPN) tunnel for secure and safe communication. The better way to do this with cellular IoT is to negotiate with your carrier to add devices in their private network with a VPN tunnel directly to your backend. And the result is there’s no way for any traffic to or from your devices to get to the internet. This is called Virtual Air Gapping.

5. Try to Avoid definite IPS and Domain names

Consider only a selected list of IP addresses or domain names to direct traffic to your devices as a form of firewall protection. This can help prevent bad connections. Keep in mind that if your device is hacked, it may be possible for the hacker to release the IP and domain blocks you have in particular place but this is still a good precautionary step.

Why IoT Devices Face Security Issues?

IoT cycle is preferably new for everyone from manufacturers to end users which is why there is a little shortage thorough knowledge about the technology. There is an deficiency of proper regulations and management around deployment and usability of IoT devices. Also with constant innovations and endless updates it becomes hard for enterprises to improve the security framework.

From password attacks to malicious node injections and firmware hacking, IoT devices are extremely unsecure to breaches and therefore, make for preferred penetration gateway for hackers. It is rather difficult to recognize all the weak links among the billions of IoT devices but there are a few concerns that should be addressed to enhance the security.

The California IoT Cyber security law has recorded realization of ‘reasonable’ security characteristics in any device that connects to the internet, directly or indirectly.

Taking care of inadequate authentication systems in most of the IoT devices the law has been written to ensure prevention of unauthorized access and understanding of sensitive information. The alteration to cloud and web-based interface has also opened new possibilities for hackers to insert the device. Most IoT devices utilize unstable network services, deficient security configurability and unguarded firmware.

How Application Security Testing Can Fight IoT Insecurities:

Instead of being a huge turnaround, security should be the operating factor in the manufacturing process of an IoT device. Application security testing when interfaced into the product life cycle from the beginning can efficiently protect a device against potential risks and threats.

1. Get a comprehensive view:

With application security testing placed from the startup stages, the security aspect is taken care at each step. Hence, instead of going back to identify any scaly behavior after the cycle is ended application security testing allows the developers to recognize threats and solve them on the spot.

2. Analyze compliance:

Automated application security testing can support way of non-compliant devices in an IoT network notify the developers to control access to them.

3. Restrict devices for anomalous behavior:

Any harmful behavior can be quickly uncover with the help of application security testing.

4. Constant supervision:

Application security testing constantly analyzing the IoT networks for any breach attempts or penetrations after the implementation of security firewalls that will give alerts to the respective authorities for curative actions to be taken whenever required.

Securing an IoT network is essential. It needs devolution of a precise action plan to preserve and examine billions of interconnected devices. Mixture of a single device may begin to compromise of other connected nodes as well. It is crucial that significant personal information assets are classified and obscured from the network in order to protect serious harm in case of a breach.

Actions such as two-factor authentication, installation of firewalls and assigning unique passwords have become a necessity. IoT Course framework will give you a comprehensive view of IoT Cyber Security parameters to secure your Application.