Guest lecture Internet of things Security and Forensics 00 30 43 50

Introduction to IoT and Forensics

Overview of the Lecture

• The speaker introduces the topic of Internet of Things (IoT) forensics, emphasizing its relevance in modern technology.

• Key areas of discussion include the definition of IoT, real-life applications, security concerns, incidents since 2016, protection mechanisms, and forensic challenges.

Understanding IoT

• IoT is defined as an interconnected network of small embedded devices that operate autonomously or semi-autonomously.

• These devices often rely on battery power and are designed for smart applications involving sensors and actuators.

Security Challenges

• Many IoT solutions lack "security by design" or "privacy by design," making data safety a significant concern.

• The concept of an IoT ecosystem includes various nodes like low-power devices (e.g., Arduino), hubs (e.g., Raspberry Pi), and cloud services for data aggregation.

Applications and Real-Time Use Cases

Smart Cities

• Examples include smart transportation systems and waste management solutions that optimize resource distribution through connected devices.

Safety and Security Enhancements

• Police can utilize IoT technologies such as CCTV cameras to monitor public spaces effectively. Noise monitoring systems have been implemented in cities to detect potential conflicts.

Industrial Applications

• Connected industries leverage IoT for automation in manufacturing processes, enhancing efficiency across operations.

Emerging Trends in Smart Technology

Connected Health and Agriculture

• Smart agriculture employs GPS tracking and planning tools to improve farm efficiency through data-driven decision-making.

Personal Devices

• The lecture highlights the prevalence of smart personal devices like smartphones and smartwatches that aggregate contextual data alongside basic metrics.

Understanding IoT Applications and Their Implications

Overview of IoT Applications

• The discussion begins with the mention of various applications of IoT, such as weather tracking, emphasizing that these applications are primarily for fun and performance tracking.

• An example is provided where soldiers used the Straa application to track their movements through a military base, highlighting concerns about privacy when sensitive data becomes public.

Data Concerns in IoT

• The speaker notes that while IoT applications can be beneficial, they also raise concerns due to the overwhelming amount of data generated, which can sometimes be alarming.

• In 2020, it was reported that there were 50 billion smart devices connected to the internet, ranging from small sensors to smart home appliances.

Security Issues

• The importance of security in smart home systems is discussed; without proper protection, sensitive information could be accessed by unauthorized users.

• It is emphasized that IT in this context isn't just entertaining but poses unique threats not typically seen in conventional computer systems.

Factors Contributing to IoT Popularity

• Several factors contribute to the popularity of IoT: inexpensive hardware (e.g., Raspberry Pi), ease of production, and rapid deployment capabilities.

• A wealth of online resources and libraries allows users to quickly build systems without needing extensive technical knowledge.

Components of the IoT Ecosystem

• The speaker describes common components within an IoT ecosystem: processing gateways (like Raspberry Pi), computing nodes (Arduino or STDM32), and simple sensors/actuators that interact with the physical world.

Single Board Computers in IoT

Characteristics and Capabilities

• Single board computers like Raspberry Pi are highlighted for their ability to run neural networks and deep learning applications due to built-in AI capabilities.

• These devices offer comparable performance to older PCs with multiple cores and threads but have limitations regarding power supply requirements.

Connectivity Options

• Various connectivity options available on single board computers include Ethernet, Bluetooth, Wi-Fi, among others. They typically operate at 5 volts using standard phone chargers for power.

Development Status

• Some devices are actively developed (e.g., Raspberry Pi), while others may not see ongoing updates. Most devices share similar ARM-based functionality across different models.

This structured summary captures key insights from the transcript while providing timestamps for easy reference.

Overview of Digital Interfaces and IoT Components

Digital IO Interfaces for Sensors and Actuators

• Digital IO interfaces are essential for connecting various sensors and actuators, requiring specific firmware and IDs (e.g., Arduino ID) to upload sketches.

• These interfaces typically have limited memory, with a few kilobytes of RAM and tens of kilobytes of flash storage, making them suitable for low-power applications.

Power Requirements

• Operating voltage ranges from 3.3 to 5 volts, allowing devices like Arduino to be powered by standard lithium batteries or small solar panels.

Comparison Between Arduino Nano and STDM32

• Both boards serve similar functions but differ in functionality and required software; the schematic shows multiple ports available for various connections.

Customizability in IoT Ecosystem

• The Arduino platform is highly customizable, supporting connections to other Arduinos, temperature sensors, motors, and illumination systems.

Types of Sensors Available

• A wide range of sensors can be integrated with Arduino, including those measuring brightness, noise levels, CO2 concentration, temperature, humidity, etc., generally consuming minimal energy except certain CO2 sensors which require more power due to heating elements.

Actuators in IoT Systems

Functionality of Actuators

• Actuators perform physical actions based on signals received (e.g., opening/closing windows or doors), often involving motor-based mechanisms.

Security Concerns in IoT Technology

Legacy vs. Modern Systems

• Older devices designed before 2010 may not meet current security standards; integrating new technologies into these legacy systems can be complex yet cost-effective.

Greenfield vs. Brownfield Approaches

• New applications like smart homes (e.g., Google Nest) are built from scratch (greenfield), offering better customization and security compared to integrating IoT into existing systems (brownfield).

Characterization of IoT Applications

Application Areas

• IoT can be categorized by application areas such as smart environments or healthcare; it also varies based on communication protocols used (e.g., RFID, NFC).

Device Location within Ecosystems

• Devices may operate over wide area networks or locally; their location affects data processing methods—some may process data in the cloud while others function independently.

Common Vulnerabilities Identified by OWASP

Security Issues in IoT Applications

• OWASP has identified vulnerabilities common across mobile apps and web applications that also apply to IoT: insecure web interfaces, insufficient authentication/authorization measures.

Importance of Secure Communication

• While HTTPS encryption has improved security over the past years by phasing out HTTP usage in browsers, many challenges remain regarding secure cloud interfaces and mobile interactions.

Firmware Challenges

• Not all devices support over-the-air updates for software/firmware improvements; this poses significant risks as outdated software can lead to vulnerabilities.

Understanding IoT Security Challenges

The Need for Physical Access to Devices

• Many simpler devices in the Internet of Things (IoT) require physical access for firmware updates, necessitating transport to a computer room or vice versa.

Concerns About Physical Security

• Without direct access to devices like temperature sensors, it is challenging to ensure their physical integrity and security against tampering.

Complexity of Threat Landscapes

• The threat landscape in IoT is vast and complex, encompassing various vulnerabilities from access control to device configuration.

• Compared to traditional computers, IoT devices present a more versatile array of attack vectors due to their diverse functionalities and connectivity options.

Potential Attack Scenarios

• Examples include loss of control over vehicles due to hacking, which poses risks not only to passengers but also pedestrians.

• Smart home systems are vulnerable; hackers could exploit them for unauthorized surveillance or data theft.

Health Risks from Device Vulnerabilities

• Critical medical devices like insulin pumps can be compromised if communication protocols lack security measures, leading to potentially life-threatening situations.

Notable Incidents Highlighting IoT Vulnerabilities

The Mirai Botnet Incident

• The Mirai botnet demonstrated how unsecured small devices could launch massive DDoS attacks that disrupt major services like DNS providers in the U.S.

Exploitation of Common Passwords

• Attackers exploited default passwords across numerous IP cameras and routers, gaining unauthorized access through automated scripts.

Kylo Doll Case Study

• A smart doll designed for children was found lacking encryption and anti-eavesdropping features, allowing potential intruders to listen in on conversations near the doll.

Consequences of Insecure Design

• This incident led to significant concerns about privacy and safety in consumer products aimed at children, resulting in bans on such toys.

Concerns Over Smart Technology Security

Issues with Vulnerable Technologies

• The German Consumer Council requested the destruction of certain dolls due to security vulnerabilities, highlighting how technology can become harmful when poorly designed.

• A 2017 study by Minneonic and the Norwegian Consumer Council found that only one out of four children's smartwatches promised reasonable security standards, raising concerns about data privacy.

• Manufacturers often prioritize user experience over security; for instance, a smartwatch could run longer without encryption than with full encryption, compromising data safety.

Risks in Medical Devices

• Medical devices like pacemakers and insulin pumps are susceptible to hacking through radio frequency communication, which can manipulate their functions dangerously.

• Attackers can increase or decrease insulin delivery in pumps or alter heart rhythms in pacemakers by sending unauthorized signals.

Vulnerabilities in Modern Vehicles

• Modern smart cars face various attacks due to multiple connectivity protocols; key fobs can be exploited if signals are intercepted by nearby attackers.

• An attacker with a powerful antenna can capture and replay signals from a key fob, allowing unauthorized access to vehicles if proper protections aren't implemented.

Protection Mechanisms for IoT Devices

• Various protection strategies exist within the IoT ecosystem, including application-level security measures and user training on safe practices.

• Implementing strong passwords, regular updates, access control measures, and physical checks are essential for enhancing device security against potential threats.

Challenges in Intrusion Detection

• Antivirus solutions pose challenges for small devices like Arduino due to limited processing power; however, some systems have been developed for basic intrusion detection on these platforms.

• Full-stack cryptographic functions have been created for smaller devices like Arduino to enhance their security capabilities without significant overhead.

Opportunities and Challenges in IoT Forensics

Overview of IoT Forensics

• The discussion focuses on the opportunities and challenges present in IoT forensics, particularly regarding data extraction from IoT devices during crime investigations.

• Emphasis is placed on the digital forensics process, which involves several stages that first responders must follow to preserve evidence effectively.

Challenges in Data Extraction

• Many IoT devices are proprietary and custom-built, leading to a lack of documentation and information about protocols or stored data.

• Security is often not prioritized in these devices; for example, firmware from Arduino can be dumped and reverse-engineered due to its lack of encryption.

Data Extraction Techniques

• Key steps include extracting data from RAM memory, hard drives (or micro SD cards), checking system status, network communication, files, logs, GPS data, and correlating timestamps.

• Raspberry Pi forensics parallels traditional computer forensics but utilizes different storage mediums like micro SD cards.

Specific Device Considerations

• Arduino presents unique challenges due to its limited procedures (setup and loop), making data retrieval more complex.

• Techniques such as chip-off methods or connecting another Arduino can be used to access limited flash memory (32 KB).

Real-world Implications of IoT Data

Case Study: Arson Investigation

• A notable case involved arson where smartwatch data indicated suspicious activity prior to a house fire.

• The investigation revealed that the suspect had engaged in heavy physical activity before claiming the fire was accidental, ultimately leading to a conviction for insurance fraud.

Security Concerns in IoT Devices

• IoT security lags behind traditional computer security due to energy consumption issues and resource constraints.

• Despite numerous attack vectors being present in IoT systems, there are emerging tools and standards aimed at enhancing device security.

Conclusion: Future Directions in IoT Forensics

Opportunities Amidst Challenges

• While there are significant challenges related to proprietary software/hardware limitations in accessing information about devices, the absence of encryption may provide law enforcement with greater access to valuable data compared to conventional systems.