Is there any Security (and Privacy) in the Internet of Things?

No ratings

Presented at RuhrSecBochum 2018 by

Dr. Oswald

Embedded (IoT) devices have become commonplace in many areas of our daily life, ranging from smart home assistants to resource-constrained medical devices. Unfortunately, the firmware of such devices is often closed-source and thus, the vendor's security and privacy promises cannot be independently verified. In this talk, we will discuss techniques to address this issue, for example by means of firmware extraction and analysis.In the first of two case studies, we focus on the Amazon Echo product line and cover methods to extract complete filesystem images from both newer and older devices. We then describe the (solid) security measures implemented in the Echo (e.g. for software updates), and will also outline how Amazon handles the transmission of voice data from and to the backend.Our second example is the Dexcom G4, a wide-spread continous blood glucose meter used in the treatment of diabetes. Through black-box analysis of the RF interface, we find that the Dexcom G4 does not implement cryptographic protections, which enables a range of attacks, including malicious modification of the transmitted measurements.The talk concludes with lessons learned from these (and other) case studies and with ideas how the security and privacy of future embedded devices can be improved.