Actions
Forum Thread Details
  • Replies 24 replies
  • Subscribers 396 subscribers
  • Views 2043 views
  • Users 0 members are here
Related

Internet of Things... Security

gadget.iom

I have recently purchased an ENC28J60 module and started experimenting with ethernet connectivity on my various Arduino boards. As to be expected with the Arduino community there are a good number of resources, on here and the wider web, for support in getting a basic project up and running.

 

I have mainly been experimenting with sending GET requests to a web server and acting upon the responses, and while there is a great deal of guidance about how to achieve this, none of them seem to contemplate the aspect of secure communications. While this may not be so much of an issue on a private LAN, the very nature of 'Internet of Things' would suggest that this communication will take place over a third party network at some point.

 

I have spent some time investigating the process of implementing some basic encryption on these communications and have found the availability of such information to be very weak. Methods I have looked into so far are RC4 and XOR, and some of the examples actually work on the local microcontroller, but fail to encrypt/decrypt successfully in the PHP implementations at the server.

 

Have you implemented any kind of encryption in your microcontroller projects? How successful were they? Do you think there are enough resources for data encryption? Or is there something obvious that I've missed? image

 

Would love to hear your thoughts and opinions.

Paul

  • in reply to mcb1

    Had a big thing here in the UK about Smart TV's been able to listen in to your conversations..

    I was wondering how long it was before they got compromised ...looks like I 'll get a first run with the legitimate traffic first image

  • in reply to mcb1

    Hi Mark,

     

    Thanks for this, very nice paper!!

    Hi DAB,

    As you say, it is super-important to know the information and the value of it. Not just IoT related (although often it is harder to know what is valuable, since data can reveal subtle bits of information), but so many organizations in general tend to consider security with no regard to the value of the data. They then end up vastly underspending, or vastly overspending but in the wrong areas, leaving themselves (and customers) still vulnerable, e.g. by not considering who should and who should not have access to which data, what data should not be shared with some departments (i.e. within a business), and how to handle data between businesses too (e.g. the smart TV scenario you guys mention).

  • in reply to shabaz

    Totally agree with you there Shabaz

     

    I have to be always on the lookout for issues like this as a Solutions Architect in the government Healthcare world, I design systems for the Province of Ontario to manage peoples medical data and also personal information (PHI and PI) so I totally get what your saying, the vulnerabilities come from the strangest of places and often not where you suspect, for instance most breaches are committed by insider support people, not a hack from the outside and also what constitutes PI or PHI data

     

    Social Engineering is also a popular way for back trace information to people, simple things like age, gender, local events or entities all lead someone closer and closer to you

     

    Now start posting when your heating comes on or lights etc etc and soon someone knows where you live and hen you home (On not more to the point)

     

    So while I get Dabs comment, don't post it if you don't need to (Is it necessary for the recipient to have that additional bit of info) because it can all add up to finding more about you

     

    This is a very interesting topic and one that can run for a long time, I welcome it completely as it is long over due

  • in reply to Robert Peter Oakes

    I'm not even sure how IoT could possibly take off.  I can understand your own projects, connecting to your own systems as long as you're careful and monitor them.  But would many people buy a commercial device(eg, fridge, thermostat) and put it online to do or connect to whatever the manufacturer wanted?  I sure wouldn't want to, it seems ridiculous.  Although, I do know a few people that have bought the "nest" thermostat who are crazy for the google stuffimage.  To me, it's a trap.  Then again, most people are carrying around their own(or their employers) tracking device now, so maybe it will. image

  • in reply to Robert Peter Oakes

    Oh, wow - probably healthcare has some of the highest security requirements - so we should use you to grill all the kickstarter creators we see who totally ignore security : )

  • in reply to shabaz

    Funnily enough Healthcare and the likes were one of the bigger concerns....

     

    ve3zyr

    I'm afraid your average non technical consumer has NO IDEA.

    The classic case is a Smart TV they have no idea about security (or lack of it).

     

    Mark

  • Hi Paul

    a few years ago, on small embedded systems I used to implement security using 3DES algorithm

    This was lightweight to be implemented and run on by most of the MCUs

    Nowadays, as it was said in other posts, encryption units are integrated (typically implementing AES algorithm), so that is now the obvious choice for new projects

  • in reply to gadget.iom

    Hi Paul

    I am using the Tiva launchpad TM4123GXL, uses C to program and I quite like it. I am taking part in the shape the world course on EDX and this is a nice little bit of kit. I would be interested in your opinion on the system you have bought when you have had a chance to play.

     

    @DAB has it right I think, Look at where your data is being sent and does it need to be that particular bit of data being sent. My project is likely to send data off site and I am going to be encrypting it before it leaves. Stuff over the air inside the site will just be things like measurements and on / off commands. This should be OK I think

  • in reply to Robert Peter Oakes

    Yeah it would be the ultimate in slackness to have found that some one had gained access via pivoting off a smart TV !

  • in reply to Problemchild

    I don't really know how people think these things work. Surely, if a device is going to act on things you say then it must be obvious that they must be listening all the time. I know that data being sent off to 3rd parties is the real issue but there seems to be a general lack of knowledge in the general population how these things work. I don't mean technically but how they do what they do and what sort of processes, at a very high level, must be in action to achieve those jobs.