The Myth of a Hacker-Proof IoT

Kevin Gross

I was recently invited to give a presentation on security for Internet of Things networking at infocomm 16. While I discussed the topic and scope with the organizers, I didn’t have a good catchy title prepared, so the organizers took it upon themselves to submit one for me: “Hacker-Proof IoT”. Easy, right? While I would love to be able to give a talk that delivers on this promise, reality dictates otherwise. I had to be ready for unrealistic audience expectations.

Dated Security Protocols

The original idea behind the IoT—and the internet itself—was to connect things together with few restrictions. The IoT uses a lot of the same internet protocols, many dating back to the 1980s, developed when security wasn’t a large consideration. Although security now gets substantially more attention, building a secure network is still a challenge.

When doing security analysis or risk ashutterstock_291690857ssessment, you want to ask yourself, “What could possibly go wrong?” Things going wrong fall into two classes:

  • Unauthorized access to information
  • Unauthorized manipulation of things

While the latter is often considered more severe, it is important to appreciate that the former can be used as a step stool to reach the latter. With regards to either, you need to consider that if there is authorized means of accessing or manipulating your things, there is at least the theoretical possibility of unauthorized access and manipulation.

Safety First

When analyzing or designing for security, there are a few things we can do to make us feel safe:

  • Building a physically separate or dedicated network or VLAN
  • Installing firewall and NAT equipment
  • Implementing access control on individual devices

Feeling safe and being safe are not one and the same, so I’m going to address each of these approaches.

Isolated Networks

It seems obvious that if a network is isolated it should be more secure. If there is no path from a potential attacker to the network of interest, there is no opportunity for attack. The catch is that engineers often overlook potential paths. Remote access is a compelling function of the IoT, so it is tempting, and even necessary, to connect a network of things to the internet or other larger network. Maintenance scenarios, including remote diagnostics and firmware updates, often require at least temporary remote connections into the network. For many applications it is impossible or impractical to build an all-wired network, and the importance of wireless networking is increasing. In most cases, it is impossible to physically isolate a network with a wireless component. Even if you have all this covered—and the Department of Defense, for instance, believes they do—it has been shown through academic exercises and real embarrassments that there are, for the determined, still paths into and out of presumed isolated networks.

Firewalls

Most internet users and network operators rely on firewall technology (allowing outgoing, but not incoming access) to protect themselves from the forces of evil on the internet at large. If you assume internet communications can be classified by direction, that model feels secure. In reality, almost all network communication is bidirectional. To retrieve a webpage, you must first send a request to the web server before it sends the page content. When you send an email, the recipient must send you an acknowledgement that the message was received. So, no, a firewall cannot block all messages originating from insecure side of the wall. “Firewall” is a blanket term describing an array of security algorithms. Most firewalls control how and what communications can be initiated. More sophisticated firewalls examine the data passing through them and block communications that appears to be malicious. Firewalls do not create an isolated network.

Device Access

Having failed to secure a network through isolation or firewall, the focus for security shifts to the devices themselves. This approach is most compatible with the end-to-end principle but is also the most burdensome in terms of configuration and testing—and it’s most likely to get in the way of getting fun and productive stuff done on your network. Security features are available in many devices but are often disabled by default. Users, and we have to include network administrators as users in most cases, are lazy and will not change default configurations if deemed unnecessary. Device access control is often based on passwords, but passwords are only secure if you use a different, long, and cumbersome password for each device. In other words, passwords are only secure if they’re impractical. In addition to a strong password, a secure device must have no security bugs in implementation and no alternate means of access (i.e. backdoor). You assume and hope manufacturers are not including backdoors in their systems right up to that point where you misplace a critical password and need to ask the manufacturer for the recovery procedure. Could an attacker also use this password recovery backdoor? Are there other doors they’ve not told you about?

An Apology

Far from delivering a recipe for “Hacker-Proof IoT”, this post has hopefully given you a better appreciation for the challenges of securing a network. You probably feel your network is less secure and less securable than you thought going in. You’re disappointed that there’s no hacker-proof recipe and you’re not happy about all the setup you have to do and the difficult passwords you need to use. Sorry about that.

Cardinal Peak
Learn more about our Audio & Video capabilities.

Dive deeper into our IoT portfolio

Take a look at the clients we have helped.

We’re always looking for top talent, check out our current openings. 

Contact Us

Please fill out the contact form below and our engineering services team will be in touch soon.

We rely on Cardinal Peak for their ability to bolster our patent licensing efforts with in-depth technical guidance. They have deep expertise and they’re easy to work with.
Diego deGarrido Sr. Manager, LSI
Cardinal Peak has a strong technology portfolio that has complemented our own expertise well. They are communicative, drive toward results quickly, and understand the appropriate level of documentation it takes to effectively convey their work. In…
Jason Damori Director of Engineering, Biamp Systems
We asked Cardinal Peak to take ownership for an important subsystem, and they completed a very high quality deliverable on time.
Matt Cowan Chief Scientific Officer, RealD
Cardinal Peak’s personnel worked side-by-side with our own engineers and engineers from other companies on several of our key projects. The Cardinal Peak staff has consistently provided a level of professionalism and technical expertise that we…
Sherisse Hawkins VP Software Development, Time Warner Cable
Cardinal Peak was a natural choice for us. They were able to develop a high-quality product, based in part on open source, and in part on intellectual property they had already developed, all for a very effective price.
Bruce Webber VP Engineering, VBrick
We completely trust Cardinal Peak to advise us on technology strategy, as well as to implement it. They are a dependable partner that ultimately makes us more competitive in the marketplace.
Brian Brown President and CEO, Decatur Electronics
The Cardinal Peak team started quickly and delivered high-quality results, and they worked really well with our own engineering team.
Charles Corbalis VP Engineering, RGB Networks
We found Cardinal Peak’s team to be very knowledgeable about embedded video delivery systems. Their ability to deliver working solutions on time—combined with excellent project management skills—helped bring success not only to the product…
Ralph Schmitt VP, Product Marketing and Engineering, Kustom Signals
Cardinal Peak has provided deep technical insights, and they’ve allowed us to complete some really hard projects quickly. We are big fans of their team.
Scott Garlington VP Engineering, xG Technology
We’ve used Cardinal Peak on several projects. They have a very capable engineering team. They’re a great resource.
Greg Read Senior Program Manager, Symmetricom
Cardinal Peak has proven to be a trusted and flexible partner who has helped Harmonic to deliver reliably on our commitments to our own customers. The team at Cardinal Peak was responsive to our needs and delivered high quality results.
Alex Derecho VP Professional Services, Harmonic
Yonder Music was an excellent collaboration with Cardinal Peak. Combining our experience with the music industry and target music market, with Cardinal Peak’s technical expertise, the product has made the mobile experience of Yonder as powerful as…
Adam Kidron founder and CEO, Yonder Music
The Cardinal Peak team played an invaluable role in helping us get our first Internet of Things product to market quickly. They were up to speed in no time and provided all of the technical expertise we lacked. They interfaced seamlessly with our i…
Kevin Leadford Vice President of Innovation, Acuity Brands Lighting
We asked Cardinal Peak to help us address a number of open items related to programming our systems in production. Their engineers have a wealth of experience in IoT and embedded fields, and they helped us quickly and diligently. I’d definitely…
Ryan Margoles Founder and CTO, notion