Everyone is working on their own ways to secure IoT

Companies are doing everything from building their own secure devices to creating new encryption protocols.

If there’s one thing that alarms even the hardened cybersecurity veterans at the Black Hat convention this year, it’s the huge attack surface represented by the burgeoning internet of things — and at least two researchers are presenting solutions designed to secure connected devices.

Mikko Hypponen, chief research officer for F-Secure was touting his company’s solution for consumer devices; and Brian Knopf, Neustar’s senior security researcher gave a presentation about an alternative to Public Key Infrastructure encryption that enterprises can use to secure their IoT devices.

“PKI is awful,” Knopf told CyberScoop, “It works OK for browsers … but it wasn’t designed for IoT devices … The problem is the scale.”

PKI is a form of asymmetric encryption, in which users have a private key and a public key. Anyone with the public key can encrypt a message, which can then only be unscrambled with the private key. PKI is the basis for most internet encryption.

But PKI relies on digital certificates — which prove ownership of a cryptographic key — and certificates sometimes expire or have to be revoked. That means the software on any device relying on those certificates has to be updated. “Someone has to do that, either the end user or the site manager,” Knopf said, noting that automatic updating would only work if the user enabled it.

Knopf recalled how, as a security chief for a large IoT device manufacturer, he’d been faced with the job of updating a half million devices in the homes of consumers after a certificate revocation or expiry.

“There was a point at which we would just send the users [who had failed to install updates] a new device,” he said, to avoid the security risks inherent in continuing to use an expired or revoked certificate.

“So I had the crazy idea to basically redesign PKI from scratch,” he told CyberScoop.

Trusted Device Identity, or TDI, is the result and will be open-sourced by Neustar later this year, Knopf said, adding that at that point it would become part of the Linux Foundation’s EdgeX project — a multi-vendor supported open-source effort to create a more secure IoT.

TDI is a co-signing server for encryption certificates and a tiny piece of software which sits on each connected IoT device. Unlike PKI, which requires a certificate for every server that needs to communicate with the devices, stored on each device, TDI only requires two certificates: One for the TDI server and one for the “fleet,” which is Neustar’s terms for the full compliment of assets — update or web content servers for instance — that need to communicate with with IoT devices.

“The minute one of those servers is compromised, you can revoke that server [via TDI] and the next request [to the devices] will fail. So instead of months of clean-up, you have minutes,” he said.

He said that, in the case of a more extensive breach, “You can spin up a totally new TDI environment when you need it.”

“The key is,” Knopf said, “We separated identification and authentication. The device doesn’t need to know which server it is communicating with, it only needs to know if [the server] is authorized … and that means you can replace all your servers and the very next request will go through, because they are validated [by TDI.]”

“TDI is not a silver bullet … It won’t stop every attack,” but it does make the IoT ecosystem of a large enterprise more resilient, Knopf said. “We started from the assumption that you will get breached,” he said.

Hypponen says F-Secure is tackling the problem from the other end — for the consumer.

Connected consumer devices, he says, are never going to be secure because the market incentives all point the wrong way. “For the manufacturers, what matters is the price,” he told CyberScoop, noting that, “When people buy a washing machine, they are not asking about its firewall, or whether it has an intrusion detection system. They want to know how much it will cost them.”

Given this, Hypponen believes that, for the time being, the best we can do is to empower consumers to manage their own security, which is what F-Secure’s Sense home IoT router aims to do.

“There is an app interface you can run from your smartphone … It will alert you if one of your devices needs updating or if it is behaving oddly,” he said.

The router segments potentially insecure IoT devices away from conventional computers — just as an enterprise might use a VLAN or subnet to segregate some especially vulnerable part of their network.

Sense aims to make every householder their own CISO, Hypponen said in an interview after his Black Hat presentation.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure