Internet of Shit
The ”S” in “IoT” stands for ”Security”
Slide 3
Slide 3 text
I’m:
- Andy
- Dev-like
- Sec-ish
- Ops-y
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
Viktor (@vpetersson)
● Entrepreneur, geek, tinkerer
● Jack-of-all-trades
● Cofounder of
○ Screenly (screenly.io)
○ WoTT (wott.io)
○ (and a few other things)
Slide 6
Slide 6 text
What’s WoTT?
● Enable DevSecOps
● Gamify security
● Provide visibility and alerting
● Started in IoT, now on edge devices and servers
What This Talk is About
● IoT: The State of the Art
● How Containers and Kernel Technologies Can Help
● Botnets and Brickerbots
● Building Better Devices
Why do IoT devices get compromised?
● Default credentials
● Poor, or non-existent, update cycles
● Insecure services exposed to the network (telnet, ftp, etc)
● No isolation or hardening
● Manufacturers not using common sense
Slide 33
Slide 33 text
IoT Devices vs Servers
● IoT devices are getting more powerful
● More and more are running Linux
○ Except many battery-powered devices
● This means we are deploying general purpose computers into...everything
○ Moore’s law at play
● ...the line is getting blurry between IoT and traditional compute
Slide 34
Slide 34 text
Securing Servers 101
● What services are running?
○ Do we need all of them?
○ Are any of them publicly exposed on the network?
● Is everything configured with least privilege?
● Are we using process isolation to limit the blast radius of a breach?
● Is everything encrypted in transit? At rest?
● Is the firewall configured?
● Are there any packages installed with known vulnerabilities?
● Are we conformant to documented best practice (CIS, OWASP, et. al.)?
● How do we monitor if any of this changes?
Slide 35
Slide 35 text
Securing IoT Devices 101
Slide 36
Slide 36 text
Sham
eless self-plug
Slide 37
Slide 37 text
Containers and IoT
Slide 38
Slide 38 text
Containers to the Rescue!
Containers to the Rescue!
● Smaller footprint than “Classic”
● Lots of “read-only” and kernel magic
● Interfaces, slots and plugs
● Snaps, Docker and LXD
● Self-updating
● Isolation tool (primary): AppArmor
Slide 43
Slide 43 text
No content
Slide 44
Slide 44 text
● Everything is a “snap” (including the OS)
● Transactional, cryptographically signed, updates
● Default permission is nill (or almost)
● Permission must be granted explicitly
○ E.g. network access, ports etc
Screenly 2 Player criteria
● Disk images built on CI
● Process isolation (perhaps using containers)
● Transactional updates (app and OS)
○ Automatic roll-back
● Not having to manage the OS layer ourselves
○ Must be locked down/Hardened by default
● Bonus: Cryptographically signed updates
Slide 65
Slide 65 text
Screenly 2 Player
+ +
Slide 66
Slide 66 text
Recap
Slide 67
Slide 67 text
Conclusion
● Everything is now a computer
○ Whatever that means...
● IoT security is an afterthought at best
● The new breed of containerised IoT platforms greatly enhance the update
and security story
● This problem is bigger than all of us: legislation, class action, or revolt is
required! This should be supported by financial incentives
● We can fix life cycle and runtime security
● Go forth and patch your devices!