IoT

Question 1

IoT challenges

Answer 1

• Security
  -> IoT devices can easily outnumber servers when compromised
  -> Can spy on you if in the wrong hands
• Connectivity: How to manage that many devices? (Centralized, Decentralized)
• Compatibility and Longevity
  -> Standard
  -> Update/Bugfix deployment

Question 2

IoT Vulnerabilities

Answer 2

• Insecure Web Interface
• Insecure Cloud Interface
• Insecure Mobile Interface
• Insufficient Authentication/Authorization
• Insecure Network Services (e.g. exposed ports)
• Lack of Transport Encryption
• Privacy Concerns
• Insufficient Security Configurability
• Insecure Software/Firmware
• Poor Physical Security

Question 3

Message Queuing Telemetry Transport

Answer 3

• Used by Amazon, Microsoft and in smart home automation
• ISO Standard
• TCP/IP or WebSocket based
• Publish/Subscribe pattern
• Authentication
  -> Username/Password
  -> Using TLS
  -> Using client certificates

Question 4

Insecurity of MQTT

Answer 4

• Many devices are too weak to support TLS
• Vulnerable to a slow DoS attack
• Permissions are set on the broker while topics are set on the client
  -> Permission for new topics do not exist initially
  -> Have to be set by hand