CISC 7050 Lecture 13: Unit 13
31 May 2020
School
Department
Course
Professor
IOT
• IoT = Internet of Things
o Catchphrase to encompass all devices w/ network connectivity outside of
laptops, desktops & mobile devices
• Major devices included in IOT are smart devices found in homes/enterprises,
SCADA devices, devices found in hospitals/biotech & control systems found in
vehicles
• Threat Modeling home assistants
o Ecosystem of IOT devices created to integrate w/ each other
o By design these devices are talking to each other exchanging info &
commands
o Star topology where home assistant is the single point of failure
o Dependency of having internet access & access to other devices that they
would control
o Constantly listening via microphone by design
▪ Listening is important to provide users that abilities to speak w/o any
additional actions
o Privacy & security concerns b/c home assistants always processing audio
surrounding the devices
▪ Leads to situation where we are dependent upon device security to
ensure privacy
o Data not stored on device, but the cloud
▪ Susceptible to incidents if there are design flaws
• Blueborne exploit was major Bluetooth flaw that impacted all Bluetooth-enabled
devices
o Doesn’t require any user interaction & all that was required is that attacker is
w/in Bluetooth range of device
o Attackers send device specialized payload exploiting vulnerability where
unexpected input eventually takes control of the device & allows full access
into system
• Jeep Hacking
o Researchers targeted radios in the vehicle (Bluetooth, Wi-Fi, Cellular)
o Moved laterally from exploiting cellular network in the car to other computer
components, allowing them to take full control of the car
IOT Botnet
• Mirai IOT is worm designed to exploit IOT devices
o Botnet infrastructure eventually built w/ massive amount of infected “zombie”
endpoints
o All of those devices fell under the control of the attacker once infected
o Devices targeted: IP cameras, DVRs, smart devices, etc.
o Once machine was infected, it would attempt to move laterally to next device
