Embedded Web Device Security
Total Page：16
File Type：pdf, Size：1020Kb
SECURWARE 2014 : The Eighth International Conference on Emerging Security Information, Systems and Technologies Embedded Web Device Security Michael Riegler Johannes Sametinger IT Solutions Dept. of Information Systems – Software Engineering RMTec Johannes Kepler University Baumgartenberg, Austria Linz, Austria [email protected] [email protected] Abstract —Due to the increasing networking of devices and access. We will outline the importance of the security of services to the Internet of Things, security requirements are such devices, demonstrate how neglected it is, and also pre- rising. Systems that were previously operated in isolation can sent a case study of a water supply facility. The paper is be attacked over the Internet today. Industrial control systems structured as follows. Section II introduces embedded web often form the core of critical infrastructures. Their vulnera- devices. In Section III, we outline security aspects. Risks to bilities and too lax security management can have fatal conse- industrial control systems are described in Section IV. Sec- quences. With the help of vulnerability databases and search tion V explains how vulnerable web devices can be found on engines, hackers can get instructions and targets to exploit. the Internet. A case study is given in Section VI. Related Routers, printers, cameras and other devices can be the gate- work and a conclusion follow in Sections VII and VIII, re- way to the home or corporate network. Cyber criminals can spectively. enter sensitive areas through inadequately protected remote access. In a case study of a central water supply control system, II. EMBEDDED WEB DEVICES we present typical security problems. We show that security vulnerabilities are wide-spread in current embedded web devi- The Internet has started as a DARPA project, intercon- ces and demonstrate that appropriate countermeasures can necting computers through which everyone could quickly reduce the attack surface significantly. access data and programs from any site. Today’s Internet provides access to a plethora of information from not just Keywords-web; embedded devices; web security; industrial computers – back then only mainframes were available – but control systems. from devices like smartphones, and television sets. Ad- ditionally, access is not limited to other computers but is I. INTRODUCTION increasingly available to other devices like printers, routers Embedded devices increasingly include connectivity as a or webcams. Web devices are any devices that are connected standard feature, putting them at risk to malicious attack if to the Internet via the Hypertext Transfer Protocol (HTTP) not secured properly. Some device vendors are offering protocol, including web servers, personal computers and solutions to protect their embedded devices, including anti- smartphones. Embedded web devices are with a different malware technology, access control, data encryption, and focus than just providing and retrieving information on the real-time threat analysis, as well as maintenance, support, web. We have already mentioned printers, routers, and and update/patch services [8]. However, there is insufficient webcams. Additional examples include network devices, awareness of both device manufacturers and their users sensors in smart homes, smart meters in smart grids, smart about the risks that stem from lacking protection. Take medi- TVs, etc. cal devices as an example. Today, even heart pacemakers communicate wirelessly. Parameter settings can be sent to A. Embedded Web Servers the devices, and usage data including alerts are automatically Web servers are running on a combination of hardware sent to manufacturers and clinics. If not properly secured, and software. They deliver web content to be accessed these devices are a threat to patients’ privacy as well as to through the Internet. Embedded web servers are components their well-being and even life [12]. Users of devices like of systems that, like web servers, communicate via the HTTP personal computers, smartphones as well as operators of web protocol. Typically, they provide a thin client interface for servers are typically aware to some extent about the security traditional applications. Lightweight web servers work with risks. Security risks of devices that we use more unobtrusive- small resources and are often used in embedded systems. ly often go unnoticed. Such devices include printers, routers, Examples include Barracuda [41], Mongoose [26], Appweb and cameras [14]. Their use is widespread, they are connect- [2], and RomPager [33]. Embedded web servers are used for ed to the Internet, they often provide web interfaces, and they special purpose and are not as extensive as major web serv- are often unprotected. On the road to a secure Internet of ers like Apache [1] and Microsoft’s IIS [25]. Things (IoT) [3], we will have to do our homework and Embedded web servers are important for the IoT. Today provide security as needed to all devices. computers and the Internet are almost completely dependent In this paper, we will describe security issues of what we on humans for information. Radio-frequency Identification call embedded web devices, i.e., embedded devices with web (RFID) and sensor technology enable computers to observe Copyright (c) IARIA, 2014. ISBN: 978-1-61208-376-6 1 SECURWARE 2014 : The Eighth International Conference on Emerging Security Information, Systems and Technologies and identify the world without the limitations of data entered ment. We can assess risks by enumerating the most critical by humans [3]. IoT refers to uniquely identifiable objects, and most likely threats, by evaluating their levels of risk as a e.g., sensors having an Internet Protocol (IP) address, and function of the probability of a threat and the associated cost their virtual representations in the Internet. if the threat becomes true. Secure devices have to continue to function correctly even if under malicious attack. Vulnerabil- B. ICS – Industrial Control Systems ities are mistakes in devices, typically in software, which can The term Industrial Control System (ICS) encompasses be directly used to gain access to the device. They pose a several types of control systems that are used in industrial threat to the device itself, to the information it contains, to production. Examples are Supervisory Control and Data other devices it communicates with, and to the environment Acquisition (SCADA) systems, Distributed Control Systems that it manipulates. (DCS), and Programmable Logic Controllers (PLC). ICSs are instrumental in the production of goods and in the provi- B. ICS Security sion of essential services, e.g., to monitor and control pro- ICSs are often found in critical infrastructures, thus have cesses like gas and electricity distribution or water treatment. a high need for security. A typical information network will The largest group of ICS is SCADA. For example, all nine prioritize its security objectives as CIA, i.e., first confidenti- Austrian Danube power plants are controlled centrally from ality and integrity, and then availability. Industrial control Vienna. The stations are connected with optical fibers to the systems often have a high need for availability, reversing the central control room and cannot easily be accessed over the security objectives for most control entities [8]. Table 1 Internet [42]. shows these different security goals. There are other crucial differences that have an influence C. CPS – Cyber Physical Systems on the security of these systems. Table 2 summarizes some Embedded systems contain computer systems with dedi- of these differences. For example, ICSs are usually real-time cated functions within larger mechanical or electrical sys- systems, whereas in IT systems delays are acceptable most tems, often having real-time computing constraints [13]. In of the time. Also, an ICS has to run continuously and cannot Cyber Physical Systems (CPS) computational elements col- simply be rebooted. More details are given by Stouffer et al. laborate to control physical entities. CPSs have a tight inte- [36]. gration of cyber objects and physical objects. They can be According to a security survey, 70% of SCADA system systems at various scales, e.g., large smart bridges with fluc- operators consider the risks to their systems to be high to tuation detection and responding functions, autonomous cars, severe, and 33% suspect they may have had incidents [21]. and tiny implanted medical devices [15]. While IT security is not entirely different from ICS security, there are several differences; see [22]: III. SECURITY Security is about protecting information and information • ICS security failures often have physical conse- systems, including embedded devices, from unauthorized quences, thus having more severe and immediate access and use. The core goals are to retain confidentiality, impact. integrity and availability of information. Often used terms • ICS security failures can easily and wrongly be in- include IT security, network security, computer security, web terpreted as traditional maintenance failures, making security, mobile security, and software security. They de- them more difficult to diagnose and remedy. scribe different, but sometimes overlapping aspects of reach- ing the above mentioned core goals. For example, software Security management of an ICS is often much more dif- security is “the idea of engineering software so that it contin- ficult than of a regular IT system. They more often rely