Flaws on a Billion Devices: Rethinking
Total Page：16
File Type：pdf, Size：1020Kb
Handling a trillion (unfixable) flaws on a billion devices: Rethinking network security for the Internet-of-Things Tianlong Yuy, Vyas Sekary, Srinivasan Seshany, Yuvraj Agarwaly, Chenren Xuz yCarnegie Mellon University, zCECA Peking University ABSTRACT Interac0on/control!over! Launchpad!for!deep!and! physical!environment! ! scalable!a;acks! The Internet-of-Things (IoT) has quickly moved from the ! ! realm of hype to reality with estimates of over 25 billion ! ! devices deployed by 2020. While IoT has huge potential for societal impact, it comes with a number of key security Privacy!leaks! challenges—IoT devices can become the entry points into IoT!Challenges! critical infrastructures and can be exploited to leak sensitive Tradi0onal!IT! ContextBdependence! information. Traditional host-centric security solutions in Policies! Sta0c,!PerBhost! CrossBdevice!interac0ons!! today’s IT ecosystems (e.g., antivirus, software patches) are Simple!honeypots! Device/Vendor!diversity! Learning! fundamentally at odds with the realities of IoT (e.g., poor Few!configura0ons! CrossBdevice!interac0ons! vendor security practices and constrained hardware). We ar- Host!Patch/An0virus! Device!constraints! Enforcement! gue that the network will have to play a critical role in se- Perimeter!Appliances! Deep!access!to!a;acker! curing IoT deployments. However, the scale, diversity, cy- Figure 1: IoT security challenges and how/why conven- berphysical coupling, and cross-device use cases inherent to tional IT security approaches are found wanting IoT require us to rethink network security along three key dimensions: (1) abstractions for security policies; (2) mech- While IoT has huge potential, it also comes with its share anisms to learn attack and normal profiles; and (3) dynamic of challenges. Most vendors only deal with parts of the IoT and context-aware enforcement capabilities. Our goal in this ecosystem and, typically, their priorities have been providing paper is to highlight these challenges and sketch a roadmap novel functionality, getting their products to market soon, to avoid this impending security disaster. and making them easy to use. Unfortunately, security and privacy risks have not received as much attention. Since IoT Categories and Subject Descriptors devices will typically be embedded deep inside networks, C.2.0 [Computer-Communication Networks]: General- they are attractive attack targets and may become the “weak- security and protection; C.2.1 [Computer-Communication est link” for breaking into a secure IT infrastructure [17], or Networks]: Network Architecture and Design-distributed for leaking sensitive information about users and their be- networks haviors [18]. These are not hypothetical concerns as several actual attacks have already been reported. For example, IoT General Terms devices were used as bots to launch DDoS or spam [3], smart Security, Design meters were hacked to lower utility bills [15], and handheld scanners were compromised to enter logistics firms [6]. 1 Introduction Today’s IT security ecosystem, which relies on a combi- The Internet-of-Things (IoT) has quickly moved from hype nation of static perimeter network defenses (e.g., firewalls to reality; Gartner, Inc. estimates that the number of de- and intrusion detection/prevention systems), ubiquitous use ployed IoT devices will grow from 5 Billion in 2015 to 25 of end-host based defenses (e.g, antivirus), and software Billion in 2020 [4]. Like other disruptive technologies, such patches from vendors (e.g., Patch Tuesday), is fundamen- as smartphones and cloud computing, IoT holds the potential tally ill-equipped to handle IoT deployments (Figure 1). for societal scale impact by transforming many industries as Specifically, the scale, heterogeneity, use cases, and device well as our daily lives. and vendor constraints of IoT means that traditional ap- proaches fall short along three key dimensions: • Types of policies: IoT devices can interact with other de- Permission to make digital or hard copies of all or part of this work for vices via explicit channels (e.g. a single app may use mul- personal or classroom use is granted without fee provided that copies are tiple IoT devices) or implicitly by affecting the physical not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to world around them (e.g., an IoT light bulb may trigger republish, to post on servers or to redistribute to lists, requires prior specific an IoT light sensor). Thus, compromised IoT devices can permission and/or a fee. affect both applications that use them explicitly as well HotNets ’15 November 16–17 2015, Philadelphia, PA USA Copyright 2015 ACM 978-1-4503-4047-2 ...$15.00. as applications with implicit or indirect cross-device de- Row Device Device Num. Vulnerability Device Cross-device policies Typical Example 1. Avtech Cam 130k exposed account/password If Nest Protect detects smoke, NEST Protect 188 2. TV Set-top box 61k exposed access then turn Philips hue lights on. 3. Smart Refrigerator 146 exposed access Turn of WeMo Insight if SmartThing Wemo Plugin 227 4. CCTV Cam 30k (by IP) unprotected RSA key pairs shows no body is at home. 5. Traffic Light 219 no credentials Activate your Manythings Camera Scout Alarm 63 6. Belkin Wemo >500k (estimated) open DNS resolver, use for DDoS if Alarm is Triggered. 7. Belkin Wemo >500k (estimated) exposed access, bypass app Table 2: Cross device policy examples. Table 1: Examples of Known IoT Vulnerabilities. pendencies. The result is that the security for an IoT de- teractions. Finally, we present the issues in using current ployment are likely to be complex and dynamic since they enforcement mechanisms and highlight the requirements for depend on both physical (e.g. environmental parameters) IoT security. and computational (e.g., the state of other related devices) 2.1 Motivating Scenarios contexts. IoT Vulnerability Cases: Table 1 lists a small subset of • di- Learning signatures and anomalous behaviors: The IoT device vulnerabilities found from SHODAN [14] and versity of IoT devices and vendors inevitably means that other sources. The examples come from different types of traditional approaches of discovering attack signatures IoT devices, including: cameras (Row 1 and 4), Set-top box (e.g., honeypots) will be insufficient and/or non-scalable. (Row 2), Smart Appliance (Row 3), Traffic light (Row 5) Furthermore, there might be implicit dependencies where and Smart Plugs (Row 6 and 7). The first three cases are device interactions are indirectly coupled through the en- examples where the devices have hardcoded default user- vironment. Thus, we need new mechanisms to learn sig- name/passwords (“admin/admin” for Avtech cameras) or de- natures and infer such cross-device dependencies to in- vices with open IPs, ports and protocols that can be accessed form security policies. (Row 2 and 3). The fourth example is a CCTV setup with • Enforcement mechanisms: Since IoT devices operate unprotected RSA key pairs in the firmware image for ≈30K deep inside the network, traditional perimeter defenses devices [20]. Here, an attacker can gain access to the devices are ineffective. At the same time, IoT devices typically and mount more complex attacks on the internal networks, do not run full-fledged operating systems, require low- turn on/off devices, or compromise the privacy of individ- power consumption and are resource constrained. More- uals. To date, these vulnerabilities remain unpatched. The over, the longevity of these devices means that vulnerable traffic light vulnerability (Row 5) allows unfettered access of devices (e.g., default passwords, unpatched bugs) remain 219 traffic lights, enabling an attacker to change traffic lights deployed long after vendors cease to produce or support and even cause accidents [14]. The last two examples (Row them. Thus, traditional host- or device-centric mecha- 6,7) are vulnerabilities in the popular Belkin Wemo line of nisms (e.g., antivirus, patches) are impractical to expect smart home products. The Wemo devices run a open DNS in an IoT world. Finally, given that the environment and resolver which was used to mount a DDoS attack. The sec- device behaviors can change rapidly, we need to rapidly ond vulnerability allows open access to the devices across reassess and update the system’s security posture. Unfor- the Internet (not just on the LAN), which means that their tunately, today’s security enforcement schemes stem from data (power usage) be accessed and they can even be turned a static mindset and cannot handle such dynamics. ON/OFF remotely. In summary, these anecdotes suggest that Rather than chase the hopeless goal of IoT devices that vulnerable IoT devices can create a significant threat to the are secure-by-construction, we need pragmatic “bolt-on” so- security of our networked infrastructures and compromise lutions for securing IoT that acknowledge the realities of the privacy of individuals. marketplace (e.g., existing devices, poor software practices, Cross-device dependencies: Like typical network de- patch unavailability) and the practical challenges associated vices, IoT devices can communicate explicitly with each with IoT (e.g., resource or software constraints). Unlike other. For example, a networked thermostat (e.g., NEST) traditional IT ecosystems where host-based detection and can control the air-conditioning system in a smart home. prevention are prevalent, we believe that the device and However, unlike traditional devices, IoT devices can also ecosystem limitations of IoT will need the the network to be coupled through the physical environment leading to (re)emerge as the key vantage point for enforcing security implicit dependencies. For instance, a temperature sen- policies. In the rest of the paper, we elaborate on the chal- sor can be connected to a service like IF-This-Then-That lenges with respect to policies, policy learning, and enforce- (IFTTT) [7] to open windows to cool down a space when ment and discuss preliminary ideas for rethinking network the air-conditioning is not active.