Exploring the Future Of IoT: Challenges And Opportunities

by Miri Ofir, Research and Development Director at Check Point Software; and Gili Yankovitch, Technology Leader at Check Point Software

What Does The Global Threat Landscape Look Like And Could You Share Perspectives Around 2024 Predictions?
The global threat landscape has been affected by the increasing number of geopolitically motivated cyber-attacks. We’re referring to state-sponsored attacks.

Cyber espionage by state-sponsored actors aims to steal intellectual property, gather intelligence, or even lay the groundwork for potential sabotage. Countries like Russia, China, North Korea, and Iran have advanced state-sponsored cyber-attack skills, and we can track complicated campaigns affiliated with those countries.

An example of such type of campaign is a supply chain attack. As the name implies, this involves targeting less-secure elements in an organisation’s supply chain. The SolarWinds hack from 2020 is a notable example, in which attackers compromised a software update mechanism of a business to infiltrate numerous government and private sector systems across the U.S.

The Internet of Things (IoT) market is highly targeted and prone to supply chain attacks. The rapid proliferation of these devices, often in the absence of robust security measures, means a vast expansion of potential vulnerabilities. Malicious actors can exploit IoT weak points to gain unauthorised access, steal data, or launch attacks.

What are IoT Device Manufacturers’ Biggest Challenges at The Moment?
IoT manufacturers are facing evolving regulations in regard to cyber security obligations. The supply chain concerns and the increasing attacks (41% increase in IoT attacks during Q1 `23 compared to Q1 `22) have led governments to change policies and better regulate device security. We see two types of programmes being rolled out:

• Mandatory regulations to help manage Software and Hardware Bill of Materials (SBOM) and to verify that products will go to the market with some basic cyber security coverage. SBOMs will help manufacturers get a better understanding of the components inside of their products and maintain them through patches and other mitigations. This will add overhead for manufacturers.

• Excellent initiatives like the U.S. cyber trust mark and labelling programme, which aims to dispel the myth of clarity about privacy and security in the product and to allow educated users to select safer products, among other considerations, like energy efficiency.

While this is an obligation and a burden, it is also a business opportunity for manufacturers. The market is changing in many respects. For example, the U.S. sanctions over China are not only financially motivated; the Americans see China as a national security concern and the new sanctions push major competitors out of the market.

In this vacuum, there is room for new players. Manufacturers can leverage the changing landscape to gain higher market share by highlighting cyber security in their products as a key differentiator.

What Are the Most Used Exploit Techniques on IoT Devices?
There are several main attack vectors for IoT devices:

1. Weak credentials: Although manufacturers take credentials much more seriously these days than previously (because of knowledge, experience or on account of regulation), weak/leaked credentials still plague the IoT world. This is due to a lot of older devices that are already deployed in the field or due to still easily-cracked passwords. One such example is the famous Mirai botnet that continues to plague the internet in search of devices with known credentials.

2. Command injection: Because IoT devices are usually implemented with a lower-level language (due to performance constraints), developers sometimes take “shortcuts” in implementing the devices’ software. These shortcuts are usually commands that interact with system resources such as files, services and utilities that run in parallel to the main application running on the IoT device. An unaware developer can take these shortcuts to provide functionality much faster to the device while leaving a large security hole that allows attackers to gain complete control. These developer actions can be completed in a “safer” way but will take longer to implement and change. Command weaknesses can be used as entry points for attackers to exploit vulnerabilities on the device.

3. Vulnerabilities in 3rd party components: Devices aren’t built from scratch by the same vendor. They usually consist of a number of 3rd party libraries, usually open-sourced, that are an integral part of the device’s software. These software components are actively maintained and researched, therefore new vulnerabilities in them are discovered all the time. However, the rate in which vulnerabilities are discovered is much higher than that of an IoT device software update cycle. This causes devices to remain unpatched for a very long time, even for years; resulting in vulnerable devices with vulnerable components.

Why Do IoT Devices Require Prevention and Not Only Detection Security Controls?
Unlike endpoints and servers, IoT devices are physical devices that can be spread across a large geographical landscape. These are usually fire-and-forget solutions that are monitored live at best or sampled once-a-period, at worst. When attention to these software components is that low, the device needs to be able to protect itself on its own, rather than wait for human interaction.

Moreover, attacks on these devices are fairly technical, in contrast to things such as the ransomware that we see on endpoints. Usually, detection security controls will only allow for the operator to reboot the device at best. Instead, prevention takes care of the threat entirely from the system. This way not only is mitigation immediate, it is also appropriate and reactive, in accordance with each threat and attack it faces.

Why Is It Important To Check The Firmware? What Are the Most Common Mistakes When It Comes to Firmware Analysis?
The most common security mistakes we find in firmware are usually things that “technically work, so don’t touch them” and so they’ve been left alone for a while.

For example, outdated libraries/packages and servers; all start “growing” CVEs over time. They technically still function, so no one bothers to update them, but many times they’re exposed over the network to a potential attacker, and when the day comes, an outdated server can and will be the point of entry allowing for takeover of the machine.

A second common thing we see is private keys, exposed in firmware, that are available for download online. Private keys that are supposed to hold some cryptographically strong value – for example, proof that the entity communicating belongs to a certain company. However, they are available for anyone who anonymously downloads the firmware for free. This means they no longer hold a cryptographically strong value.

What Are Some Best Practices for Automatic Firmware Analysis?
Best practices for automated assessment – in my opinion, the analysis process is broken into 3 clear steps: Extraction, analysis, and report.

• Extraction: Is a huge, unsolved problem, the elephant in the room. When it comes to extracting firmware, it is not a flawless process. It is important to verify the results, extract any missed items, create custom plugins for unsupported file types, remove duplicates, and to detect failed extractions.

• Analysis: Proper software design is key. A security expert is often required to assess the risk, impact and likeliness of an exploit for a discovered vulnerability. The security posture depends on the setup and working of the IoT device itself.

• Report: After the analysis is completed, you end up with a lot of actionable data. It’s critical to improve the security posture of the device based on action items in the report.