February 17, 2017 By Charles Henderson 4 min read

An IoT Love Story

This is the true story of when my personal life and my security research world collided. It’s also a love story, but it’s not really that mushy.

Let’s start with the love story. I used to have a great convertible car. It brought me joy to cruise around Austin, wind blowing through my thinning hair and The Black Keys on the radio. Then I had kids. I decided having a good roof over my kids’ heads is just as important in the car as it is in the house. I responsibly disclosed to my wife that I wasn’t happy about it, but I decided to be an adult and trade in my convertible. My lovely convertible went back to the dealership and I got a more kid-friendly model from the same manufacturer.

I’m a security researcher, so I’m skeptical of everything by nature. Before I brought the car to the dealership I deleted all my personal information from the car, reset the phone book, removed all connected devices and reset the garage door opener. When I got to the dealership, they took several steps as well. They made sure that all the keys issued to the car were turned back over.

I was happy to see that the dealership went through several of the same privacy precautions, like making sure my personal information was removed from the phone book. Luckily, my new car also had the same connected car management app for my mobile device. When I got home, I synced up my management app and I noticed that under the car inventory in the application, my old car was still listed. I didn’t think much of it — I figured there must be a process by which that car would be expired.

Over time, I began to realize that the car wasn’t going to expire. Days went by, then weeks, months and, eventually, years. It was obvious that whomever had purchased my old car had not enrolled it in the mobile app. This is where my curiosity kicked in — were manufacturers only designing Internet of Things (IoT) functionality for the first owner because that’s where their revenue comes from?

Secondhand IoT Security

The first owner drives the value of most products, and for IoT devices especially, there’s no expectation that the life of the product will extend beyond that owner. Setting my old car aside for a moment, I looked at other forms of internet-based technology and found it wasn’t limited to vehicles.

David Bryan, who works in X-Force Red, recently bought a used home automation hub. He’s a penetration tester and vulnerability researcher, so he too is more cynical about technology and security than the average consumer. The first thing David did with the hub was perform a factory reset. But when he went to set it up, he saw a device listed under the management screen that was not his.

After performing another factory reset, he contacted customer support. The first thing they asked him was, “Well, have you performed a factory reset?” It turned out that in this case, the factory reset only cleared the settings on the device, but not the account that managed the device in the cloud.

After two weeks of going back and forth, the support team removed that extra device from the approved devices and asked David if they should remove a second device that also had access to his hub. David couldn’t even see that second device in his management console. It’s scary to think that even if a user checks the management settings and determines that everything is secure, there still might be authorized devices invisible to them.

A New Challenge for Manufacturers

User awareness about security risks associated with these types of devices is relatively low. An IBM Security survey revealed that consumers were least worried about protecting car navigation data (8 percent), home devices (10 percent) and connected cameras (16 percent), compared to 64 percent who cared about their mobile devices.

Thinking back to the connected car, the dealership was very aware that it should collect the keys for that car. When I notified the manufacturer of my remote access after selling the car, its response was, “Well, that’s the same as keeping keys.” But keys don’t have geolocation built in. Actually, a mobile device is much more dangerous than a simple key.

Fundamentally, this really isn’t a new problem. Transfer of ownership has caused complications before in the tech industry. Look at the early days of mobile phones, when people would trade up to a new device and leave personal data on the old one. They didn’t know to remove it and it caused some embarrassing situations. But through education and more prominently featured factory reset methods, the phone manufacturers and carriers standardized the way mobile devices are reset.

IoT device manufacturers need to look to that example and establish a common definition of factory reset. They need to disclose to their customers what data remains in the cloud after that factory reset.

Devices Are Only as Smart as Their Users

Some industries are getting in front of these IoT security issues. The National Association of Realtors is not only testing smart home devices, but also looking at how to properly convey them as part of a home sale. Smart home devices can be tricky, because a smart light bulb is designed to look like a regular light bulb. Consumers feel better when products look and feel the same, but this also means a new homeowner might be living with dozens of smart devices they don’t control.

We’re living in a strange time because we’re seeing IoT devices change ownership for the first time. We know these devices aren’t aware enough to know they’ve been sold — but the bigger problem is that many consumers don’t know they’ve purchased a product with IoT capabilities.

For those of you old enough to remember the early days of seat belt notifications in cars, there were not only beeps and dings, but also a voice reminding you to buckle up. I can imagine a similar situation emerging soon in which a light switch alerts you when you haven’t logged into your control app in the last 10 days. There are definitely some creative ways to approach these issues.

An Open Dialogue

Obviously, my team and I have looked into IoT security to see what’s broken, but we’re also aware that our talents are more geared toward breaking than building. The path to true IoT security will require open dialogue between manufacturers, resellers, security researchers and consumers.

For now, IoT consumers should follow a few rules to keep themselves safe:

  • Even though factory resets aren’t perfect, they’re still a good practice.
  • Don’t assume you’re the only authorized user of a smart device. Verify it.
  • Do a little security testing of your own. Play with your digital toys and see what else you can learn about them.

Hear more from Charles Henderson: Connected Cars, Smart Homes and IoT Security

More from X-Force

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Empowering cybersecurity leadership: Strategies for effective Board engagement

4 min read - With the increased regulation surrounding cyberattacks, more and more executives are seeing these attacks for what they are - serious threats to business operations, profitability and business survivability. But what about the Board of Directors? Are they getting all the information they need? Are they aware of your organization’s cybersecurity initiatives? Do they understand why those initiatives matter? Maybe not. According to Harvard Business Review, only 47% of board members regularly engage with their CISO. There appears to be a…

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today