Endpoint

8/10/2014
10:00 PM
Brian Prince
Brian Prince
Quick Hits
50%
50%

Small IoT Firms Get A Security Assist

BuildItSecure.ly, an initiative where researchers vet code for small Internet of Things vendors, in the spotlight at DEF CON 22.

LAS VEGAS — DEF CON 22 — There was a time when people did not have to think about an egg tray connected to the Internet. But those days are gone.

Researchers Mark Stanislav and Zach Lanier of Duo Security here today spotlighted the increasingly connected world of devices that comprise the Internet of Things (IoT), and how the IoT continues to be challenged when it comes to security. Their solution was the creation of BuildItSecure.ly, a partnership of vendors and researchers working to make sure devices that make up the IoT are built... well, securely.

BuildItSecure.ly, which was launched in February, is focused on small vendors and startups, Stanislav says. So far, the initiative has drawn support from vendors such as Dropcam, which was recently acquired by Google's Nest Labs, and Belkin as well as security researchers from companies such as IOActive and Lab Mouse Security. Bugcrowd is supporting the initiative as well, and the BuildItSecure.ly website contains links to information on security ranging from presentation slides to technical documents on standards and best-practices.

"All the researchers basically are doing this -- one, because they want to help some people; two, because they are getting research done and not being sued for it," says Stanislav. "They already have opt-in from these vendors.

"We're going to have researchers looking at pre-production hardware, doing assessments against them… and actually making the device better before they go to people's hands rather than after."

The emphasis is on small vendors, the researchers explain, because startups and smaller vendors may not have the resources and budget to focus on security. Many may not know how to react to a security researcher poking holes in their product, either.

"They don't quite get why you're coming to them telling them that their baby is ugly," says Lanier.

"They don't have the resources or the experience to necessarily deal with this," he adds, noting that security researchers likewise might not know how to approach a smaller vendor unused to dealing with the security community.

The stakes can be high: Take the research the firm publicized last year that uncovered security weaknesses in the IZON IP camera.

"The number of devices that we have in IoT where you have firmware going, we can barely update one router," Stanislav says. "What makes us think that we're going to update like hundreds of devices in our household in five years?"

The ecosystem of the Internet of Things is also messy, the researchers note.

"There's a lot going on just in terms of how diverse the technologies are," says Stanislav. "The ecosystem's really messed up right now. You see companies big and small trying to standardize and trying to make sense of it all, but really we don't see that quite yet, and I don't think we will for a while.

"The problem we've always had with embedded hardware is you get random OEMs, you have firmware that nobody's actually done a security audit of, kernels that are, like, 15 years old," he laments. "This is the kind of stuff that we are putting in our networks right now. So even if the device is new, the actual technology underlying it is probably not."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Gary Scott
50%
50%
Gary Scott,
User Rank: Strategist
8/12/2014 | 6:58:44 PM
Small firms don't have the resources to deal with IT security
You are right, the stakes are higher for smaller companies and they don't have the resources to deal with many security issues.  For example, I work with small and large companies regulated by the same data privacy laws.  

Both large and small companies must follow the same steps to comply (in my case it is data destruction) but the small company is at a disadvantage.  One small mistake and it could be bankruptcy.

 
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Mozilla, Internet Society and Others Pressure Retailers to Demand Secure IoT Products
Curtis Franklin Jr., Senior Editor at Dark Reading,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7629
PUBLISHED: 2019-02-18
Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client.
CVE-2019-8919
PUBLISHED: 2019-02-18
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2019-8917
PUBLISHED: 2019-02-18
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may b...
CVE-2019-8908
PUBLISHED: 2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/g...
CVE-2019-8909
PUBLISHED: 2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image.