Threat Intelligence

12:00 PM
Connect Directly

New Bug Bounty Program Targets IoT Security

GeekPwn bug bounty program aims to collect Internet of Things security vulnerabilities, and highlight mistakes to vendors.

The Internet of Things, like all new tech, drives security risk. Similar to the PC in its early stages, IoT faces two security challenges: large amounts of vulnerabilities, and major consequences.

"As an emerging technology, IoT is far from the maturity stage," explain security researchers Huiming Liu and Yuhao Song, both with GeekPwn Lab. "The development of security always lags behind the corresponding industry."

Vendors working on product development tend to place more emphasis on improving usability and user experience, and less on security. There is a lack of security sense, the researchers say; most vulnerabilities are obvious and can be easily avoided.

This is a key takeaway from the GeekPwn Contest, a security contest focused on IoT devices and other smart devices.

The duo founded GeekPwn in 2014 to broaden white hats' research efforts to include IoT and help vendors strengthen product security. There are many contests and bug bounty programs focused on software security, they noticed, but nearly none geared towards IoT.

Since launching the contest, the team has collected more than 100 security vulnerabilities and exploit techniques for IoT products including smart home devices, wearables, routers, cameras, network protocols, and smart entertainment products. All were reported to their respective vendors following the contest.

They found IoT vendors, especially smaller businesses, are challenged to address the problems.

"When we collect vulnerabilities in GeekPwn and submit them to the vendors, some of the vendors don't have a process of vulnerability response, some reject and deny any vulnerabilities, some even regard vulnerabilities as infringement of their reputation and threaten court against us," the team says.

This issue has improved over time as vendors accept the responsibility of improving product security. After three years of GeekPwn, more are agreeing to "responsible disclosure" and welcome white hats' efforts to hunt flaws in their products.

The two acknowledge additional challenges companies face with IoT security including a small talent pool and lack of systemic guidelines, solutions, and standards related to this new wave of technology.

Both Liu and Song will be at Black Hat Asia 2017 to discuss design misconceptions and implementation mistakes that developers may overlook in IoT devices. Their briefing is entitled "Daily-Life Peeper: Bug Hunting and Exploit Techniques in IoT."

GeekPwn collected 32 router vulnerabilities. In their session, the duo will expand on one that exploits three vulnerabilities as a chain.

They also plan to discuss attack vectors and most vulnerable modules of IoT devices based on data collected in GeekPwn, and consequences these vulnerabilities could cause. Their idea is to help security researchers kick off their IoT security research.

"Based on our study and analysis, the current situation of IoT security is nearly catastrophic," the team states.

Businesses' lack of attention to IoT, implementation errors, and design flaws could have severe consequences and lead to damage to property or personal safety. Researchers cite last year's massive DDoS attack, which took down several major websites, as an example.

Related Content:


Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
The Case for Integrating Physical Security & Cybersecurity
Paul Kurtz, CEO & Cofounder, TruSTAR Technology,  3/20/2018
A Look at Cybercrime's Banal Nature
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/20/2018
Is Application Security Dead?
Tyler Shields, VP of Marketing, Strategy & Partnerships, Signal Sciences,  3/22/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.