Threat Intelligence

2/13/2017
12:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New Bug Bounty Program Targets IoT Security

GeekPwn bug bounty program aims to collect Internet of Things security vulnerabilities, and highlight mistakes to vendors.

The Internet of Things, like all new tech, drives security risk. Similar to the PC in its early stages, IoT faces two security challenges: large amounts of vulnerabilities, and major consequences.

"As an emerging technology, IoT is far from the maturity stage," explain security researchers Huiming Liu and Yuhao Song, both with GeekPwn Lab. "The development of security always lags behind the corresponding industry."

Vendors working on product development tend to place more emphasis on improving usability and user experience, and less on security. There is a lack of security sense, the researchers say; most vulnerabilities are obvious and can be easily avoided.

This is a key takeaway from the GeekPwn Contest, a security contest focused on IoT devices and other smart devices.

The duo founded GeekPwn in 2014 to broaden white hats' research efforts to include IoT and help vendors strengthen product security. There are many contests and bug bounty programs focused on software security, they noticed, but nearly none geared towards IoT.

Since launching the contest, the team has collected more than 100 security vulnerabilities and exploit techniques for IoT products including smart home devices, wearables, routers, cameras, network protocols, and smart entertainment products. All were reported to their respective vendors following the contest.

They found IoT vendors, especially smaller businesses, are challenged to address the problems.

"When we collect vulnerabilities in GeekPwn and submit them to the vendors, some of the vendors don't have a process of vulnerability response, some reject and deny any vulnerabilities, some even regard vulnerabilities as infringement of their reputation and threaten court against us," the team says.

This issue has improved over time as vendors accept the responsibility of improving product security. After three years of GeekPwn, more are agreeing to "responsible disclosure" and welcome white hats' efforts to hunt flaws in their products.

The two acknowledge additional challenges companies face with IoT security including a small talent pool and lack of systemic guidelines, solutions, and standards related to this new wave of technology.

Both Liu and Song will be at Black Hat Asia 2017 to discuss design misconceptions and implementation mistakes that developers may overlook in IoT devices. Their briefing is entitled "Daily-Life Peeper: Bug Hunting and Exploit Techniques in IoT."

GeekPwn collected 32 router vulnerabilities. In their session, the duo will expand on one that exploits three vulnerabilities as a chain.

They also plan to discuss attack vectors and most vulnerable modules of IoT devices based on data collected in GeekPwn, and consequences these vulnerabilities could cause. Their idea is to help security researchers kick off their IoT security research.

"Based on our study and analysis, the current situation of IoT security is nearly catastrophic," the team states.

Businesses' lack of attention to IoT, implementation errors, and design flaws could have severe consequences and lead to damage to property or personal safety. Researchers cite last year's massive DDoS attack, which took down several major websites, as an example.

Related Content:

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2018-5067
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5068
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2018-5069
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.