Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/10/2014
10:00 PM
Brian Prince
Brian Prince
Quick Hits
50%
50%

Small IoT Firms Get A Security Assist

BuildItSecure.ly, an initiative where researchers vet code for small Internet of Things vendors, in the spotlight at DEF CON 22.

LAS VEGAS — DEF CON 22 — There was a time when people did not have to think about an egg tray connected to the Internet. But those days are gone.

Researchers Mark Stanislav and Zach Lanier of Duo Security here today spotlighted the increasingly connected world of devices that comprise the Internet of Things (IoT), and how the IoT continues to be challenged when it comes to security. Their solution was the creation of BuildItSecure.ly, a partnership of vendors and researchers working to make sure devices that make up the IoT are built... well, securely.

BuildItSecure.ly, which was launched in February, is focused on small vendors and startups, Stanislav says. So far, the initiative has drawn support from vendors such as Dropcam, which was recently acquired by Google's Nest Labs, and Belkin as well as security researchers from companies such as IOActive and Lab Mouse Security. Bugcrowd is supporting the initiative as well, and the BuildItSecure.ly website contains links to information on security ranging from presentation slides to technical documents on standards and best-practices.

"All the researchers basically are doing this -- one, because they want to help some people; two, because they are getting research done and not being sued for it," says Stanislav. "They already have opt-in from these vendors.

"We're going to have researchers looking at pre-production hardware, doing assessments against them… and actually making the device better before they go to people's hands rather than after."

The emphasis is on small vendors, the researchers explain, because startups and smaller vendors may not have the resources and budget to focus on security. Many may not know how to react to a security researcher poking holes in their product, either.

"They don't quite get why you're coming to them telling them that their baby is ugly," says Lanier.

"They don't have the resources or the experience to necessarily deal with this," he adds, noting that security researchers likewise might not know how to approach a smaller vendor unused to dealing with the security community.

The stakes can be high: Take the research the firm publicized last year that uncovered security weaknesses in the IZON IP camera.

"The number of devices that we have in IoT where you have firmware going, we can barely update one router," Stanislav says. "What makes us think that we're going to update like hundreds of devices in our household in five years?"

The ecosystem of the Internet of Things is also messy, the researchers note.

"There's a lot going on just in terms of how diverse the technologies are," says Stanislav. "The ecosystem's really messed up right now. You see companies big and small trying to standardize and trying to make sense of it all, but really we don't see that quite yet, and I don't think we will for a while.

"The problem we've always had with embedded hardware is you get random OEMs, you have firmware that nobody's actually done a security audit of, kernels that are, like, 15 years old," he laments. "This is the kind of stuff that we are putting in our networks right now. So even if the device is new, the actual technology underlying it is probably not."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Gary Scott
50%
50%
Gary Scott,
User Rank: Strategist
8/12/2014 | 6:58:44 PM
Small firms don't have the resources to deal with IT security
You are right, the stakes are higher for smaller companies and they don't have the resources to deal with many security issues.  For example, I work with small and large companies regulated by the same data privacy laws.  

Both large and small companies must follow the same steps to comply (in my case it is data destruction) but the small company is at a disadvantage.  One small mistake and it could be bankruptcy.

 
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
10 Notable Security Acquisitions of 2019 (So Far)
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12865
PUBLISHED: 2019-06-17
In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.
CVE-2017-10720
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installed o...
CVE-2017-10721
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality enabled by default. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car ga...
CVE-2017-10722
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is install...
CVE-2017-10723
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows it...