Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

End of Bibblio RCM includes -->
4/16/2021
04:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail

Security Gaps in IoT Access Control Threaten Devices and Users

Researchers spot problems in how IoT vendors delegate device access across multiple clouds and users.

A team of Internet of Things security researchers has discovered vulnerabilities in the way IoT device vendors manage access across multiple clouds and users, putting both individuals and vendors at risk.

Related Content:

Rethinking IoT Security: It's Not About the Devices

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: How to Create an Incident Response Plan From the Ground Up

IoT devices are increasingly managed through clouds operated by device vendors such as Philips Hue, LIFX, and Tuya, or by cloud providers such as Google and Amazon. These clouds mediate the users' access to specific devices — for example, granting them permission to unlock a smart lock.

The researchers were especially interested in the emerging capability to delegate device access across multiple clouds and users. Some vendors let Google Home control devices under their clouds, so a person can manage multiple devices from different vendors via their Google Home. It's a win for usability — normally, someone with devices from various vendors would install multiple apps to control them, which becomes a hassle as their IoT device collection grows.

"[The IoT] keeps evolving, and we keep observing new security issues, new security risks coming up, especially when a vendor tries to strike a balance between usability and security," says Luyi Xing, assistant professor of computer science at Indiana University Bloomington and a member of the research team.

While being able to manage multiple devices from a single hub is convenient, access delegation across IoT clouds is distributed and unverified, researchers report. The problems emerge when one cloud unknowingly violates the security operations and assumptions of another cloud. When this happens, devices may not fully revoke access when someone instructs them to.

"Security always comes behind the functionality, so that's why this is important," adds Bin Yuan, post-doc at Huazhong University of Science and Technology and Indiana University Bloomington. "That's why we did our research in this area, to better understand it and try to solve the security risks here."

The problem lies in vendors' protocols, Xing explains. Each vendor independently develops its own delegation protocol with implicit security assumptions, but the protocols from different vendors have to work together to establish the delegation chain between vendor and user.

"When these protocols work together, their security assumptions may conflict with each other, and one vendor may not fully understand the implications [or] the assumptions of another vendor's operation in terms of security," he says. One of the vulnerabilities they discovered let a user continue accessing a device after temporary permissions were removed. When someone attempted to revoke the permission, it turned out the user still had control over the device.

In the real world, this could happen with something as simple as a smart lock, Xing says. An Airbnb host may grant temporary access to a guest, but that guest could still have access to their home after the host thinks they've checked out.

An Industrywide Problem
This problem affects a broad range of IoT device vendors and clouds. Given this, the researchers sought to develop an approach to verify the protocols of different device manufacturers and determine whether a protocol might be vulnerable to an attack. They created a verification tool to model the operations and data flows of an IoT vendor and automatically discover flaws.

From there, they conducted a systematic study on cross-cloud IoT delegation, in which they investigated 10 mainstream IoT clouds, including Google Home, SmartThings, Philips Hue, LIFX, August, and others. They discovered five serious flaws that, if exploited, could give someone unauthorized access to IoT devices such as smart locks, switches, and safety sensors, they say.

"We can find the individual vulnerabilities for a specific protocol, for a specific vendor, but that doesn't solve the problem," Xing says of why they wanted to create a systematic approach. All of the flaws they discovered were reported to the respective vendors, which have deployed or scheduled fixes.

The researchers believe cross-vendor delegation is helpful to users; however, the protocols behind it must be designed with more caution. Protocols they saw in the wild had not undergone rigorous security analysis or verification, Xing says. The team hopes that protocols will eventually become more transparent, so vendors know one another's security assumptions.

Xing and Yuan will join their fellow researchers, Yan Jia, research associate at Nankai University, and Dongfang Zhao, PhD student at Indiana University Bloomington, to present their research findings in a Black Hat Asia briefing: "How I Can Unlock Your Smart Door: Security Pitfalls in Cross-Vendor IoT Access Control," on May 7.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
//Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-46411
PUBLISHED: 2022-12-04
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation and may be discovered and used to escalate privileges.
CVE-2022-46412
PUBLISHED: 2022-12-04
An issue was discovered in Veritas NetBackup Flex Scale through 3.0. A non-privileged user may escape a restricted shell and execute privileged commands.
CVE-2022-46413
PUBLISHED: 2022-12-04
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can occur via the management portal.
CVE-2022-46414
PUBLISHED: 2022-12-04
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur via the management portal.
CVE-2022-44721
PUBLISHED: 2022-12-04
CrowdStrike Falcon 6.44.15806 allows an administrative attacker to uninstall Falcon Sensor, bypassing the intended protection mechanism in which uninstallation requires possessing a one-time token. (The sensor is managed at the kernel level.)