Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/13/2017
12:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Bug Bounty Program Targets IoT Security

GeekPwn bug bounty program aims to collect Internet of Things security vulnerabilities, and highlight mistakes to vendors.

The Internet of Things, like all new tech, drives security risk. Similar to the PC in its early stages, IoT faces two security challenges: large amounts of vulnerabilities, and major consequences.

"As an emerging technology, IoT is far from the maturity stage," explain security researchers Huiming Liu and Yuhao Song, both with GeekPwn Lab. "The development of security always lags behind the corresponding industry."

Vendors working on product development tend to place more emphasis on improving usability and user experience, and less on security. There is a lack of security sense, the researchers say; most vulnerabilities are obvious and can be easily avoided.

This is a key takeaway from the GeekPwn Contest, a security contest focused on IoT devices and other smart devices.

The duo founded GeekPwn in 2014 to broaden white hats' research efforts to include IoT and help vendors strengthen product security. There are many contests and bug bounty programs focused on software security, they noticed, but nearly none geared towards IoT.

Since launching the contest, the team has collected more than 100 security vulnerabilities and exploit techniques for IoT products including smart home devices, wearables, routers, cameras, network protocols, and smart entertainment products. All were reported to their respective vendors following the contest.

They found IoT vendors, especially smaller businesses, are challenged to address the problems.

"When we collect vulnerabilities in GeekPwn and submit them to the vendors, some of the vendors don't have a process of vulnerability response, some reject and deny any vulnerabilities, some even regard vulnerabilities as infringement of their reputation and threaten court against us," the team says.

This issue has improved over time as vendors accept the responsibility of improving product security. After three years of GeekPwn, more are agreeing to "responsible disclosure" and welcome white hats' efforts to hunt flaws in their products.

The two acknowledge additional challenges companies face with IoT security including a small talent pool and lack of systemic guidelines, solutions, and standards related to this new wave of technology.

Both Liu and Song will be at Black Hat Asia 2017 to discuss design misconceptions and implementation mistakes that developers may overlook in IoT devices. Their briefing is entitled "Daily-Life Peeper: Bug Hunting and Exploit Techniques in IoT."

GeekPwn collected 32 router vulnerabilities. In their session, the duo will expand on one that exploits three vulnerabilities as a chain.

They also plan to discuss attack vectors and most vulnerable modules of IoT devices based on data collected in GeekPwn, and consequences these vulnerabilities could cause. Their idea is to help security researchers kick off their IoT security research.

"Based on our study and analysis, the current situation of IoT security is nearly catastrophic," the team states.

Businesses' lack of attention to IoT, implementation errors, and design flaws could have severe consequences and lead to damage to property or personal safety. Researchers cite last year's massive DDoS attack, which took down several major websites, as an example.

Related Content:

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.