Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/13/2017
12:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

New Bug Bounty Program Targets IoT Security

GeekPwn bug bounty program aims to collect Internet of Things security vulnerabilities, and highlight mistakes to vendors.

The Internet of Things, like all new tech, drives security risk. Similar to the PC in its early stages, IoT faces two security challenges: large amounts of vulnerabilities, and major consequences.

"As an emerging technology, IoT is far from the maturity stage," explain security researchers Huiming Liu and Yuhao Song, both with GeekPwn Lab. "The development of security always lags behind the corresponding industry."

Vendors working on product development tend to place more emphasis on improving usability and user experience, and less on security. There is a lack of security sense, the researchers say; most vulnerabilities are obvious and can be easily avoided.

This is a key takeaway from the GeekPwn Contest, a security contest focused on IoT devices and other smart devices.

The duo founded GeekPwn in 2014 to broaden white hats' research efforts to include IoT and help vendors strengthen product security. There are many contests and bug bounty programs focused on software security, they noticed, but nearly none geared towards IoT.

Since launching the contest, the team has collected more than 100 security vulnerabilities and exploit techniques for IoT products including smart home devices, wearables, routers, cameras, network protocols, and smart entertainment products. All were reported to their respective vendors following the contest.

They found IoT vendors, especially smaller businesses, are challenged to address the problems.

"When we collect vulnerabilities in GeekPwn and submit them to the vendors, some of the vendors don't have a process of vulnerability response, some reject and deny any vulnerabilities, some even regard vulnerabilities as infringement of their reputation and threaten court against us," the team says.

This issue has improved over time as vendors accept the responsibility of improving product security. After three years of GeekPwn, more are agreeing to "responsible disclosure" and welcome white hats' efforts to hunt flaws in their products.

The two acknowledge additional challenges companies face with IoT security including a small talent pool and lack of systemic guidelines, solutions, and standards related to this new wave of technology.

Both Liu and Song will be at Black Hat Asia 2017 to discuss design misconceptions and implementation mistakes that developers may overlook in IoT devices. Their briefing is entitled "Daily-Life Peeper: Bug Hunting and Exploit Techniques in IoT."

GeekPwn collected 32 router vulnerabilities. In their session, the duo will expand on one that exploits three vulnerabilities as a chain.

They also plan to discuss attack vectors and most vulnerable modules of IoT devices based on data collected in GeekPwn, and consequences these vulnerabilities could cause. Their idea is to help security researchers kick off their IoT security research.

"Based on our study and analysis, the current situation of IoT security is nearly catastrophic," the team states.

Businesses' lack of attention to IoT, implementation errors, and design flaws could have severe consequences and lead to damage to property or personal safety. Researchers cite last year's massive DDoS attack, which took down several major websites, as an example.

Related Content:

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18216
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.