Painful IoT Security Lessons Highlighted by a Digital Padlock by mrosenquist

cybersecurity · @mrosenquist · Sep 16 '20

$3.40

Painful IoT Security Lessons Highlighted by a Digital Padlock

<html>
<p><img src="https://i.postimg.cc/MHd3Tfrg/cyber-security-3411476-640.jpg"/></p>
<p>The first warning sign was “hackproof” in the <a href="https://www.kickstarter.com/projects/1686612613/360lock-1st-modular-smart-padlock-certified-by-blo">360Lock marketing materials</a>. As it turns out, with no surprise to any security professional, the NFC and Bluetooth enabled padlock proved to be anything but secure.</p>
<p><a href="https://www.pentestpartners.com/security-blog/360lock-smart-lock-review/">Straightforward penetration testing revealed</a> horrible logical and physical security for a padlock that promotes itself as “incorruptible” and “hackproof”!</p>
<p>Digital Transformation is a rush to connect our physical world to the global electronic ecosystem to enable better access, integration, and advanced capabilities. Internet of Things (IoT) devices are often at the forefront of this movement, turning normal devices into ‘smart’ devices. Sometimes even the best ideas fail when it comes to design and execution. </p>
<p>This padlock has several innovative features such as connectivity to mobile applications, an included RFID wristband and tag for easy unlocking, configurability to add access for others, and a detailed history log. What it lacks however, is actual security.</p>
<h3><strong>Security theater</strong></h3>
<p>Simple pentesting proved what was likely a foregone conclusion. The kickstarter funded lock is neither hackproof nor secure. Testers found that simple replay attacks could trick the logic to open the device. Additionally, crude brute-force methods were able to compromise the integrity of the lock mechanism. Pounding it with a hammer quickly defeated the padlock. </p>
<p>The results highlighted that the $40 lock is not robust and better served as a visual deterrent, casual locking device, or novelty item. </p>
<h3><strong>An industry problem</strong></h3>
<p>A massive quantity and vast diversity of smart devices are emerging. Most connect to the internet and require a high degree of security. Connectivity accentuates vulnerabilities. Sadly, many of the IoT devices consumers and businesses are embracing lack the necessary measure for security rigor, leaving users exposed and data vulnerable. </p>
<p>The 360Lock is not the only device that has poor security, but it does highlight two important points, emphasizing overall industry challenges. </p>
<p>First<a href="https://medium.com/@matthew.rosenquist/unhackable-product-claims-are-a-fiasco-waiting-to-happen-dc73e4f763ff">, never trust any product that claims to be ‘unhackable’</a>. Seasoned security professionals would never make such an outlandish assertion as to say a device is hackproof! The fact that 360Lock promoted their product in this way was the only indicator needed to instill great skepticism.   </p>
<p>Second, this device’s weaknesses highlight the need for proper data transport security. Man-in-the-Middle (MitM) attacks, such as a replay attacks, are common tactics for hackers. Transactional security is absolutely critical to protect data and requests. Unfortunately, securing data in-transit between IoT devices on the edge and phones/PC/cloud-services requires the right expertise and tools. Most failures occur in how data protections are implemented and managed. As a rule, if a product manufacturer is not detailing their security, they likely do not have quality capabilities in place.</p>
<h3><strong>Painful lessons</strong></h3>
<p>Consumers must be wary and realize that even dedicated security products, such as padlocks, can be victimized by poor development decisions. Trendy features are no replacement for solid security and reliability. IoT devices are often much less secure than the marketing materials and salesperson will reveal. Look for reputable manufacturers who have committed to work with the best technology, security integrators, and verification practices. Every consumer and business is responsible for understanding the risks accompanying the benefits of new technology.</p>
<p><br/></p>
<p>Interested in more? Follow me on <a href="https://www.linkedin.com/today/author/matthewrosenquist">LinkedIn</a>, <a href="https://medium.com/@matthew.rosenquist">Medium</a>, and <a href="https://twitter.com/Matt_Rosenquist">Twitter (@Matt_Rosenquist)</a> to hear insights, rants, and what is going on in cybersecurity.</p>
</html>

👍 buildawhale, themarkymark, axel-blaze, therealwolf, steemflagrewards, mrosenquist, meppij, mountaingod, recoveryinc, smartsteem, stevescoins, enforcer48, peterpanpan, bitshares101, roomservice, payroll, gadrian, memehub, dying, maruskina, makerhacks, tombstone, ultimus, stemgeeks, upmyvote, monster-burner, admiralbot, aninsidejob, balticbadger, epicdice, commonlaw, movement19, elkaos, boomalex, gadrian-sp, machete9595, quantumdeveloper, coyotelation, stemcuration, pecoshop, btc4breackfast, paolo.senegal, nalacanecorso, abbenay, splinterlander, samuel.steem, stem.curate, abh12345.stem, gordonramzy, tonimontana, jessica.steem, zorg67, dolcesalato1981, yggdrasil.laguna, oakshieldholding, stemd, limka, laissez-faire, vxc.stem, jk6276

`author`	mrosenquist
`permlink`	painful-iot-security-lessons-highlighted-by-a-digital-padlock
`category`	cybersecurity
`json_metadata`	{"tags":["cybersecurity","security","iot","technology","hacking"],"image":["https://i.postimg.cc/MHd3Tfrg/cyber-security-3411476-640.jpg"],"links":["https://www.kickstarter.com/projects/1686612613/360lock-1st-modular-smart-padlock-certified-by-blo","https://www.pentestpartners.com/security-blog/360lock-smart-lock-review/","https://medium.com/@matthew.rosenquist/unhackable-product-claims-are-a-fiasco-waiting-to-happen-dc73e4f763ff","https://www.linkedin.com/today/author/matthewrosenquist","https://medium.com/@matthew.rosenquist","https://twitter.com/Matt_Rosenquist"],"app":"hiveblog/0.1","format":"html"}
`created`	2020-09-16 01:05:21
`last_update`	2020-09-16 01:05:21
`depth`	0
`children`	2
`last_payout`	2020-09-23 01:05:21
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	1.944 HBD
`curator_payout_value`	1.458 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	4,388
`author_reputation`	179,465,243,630,432
`root_title`	"Painful IoT Security Lessons Highlighted by a Digital Padlock"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	99,650,642
`net_rshares`	14,718,687,259,213
`author_curate_reward`	""

properties (23)vote details (60)

voter	rshares	pct
tombstone	15,657,313,426	0.75%
bitshares101	97,518,228,035	25%
mrosenquist	383,291,501,753	100%
stevescoins	122,450,428,470	100%
ultimus	13,010,659,234	100%
zorg67	563,807,538	100%
roomservice	78,908,009,489	1.87%
themarkymark	2,246,393,326,134	10%
buildawhale	7,339,318,906,384	10%
therealwolf	684,655,191,273	2.5%
makerhacks	28,400,695,531	10%
coyotelation	2,264,330,354	10%
smartsteem	137,150,635,708	2.5%
upmyvote	7,348,524,500	10%
steemflagrewards	454,026,170,939	100%
movement19	3,259,002,093	2.5%
gadrian	55,967,360,572	35%
tonimontana	609,556,281	21.82%
payroll	78,623,423,281	2%
enforcer48	120,919,333,437	15%
commonlaw	4,475,744,672	35%
jk6276	0	1%
gordonramzy	620,130,932	100%
jessica.steem	589,328,020	100%
oakshieldholding	345,533,549	100%
laissez-faire	91,163,772	100%
admiralbot	5,931,671,187	100%
balticbadger	5,651,297,919	25%
elkaos	2,755,887,427	100%
limka	307,056,197	100%
abbenay	1,054,037,152	5%
samuel.steem	1,023,737,048	100%
paolo.senegal	1,481,570,820	100%
memehub	51,017,140,816	100%
epicdice	5,445,022,205	0.75%
gadrian-sp	2,564,126,156	35%
aninsidejob	5,803,146,349	100%
quantumdeveloper	2,541,117,699	50%
maruskina	30,724,054,756	50%
nalacanecorso	1,257,168,827	100%
stemgeeks	8,168,953,333	50%
stemcuration	1,941,524,835	50%
abh12345.stem	678,863,122	100%
btc4breackfast	1,928,406,999	100%
vxc.stem	0	21.82%
stemd	322,057,885	100%
axel-blaze	1,611,831,653,896	100%
yggdrasil.laguna	355,450,860	70%
pecoshop	1,940,497,181	100%
stem.curate	979,116,786	100%
boomalex	2,635,636,573	100%
dolcesalato1981	536,802,816	80%
machete9595	2,542,076,411	100%
mountaingod	369,277,976,116	100%
peterpanpan	99,567,062,827	100%
monster-burner	7,176,768,485	100%
meppij	373,753,713,909	100%
splinterlander	1,034,952,588	50%
recoveryinc	207,072,468,533	5%
dying	32,927,936,123	5%