An IoT Love Story
This is the true story of when my personal life and my security research world collided. It’s also a love story, but it’s not really that mushy.
Let’s start with the love story. I used to have a great convertible car. It brought me joy to cruise around Austin, wind blowing through my thinning hair and The Black Keys on the radio. Then I had kids. I decided having a good roof over my kids’ heads is just as important in the car as it is in the house. I responsibly disclosed to my wife that I wasn’t happy about it, but I decided to be an adult and trade in my convertible. My lovely convertible went back to the dealership and I got a more kid-friendly model from the same manufacturer.
I’m a security researcher, so I’m skeptical of everything by nature. Before I brought the car to the dealership I deleted all my personal information from the car, reset the phone book, removed all connected devices and reset the garage door opener. When I got to the dealership, they took several steps as well. They made sure that all the keys issued to the car were turned back over.
I was happy to see that the dealership went through several of the same privacy precautions, like making sure my personal information was removed from the phone book. Luckily, my new car also had the same connected car management app for my mobile device. When I got home, I synced up my management app and I noticed that under the car inventory in the application, my old car was still listed. I didn’t think much of it — I figured there must be a process by which that car would be expired.
Over time, I began to realize that the car wasn’t going to expire. Days went by, then weeks, months and, eventually, years. It was obvious that whomever had purchased my old car had not enrolled it in the mobile app. This is where my curiosity kicked in — were manufacturers only designing Internet of Things (IoT) functionality for the first owner because that’s where their revenue comes from?
Secondhand IoT Security
The first owner drives the value of most products, and for IoT devices especially, there’s no expectation that the life of the product will extend beyond that owner. Setting my old car aside for a moment, I looked at other forms of internet-based technology and found it wasn’t limited to vehicles.
David Bryan, who works in X-Force Red, recently bought a used home automation hub. He’s a penetration tester and vulnerability researcher, so he too is more cynical about technology and security than the average consumer. The first thing David did with the hub was perform a factory reset. But when he went to set it up, he saw a device listed under the management screen that was not his.
After performing another factory reset, he contacted customer support. The first thing they asked him was, “Well, have you performed a factory reset?” It turned out that in this case, the factory reset only cleared the settings on the device, but not the account that managed the device in the cloud.
After two weeks of going back and forth, the support team removed that extra device from the approved devices and asked David if they should remove a second device that also had access to his hub. David couldn’t even see that second device in his management console. It’s scary to think that even if a user checks the management settings and determines that everything is secure, there still might be authorized devices invisible to them.
A New Challenge for Manufacturers
User awareness about security risks associated with these types of devices is relatively low. An IBM Security survey revealed that consumers were least worried about protecting car navigation data (8 percent), home devices (10 percent) and connected cameras (16 percent), compared to 64 percent who cared about their mobile devices.
Thinking back to the connected car, the dealership was very aware that it should collect the keys for that car. When I notified the manufacturer of my remote access after selling the car, its response was, “Well, that’s the same as keeping keys.” But keys don’t have geolocation built in. Actually, a mobile device is much more dangerous than a simple key.
Fundamentally, this really isn’t a new problem. Transfer of ownership has caused complications before in the tech industry. Look at the early days of mobile phones, when people would trade up to a new device and leave personal data on the old one. They didn’t know to remove it and it caused some embarrassing situations. But through education and more prominently featured factory reset methods, the phone manufacturers and carriers standardized the way mobile devices are reset.
IoT device manufacturers need to look to that example and establish a common definition of factory reset. They need to disclose to their customers what data remains in the cloud after that factory reset.
Devices Are Only as Smart as Their Users
Some industries are getting in front of these IoT security issues. The National Association of Realtors is not only testing smart home devices, but also looking at how to properly convey them as part of a home sale. Smart home devices can be tricky, because a smart light bulb is designed to look like a regular light bulb. Consumers feel better when products look and feel the same, but this also means a new homeowner might be living with dozens of smart devices they don’t control.
We’re living in a strange time because we’re seeing IoT devices change ownership for the first time. We know these devices aren’t aware enough to know they’ve been sold — but the bigger problem is that many consumers don’t know they’ve purchased a product with IoT capabilities.
For those of you old enough to remember the early days of seat belt notifications in cars, there were not only beeps and dings, but also a voice reminding you to buckle up. I can imagine a similar situation emerging soon in which a light switch alerts you when you haven’t logged into your control app in the last 10 days. There are definitely some creative ways to approach these issues.
An Open Dialogue
Obviously, my team and I have looked into IoT security to see what’s broken, but we’re also aware that our talents are more geared toward breaking than building. The path to true IoT security will require open dialogue between manufacturers, resellers, security researchers and consumers.
For now, IoT consumers should follow a few rules to keep themselves safe:
- Even though factory resets aren’t perfect, they’re still a good practice.
- Don’t assume you’re the only authorized user of a smart device. Verify it.
- Do a little security testing of your own. Play with your digital toys and see what else you can learn about them.
