The fight to secure IoT devices from cyber attacks.
A security researcher from Red Balloon, Dr. Ang Cui, believes that his research project could provide a critical tool in the fight to secure IoT devices from cyber attacks.
Dr. Cui will use an IoT threat-scanning tool on the building control systems of Plum Island Animal Disease Center for the next year to determine if the tool is sufficient for securing the vulnerabilities present in embedded industrial systems and critical infrastructure.
It is well known that there are inadequate levels of security in place for modern IoT devices. Securing IoT devices is especially challenging as there is a wide range of device types from consumer devices to complex manufacturing and industrial systems. These devices are often based on popular platforms such as Linux. However, they contain several modifications that make it difficult to establish a fixed method for finding bugs. Manufacturers also do not build devices with a plan in mind regarding what to do if and when vulnerabilities are discovered.
Red Balloon’s research project involves using an automated strategy for finding software vulnerabilities that have been previously detected in other connected devices. This approach could enable increased detection of devices that are at risk of being hacked. Unlike other research that looks for ways to find previously unknown bugs or “zero-day vulnerabilities”, Red Balloon is trying to find a way to detect vulnerabilities that have been publicly disclosed for a number of days but have not yet been discovered in specific devices. While it is possible to manually detect whether a device has a vulnerability by reverse engineering its fundamental code, this would have to be done on a device by device basis. Dr. Cui wants to instead create a process that automatically develops a code to expose vulnerabilities. The goal of the research project is to demonstrate that an autonomous system can write code for each new vulnerable device it finds, a strategy that hackers might use as well.
Security experts like Anders Fogh, a malware analyst from GData, say that there is a very real possibility that hackers will develop an automated way to find vulnerable IoT devices. He says that manufacturers need to understand that hackers are only becoming more advanced and that an investment should be made in IoT device security. Fogh stated, “We are waiting for the vendors to realize that security is relevant. They need a dose of bitter medicine.”