Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/10/2014
10:00 PM
Brian Prince
Brian Prince
Quick Hits
50%
50%

Small IoT Firms Get A Security Assist

BuildItSecure.ly, an initiative where researchers vet code for small Internet of Things vendors, in the spotlight at DEF CON 22.

LAS VEGAS — DEF CON 22 — There was a time when people did not have to think about an egg tray connected to the Internet. But those days are gone.

Researchers Mark Stanislav and Zach Lanier of Duo Security here today spotlighted the increasingly connected world of devices that comprise the Internet of Things (IoT), and how the IoT continues to be challenged when it comes to security. Their solution was the creation of BuildItSecure.ly, a partnership of vendors and researchers working to make sure devices that make up the IoT are built... well, securely.

BuildItSecure.ly, which was launched in February, is focused on small vendors and startups, Stanislav says. So far, the initiative has drawn support from vendors such as Dropcam, which was recently acquired by Google's Nest Labs, and Belkin as well as security researchers from companies such as IOActive and Lab Mouse Security. Bugcrowd is supporting the initiative as well, and the BuildItSecure.ly website contains links to information on security ranging from presentation slides to technical documents on standards and best-practices.

"All the researchers basically are doing this -- one, because they want to help some people; two, because they are getting research done and not being sued for it," says Stanislav. "They already have opt-in from these vendors.

"We're going to have researchers looking at pre-production hardware, doing assessments against them… and actually making the device better before they go to people's hands rather than after."

The emphasis is on small vendors, the researchers explain, because startups and smaller vendors may not have the resources and budget to focus on security. Many may not know how to react to a security researcher poking holes in their product, either.

"They don't quite get why you're coming to them telling them that their baby is ugly," says Lanier.

"They don't have the resources or the experience to necessarily deal with this," he adds, noting that security researchers likewise might not know how to approach a smaller vendor unused to dealing with the security community.

The stakes can be high: Take the research the firm publicized last year that uncovered security weaknesses in the IZON IP camera.

"The number of devices that we have in IoT where you have firmware going, we can barely update one router," Stanislav says. "What makes us think that we're going to update like hundreds of devices in our household in five years?"

The ecosystem of the Internet of Things is also messy, the researchers note.

"There's a lot going on just in terms of how diverse the technologies are," says Stanislav. "The ecosystem's really messed up right now. You see companies big and small trying to standardize and trying to make sense of it all, but really we don't see that quite yet, and I don't think we will for a while.

"The problem we've always had with embedded hardware is you get random OEMs, you have firmware that nobody's actually done a security audit of, kernels that are, like, 15 years old," he laments. "This is the kind of stuff that we are putting in our networks right now. So even if the device is new, the actual technology underlying it is probably not."

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Gary Scott
50%
50%
Gary Scott,
User Rank: Strategist
8/12/2014 | 6:58:44 PM
Small firms don't have the resources to deal with IT security
You are right, the stakes are higher for smaller companies and they don't have the resources to deal with many security issues.  For example, I work with small and large companies regulated by the same data privacy laws.  

Both large and small companies must follow the same steps to comply (in my case it is data destruction) but the small company is at a disadvantage.  One small mistake and it could be bankruptcy.

 
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19631
PUBLISHED: 2020-01-24
An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. A read-only user can ac...
CVE-2020-5219
PUBLISHED: 2020-01-24
Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the appli...
CVE-2019-18900
PUBLISHED: 2020-01-24
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions p...
CVE-2020-7226
PUBLISHED: 2020-01-24
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data...
CVE-2012-6302
PUBLISHED: 2020-01-24
Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox.