A Brief History of IoT Inspector: Securing the Internet of Things Since 2015
Since its initial development in 2015, the firmware analysis platform IoT Inspector has analyzed tens of thousands of firmware images for vulnerabilities and compliance violations. Not only have we been able to identify countless misconfigurations and security issues. We have also detected many previously unknown security vulnerabilities for the first time.
Increasing Connectivity = Growing Security Risks
It is estimated that over 25 billion devices are already connected to the Internet, and the number is still rising. But as connectivity increases, so do the security risks. According to a study conducted by Nokia, IoT devices already accounted for one-third of all devices affected by security vulnerabilities in 2020. By comparison, the figure was only 16 percent in 2019. But the Internet of Things goes well beyond smart homes and personal gadgets such as hobby drones and fitness trackers. In over two-thirds of all companies, the number of IoT devices now exceeds the number of traditional endpoints such as notebooks, servers, and desktop systems. Almost as many companies (67 percent) said in a recent survey that they had already experienced security incidents which involved their IoT devices.Automated Analysis Tools for Efficient Security Checks
These numbers are startling, though unsurprising, as the vast majority of IoT devices operate under questionable security standards: 57% of them are “vulnerable to medium- or high-severity attacks, making IoT the low-hanging fruit for attackers." SEC Consult recognized the rapidly growing problem of insecure IoT devices early on and set the success story of IoT Inspector in motion as early as 2015. With the increasing demand for product testing of IoT and embedded devices (due to stricter regulatory requirements, particularly), the security consultants saw the need for an automated solution to support the relevant security checks. This laid the foundation for IoT Inspector.
House of Keys and the Tale of Black Widow
The first large-scale research project took place the same year. Security researcher Stefan Viehböck developed an analysis software within the "Large-Scale Firmware Analysis" project, which he used to examine the firmware images of over 4,000 different products from over seventy manufacturers. One result: House of Keys. 580 security keys were reused and found in a large number of devices - making their encryption obsolete and exposing numerous devices to an increased security risk. IoT Inspector was first used under its name in 2016, when a serious backdoor was uncovered in several devices from the American conference room equipment manufacturer AMX - whose products were used at the time in the White House, particularly. The devices had secret credentials (code name: black widow) that allow the manufacturer (and possibly others) to easily gain access to the devices and spy on its customers. This backdoor was discovered during a manual analysis and subsequently added to IoT Inspector's database. It is also worth mentioning that the manufacturer has assured that it had gotten rid of the backdoor during a security update. However, a new analysis by IoT Inspector showed the backdoor was not removed, only renamed... In the same year, we achieved another brilliant success: Many companies use cameras to monitor their premises and protect themselves from intruders. Paradoxically, sometimes the cameras themselves are not sufficiently secured against external attacks. For example, a backdoor was discovered in Sony's IPELA Engine IP series, which enabled potential attackers to upload arbitrary code to the affected devicesviii. This would have allowed hackers to gain access to the targeted corporate network, disable or manipulate the cameras, connect them to a botnet, or simply spy on the owner. This example also shows the great potential of undiscovered security vulnerabilities, as many firmware components are used in different devices. In the case of Sony, IoT Inspector could automatically identify over 80 other models that were affected by this critical vulnerability (which has fortunately since been fixed).A vulnerability of even greater magnitude was discovered in 2018 in the course of research around the automated detection of management protocols and supported cloud backends in IoT firmware at the Chinese OEM manufacturer Xiongmai. Its white-label components are used in products around the globe. Accordingly, over 9 million cameras were equipped with a remote monitoring feature enabled by default ("XMEye P2P cloud"), which was affected by critical security vulnerabilities. Of course, since then, vulnerable connections to the XMEye P2P cloud can be detected automatically by IoT Inspector, in addition to dozens of other management protocols.
An Overview of IoT Inspector in Action
To go into all the findings in detail would be beyond the scope here, but we can say this much: The research team of SEC Consult is always very ambitious in its fight for more cybersecurity.
To continuously develop IoT Inspector's analysis capabilities, we work with established security experts, including Red Alert Labs, QGroup, TÜV Rheinland, TÜV Hessen and VDE-Cert. Our analysis platform supports the security research of our research partners, and insights from their manual security analyses in turn migrate into the vulnerability modules of IoT Inspector. If you are also interested in a research partnership, we look forward to hearing from you.
#makeIoTsecure - IoT Security for Your Company
Our mission is to make the Internet of Things secure. That's why we developed IoT Inspector - the leading European solution for automated firmware security analysis and compliance checks. To make our technology accessible to the widest possible audience, in June 2020 we completely separated from SEC Consult Group (disclaimer: SEC Consult has meanwhile been acquired by Atos). Since then, IoT Inspector has been an independent company based in Bad Homburg, Germany. In September 2020, we received a first round of financing from German VC eCAPITAL. Within the company, a team of highly motivated security experts from six countries is continuously expanding and improving the platform's analysis capabilities.
IoT Inspector - How it Works
- Upload firmware images to the intuitive IoT Inspector web platform (hosted in our own data center)
- Automatically check for security and compliance with our continuous analysis engine
- Receive smart reports and alerts within minutes, online and via email
Our Advisory Archive
2015
-
2015-04: TP Link
-
2015-05: Kernel
-
2015-11: House of Keys
-
2015-11: Ubiquiti Networks
2016
-
2016-01: AMX
-
2016-06: Ubee
-
2016-09: Aruba Networks
-
2016-09: House of Keys Follow Up
-
2016-12: Sony
-
2016-12: AGFEO
2017
-
2017-01: Ubiquiti Networks
-
2017-02: Jung
-
2017-03: Western Digital My Cloud
-
2017-03: Ubiquiti (again)
-
2017-03: SolarLog
-
2017-05: Western Digital TV Media Player
-
2017-06: Wimax, Zyxel, Huawei
-
2017-06: Cisco Prime Infrastructure
-
2017-06: Linksys
-
2017-06: Kathrein
-
2017-06 & 2017-07 & 2017-07 & 2017-07 & 2017-08 & 2017-09: Ubiquiti
-
2017-11: Siemens
-
2017-11: Wago
2018
-
2018-01: Sprecher Automation
-
2018-02: Vibratissimo
-
2018-02: miSafes
-
2018-04: Zyxel ZyWALL
-
2018-05: TR-069
-
2018-05: VGate
-
2018-06: Siglent Technologies
-
2018-07: Wago
-
2018-07: ADB 1, ADB 2, ADB 3
-
2018-10: Cisco
-
2018-10: Xiongmai
2019
2020
-
2020-01: Phoenix Contact
-
2020-02: Red Lion
-
2020-05: Cisco
-
2020-07: ZTE
-
2020-10: Hörmann
-
2020-10: RocketLinx
-
2020-10: Pepperl+Fuchs
About Onekey
ONEKEY is the leading European specialist in Product Cybersecurity & Compliance Management and part of the investment portfolio of PricewaterhouseCoopers Germany (PwC). The unique combination of an automated Product Cybersecurity & Compliance Platform (PCCP) with expert knowledge and consulting services provides fast and comprehensive analysis, support, and management to improve product cybersecurity and compliance from product purchasing, design, development, production to end-of-life.
CONTACT:
Sara Fortmann
Marketing Manager
sara.fortmann@onekey.com
euromarcom public relations GmbH
+49 611 973 150
team@euromarcom.de
RELATED BLOG POST
Understanding the EU Cyber Resilience Act and achieve product cybersecurity compliance with ONEKEY’s whitepaper
ONEKEY Whitepaper: Enhance EU CRA compliance. Streamline supply chain risk management & automate compliance controls for secure device market. Download now!
Ready to automate your Product Cybersecurity & Compliance?
Make cybersecurity and compliance efficient and effective with ONEKEY.