Most IoT devices are vulnerable to hacking

[Tomcat]

Security experts urged IoT device manufacturers to make more efforts to secure root-level access to connected equipment. According to Okta CEO Marc Rogers, the vast majority of IoT equipment in homes and offices is vulnerable to attacks that make it easy to take control and manipulate them for malicious purposes. The portal DarkReading reports.

According to the specialist, he could get full root-level access, including the ability to flash, on 10 of the 12 devices tested. Most of them were completely hacked in less than five minutes. Products he tested included home routers, switches, access card readers, and other commonly installed network-connected devices.

The problem is that most of the sensitive information about the device, including certificates, keys and communication protocols, is usually stored in poorly protected flash memory. Anyone with access to an IoT device and some basic knowledge of hacking hardware can easily access firmware and search for data, including vulnerabilities, exploiting which allows attacks on similar devices without requiring physical access.

In his speech, Rogers outlined several approaches available to hackers to extract confidential information and gain control over an IoT device. One of the easiest ways is to access the Universal Asynchronous Receiver / Receiver (UART), which is used for diagnostic and debug reporting in all IoT products, among other things. An attacker can use the UART to gain root access to the shell of the IoT device, and then download the firmware and identify vulnerabilities.

Another, slightly more complex, way is through JTAG, a microcontroller-level interface that is used for a variety of purposes, including testing integrated circuits and programming flash memory. As with the UART, an attacker with JTAG access can alter the flash memory, access debugging tools, and extract other sensitive information about the device.