2
\$\begingroup\$

I have a IoT device that works with BLE and uses a smartphone as a bridge to connect to a digital platform (cloud). The communication between the IoT device and the platform is based in PKI. The IoT device has only few privileges and services to with the platform such as status communication, public key sharing and other few status messages.

If this IoT device is hacked, could it be used as a backdoor to access or change critical information in the platform?

What can a hacker do with a hacked IoT device to threat the platform data?

The hacker will not be able to access any other data than the one allowed by the platform to that device, correct?

\$\endgroup\$
8
  • \$\begingroup\$ The main danger is to allow firmware updates or bootloader access over the Internet. If you open that can of worms, a hacker can take over your whole micro. Other than that, a hacker can't do much at all. It isn't really possible to inject malicious code in an existing microcontroller program like you can do with a PC, not without flashing the whole thing. Modern MCUs might also have hardware pirate protection, since some 20 years back, meaning that it isn't physically possible to read out or change the firmware, not without erasing everything first. \$\endgroup\$
    – Lundin
    Apr 16, 2020 at 12:42
  • \$\begingroup\$ OK, but I´m really asking about what a hacker can do if, for example , has downloaded malicious FW. Can the hacker attack the cloud platform even if the privileges of that device are restricted from the cloud? \$\endgroup\$
    – LazyTurtle
    Apr 16, 2020 at 13:26
  • \$\begingroup\$ They can do everything the microcontroller can do, depending on how much the hacker knows about the connected hardware in advance. An example is where hackers use relatively dumb security cameras to work as proxies solely for the purpose of sending internet data in DoS attacks. Another example is where they took control of a whole Jeep car remotely. These attacks aren't really possible unless the microcontroller allows firmware updates of the high integrity system through IdiOtic Things. Or alternatively, if you don't use a microcontroller but some manner of PC in disguise. \$\endgroup\$
    – Lundin
    Apr 16, 2020 at 14:09
  • \$\begingroup\$ @Lundin Thank you very much. OK, so, if the device is only meant to turn on a light the hacker would only be capable of turning on that light, nothing else. Or could the hacker use the device as a backdoor to access different platform services the device or the phone's sentive data even if the platform restricts this IoT device to specific non critical functions? \$\endgroup\$
    – LazyTurtle
    Apr 16, 2020 at 15:11
  • \$\begingroup\$ I’m voting to close this question because it belongs to security.SE. \$\endgroup\$
    – Ariser
    Apr 17, 2020 at 14:55

1 Answer 1

2
\$\begingroup\$

This is based heavily on how that data is used

Assuming a IOT device is compromised, It can likely access the internet and anything on the same local network (assuming poor security home network),

It also has the BLE bridge to your phone

So to limit the scope to the phone and the platform, anything it can do would be related to vulnerabilities in those 2 end points, If your using the data it sends to the platform for something, it could spoof it, If the API allows it to read back old or user account level information, it could expose that elsewhere,

For the phone, there could be a blutooth exploit for your model allowing for other things, e.g. it sees your car radio BLE in range, clones its ID and pretends to be it to access your contacts and call logs,

For the platform, assuming no exploits, it can do anything exposed on the API, if there are exploits, then possibly anything on the platform, be it editing, deleting, mass downloading

\$\endgroup\$
7
  • \$\begingroup\$ Thanks for your answer. So, in this case, if the platform is correctly configured to allow only specific data sharing that is not critical data, there wouldn´t really be a threat to the platform itself, correct? \$\endgroup\$
    – LazyTurtle
    Apr 16, 2020 at 13:28
  • \$\begingroup\$ Assuming the platform is perfect, in the sense that the input is confined to say data formatted only as X, and to discard anything that does not match, e.g. unicode, escape characters, etc, (well sanitised) then there should not be a threat to the platform, but sanitation of inputs is something many people gloss over, and it is hard, when you need to handle a number as 5 or 5.0 or 5E5 or 0x05 or "5", etc and other variations, many fail to handle all possibilities. \$\endgroup\$
    – Reroute
    Apr 16, 2020 at 13:33
  • \$\begingroup\$ And for the phone, can the hacked IoT device get sensitive data from it? What possibilities are there, such as contact list from phone, bank account details, mails etc...Can these data be obtained using a hacked IoT device? \$\endgroup\$
    – LazyTurtle
    Apr 16, 2020 at 13:46
  • \$\begingroup\$ If it can see your car radio bluetooth for example, the pin will be 0000 or 1234 for almost all cars, so spoof itself as that device, your phone automatically connects, and if setup with the radio can then request all call logs on the device, and all contacts, you can also force it to dial out to a number, or take over audio of a call, which could lead to more complex spoofing, e.g. ringing the bank from your number, or a phishing attack using all the gained information. \$\endgroup\$
    – Reroute
    Apr 16, 2020 at 13:52
  • \$\begingroup\$ But could it access to the phone´s internal data? \$\endgroup\$
    – LazyTurtle
    Apr 16, 2020 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.