Tag Archives: hack

Security coprocessor marks a new approach to provisioning for IoT edge devices


It’s worth noting that security breaches rarely involve breaking the encryption code; hackers mostly use techniques like spoofing to steal the ID.


The advent of security coprocessor that offloads the provisioning task from the main MCU or MPU is bringing new possibilities for the Internet of Things product developers to secure the edge device at lower cost and power points regardless of the scale.

Hardware engineers often like to say that there is now such thing as software security, and quote Apple that has all the money in the world and an army of software developers. The maker of the iPhone chose a secure element (SE)-based hardware solution while cobbling the Apple Pay mobile commerce service. Apparently, with a hardware solution, engineers have the ecosystem fully in control.

sec-1

Security is the basic building block of the IoT bandwagon, and there is a lot of talk about securing the access points. So far, the security stack has largely been integrated into the MCUs and MPUs serving the IoT products. However, tasks like encryption and authentication take a lot of battery power — a precious commodity in the IoT world.

Atmel’s solution: a coprocessor that offloads security tasks from main MCU or MPU. The ATECC508A uses elliptic curve cryptography (ECC) capabilities to create secure hardware-based key storage for IoT markets such as home automation, industrial networking and medical. This CryptoAuthentication chip comes at a manageable cost — 50 cents for low volumes — and consumers very low power. Plus, it makes provisioning — the process of generating a security key — a viable option for small and mid-sized IoT product developers.

A New Approach to Provisioning

It’s worth noting that security breaches rarely involve breaking the encryption code; hackers mostly use techniques like spoofing to steal the ID. So, the focus of the ATECC508A crypto engine is the tasks such as key generation and authentication. The chip employs ECC math to ensure sign-verify authentication and subsequently the verification of the key agreement.

The IoT security — which includes the exchange of certificates and other trusted objects — is implemented at the edge node in two steps: provisioning and commissioning. Provisioning is the process of loading a unique private key and other certificates to provide identity to a device while commissioning allows the pre-provisioned device to join a network. Moreover, provisioning is carried out during the manufacturing or testing of a device and commissioning is performed later by the network service provider and end-user.

Atmel ATECC508A crypto-engine

Presently, snooping threats are mostly countered through hardware security module (HSM), a mechanism to store, protect and manage keys, which requires a centralized database approach and entails significant upfront costs in infrastructure and logistics. On the other hand, the ATECC508A security coprocessor simplifies the deployment of secure IoT nodes through pre-provisioning with internally generated unique keys, associated certificates and certification-ready authentication.

It’s a new approach toward provisioning that not only prevents over-building, as done by the HSM-centric techniques, but also prevents cloning for the gray market. The key is controlled by a separate chip, like the ATECC508A coprocessor. Meaning, if there are 1,000 IoT systems to be built, there will be exactly 1,000 security coprocessors for them.

Certified-ID Security Platform

Back at ARM TechCon 2015, Atmel went one step ahead when it announced the availability of Certified-ID security platform for the IoT entry points like edge devices to acquire certified and trusted identities. This platform leverages internal key generation capabilities of the ATECC508A security coprocessor to deliver distributed key provisioning for any device joining the IoT network. That way it enables a decentralized secure key generation and eliminates the upfront cost of building the provisioning infrastructure for IoT setups being deployed at smaller scales.

AT88CKECCROOT-SIGNER

Atmel, a pioneer in Trusted Platform Module (TPM)-based secure microcontrollers, is now working with cloud service providers like Proximetry and Exosite to turn its ATECC508A coprocessor-based Certified-ID platform into an IoT edge node-to-cloud turnkey security solution. TPM chips, which have roots in the computer industry, aren’t well-positioned to meet the cost demands of low-price IoT edge devices.

Additionally, the company has announced the availability of two provisioning toolkits for low volume IoT systems. The AT88CKECCROOT toolkit is a ‘master template’ that creates and manages certificate root of trust in any IoT ecosystem. On the other hand, AT88CKECCSIGNER is a production kit that allows designers and manufacturers to generate tamper-resistant keys and security certifications in their IoT applications.

What’s ahead this year in digital insecurity?


Here’s a closer look at the top 10 cyber security predictions for 2015.


In 2014 worries about security went from a simple “meh” to “WTF!” Not only did high-profile attacks get sensational media coverage, but those incidents led to a pivotal judicial ruling that corporations can be sued for data breaches. And as hard as it is to believe, 2015 will only get worse because attack surfaces are expanding as mobile BYOD policies overtake enterprises, cloud services spread, and a growing number of IoT networks get rolled out. Add m-commerce, e-banking, and mobile payments to the questionable tradition of lax credit card security infrastructure in the U.S. and you get a perfect storm for cybercrime.

In fact, 92% of attacks across the range of segments come from nine basic sources (seen in the diagram below), according to Verizon. More numerous and sophisticated cyber crimes are anticipated for this year and beyond.

z1

 1. More companies to get “Sony’d”

2014 saw the release of highly-evolved threats from criminals that in the past only came from governments, electronic armies and defense firms. A wide-range of targets included organizations in retail, entertainment, finance, healthcare, industrial, military, among countless other industries. As a repeat offender, Sony is now the cyber-victim poster child, and the term “Sony’d” has become a verb meaning digital security incompetence. Perhaps Sony’s motto should be changed from “make.believe.” to “make.believe.security.” Just saying!

Prior to 2014, companies on a wholesale basis tended to simply deny cyber vulnerabilities. However, a string of higher profile data breaches — such as Sony, Heartbleed, Poodle, Shellshock, Russian Cyber-vor, Home Depot, Target, PF Chang’s, eBay, etc. — have changed all of that. Denial is dead, but confusion and about what to do is rampant.

2. Embedded insecurity rising

Computing naturally segregates into embedded systems and humans sitting in front of screens.  Embedded systems are processor-based subsystems that are “embedded” into other machines or bigger systems.  Examples are routers, industrial controls, avionics, automotive engine and in-cabin systems, medical diagnostics, white goods, consumer electronics, smart weapons, and countless others.  Embedded security was not a big deal until the IoT emerged, which will lead to billions of smart, communicating nodes.  15 to more than 20 billion IoT nodes are being forecast by 2020, which will create a gigantic attack platform and make security paramount.

IoT Installed

A recent study by HP revealed that 70% of interconnected (IoT) devices have serious vulnerabilities to attacks. The devices they investigated consisted of “things” like cloud-connected TVs, smart thermostats and electronic door locks.

“The current state of Internet of Things security seems to take all the vulnerabilities from existing spaces — network security, application security, mobile security and Internet-connected devices — and combine them into a new, even more insecure space, which is troubling,” HP’s Daniel Miessler stated.

Issues HP identified ranged from weak passwords, to lack of encryption, to poor interfaces, to troubling firmware, to unencrypted updating protocols. Other notable findings included:

  • 60% of devices were subject to weak credentials
  • 90% collected personal data
  • 80% did not use passwords or used very weak passwords
  • 70% of cloud connected mobile devices allowed access to user accounts
  • 70% of devices were unencrypted

Investigators at the Black Hat Conference demonstrated serious security flaws in home automation systems. At DEFCON, investigators hacked NFC-based payment systems showing that passwords and account data was vulnerable. They also revealed that the doors of a Tesla car could be hacked to open while in motion. Nice! Other attacks were exploited on smart TVs, Boxee TV devices, smartphone biometric systems, routers, IP cameras, smart meters, healthcare devices, SCADA (supervisory, control and data acquisition) devices, engine control units, and some wearables. Even simple USB firmware was proven to be highly vulnerable… “Bad USB.”

These are just the tip of the embedded insecurity iceberg. Under the surface is the entire Dark Net which adds even more treacherousness. Security companies like Symmantic have identified home automation as a likely early IoT attack point. That is not surprising because home automation will be an early adopter of IoT technologies, after all. In-house appliances also represent an attractive attack surface as more firmware is contained in smart TVs, set top boxes, white goods, and routers that also communicate. Node-to-node connectivity security extends to industrial settings as well.

Tools like Shodan, which is the Google of embedded systems, make it very easy for hackers to get into the things in the IoT.  CNN recently called Shodan the scariest search engine on the Internet. You can see why since everything that is connected is now accessible. Clearly strong security, including hardware-based crypto elements, is paramount.

 3. More storms from the cloud

z5

It became clear in 2014 that cloud services such as iCloud, GoogleDrive, DropBox and others were rather large targets because they are replete with sensitive data (just ask Jennifer Lawrence). The cloud is starting to look like the technological Typhoid Mary that can spread viruses, malware, ransomware, rootkits, and other bad things around the world. As we know by now, the key to security is how well cryptographic keys are stored.   Heartbleed taught us that, so utilizing new technologies and more secure approaches to maintain and control cryptographic keys will accelerate in 2015 to address endemic cloud exposure. Look for more use of hardware-based key storage.

4. Cyber warfare breaks out

eBay, PF Chang’s, Home Depot, Sony, JP Morgan, and Target are well-known names on the cybercrime blotter, and things will just get worse as cyber armies go on the attack. North Korea’s special cyber units, the Syrian Electronic Army, the Iranian Cyber Army (ICA), and Unit 61398 of the People’s Liberation Army of China are high profile examples of cyber-armies that are hostile to Western interests. Every country now seems to have a cyber-army units to conduct asymmetric warfare. (These groups are even adopting logos, with eagles appearing to be a very popular motif.)

z6

Cyber warfare is attractive because government-built malware is cheap, accessible, and covert, and thus highly efficient. Researchers have estimated that 87% of cyber-attacks on companies are state-affiliated, 11% by organized crime, 1% by competitors, and another 1% by former employees. Long story short, cyber war is real and it has already been waged against non-state commercial actors such as Sony. It won’t stop there.

 5. Cybercrime mobilizes

According to security researchers, mobile will become an increasingly attractive target for hackers. Fifteen million mobile devices are infected with malware according to a report by Alcatel-Lucent’s Kindsight Security Labs. Malvertising is rampant on untrusted app stores and ransomware is being attached to virtual currencies. Easily acquired malware generation kits and source code make it extremely easy to target mobile devices. Malicious apps take advantage of the Webkit plugin and gain control over application data which hands credentials, bank account, and email details over to hackers. What’s more, online banking malware is also spreading. 2014 presented ZeuS, which stole data, and VAWTRAK that hit online banking customers in Japan.

Even two-factor authentication measures that banks employ have recently been breached using schemes, such as Operation Emmental. Emmental is the real name of Swiss cheese, which of course is full of holes just like the banking systems’ security mechanisms.  Emmental uses fake mobile apps and Domain Name System (DNS) changers to launch mobile phishing attacks to get at online  banking  accounts and steal identities. Some researchers believe that cybercriminals will increasingly use such sophisticated attacks to make illegal equity front running and short selling scams.

z7

6. Growing electronic payments tantalize attackers

Apple Pay could be a land mine just waiting to explode due to NFC’s susceptibility to hacking. Google Wallet is an example of what can happen when a malicious app is granted NFC privileges making it capable of stealing account information and money. M-commerce schemes like WeChat could be another big potential target.

z8

E-payments are growing and with that so will the attacks on mobile devices using schemes ranging from FakeID to master key. Master key is an exploit kit similar to blackhole exploit kit that specifically targets mobile, where FakeID allows malicious apps to impersonate legitimate apps that allow access to sensitive data without triggering suspicion.

7. Health records represent a cyber-crime gold mine

Electronic Health Records (EHR) are now mandatory in the U.S. and a vast amount of personal data is being collected and stored as never before. Because information is money, thieves will go where the information is (to paraphrase Willie Sutton). Health records are considered higher value in the hacking underground than stolen credit card data. Criminals throughout both the U.S. and UK are now specializing in health record hacking. In fact, the U.S. Identity Theft Resource Center reported 720 major data breaches during 2014 with 42% of those being health records.

8. Targeted attacks increase

Targeted attacks, also known as Advanced Persistent Threats (APTs), are very frightening due to their stealthy nature. The main differences between APTs and traditional cyber-attacks are target selection, silence, and duration of attack. According to research company APTnotes, the number of attacks by year went from 3 in 2010 to 14 in 2012 to 53 in 2014. APT targets are carefully selected, in contrast to traditional attacks that use any available corporate targets. The goal is to get in quietly and stay unnoticed for long periods of time, as seen in the famous APT attack that victimized the networking company Nortel. Chinese spyware was present on Nortel’s systems for almost ten years without being detected and drained the company of valuable intellectual property and other information. Now that’s persistent!

9. Laws and regulations try to play catch up

A number of cyber security laws are being considered in the U.S. including the National Cybersecurity Protection Act of 2014, which advocates the sharing of cybersecurity information with the private sector, provide technical assistance and incident response to companies and federal agencies.   Another one to note is the Federal Information Security Modernization Act of 2014 that is designed to better protect federal agencies from cyber-attacks. A third is the Border Patrol Agent Pay Reform Act of 2013 to recruit and retain cyber professionals who are in high demand. Additionally, there is the Cybersecurity Workforce Assessment Act, which aims to enhance the readiness, capacity, training, recruitment, and retention of the cybersecurity workforce. President Obama stated that wants a 30-day deadline for notices and a revised “Consumer Privacy Bill of Rights.”

One of the more interesting and intelligent recommendations came from the FDA, who issued guidelines for wireless medical device security to ensure hackers could not interfere with things such as implanted pacemakers and defibrillators. This notion was is part stimulated by worry about Dick Cheney’s pacemaker being hacked. In fact countermeasures were installed by on the device by Cheney’s surgeon. More regulation of health data and equipment is expected in 2015.

“Security — or the lack of it — will largely determine the success or failure of widespread adoption of internet-connected devices,” the FTC Commissioner recently shared in an article. The FTC also released a report entitled, “Privacy & Security in a Connected World.”

10. Hardware-based security may change the game

According to respected market researcher Gartner, all roads to the digital future lead through security. At this point, who can really argue with that statement? Manufacturers and service providers are seeing the seriousness of cyber-danger and are starting to integrate security at every connectivity level. Crypto element integrated circuits with hardware-based key storage are starting to be employed for that. Furthermore, these crypto elements are a kind of silver bullet given that they easily and instantly add the strongest type of security possible (i.e. protected hardware-based key storage) to IoT endpoints and embedded systems. This is a powerful concept whose fundamental value is only starting to be recognized.

IoT Node Chart 1

Crypto elements contain cryptographic engines to efficiently handle crypto functions such as hashing, sign-verify, ECDSA, key agreement (e.g.  ECDH), authentication (symmetric or asymmetric), encryption/decryption, message authentication coding (MAC), run crypto algorithms (e.g. elliptic curve cryptography, AES, SHA) and many other functions.

The hardware key storage plus crypto engine combination in a single device makes it simple, ultra-secure, tiny, and inexpensive to add robust security. Recent crypto element products offer ECDH for key agreement and ECDSA for authentication. Adding a device with both of these powerful capabilities to any system with a microprocessor that can run encryption algorithms (such as AES) brings all three pillars of security (confidentiality, data integrity and authentication) into play.

2014-Crypto-Security-at-our-Core-Atmel-Has-You-Covered

With security rising in significance as attack platforms increase in size and threats become more sophisticated, it is good to know that solutions are already available to ensure that digital systems are not only smart and connected, but robustly secured by hardware key storage. This could be the one of the biggest stories in security going forward.

Hacking a Nespresso machine with an ATmega328P

If there are a couple of things engineers love, tinkering and coffee rank high on that list. To our delight, a Maker by the name of Guido Burger brought to our attention one of his latest builds powered by an ATmega328P, of course.

IMG_9113

Along with fellow members of his Fab-Lab team, Burger has created the first open sensor platform for the Internet of Things, which uses a combination of Arduino IDE and Bluetooth Low Energy driven by just a single coin cell battery. Aptly named blueIOT, the platform is equipped with a certified BLE module and an ATmega328P MCU at its core.

Here, you can see the hacked Nespresso Inissia coffee maker. The black box is hosting the blueIOT module, optocoppler and a relay to physically decouple the machine from the control unit.

A closer look at the hacked Nespresso Inissia coffee maker. Here, you can see the black box that hosts the blueIOT module, along with an optocoupler and a relay that physically decouple the machine from the control unit.

Most recently, the Maker successfully hacked a Nespresso machine using the blueIOT to control his new makeshift device. Among the various tasks the ‘smarter’ coffee maker can carry out include awaking the device from power safe mode, beginning to brew a morning cup ‘o joe, changing the coffee/water mix, as well as starting the cleaning process — all made possible through a simple Arduino code running on the ATmega328P and the blueIOT’s ultra-low power design.

A peek inside the coffee maker.

A peek inside the coffee maker.

Furthermore, the gadget serves as an iBeacon, sharing the proximity of a user to the coffee maker via its companion smartphone app.

“This will be the cheapest BLE-enabled coffee maker based on a Nespresso mass market coffee maker… and simple to rebuild in less than two hours… It might be the first coffee maker actually being an iBeacon too,” Burger adds.

blueIOT and a Darlington driver running the relay (black on bottom), optocoupler (red) running Arduino code on the ATmega328P.

blueIOT and a Darlington driver running the relay (black on bottom), along with an optocoupler (red) running Arduino code on the ATmega328P.

Did this project perk your interest? If so, head on over to Fab Labs official page here to learn more about blueIOT and other related hacks.

Video: Leap Motion sensor hack turns any object or surface into a touch interface

Computer screens. Gift boxes. Beers cans. Cork boards. Bart Simpson. Pikachu. Each of these things can become touch interfaces thanks to a new proof of concept demonstration from Russian creative agency The Family. By hacking a standard Leap Motion sensor, the team was able to calibrate the device to interpret gestures. Watch it in action below!

 

Hacking and tracking an RC car

A Maker by the name of Shazin recently posted an RC car hack that tracks (and follows) the face of a user. The first step of the project? Assuming direct control of the RC vehicle.

“The uniqueness in this approach is that many people have [executed] RC car hacks using Arduino to control the RC, [rather than] the car itself,” Shazin explained in a recent blog post. “[This] hack directly controls the car instead of sending commands using the RC.”

As HackADay’s Kevin Darrah points out, the car used in the project isn’t exactly high-end, so Shazin had to forego about PWM control.

“Instead, a single IC (RX-2) was found to handle both the RF Receiver and H-Bridges,” writes Darrah.

“After a bit of probing, the four control lines (forward/back and left/right) were identified and connected to an [Atmel-based] Arduino.”

Shazin then paired the Arduino with a USB host shield, linking it with his Android phone via ADB (Android Debug Bridge), while also tweaking the OpenCV Android Face Detection app for the project.

“If the first detected face (target) is in the right half of the image, then turn right or else turn left and go forward,” notes Shazin.

Interested in learning more about the user tracking car? You can check out Shazin’s project page here and HackADay’s coverage here.

A specially crafted badge for r00tz kids

DEF CON Kids (aka r00tz Asylum) will be giving the first 175 attendees a specially crafted badge that allows kids do some hands-on hacking of their own. According to Kelly Jackson Higgins of Dark Reading, this includes shutting down or selecting the color of the LED on press and parent badges.

rootzbadge

Security expert James Arlen, a senior consultant at Leviathan Security Group, and his 11-year-old daughter Amelia designed the badges, which Arlen says is somewhat more complex than any of the previous versions of DEF CON badges for adults.

“It is the first, as far as we can tell, conference badge equipped with six co-processors slaved to a master processor. It also puts out a significant amount of light with all of the LEDs firing,” Arlen told Dark Reading. “[In addition], it utilizes the now common Arduino platform to make it simple for the kids to do their own programming of the device.”

The specially crafted r00tz kids DEF CON 2013 badge is also packaged with a trackball, speaker, a white LED, programmable color LEDs and an infrared receiver. Joysticks and wires will also be provided to facilitate even more modding and customization.

Vendor partners behind the kid badges are AT&T, Lookout, .secure and Wickr, as well as hardware support and supplies from Parallax, Atmel, Element14/Newark and Instructables.

Arduino making a mark at Maker Faire

I don’t usually make a big deal of my upcoming weekends, but when I get the chance to hang out in a human-size mouse trap, buzz around a giant Hand of Man robot, or get my code on competitively in a variety of hacker races, it’s worth talking up a bit.

Before you wonder whether I’ve managed to contract an unhealthy dose of hallucinogenic corporate cube fever, don’t panic! I’m referring to the upcoming Maker Faire, to be held at the San Mateo County Fairgrounds on the 18/19 of May.

makerpics

Maker Faire, created by Make magazine back in 2006, stitches together the arts and crafts with engineering and science.

beat_report

It’s a huge science fair for the general public, where Do-It-Yourselfers are free to roam around unleashed (usually on their segways) wearing propeller beanies and flashy LED pins without anybody judging them. Much.

Tinkerers little and large take center stage at Maker Faire, showing the world their zany contraptions and electrifying experiments, while trading tips and tricks for others who want to follow in their low power footsteps.

And Atmel, I’m proud to say, is all over it.

Why? Because in many ways, Atmel powers the maker movement, with its tech at the heart of so many maker designs. It helps, of course, that Atmel microprocessors are the chips of choice for the Arduino platform, both in their AVR flavor and ARM varieties.

arduino_due_in_hand

Arduino has democratized hardware in a way that allows anyone – young or old, engineer or not, rich or poor – to scratch their own itch and create anything they can imagine.

As Arduino’s founder, Massimo Banzi, puts it, “You don’t need anyone’s permission to create something great.”

Indeed, with Arduino even finding its way into every single MakerBot 3D printer, creativity now really knows no bounds.

At Maker Faire, Atmel will be right across from our friends and partners at Arduino (Booth #625 and #619 for the location sticklers) and along with a pretty slick booth design made up entirely of cardboard furniture (Chairigami!!), we’ll have quite a bit going on.

makerfairepic

For starters, we’ll have some MakerBot demos and an “IoTorium” (which I’m assuming is an emporium of awesome Internet of Things devices).

Speaking of awesome “things”, the folks from PuzzleBox will be pitching up in Atmel’s booth with their brain-controlled helicopters, alongside the cool riders from Faraday Bikes who will be peddling their electric bicycle wares.

We’ll also have some cute hackable Hexbugs crawling around and for those keeping an eye on the time, some smart watches from Secret Labs (shhhh!).

hexbugs

The Maker movement is a passionate one, and Atmel’s pretty passionate about being a part of it. If you can’t make it to Maker Faire, no sweat. You can follow all the goings on via Twitter. Just look for the hashtags @makerfaire, @atmel, @arduino.

Hope to see you there!