Closing Back Doors in the IoT
Software hackers are growing bolder and more resourceful by the day. They take advantage of the fact that so many companies today blindly put their faith in the IoT, assuming that the environment’s complexity is enough to keep their applications safe. As Gemalto’s VP, CTO Software Monetization, Michael Zunke, explains, nothing could be further from the truth.
LEAP: Last year, Volkswagen took High Court action to cover up claims that the keyless ignition system in its luxury cars was easily hackable. Why do you think it went to such great lengths?
MZ: That was an exercise in damage control. VW was clearly worried that if word got out that the signal between its immobilizer and key fob could be intercepted and cracked within 30 minutes, every hacker with a penchant for luxury cars would try to beat those odds. It had a lot at stake.
LEAP: What are the implications of this type of cyber attack?
MZ: In the short term, the cost of fixing a security breach can set a company back millions of dollars. It can also put a serious dent in its brand reputation, which can be harder to recover from in the long term. In VW’s case, the prospect of thieves gaining control of its cars posed a serious threat to road safety as well.
LEAP: Is this problem more prevalent in the automotive industry or does it affect all verticals?
MZ: Volkswagen is just one example of hackers exploiting the lax security measures in the IoT. Oracle has also reported an uptick in customers reverse engineering its code in order to uncover vulnerabilities. More recently, Juniper had to issue a security announcement warning its customers to patch their enterprise firewalls against bad code. If left unchecked, this would’ve given attackers free rein to hijack its devices and decrypt VPN traffic. Even Juniper’s largest rival, Cisco, couldn’t escape the effects of tampering. Despite protestations that the security of its code is rock solid due to a strict no-backdoor policy, Cisco began an internal code review to find malicious modifications, suggesting that perhaps it’s not quite as confident in its own implementation as it would have us believe.
LEAP: It’s quite a bleak picture you’re painting! Just how widespread are these security threats and what, if anything, can companies do to protect themselves?
MZ: Unfortunately, they’re a lot more common than most companies are willing to admit. Practically every time an IoT device enters the market, a new attack surface is born, exposing it to unauthorized use and reverse engineering. While it isn’t possible to completely eliminate these threats, there are ways of mitigating them. Software encryption, for example, ensures that only authorized personnel have access to your device, while IP protection prevents reverse engineering of crucial code. I go into this in more detail in my LicensingLive presentation, which explores the various techniques you can use to safeguard the application and data that make up the core of your device.
