Security Challenges in Emerging Technologies

Security Challenges in Emerging TechnologiesPraveen Joseph VackayilCISSP, PCI QSA cert., CCNA, ISO 27001 LA, MS - Warwick, BE

DISCLAIMER

Ground Rules

• Questions are welcome

• Share your knowledge

• Mobile phones – you know what to do

Session Objectives

• Exploratory look at emergent technologies• Identification of associated security

challenges

• Bottom-line:Incite the thought process on upcoming challenges and opportunities in information security.

Session Plan

•The Evolution of Information Security•4 Emerging Areas of Technology and Associated Security Challenges

So Let’s Go

The Evolution of Information Security

CIA

Quick Reminder• The fundamental objective of information security is to

protect the C, I and A of data.

However, it wasn’t always this way.

The Shifting Focus of Information Security• The early days of data security focused primarily on

Confidentiality of Data• Cryptography dates back to around 2000 B.C. in Egypt when

encrypted hieroglyphic messages were etched on tombs

The Shifting Focus of Information Security• Military applications of cryptography were developed in the

1800s.• Cryptography was extensively used to encrypt tactical

communications during World Wars I and II.

Can you Identify This Machine?

The Shifting Focus of Information Security• With the computing era, the way people use information in

their daily lives evolved.

And with it, so did information security.

1944 Today

Criticality of Information Stored/Processed/Transmitted

Today’s InfoSec Focals – How is Data

Transmitted

Accessed

Shared

Retained Used

Stored

Processed

What Does The Future Hold?

Wearables

Self Driving Cars 3D Printing

What This All Means• The same trend from the 60s and 70s is repeating itself. • Just like how computers spread out from a few offices to the

common man, advanced technology is becoming cheaper and easily available.

From Greater Pervasiveness to Greater Power• Technology’s control over a common man’s life is increasing. • Today we use mobile phones to keep us connected, and

process information. • Tomorrow, we will use technology to drive our cars to work.

Shift in the Goal of Information Security• Today, the end objective of information security is mainly to

protect assets like• money• trade secrets • business productivity • organizations’ reputations, etc.

In future, the end objective will shift towards the protection of• Human Life

Example Scenario

I’ve hacked into your Core Banking Database. Pay me $500,000 or I will crash it.

I’ve hacked into your self-driven car. All I ask is $10 million. I’ve texted you my Account Number. Choose not to comply and I WILL crash your car.

Cyber extortion TODAY Cyber extortion of the FUTURE

4 Emergent Technologies and Their Security Challenges

Discussion Plan• Review of 4 Emergent Technologies

Robotics

3D Printing

The Internet of Things

Wearables

Robotics

Robots Have Been Around A Very Long TimeFirst Robot Ever Made: Archytas’ Bird• Steam powered wooden bird• Dates back to 360 BC• First known attempt at

automation

First Industrial Robot• 1961 – General Motors developed a

robot to move hot car parts into a cooling liquid

Robotics: Applications Today• Industrial Applications:• Factories – manufacture of cars,

packaging material, processed foods, etc.

• Automation of repetitive tasks with high precision

• Medical Applications:• Robotic surgery allows doctors

to control and automate complex procedures with high precision, sometimes even remotely.

Military Applications of Robotics

• TALON• Built by a company called Foster-

Miller• Most common military robot in use• Can travel through sand, water, and

snow.• Has Audio-visual listening devices and

a mechanical arm• Primarily used in search and rescue

operations. Was used in 911.• Controlled remotely by a human.

Upcoming versions of TALON will include a weapons system holding guns and grenade launchers.

What Are The Security Implications?

• End-Points – ie the equipment at the doctor’s end or at the patient’s end is compromised. This is less common since the end-points are usually physically guarded.

• Network Attacks – the channel of communication between the doctor and patient is compromised. This is more common.

Ref: http://arxiv.org/pdf/1504.04339v2.pdf

Consider a Tele-Robotic Surgery. How can it be attacked?

Types of Network AttackIntention Modification

Intention Manipulation

Hijacking Attack

How Bad Can It Get?

• The above was just one example, but it can be extrapolated to other scenarios where robots are used.•Most robots today are not entirely

autonomous – ie. they must be instructed by a human entity over a communication channel. • If this process is compromised, the impact

can be death and/or serious physical damage.

Recent Events

Ref: http://time.com/3944181/robot-kills-man-volkswagen-plant/

Security Approach

• Go Back to the Basics• Strong encryption of the network link between

the Operator and the Operated Device. • Use secure communication protocols like TLS

v1.3 and above, SSH, WPA2, etc.• Strong authentication of source and

destination IPs • Harden the end-point devices• Perform network and app level pen-testing

3D Printing

What Is It?

Technology that allows you to fabricate three dimensional objects using plastic, metal, ceramics, powders, liquids, or even living cells provided you have a blueprint of the object created with CAD software.

3D Printing has been around since the late 80s. Since 2006, the technology has started to become cheaper and more accessible.

You Will Need A 3D Printer and a “.stl” Template

http://www.thingiverse.com

3D printing is also called Stereolithography and the CAD templates are created in the .stl format.

Applications

• Automobile ManufactureManufacture and testing of prototypes and auto parts/components

• Medical SectorManufacture of low cost prosthetic limbs, dental implants and even living tissue.

• Defence, Education, etc.

3D Printed Weapons?• Defense Distributed is an open source company that provides .stl designs for

3D printed firearms – for FREE.

3D Printed Weapons?• Plastic 3D printed guns can actually be used to fire rounds.• Liberator 3D is a functioning 3D printed gun developed by Defense

Distributed.• Plastic guns – don’t show up under a metal detector scan. So this means

everyone with a 3D Printer can create and own an invisible weapon.

Ref: https://www.youtube.com/watch?feature=player_embedded&v=drPz6n6UXQY

3D Printed ATM Skimmers• An ATM skimmer fits into an ATM card

slot and can capture Track data from a swiped credit/debit card.

• A pinhole camera/ keypad overlay captures the PIN as it is keyed in by the cardholder

• This is transmitted wirelessly to criminals located within a 100m range of the ATM.

• Unless cardholders are alert, the skimmer will pass off as a genuine part of the ATM itself.

• 3D printing allows ATM skimmer devices to be made faster, more accurately and efficiently by crooks.

How About Your Car Keys?

• All it takes is a few photographs of a key to create the .stl design and 3D print a duplicate set.• Burglars, car thieves, etc. are jumping at

the opportunities.

What’s Next?

•There are 6 million parts that go into a Boeing 747. What if tomorrow one of those is a 3D printed fake? •Counterfeit coins•Fake ID Cards ???

And By The Way…• The world’s first fully 3D printed car is on its way out in 2016.• LocalMotors is working on a road-ready model.

Solutions?

•The technology is still evolving•Regulation and Legislation is yet to catch up with ethical, legal, privacy and security challenges.• It is going to be difficult to predict, let alone prevent the mis-use of this technology.

Wearables

Recognize This?

Casio CFX-400 Calculator Watch. 1995.

How Do We Understand Wearables?What’s Common to All Wearables

Portable, connected computing devices which are carried either on or inside of

a user’s body.

What’s DifferentPrimary Function of the device• Smart Glasses- Augmented

Reality Device• Smart Watch - Makes calls,

plays music, etc.• Smart Pills – monitor health

stats

Device Capability• Does it have a camera?• Can it make calls?• Is it online?• Does it keep you alive?

Most Popular Wearables Today• Smart Watches• Samsung Gear, Apple Watch, Pebble, etc.• They account for 40% of the wearables market

• Fitness Bands• FitBit, Garmin, etc.

• Smart Glasses• Vuzix, Google Glass

Ref: http://www.gartner.com/document/2847117

The Security Challenge with WearablesI. For a Personal User – Data

Privacy is the primary concern with Wearables

II. At an Organizational Level – Data Security is the key concern

I. Personal Users: The Privacy Challenge•Wearable technology is still evolving. • The primary design focus is more on

functionality and less on privacy.• Imagine the data available to a stalker who

has hacked into your fitness band:• Location of your house• Places you frequent the most• Your sleep patterns• Your food habits• Your exercise habits• Your health data: heart rate, BP, etc.

Security vs Functionality• We all know the Google Glass story. A host of great new

features… but privacy??Eye Tracking Feature Recording Feature

What you see – Glass sees. People that you see – Glass sees (and can record).

Ref: https://www.youtube.com/watch?t=85&v=9c6W4CCU9M4

Come Jan 2015, Google eventually had to pull the plug on Glass

II. Organizational Context –Security Challenge

The primary challenge with allowing wearables within an office workspace is Data Security

Mobile phones have already changed the security landscape within organizations. How hard is it to take pictures of your screen using a mobile camera?

The main issue with wearables is they make it difficult to find out when they are used to steal data - taking pictures at the blink of an eye, for instance.

The Next Level of Wearables

• Implantables• Ingestibles

Implantables

Jiya Bavishi's auditory brainstem implant is helping her hear sounds for the first time.

Auditory Brain-Stem Implant consists of a i. mic attached to the

ear and ii. a sensor implanted in

the brainto process sound signals in hearing impaired patients.

Ref: http://www.npr.org/sections/health-shots/2015/06/01/410065053/new-hearing-technology-brings-sound-to-a-litte-girl

Ingestibles

• The Pill communicates with a wearable sensor on the skin called a Patch.

• The technology will track the patient’s physiological stats about medication ingestion, heart rate, activity, rest, and skin temperature

• The digital health information can be viewed on a synced Mobile/Tablet.

Ref: proteus.com

Proteus, a company specializing in Digital Medicine, has received FDA approval for its Digital Pills – sensors which can be swallowed by a patient.

What are the Security Threats?• Can someone hack into your internet connected pacemaker

and speed your heart up till you die? According to the former US Vice President’s advisors…

Ref: https://www.washingtonpost.com/news/the-switch/wp/2013/10/21/yes-terrorists-could-have-hacked-dick-cheneys-heart/

Securing Wearable Technology

Manufacturers of Wearable Technology• Manufacturers are being pushed by security researchers to look at security

and privacy at the design stage of their devices.• Devices must anticipate and inform users of privacy compromises they will

make at every stage of using a device

Organizations/Work Places• Organizations must understand the risks introduced by allowing wearables

within their premises. • A risk assessment must be done to identify controls ranging from restricted

permission to use these devices to fully denying access

End-Users:• Users must be aware that privacy will be compromised when they use a

wearable device.• Children and senior citizens are more vulnerable.

The Internet of Things

What Is It?

What if we developed a way for all these devices to get out of their own little worlds and actually talk to each other?

Technology today consists of a number of devices of different kinds, each with a certain level of computing power and memory.

The IoT is a

heterogeneous ecosystem of

hardware (Things) and embedded software within which data can be

Sensed, Analyzed and

Transmitted

How Do We Define the IoT?

Interesting Statistic• The IoT s is projected to consist of 30 billion connected

“things” by 2020. Ref: IDC

The world’s human population is projected to be almost 8 billion by 2020.Ref: United Nations Population Fund

What This Means

The Big Challenge – Securing the IoT• BMW patches security flaw on their ConnectedDrive software,

that would have allowed a hacker to unlock car doors

Ref: http://www.bmw.com/com/en/insights/technology/connecteddrive/2013/

The Big Challenge – Securing the IoTJul 22, 2015: Hack moving Jeep. Switch off engine.

Ref: http://www.cbc.ca/news/technology/hackers-kill-engine-of-moving-jeep-on-highway-in-security-demo-1.3162944

The Challenges are Many

• ComplexityA heterogeneous network means devices on the IoT are different, with unique designs, software, operating protocols, etc. Where does a security attempt even begin?• Uniform StandardsOn the IoT, we will need to develop a uniform standard for devices to communicate. A uniform standard/protocol makes the IoT that much easier to hack into.• MonitoringCurrently, organizations have SOCs with IPS/DLP, etc. Who will monitor the IoT network?

IBM Model for the IoT

Each Layer Is Susceptible to a Variety of Attacks

• Recommends a holistic approach• Focus not only on securing the Device, but also, • The IoT Environment it operates in

• It looks at:• The Device• The Cloud• The Mobile Application• Network Interfaces• Software• Use of Encryption• Use of Authentication• Physical Security• USB Ports

Ref: OWASP Internet of Things Top Ten

OWASP – Internet of Things Top Ten

THANK YOU &

STAY IN TOUCH

Linkedin.com/in/vackayil

Praveen.jvc@gmail.com