January 24, 2023

The next wave of wireless security concerns: API-driven IoT devices


LAS VEGAS — Wireless carriers could be the next cast of characters to learn the hard way about the security risks created by IoT devices. This warning came during a recent briefing at the Black Hat conference on information security here by Altaf Shaik, Senior Security Researcher at Technische Universität Berlin.

“There is an increased threat when it comes to 5G, and the impact is also quite significant because here the hacker can target the industry and not just a single user,” Shaik said at the start of this 40-year presentation. minutes.

The central issue here is the utility of 5G in connecting not just people (who will benefit from notable privacy improvements with 5G, as Shaik explored in a presentation at last year’s Black Hat conference ), but also machines. Operators are now working to turn this latest functionality into new business lines by offering enterprises IoT services that these customers can directly manage through new APIs.

“For the first time, 4G and 5G networks are trying to bring that exposure to the network,” Shaik said. “Proprietary interfaces are now changing and slowly evolving into generalized or commoditized technologies like APIs.”

“So now any external entity can actually control their smart devices using the service APIs and going through the 4G or 5G core network,” Shaik said, citing a test of Vodafone drones in Germany. “This exposure layer provides APIs and shares information for the drone control center.”

Operators sell these IoT services to businesses (verified with a tax ID) who want to buy IoT SIM cards in bulk of a thousand purchases or more. These business customers, in turn, can manage these SIM cards through an IoT connectivity management web interface, with an IoT service platform web interface providing account-wide controls.

“You can do a lot of things, provided you have access to these APIs,” Shaik summarized.

open to compromise

However, poorly configured or poorly administered APIs can compromise other customers’ IoT devices and possibly even a carrier’s core network. For example, an attacker could start by exploiting vulnerabilities “to obtain data from arbitrary users hosted on the same platform”, then attempt to compromise an operator’s application server – and possibly “from there break into the mobile core network, because they’re connected,” Shaik continued.

He and fellow researchers Shinjo Park, also from Technische Universität Berlin, and Matteo Strada, from NetStudio Spa, tested this by purchasing IoT SIM cards from nine services and then testing them for possible weaknesses.

To read the full article, visit Light Reading.

Source link