The Hidden Risk in IoT: Insecure Cloud Connections

Cloud is becoming more and more and more prevalent. So it's something definitely to think about and to always be cognizant about. So the device to cloud link is really is a very core component of the trust model. um If the channel is weak, just as I said, you know you can be as secure as you want. If you have one weak channel, you're ah completely compromised. um Nothing else of the architecture matters at that point. If you have a secure insecure channel going from your device to the cloud, you just man in the middle between it, monitor all the traffic, pull out insensitive information, All the hardening in the world can't save that. um So we're looking at things like encryption strength. Are they using updated up to date um transport layer security TLS? um Do they have no fallbacks? Can we not roll back their encryption to a much more vulnerable version? um And then because that's it's called a rollback attack. So, you know, sometimes we can they have really strong encryption, but they also support really weak ones. And so sometimes you can just roll it back to a really weak one and bypass all that security. um Do they have mutual authentication? Does the cloud verify the device and does the the device verify itself to the server? um Do they have credential handling? Are tokens long lived? Are they hard coded? Are they improperly scoped? um you know Can you man the middle attack as I was mentioned ah mentioning above to do some replay attacks or to spoof the device into thinking you're some trusted component by leveraging maybe one of the hard coded certificates you pulled from the device. um And how does the device do with error handling? you know If it has no rate limiting, does can you just crash the device by trying to guess its password 500 times a second? How does it handle against denial of service attacks when you just flood it? Does it go down? Does it restart itself? Does it just completely shut itself off from you to protect itself? you know It's all that kind of stuff that we look into to see how hard hardened the communication between the device and the cloud is, because sometimes that can be the weakest link.