# Real World Implications of OWASP IoT Top 10 2018

This paper proves the relevance of **OWASP IoT Top 10 2018** list and provides examples of vulnerable devices which in some way or another, utilizes the list.

## Timeline

gantt
    title OWASP IoT Top 10 Journey

    section OWASP
    IoT Top 10 2014     :a1, 2014-01-01, 2018-01-12
    IoT Top 10 2018     : 2018-01-12  , 2019-04-14

# OWASP IoT Top 10

- Insecure Web Interface
- Insufficient Authentication/Authorization
- Insecure Network Services
- Lack of Transport Encryption/Integrity Verification
- Privacy Concerns
- Insecure Cloud Interface
- Insecure Mobile Interface
- Insufficient Security Configurability
- Insecure Software/Firmware
- Poor Physical Security

## OWASP IoT Initiative

digraph {
  compound=true
  rankdir=RL

  graph [ fontname="Source Sans Pro", fontsize=20 ];
  node [ fontname="Source Sans Pro", fontsize=18];
  edge [ fontname="Source Sans Pro", fontsize=12 ];


  subgraph core {
    c [label="Vulnerabilities \n(CWEs)"] [shape=box]
  }
  
  c -> sync [ltail=session lhead=session]

  subgraph cluster1 {
     concentrate=true
    a [label="Developers,\nCustomers, Manufacturers, ..."] [shape=box]
    b [label="Infosec Community"] [shape=box]
    sync [label="IoT Devices" shape=plaintext ]
    b -> sync  [dir="both"]
    sync -> a [dir="both"]
    label="OWASP IoT 2018"
  }
}

# Correlating CWE(s) w/ OWASP IoT Top 10

- **Insecure Web Interface**
**[CWE-20](https://cwe.mitre.org/data/definitions/20.html)**
**[CWE-89](https://cwe.mitre.org/data/definitions/89.html)**
**[CWE-601](https://cwe.mitre.org/data/definitions/601.html)**
**[CWE-598](https://cwe.mitre.org/data/definitions/598.html)**
**[CWE-650](https://cwe.mitre.org/data/definitions/650.html)**
**[CWE-79](https://cwe.mitre.org/data/definitions/79.html)**
**[CWE-352](https://cwe.mitre.org/data/definitions/352.html)**
- **Insufficient Authentication/Authorization**
**[CWE-276](https://cwe.mitre.org/data/definitions/276.html)**
**[CWE-521](https://cwe.mitre.org/data/definitions/521.html)**
**[CWE-312](https://cwe.mitre.org/data/definitions/312.html)**
**[CWE-287](https://cwe.mitre.org/data/definitions/287.html)**
**[CWE-284](https://cwe.mitre.org/data/definitions/284.html)**
**[CWE-259](https://cwe.mitre.org/data/definitions/259.html)**
**[CWE-598](https://cwe.mitre.org/data/definitions/598.html)**
- **Insecure Network Services**
**[CWE-120](https://cwe.mitre.org/data/definitions/120.html)**
**[CWE-284](https://cwe.mitre.org/data/definitions/284.html)**
**[CWE-20](https://cwe.mitre.org/data/definitions/20.html)**
- **Lack of Transport Encryption/Integrity Verification**
**[CWE-201](https://cwe.mitre.org/data/definitions/201.html)**
**[CWE-327](https://cwe.mitre.org/data/definitions/327.html)**
**[CWE-300](https://cwe.mitre.org/data/definitions/300.html)**
**[CWE-200](https://cwe.mitre.org/data/definitions/200.html)**
**[CWE-319](https://cwe.mitre.org/data/definitions/319.html)**
- **Privacy Concerns**
**[CWE-200](https://cwe.mitre.org/data/definitions/200.html)**
**[CWE-359](https://cwe.mitre.org/data/definitions/359.html)**
- **Insecure Cloud Interface**
**[CWE-287](https://cwe.mitre.org/data/definitions/287.html)**
**[CWE-307](https://cwe.mitre.org/data/definitions/307.html)**
**[CWE-359](https://cwe.mitre.org/data/definitions/359.html)**
**[CWE-598](https://cwe.mitre.org/data/definitions/598.html)**
**[CWE-319](https://cwe.mitre.org/data/definitions/319.html)**
- **Insecure Mobile Interface**
**[CWE-312](https://cwe.mitre.org/data/definitions/312.html)**
**[CWE-287](https://cwe.mitre.org/data/definitions/287.html)**
**[CWE-359](https://cwe.mitre.org/data/definitions/359.html)**
**[CWE-284](https://cwe.mitre.org/data/definitions/284.html)**
**[CWE-613](https://cwe.mitre.org/data/definitions/613.html)**
**[CWE-319](https://cwe.mitre.org/data/definitions/319.html)**
- **Insufficient Security Configurability**
**[CWE-15](https://cwe.mitre.org/data/definitions/15.html)**
**[CWE-521](https://cwe.mitre.org/data/definitions/521.html)**
**[CWE-295](https://cwe.mitre.org/data/definitions/295.html)**
**[CWE-269](https://cwe.mitre.org/data/definitions/269.html)**
**[CWE-285](https://cwe.mitre.org/data/definitions/285.html)**
- **Insecure Software/Firmware**
**[CWE-15](https://cwe.mitre.org/data/definitions/15.html)**
**[CWE-798](https://cwe.mitre.org/data/definitions/798.html)**
**[CWE-295](https://cwe.mitre.org/data/definitions/295.html)**
- **Poor Physical Security**
**[CWE-284](https://cwe.mitre.org/data/definitions/284.html)**
**[CWE-20](https://cwe.mitre.org/data/definitions/20.html)**

## Common Weakness Enumeration (CWE) List Version 1.0

- **[CWE-201: Information Exposure Through Sent Data
](https://cwe.mitre.org/data/definitions/201.html)**
- **[CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
](https://cwe.mitre.org/data/definitions/601.html)**
- **[CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
](https://cwe.mitre.org/data/definitions/300.html)**
- **[CWE-285: Improper Authorization
](https://cwe.mitre.org/data/definitions/285.html)**
- **[CWE-319: Cleartext Transmission of Sensitive Information
](https://cwe.mitre.org/data/definitions/319.html)**
- **[CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
](https://cwe.mitre.org/data/definitions/79.html)**
- **[CWE-15: External Control of System or Configuration Setting
](https://cwe.mitre.org/data/definitions/15.html)**
- **[CWE-20: Improper Input Validation
](https://cwe.mitre.org/data/definitions/20.html)**
- **[CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
](https://cwe.mitre.org/data/definitions/89.html)**
- **[CWE-312: Cleartext Storage of Sensitive Information
](https://cwe.mitre.org/data/definitions/312.html)**
- **[CWE-307: Improper Restriction of Excessive Authentication Attempts
](https://cwe.mitre.org/data/definitions/307.html)**
- **[CWE-359: Exposure of Private Information ('Privacy Violation')
](https://cwe.mitre.org/data/definitions/359.html)**
- **[CWE-284: Improper Access Control
](https://cwe.mitre.org/data/definitions/284.html)**
- **[CWE-200: Information Exposure
](https://cwe.mitre.org/data/definitions/200.html)**
- **[CWE-259: Use of Hard-coded Password
](https://cwe.mitre.org/data/definitions/259.html)**
- **[CWE-650: Trusting HTTP Permission Methods on the Server Side
](https://cwe.mitre.org/data/definitions/650.html)**
- **[CWE-352: Cross-Site Request Forgery (CSRF)
](https://cwe.mitre.org/data/definitions/352.html)**
- **[CWE-276: Incorrect Default Permissions
](https://cwe.mitre.org/data/definitions/276.html)**
- **[CWE-521: Weak Password Requirements
](https://cwe.mitre.org/data/definitions/521.html)**
- **[CWE-287: Improper Authentication
](https://cwe.mitre.org/data/definitions/287.html)**
- **[CWE-327: Use of a Broken or Risky Cryptographic Algorithm
](https://cwe.mitre.org/data/definitions/327.html)**
- **[CWE-598: Information Exposure Through Query Strings in GET Request
](https://cwe.mitre.org/data/definitions/598.html)**
- **[CWE-613: Insufficient Session Expiration
](https://cwe.mitre.org/data/definitions/613.html)**
- **[CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
](https://cwe.mitre.org/data/definitions/120.html)**
- **[CWE-798: Use of Hard-coded Credentials
](https://cwe.mitre.org/data/definitions/798.html)**
- **[CWE-295: Improper Certificate Validation
](https://cwe.mitre.org/data/definitions/295.html)**
- **[CWE-269: Improper Privilege Management
](https://cwe.mitre.org/data/definitions/269.html)**

# Mapping of the IoT Top 10 (2014 vs 2018)


# Examples of OWASP IoT Top 10 2018 List in Real World :fork_and_knife:

| Type | Name of device | CWE | Security Impact | References |
|------|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|
| I1 | AXIS Cameras | CWE-20: Improper Input Validation | An attacker can edit any file in the operation system with root privileges. | https://www.exploit-db.com/exploits/41625 |
| I1 | Routers D-Link DIR-300 | CWE-352: Cross-Site Request Forgery (CSRF) | An attacker can change admin’s password and get root privilegies. | http://seclists.org/fulldisclosure/2016/Nov/1 |
| I1 | Loxone Smart Home | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | All device functions can be controlled via web-based commands by an attacker. | https://seclists.org/fulldisclosure/2015/May/55 |
| I2 | In-Flight Entertainment Systems | CWE-287: Improper Authentication | An attacker can control the means of informing passengers. For example, it’s possible to spoof flight information values such as altitude or speed. | http://blog.ioactive.com/2016/12/in-flight-hacking-system.html |
| I2 | DBPOWER U818A WIFI quadcopter drone | CWE-276: Incorrect Default Permissions | An attacker can read files from the device; for example, images and videos. | https://www.kb.cert.org/vuls/id/334207 |
| I3 | Hikvision Wi-Fi IP Camera | CWE-284: Improper Access Control | An attacker can remotely exploit or disable the camera. | http://seclists.org/fulldisclosure/2017/Nov/43 |
| I3 | Implantable Cardiac Device | CWE-284: Improper Access Control | An attacker can modify programming commands to the implanted device, which may result in rapid battery depletion and/or administration of inappropriate pacing or shocks. | https://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm535843.htm |
| I4 | Samsung Smart TV | CWE-200: Information Exposure | An attacker can monitor the wireless network and conduct a brute force guessing attack to recover the key and decrypt the traffic. | https://securitytracker.com/id/1034504 |
| I4 | DJI Spark drone | CWE-327: Use of a Broken or Risky Cryptographic Algorithm | An attacker can obtain access to the settings of the device. | https://embedi.org/blog/dji-spark-hijacking/ |
| I5 | iBaby M6 baby monitor | CWE-359: Exposure of Private Information (‘Privacy Violation’) | An attacker can view any user’s information, including video recording details. | https://www.rapid7.com/docs/Hacking-IoT-A-Case-Study-on-Baby-Monitor-Exposures-and-Vulnerabilities.pdf |
| I6 | Western Digital My Cloud | CWE-287: Improper Authentication | An attacker can get full control over the device. | https://www.securify.nl/advisory/SFY20170102/authentication_bypass_vulnerability_in_western_digital_my_cloud.html |
| I7 | Fitness-trackers (Fitbit, Apple, Xiaomi, Garmin, Samsung and others) | CWE-319: Cleartext Transmission of Sensitive Information | An attacker can spy on fitness tracker users. | https://openeffect.ca/fitness-tracker-privacy-and-security/ |
| I7 | Segway Ninebot | CWE-359: Exposure of Private Information (‘Privacy Violation’) | An attacker can gain access to a user’s geolocation. | https://www.ioactive.com/pdfs/IOActive-Security-Advisory-Ninebot-Segway-miniPRO_Final.pdf |
| I8 | Smart Nest Thermostat | CWE-269: Improper Privilege Management | An unauthorized attacker can access Nest account. | http://www.blackhat.com/docs/us-14/materials/us-14-Jin-Smart-Nest-Thermostat-A-Smart-Spy-In-Your-Home.pdf |
| I8 | ADSL device ZTE ZXDSL | CWE-15: External Control of System or Configuration Setting | An attacker can reset the configuration of the device. | https://blogs.securiteam.com/index.php/archives/3546 |
| I9 | Devices by GeoVision | CWE-295: Improper Certificate Validation | An attacker can update firmware and get full control over the device. | http://seclists.org/fulldisclosure/2018/Feb/5 |
| I9 | iSmartAlarm | CWE-295: Improper Certificate Validation | An attacker can get a user’s passwords or personal data. | http://seclists.org/fulldisclosure/2017/Jul/19 |
| I10 | Baby monitors Mi-Cam | CWE-284: Improper Access Control | An attacker can spy on users. | https://www.sec-consult.com/en/blog/2018/02/internet-of-babies-when-baby-monitors-fail-to-be-smart/index.html |
| I10 | Router TP-Link | CWE-284: Improper Access Control | An attacker can obtain root privilegies and make the devise a part of a botnet. | http://konukoii.com/blog/2018/02/16/5-min-tutorial-root-via-uart/ |

### Wrap up

- IoT devices are very vulnerable
- Most of the vulnerabilities belong to application security and can be corelated
- ***OWASP IoT Initiative Rocks*** :fire:

#### Thank you! :tada:

### References

1. CWE - CWE-928: Weaknesses in OWASP Top Ten (2013) (3.2) (https://cwe.mitre.org/data/definitions/928.html)

2. CWE - CWE-809: Weaknesses in OWASP Top Ten (2010) (3.2) (https://cwe.mitre.org/data/definitions/809.html)

3. CWE - CWE-629: Weaknesses in OWASP Top Ten (2007) (3.2)
(https://cwe.mitre.org/data/definitions/629.html)

4. CWE - CWE-711: Weaknesses in OWASP Top Ten (2004) (3.2)
(https://cwe.mitre.org/data/definitions/711.html)

:::info
**Find this document incomplete?
:arrow_right_hook: @0x48piraj**
:::

###### TAGS : `Documentation` `IoT` `OWASP` `Security` `vulnerabilities`