SoylentNews is people
SoylentNews
Submitted via IRC for SoyCow4408
A preponderance of weak keys is leaving IoT devices at risk of being hacked, and the problem won't be an easy one to solve.
This was the conclusion reached by the team at security house Keyfactor, which analyzed a collection of 75 million RSA certificates gathered from the open internet and determined that number combinations were being repeated at a far greater rate than they should, meaning encrypted connections could possibly be broken by attackers who correctly guess a key.
Comparing the millions of keys on an Azure cloud instance, the team found common factors were used to generate keys at a rate of 1 in 172 (435,000 in total). By comparison, the team also analyzed 100 million certificates collected from the Certificate Transparency logs on desktops, where they found common factors in just five certificates, or a rate of 1 in 20 million.
The team believes that the reason for this poor entropy is down to IoT devices. Because the embedded gear is often based on very low-power hardware, the devices are unable to properly generate random numbers.
The result is keys that could be easier for an attacker to break, leaving the device and all of its users vulnerable.
Source: https://www.theregister.co.uk/2019/12/16/internet_of_crap_encryption/
(Score: 2) by driverless on Wednesday December 18 2019, @12:40PM (1 child)
You're thinking about this like a security person, not a hardware vendor. Adding a "cheap $3 crypto ASIC" can double the BOM for something that adds no value to the buyer, as well as requiring a hardware redesign to fit it, maybe changing the form factor and certainly changing the power budget. Getting good randomness costs close to zero, with no change to the hardware, if you just care about security enough to load a random seed as part of the provisioning process. That's what we do with every embedded device we ship, whether it claims to have a proper entropy source or not.
The problem is that vendors of IoS don't care about security much (see the near-infinite other security holes in their crap), not whether they have a hardware RNG or not.
(Score: 3, Interesting) by DannyB on Wednesday December 18 2019, @04:49PM
Security HAS value to the buyer. It's just that buyers assume it is already included in the package.
This is why those vendors need to have direct liability for all damages. Make them care. They could make these IoT devices be the Security Hardened Internet of Things. (SHIoT)
The lower I set my standards the more accomplishments I have.