FIRMWARE SECURIT Y IN THREE STEPS ASSESS, HARDEN, CONTROL

2FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Cloud and the development of wireless networking technologies such as 5G are fueling the growth of the IoT worldwide market, estimated to grow yearly by over 25% from $212B in 2018 to $1.3T in 2026 [PRNewswire]. About one quarter of businesses used IoT technologies in 2019 and the worldwide number of IoT-connected devices is projected to increase to 43 billion by 2023 [McKinsey].

While IoT connected devices deliver clear benefits, they also create a new attack surface that exposes organizations to cyber-threats. Many of these devices run on unpatched software, are misconfigured, or use unsecured communication protocols, which make them extremely vulnerable and easy to hack. This increases the risk of a successful cyber-attack, where critical devices can be shut down, damaged, manipulated, or used to infect other systems, to steal sensitive data, perform fraudulent transactions, conduct corporate espionage or launch ransomware attacks.

As an IoT device manufacturer or a business interested in securing your IoT device purchase what can you do to improve the security of your IoT investment?

Invest in IoT Security Design While there are few standards and regulations yet, one thing is clear: nations, businesses and consumers all benefit when IoT devices are secure. New cyber security regulations for IoT will come into effect in the next 1 to 3 years, but more importantly, the need for secure devices is a growing requirement. While standards are not yet mandatory, some embedded device manufacturers are already adopting recommendations set out in IoT security frameworks such as Foundational Cybersecurity Activities for IoT Device Manufacturers (NISTIR 8259) and Considerations for Managing Internet of Things Cybersecurity and Privacy Risks (NISTIR 8228).

In fact, one study showed that enterprises are worried about IoT security, would be willing to pay 22% more and buy 70% more of IoT devices that are secured [Bain].

https://www.prnewswire.com/news-releases/internet-of-things-iot-market-worth-1319-08-billion-globally-by-2026-at-25-68-cagr-verified-market-research-301092982.html https://www.mckinsey.com/industries/private-equity-and-principal-investors/our-insights/growing-opportunities-in-the-internet-of-things https://www.bain.com/insights/cybersecurity-is-the-key-to-unlocking-demand-in-the-internet-of-things/

3FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Emerging IoT Regulations

• US: DFARS and NIST SP 800-171 (2020 law pending) • US: Foundational Cybersecurity Activities for IoT Device Manufacturers NISTIR 8259 (2020)

• US: IoT Device Cybersecurity Capability Core Baseline NISTR 8259a (2020)

• US: Considerations for Managing Internet of Things Cybersecurity and Privacy Risks NISTR 8228 (2019)

• US: IoT Cybersecurity Improvement Act of 2019

• California: SB 327 (2018)

• EU: ETSI TS 103 645 (European Telecommunications Standards Institute) – French standard for Cyber Security for Consumer Internet of Things: Baseline Requirements (2019)

• UK: Code of Practice for Consumer IoT Security (2018)

• CTIA (Cellular Telecommunications Industry Association): Cybersecurity Certification

• GSMA (Global System for Mobile Communications): IoT Security Guidelines and Assessment

Implementing Security during the Development Lifecycle Manufacturers can implement security into the development lifecycle of embedded devices, but from security audits of these devices, we know this is not always practiced. Some manufacturers have paid very little attention to effective security design and are slow to respond when their devices are found to be vulnerable.

As more regulations emerge, this can cause IoT manufacturers direct or indirect damage such as legal issues, damage to the brand, high insurance costs and even personal liability for IoT security incidents.

Device Manufacturer Cost Benefit Use Case

Cyber insurance for device manufacturers costs 0.5% to 1.5% of the insured coverage. So, for $10M coverage insurance, it will cost $100,000 per year. If the vendor can show the insurer that it has good cyber protection, then the annual costs will decrease to lower than 0.5% from the coverage amount, in this case $50,000 less.

https://www.gartner.com/en/newsroom/press-releases/2020-09-01-gartner-predicts-75--of-ceos-will-be-personally-liabl

4FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

IoT Threats IoT Threat Landscape Understanding the opponent’s capabilities is a first step on the road to better IoT device protection. Attacks can target vulnerabilities in software applications on the device, the device operating system and under some circumstances hardware level vulnerabilities.

Ultimately, IoT targeted attacks aim to compromise the device itself or are used as an entry point to gain access to sensitive networks and systems.

"Mirai DDoS Botnet: security cameras were hijacked and harnessed as part of a botnet used to launch DDoS attacks, and to infect other cameras and routers on the network. A default telnet login and Internet access led to the creation of the botnet controlled by a Command & Control server. The distributed nature and number of devices made the DDoS attack difficult to defend against. Variants by actors such as APT28 continue to use this strategy.”

Targeting IoT Devices When it comes to compromising IoT embedded devices there are several attack vectors.

Embedded Device Components

IoT components may serve as an attack entry point. This includes:

• Applications, i.e. device operations, user interface, management

• Middleware and other software libraries • Device drivers and other low-level components • Compute, storage and communications hardware

IoT Attack Motives IoT Attack End Game

Financial gain Crypto mining

Corporate espionage DDoS bot, move laterally to find more lucrative assets

Intellectual property and data theft Device destruction or ransom

Example of the effect of a successful IoT Attack

https://www.cyberscoop.com/russian-apt-iot-device-security/

5FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Unsecured or Vulnerable Communication Protocols IoT communication protocols are often NOT designed with security in mind. One example was a takeover of a smart lightbulb and subsequently using the lightbulb to move laterally to other hosts on the network using a vulnerability in the ZigBee protocol.

Specifically, the researchers demonstrated how weaknesses in the ZigBee protocol could be used to trigger a heap-based buffer overflow on a control bridge connected to the lightbulb by sending a large amount of data to it. This enabled them to install malware on the bridge and then pivot to the business or home network using the WanaCry vulnerability [cp<r> BLOG].

In another example, as a result of a Bluetooth vulnerability, a gas distribution facility detected a compromised device in its environment and identified 600 devices vulnerable to the BlueBorne attack. As described by researchers, “If exploited, an attacker could use Blueborne for remote code execution or Man-in-the-Middle attacks. An airborne attack also opens up many opportunities to conduct an attack: Unlike traditional malware or attacks, the user does not have to click a link or download a questionable file. No action by the user is necessary to enable the attack. Spreading through the air renders the attack much more contagious, and allows it to spread with minimum effort. Airborne attacks can allow hackers to penetrate secure, air-gapped internal networks. That puts industrial systems, government agencies, and critical infrastructure at extreme risk [Armis].”

Vulnerabilities in Parsers and Interpreters Command Injection

Rated in the top 2 of the OWASP Top 10 since 2010, injection attacks are one of the top vulnerabilities in any web application, and especially in IoT systems. In an OS command injection attack, an application may accept user input, then pass the value on to perform a shell command without validating the input.

A classic example is Shellshock, a vulnerability in the bash shell that scored 10 out of 10 on the severity scale. This means it is easy to execute and potentially very damaging because of the number of Linux-based embedded devices in use and to the ease with which vulnerable devices can be discovered on the Internet. Linux-based IoT devices include personal video recorders (PVRs), smart TVs, entertainment systems in cars, wired and wireless routers and switches.

https://blog.checkpoint.com/2020/02/05/the-dark-side-of-smart-lighting-check-point-research-shows-how-business-and-home-networks-can-be-hacked-from-a-lightbulb/ https://www.armis.com/resources/iot-security-blog/blueborne-one-year-later/C:/Users/bbent/Desktop/IoT-videos/If exploited, an attacker could use Blueborne for remote code execution or Man-in-the-Middle attacks. An airborne attack also opens up many opportunities to conduct an attack:

6FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Within hours of the initial disclosure, attackers were able to create botnets of compromised computers to perform DDoS attacks and vulnerability scans to search for other vulnerable systems.

Another example involves the use of bash, a common command line interface on UNIX systems. While a vulnerability is already available, in yet unpatched systems, the vulnerability allows bash to unintentionally execute commands given in function environment variables set by an attacker. This is due to an error in the way that bash parsed the input given in older versions.

Hijacking via Web Interfaces

ImageMagick is a package commonly used by web services to process images. ImageTragick is a set of vulnerabilities found in the package. One vulnerability leads to remote code execution when processing user submitted images. CVE-2016-3714 is the result of insufficient shell character filtering. Due to the parameter filtering vulnerability, it is possible to conduct a shell command injection leading to potential remote code execution (TrendMicro).

Memory Corruption

Another large class of vulnerabilities exists in replacing legitimate code with the attacker’s code by manipulating the IoT device memory that holds the IoT processor’s instruction stack. For instance Ghost, CVE-2015-023, is a heap-based buffer overflow in the GNU C Library’s gethostbyname functions on x86 and x86_64 GNU/Linux systems that can be used to remotely execute an attacker’s code on a target system.

Similarly Venom is a virtual machine escape and code execution using a buffer overflow in the QEMU software component that simulates floppy disk drives on systems running the virtualization software.

Exploiting Operating System Weaknesses

The WannaCry attack in 2017 illuminated how many IoT devices run the Windows XP Operating System. In addition to laptops and desktop computers, MRI machines were also vulnerable to the EternalBlue vulnerability, an attack against the Windows Server Message Block protocol.

https://blog.trendmicro.com/trendlabs-security-intelligence/imagemagick-vulnerability-allows-remote-code-execution-now-patched/#:~:text=The%20developers%20of%20ImageMagick%20have,servers%20and%20take%20over%20websites.

7FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Exploiting Known or Default Credentials

Anything on the Internet can be found and today this is relatively easy for both security researchers and hackers using Internet search tools like Shodan. Shodan “crawls the Internet 24/7 to provide the latest Internet intelligence. Who buys Smart TVs? Which countries are build- ing the most wind farms? What companies are affected by Heartbleed? Shodan provides the tools to answer questions at the Internet-scale [SHODAN].” With Shodan and the knowledge that an IoT device has telnet enabled and what the default username and password is, it is relatively easy to find and login to any device connected to the Internet. Scripting the login and subsequent takeover commands enables threat actors to create large networks of IoT bots under their control like the Mirai botnet [CSOONLINE].

Multi-Layered IoT Threat Defense What can device vendors and businesses do to protect IoT devices? When considering their IoT security strategy, manufacturers and organizations deploying IoT should consider these five layers of defense.

On-device Monitoring Hardware

Protections Firmware

Assessment Network-based On-device Runtime

Security Level Very Low Low Medium High Very High

Discover devices and risk

Reduce attack surface (ZTNA)

Prevention of known attacks

Prevention of IoT exploits

Manufacturer Manufacturer

Integrator Integrator – post development

End-user

Clientless via security gateways

End-user

Deployment Integrate agent into firmware

In hardware Offline firmware

scanning

Implement Nano Agent on binary

firmware

Security Value Proposition

Monitoring device health

Supply chain attacks Risk assessment Prevention of known and unknown attacks

in real-time

Deployed-by Manufacturer or software

Manufacturer hardware design

https://www.shodan.io/ https://www.csoonline.com/article/3258748/the-mirai-botnet-explained-how-teen-scammers-and-cctv-cameras-almost-brought-down-the-internet.html

8FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

1. On-device Monitoring Solutions

IoT devices may have device-level or central management built-in which can modify device settings, update the device when patches are available and provide a status of the device. The same app or management interface may also be able to alert on behavioral anomalies such as suspicious communications and changes to the device’s risk profile.

2. Built-in Hardware Protections

The device itself may have some protections built-in to the device. For instance Smartphone vendors design security and privacy into the device. This includes on-chip protection mechanisms like secure enclaves to store encryption keys, encrypting data at rest and encrypting data in transit between chips on the device. In addition, some manufacturers secure the boot up process. This is a process whereby your OS boot images and code are authenticated against the hardware root of trust. Only those boot images are allowed to be executed during the boot process.

3. Network-based IoT security

Network IoT protections is part of a multi-layered IoT protection strategy.

• Discovery: the first step is to discover and identify IoT devices using passive or active scanning technologies.

• Segment, Segment, Segment: the second step is to segment groups of devices into networks based on function, risk or business group and enforce limits between these segments.

• IoT Threat Prevention: a third step is to implement IDPS (Intrusion Detection and Prevention System) technologies to detect or prevent network-based exploits against vulnerabilities in the IoT device.

4. Firmware Assessment

Firmware assessments are a more in-depth version of the IoT network security discovery process. While IoT network discovery relies on identifying the device and associating the device ID with a catalog of known vulnerabilities, a firmware assessment looks at the IoT device internal components and provides an assessment of any known vulnerabilities or configuration issues.

9FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

5. Embedded Firmware Security - IoT On-Device Runtime Protection

One problem with network-based IoT security protections is that the IoT device must communicate through the network security devices. With the advent of 5G, more IoT devices will be able to connect Direct-to-Internet and thus bypass any network security protections. These devices may still be vulnerable to internal design flaws, coding errors and zero-days. On-device protection is a more precise application of IoT security threat defense.

On-device IoT security solutions are the latest generation of IoT cyber protection. A deep understanding of the device’s behavior enables more in-depth IoT device protection.

Runtime Protection analyzes the device firmware, maps the correct behavior of the device operating system and software, and then monitors that behavior at runtime. Most of the current solutions today are based on Control Flow Integrity (CFI) analysis (including Check Point IoT Protect Firmware).

Runtime protection focuses on the device’s behavior as a computing machine that acts according to certain computing rules. Deviations from expected behavior, such as unauthorized writes to certain parts of the file system or firmware, or rogue processes that shouldn’t spawn are identified.

Runtime protection goes even deeper to identify attempts to hook the control flow of each one of the protected processes in memory, on the device itself, constantly instrumenting their execution and making sure their flow is not diverted by any type of attack.

IoT Firmware Security in 3 Steps

Quantum IoT Protect Firmware provides embedded device manufacturers and integrators with a complete end-to-end solution for all their firmware security needs, including uncovering firmware security risks, hardening their device with a runtime protection Nano Agent, and managing their devices with a granular device-level policy.

By following the three-pronged approach detailed below, device makers and integrators can gain the visibility, security and management capabilities they need to ensure their devices and networks are protected from malicious intent.

10FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

1. Step One - Assess

FIRMWARE RISK ASSESSMENT

A cloud-based service quickly runs an automated security analysis for any device-specific firmware, to uncover security flaws and fix them ahead of mass production. The assessment generates a report that lays out ALL security flaws associated with the device including embedded third-party components along with practical recommendations to mitigate risks.

The Check Point cloud-hosted engine can scan thousands of firmware every day. Device firmware that is publicly published is easily found. This includes cameras, routers, etc. Our engine scrapes the Internet, downloads the firmware, extracts the image and analyzes it to deliver a security posture report for each file and library found.

This includes finding:

• Known vulnerabilities (CVEs databases)

• Credential evaluation (weak/ known)

• Private keys

• OS/Linux configuration kernel issues

• Geo locations domains

• Secure build flags

2. Step Two - Harden

IOT PROTECT NANO AGENT Quantum IoT Protect Nano Agent is a lightweight agent installed on IoT firmware, providing IoT developers with on-device runtime protection against zero-day attacks, regardless of how or where their device is deployed.

Anywhere Any Device Fast

The assessment uses a cloud based API and service

This works on any binary Linux based image

An assessment report is available in 5 to10 minutes

11FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

By embedding security into connected devices, services or workloads, the Nano Agent acts as the enforcement point for various controls and prevents threats against the latest known and unknown vulnerabilities and attack methods at runtime.

IoT Protect Nano Agent can be embedded into any IoT and OT device, without exposing any source code. Supporting both connected and air-gapped environments, its on-device runtime protection can be easily integrated into any design project through a dedicated open API.

By embedding security into connected devices and services, manufacturers of embedded devices can differentiate their offering, manage device security and build customer confidence even in an evolving cyber-physical attack surface.

Embedded runtime protection for IoT and OT devices provides IoT/OT devices with built-in-security against zero-day attacks regardless of where they are or how they are deployed.

IoT Protect Nano Agent works by analyzing a target binary, then at run time loads a proprietary “hardening library” on the device. When the “hardening library” is loaded, the Nano Agent hooks functions in the target binary in order to establish an instrumentation framework, which goes into the finer details of memory management and control flow, allowing it to protect against deviations from the original programming of the binary. The IoT Protect Nano Agent includes protections from memory corruption and flaws in parsers and interpreters that enable shell or command injection and other control flow hijacking techniques discussed earlier.

3. Step Three - Control

INFINITY NEXT ARCHITECTURE

Agents: IoT Protect Nano Agents implement security monitoring and enforcement with either code developed by Check Point or by controlling native capabilities of the environment.

A Nano-Agent that runs on a Smart Thermostat and provides Run-time IoT Workload Protection and Virtual Patching is called an "IoT Embedded Nano-Agent".

To deploy Quantum IoT Protect Nano Agent efficiently, the process starts with a very small piece of code that connects to a master controller which provides only the necessary software components needed to secure the device. The final total size of a basic Nano Agent is very lightweight. Management tasks like log collection, policy management and updates are relegated to management controllers, ensuring the Nano Agent and the IoT device is free to perform its normal duties.

12FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Fog: "Fog" is a term from the Edge Computing paradigm. Gartner defines edge computing as “a part of a distributed computing topology in which information processing is located close to the edge – where things and people produce or consume that information.”

The Infinity NEXT Fog is a local controller for the IoT Protect Nano Agents that is transparent to users of the Infinity Next cloud- based management system. Each Fog is highly-available, secure and provides multiple services to the Nano Agents, including:

• Software updates • Setting and policy updates • Real-time asset and security intelligence • Cross-agent Machine Learning functions • Channel for Event Logs and Telemetry (Fog sends this data for storage to the Infinity Next cloud)

Cloud Management: Infinity NEXT is the cloud service that hosts the Infinity Next Management Web Portal, a RESTful API Server and serves Infinity Next Fogs. The Web UI manages policy and the API enables DevSecOps teams to manage an organization’s IoT device security.

Infinity NEXT manages IoT devices with device-level enforcement. Intuitive object-based policy manage- ment defines security policies at the device level, including IoT network communications to and from the IoT device, allowing only what the device needs to operate while preventing infected devices from moving laterally in the network. Infinity NEXT also enables organizations to manage virtual patches for devices using signatures against known IoT and OT exploits.

The unified IT and IoT management console monitors threats against IoT devices. Connect to the cloud management portal using a web browser with strong multi-factor authentication. Set policy, monitor event logs and alerts and send summary reports to the management team as needed.

13FIRMWARE SECURITY IN THREE STEPSASSESS, HARDEN, CONTROL

Worldwide Headquarters 5 Ha’Solelim Street, Tel Aviv 67897, Israel | Tel: 972-3-753-4555 | Fax: 972-3-624-1100 | Email: info@checkpoint.com

U.S. Headquarters 959 Skyway Road, Suite 300, San Carlos, CA 94070 | Tel: 800-429-4391; 650-628-2000

www.checkpoint.com

© 2022 Check Point Software Technologies Ltd. All rights reserved.

Summary Internet of Things (IoT) technologies are crossing over into mainstream business use, in addition to their longstanding role in manufacturing, medical equipment, surveillance and logistics. Advances in wireless technologies such as 5G are enabling a more connected world to cloud-delivered data analysis and management systems that will make Internet of Things technologies easier to implement and help companies and investors seize new opportunities.

For IoT device manufacturers and businesses who want to deploy IoT securely, this can be achieved using a simple 3 step process; assess, harden and control. Assessment discovers the unique requirements needed to secure the device. Hardening then loads a Nano Agent or module that hooks functions into the target device binary in order to establish an instrumentation framework. This monitors the IoT device runtime control flow to protect the device against deviations from the original programming of the device.

Security policy is centrally managed and distributed to the edge Nano Agents from the cloud using an edge computing model architecture. The cloud and distributed cloud components do the heavy data processing, leaving the nano agents to do lighter weight policy enforcement.

For enterprises who have deployments of sanctioned, but vulnerable IoT devices like those used in industrial, healthcare and enterprise smart devices and systems, they can still benefit from network IoT security. This includes protection from rogue and shadow IoT devices using expert discovery, network segmentation and IDPS technologies to prevent network-based exploits of vulnerable IoT devices.

For more information on Check Point IoT Protect Firmware, visit: https://www.checkpoint.com/products/iot-security/iot-device-security/

https://www.checkpoint.com/products/iot-security/iot-device-security/