IEEE Consumer Electronics Magazine - March/April 2020 - 21

and taking compromising pictures and videos of
the individuals (e.g., using the camera and
speaker features in compromised devices such
as smart TVs).
Vulnerabilities and Countermeasures: Generally, in boot process hijacking, an attacker
attempts to break the normal boot process of a
device by exploiting any vulnerability in its boot
path, to replace the actual boot images with customized boot images. Due to lack of any integrity
check on the type of images being loaded into
ROM, the attacker could exploit the DFU feature
of the thermostat to boot from a USB device. The
attacker could further install malicious software
into the device gaining remote access of the
device and enter into the home network. To mitigate this attack, a chain-of-trust based secure
boot can be established if there are adequate
authentication mechanisms right from the initial
run of the code.8 This calls for a replacement of
the in-built processors with custom hardware to
facilitate secure boot support.
Lack of integrity check on the software images
being loaded into the device, and insecure software application programming interfaces (APIs)
and hardware interfaces, are some of the sources
of such attacks against the IoT devices. IoT devices may provide insecure APIs that are used by
application developers and other users to connect and communicate with them; thus, increasing the risk of malicious code injection attacks
from unauthorized entities. Well known best
practices for securing API endpoints such as
input validation, IP address filtering, etc., can be
applied to safeguard against such attacks.

Unauthorized Access
An attacker can gain unauthorized access to
an IoT system/device in many different ways
ranging from exploiting hardware/software vulnerabilities to illegal login attempts. The following case study on Tesla Model S describes one
way to carry out such an attack.
Attack and Consequences: Tesla service centers and charging stations are equipped with
TeslaService WiFi SSID. The credentials to access
them are stored in QtCarBrowser (Tesla's web
browser) as part of the autoconnect feature. By
faking this SSID, the attackers redirected the traffic from the browser to their domain.9

March/April 2020

QtWebkit=2:2x, the browser engine used by
Tesla's browser was found to contain a number
of software bugs, which were exploited by the
attackers to read/write arbitrary memory
addresses and to execute arbitrary code for gaining stable access to the shell. Once root access
was obtained, they disabled the Linux security
module, AppArmor. Gateway is one of the engine
control units (ECUs) present inside the vehicle's
communication network which is responsible
for passing control commands to other ECUs.
The attackers bypassed the Gateway firmware
integrity verification via an insecure token to
obtain privileged access to the Gateway shell
and programmed their customized firmware.
Intelligent and connected vehicles (ICV) such as
Tesla Model S are equipped with wireless communication technologies that allow vehicles to communicate with each other and with the roadside
infrastructure. As the number and range of cyber
interfaces within ICVs increase, there is also a corresponding increase in the attack vectors and security risks. The consequences of vulnerability can
be costly. In 2015, for example, Chrysler recalled
1.4 million vehicles and incurred significant financial losses due to the reported security flaws.
Vulnerabilities and Countermeasures: Several
security vulnerabilities were discovered in the
Tesla Model S, which allowed the attacker to
remotely take over the vehicle in both standby
and driving modes. First, since there were no
mechanisms implemented in the browser to avoid
memory leaks, the memory locations for binary
read/write were exposed. The AppArmor module
can be strengthened to disallow kernel address
leakage by mandatory size check, and privileged
folders can be made inaccessible in the browser
context by stringent access rules. Furthermore,
the access checks for modifying the privileged
user rights were also missing in the current version of the Linux kernel distribution used by Tesla.
Many of the above kernel security vulnerabilities
(CVE-2015-1805, CVE-2016-5195, etc.) are known
common vulnerabilities and exposures (CVEs) at
the point of attack, and the patches available open
source can address this issue. Moreover, moving
to a newer Linux version would also improve kernel security.
IoT device manufacturers must ensure that
devices without continuous Internet access are

IEEE Consumer Electronics Magazine - March/April 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - March/April 2020