With the increasing number of attacks targeting WiFi, does this pose a threat to Internet of Things (IoT) devices? In short, the answer is yes.
To elaborate, the answer is also affirmative: wireless networks are under attack — which means that all devices relying on wireless networks are also at risk of vulnerabilities. Intruders have dozens of methods to infiltrate wireless networks, from exploiting initialization vectors to attacking the WPA2 protocol, to breaching access points (this type of attack is vividly referred to as an “Evil Twin Attack” or “Man-in-the-Middle Attack”).
The vulnerability of the WPA2 protocol is concerning, as it is still widely used in wireless networks (WiFi), especially in older routers and environments that have not been updated in a timely manner. The role of WPA2 is to provide a unique encryption key for each wireless device, thereby protecting the data transmitted between the wireless network and devices. Unfortunately, the protective mechanisms of WPA2 can be compromised, especially when weak passwords and insecure practices are employed, increasing the risk of breaches.
Today, the Wi-Fi Alliance requires that all newly certified WiFi devices must support WPA2’s successor — the WPA3 protocol. But what does this actually mean? Can it resolve the security issues posed by WPA2?
Can WPA3 Solve WiFi Security Issues?
In 2017, a Belgian researcher discovered a method by which hackers could intercept and decrypt information transmitted between devices and their wireless access points. A year later, this vulnerability was addressed with the introduction of the WPA3 protocol, which opened the door to significantly enhanced security.
WPA3 is indeed a significant improvement, but if it weren’t for a major and unfortunate flaw, the story of WiFi security might have a happy ending: older IoT devices do not support the WPA3 protocol. This leaves millions of networks unable to utilize WPA3, thereby exposing themselves and the devices connected to these networks to risks.
Too Many Devices, Insufficient Control
The root of the problem lies in the rapid adoption of IoT by modern enterprises. Today, large enterprises have thousands or even tens of thousands of devices connected to their networks. Identifying every device within an enterprise has become a daunting task, let alone ensuring that all devices are updated with the latest firmware. In many cases, hardware limitations make it impossible to update older devices.
A major security risk posed by older devices is that some transmit data over Hypertext Transfer Protocol (HTTP), which is susceptible to sniffing attacks or man-in-the-middle attacks. Some devices may use Secure Hypertext Transfer Protocol (HTTPS) during authentication but switch back to HTTP for subsequent communications.
The use of HTTP is inherently insecure, and in today’s network environment, using HTTP is an extremely reckless act. If an external attacker can gain control of the WiFi access point by cracking the encryption, and the IoT devices are communicating over HTTP, then the attacker can intercept authentication credentials to expand the attack surface, steal sensitive data, inject malware, and carry out other destructive actions.
And achieving this is not particularly difficult for attackers.
How to Prevent IoT Attacks?
There are many ways to address IoT security issues, such as network segmentation, endpoint security, and authentication and access control. However, the three most important measures you should take for IoT infrastructure include:
- Adopt HTTPS: Use secure TLS/SSL (i.e., HTTPS) protocols to encrypt all communication data sent to and from IoT devices. Ensure that your devices are configured with the correct HTTPS protocol stack so that certificates can be properly validated.
- Client Certificate Authentication: Ensuring that only authorized IoT devices can connect to the network or control systems is crucial — this is why using certificates to validate the identity of each device is essential. It is easy to incorporate client certificate authentication functionality when configuring devices.
- Code Signing Certificates: The code running on devices should be signed to prevent tampering. Through code signing certificates, devices can ensure that they only install and run code from trusted sources (i.e., your organization).
How DigiCert Enhances Security in the IoT Space
Every device in the IoT space is unique, with differences in manufacturing processes, electronic components, software, functionality, and lifecycle. Additionally, these devices connect in various ways — including WiFi, Bluetooth, cellular networks (4G/5G), Ethernet, and more.
So, how can we manage and secure such a complex IoT environment? The answer lies in IoT device management. IoT device management enhances security and digital trust, allowing your organization to track the digital certificates issued for all devices and connected items.
DigiCert’s “DigiCert Device Trust Manager” provides enterprises with security management support for the entire lifecycle of IoT devices, covering every stage from deployment to decommissioning. This manager utilizes the unique identifiers of IoT devices (which are bound to public key infrastructure (PKI) certificates and issued during the manufacturing process) to achieve the following:
- Manage device identities
- Ensure secure connections
- Prevent device tampering
- Remotely and securely update firmware and device settings
Moreover, the DigiCert Device Trust Manager can ensure that organizations comply with relevant regulatory requirements while providing high reliability and efficient operational processes.
Protecting the IoT Devices that Support Business Operations
The forms of cybersecurity threats targeting IoT devices are diverse and constantly evolving. Since many IoT devices are deployed in critical infrastructures involving sensitive data or security implications, the consequences of these threats can be severe, potentially leading to high downtime costs and damaging data breaches.
To ensure security, your organization must implement robust security measures such as encryption, device authentication, and code signing. By combining these measures with device lifecycle management, you can significantly reduce vulnerability risks and prevent WiFi attacks.