hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015The endpoint wireless infrastructure is still in its infancy, and unfortunately a lack ofcollaboration in the industry during its development failed to create an open ecosystemthat would accommodate heterogeneous devices and communication protocols. The lack ofcommon interface solutions and security standards has led to proprietary implementations ofprotocol stacks and firmware updates, and as a result, has significantly expanded the surfacefor malicious attacks and vulnerabilities.At its core, an end-node device normally consists of a CPU (central processing unit, which actsas a control unit), sensors, input and output modules, and a network processor together witheither a wired or wireless network front end. Many functions are often combined within a singleintegrated chip (IC) solution.The majority of current market solutions tend to employ MIPS- or ARM-based chipsets and torun flavors of Linux. This feature was most probably dictated by the availability of ready-madedevelopment solutions and tool chains (groups of programming tools that are used in series tocreate a product), which were adopted from set-top boxes, routers, and NAS (network-attachedstorage) devices.For example, a first-generation Nest thermostat uses an AM3703 Sitara processor 139 from TexasInstruments. The thermostat is based on the ARM Cortex-A8 architecture. The developmenttools include the Linux EZ Software development kit and the Android Development Kit for SitaraMicroprocessors. Both packages are available for download from the TI website and are freeof charge. These freely available development tool chains based on popular OSes, combinedwith relatively lower rates of power consumption, made this a lucrative processor for the IoTmarket. The first-generation Nest OS is based on Linux 2.6.37 and uses other free softwarecomponents. The firmware image is locked so it only accepts signed firmware updates. Nestalso provides unlocked firmware so it can accept unsigned firmware images. This allowed athird party to re-implement the basic logic of the thermostat as an open source project calledFreeAbode.Big appliance manufacturers, such as Samsung, GE, Whirlpool, and Bosch, are likely to followthis trend. Many also use proprietary systems based on Linux or other popular OSes; Bosch isthe driving force behind the idea of developing a universal and open-source smart model.The IoT continues to grow. It continues to capitalize on new opportunities in areas such assensor monitoring in traffic, railways, car-parks, the home, the local power grid, embeddedmedical devices (including wearable sensors), and computing. The areas for these applicationsinclude industrial robotics, automotive, factory automation, home security, agriculture, andmore. According to a Gartner projection made at the end of 2013, the number of connecteddevices (excluding PCs, smartphones, and tablets) is estimated to be around 26 billion in 2020.This, according to their projections, will far exceed the number of PCs, tablets, and smartphones(which is estimated to be around 7.3 billion units in 2020). 140 Over the next few years moredevices will incorporate multiple types of wireless connectivity, including Wi-Fi, ZigBee, Z-Wave,MiWi, and other proprietary protocols. Also, to satisfy the demand for micro power and alwaysonconnected sensors, and to simplify non-interactive automation nodes, there are many lowpower,low-cost Wi-Fi and processing modules fast coming to market.139http://www.ti.com/product/am3703.140http://www.gartner.com/newsroom/id/2636073.There seem to be two large groups of hardware platforms targeting the various fields of IoT.The first group can run any sort of Linux or Windows embedded OS. The second group consistsof less computationally intensive and power-hungry processors that are aimed at proprietaryor open-source real-time operating systems with a small memory footprint (for example RTOS,Micrium uC/OS-II, uC/OS-III, or TI-RTOS-KERNEL). This second group is even more fragmentedand tends to rely on proprietary software stacks and integrated development environments.There is an effort to bring homogeneity to the IoT ecosystem that is being driven by the ARMconsortium and its partners with the development of an event-driven MBed OS specificallytargeting low-power devices within the IoT realm. The solution rests on three pillars: as theMBed OS itself, the MBed device server (which acts as an MBed-powered IoT devices cloudaggregator and a portal for Internet applications), and a suite of MBed tools aimed at simplifyingthe development effort from the ground up to fully designed solutions. Most importantly,these solutions are open source and attractive to a large proportion of makers and thedeveloper community.47