TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

IoT Security Anti-Patterns

1 post · Apr 2017 – Dec 2017

What this trail covers

Cloudflare is actively addressing security anti-patterns in Internet of Things (IoT) devices, focusing on challenges related to software updates and TLS implementation. The company is developing network-level filtering solutions to compensate for unreliable device patching and is advocating for the adoption of TLS 1.3 and Elliptic Curve Cryptography (ECC) to mitigate the overhead and certificate size issues associated with TLS in resource-constrained IoT environments. The post also highlights the introduction of Cloudflare Orbit, a private network solution that provides a security shield before devices, allowing for network-level patching of vulnerabilities and an extra layer of authentication via TLS Client Authentication handled at the edge.

All Cloudflare trails
  1. TLS 1.3 is going to save us all, and other reasons why IoT is still insecureThis post identifies two primary security anti-patterns in IoT devices: unreliable software updates and the challenges of implementing TLS. For software updates, it notes that end-users are often unaware of the need to update, devices may have limited update capabilities (low battery, lightweight firmware), and developers fear breaking devices. For TLS, it highlights the overhead of the handshake (especially with TLS 1.2), large certificate sizes due to RSA keys, and the fact that emerging IoT protocols like MQTT and CoAP are often plaintext by default. The post proposes network-level filtering as a solution for update issues and advocates for TLS 1.3 and ECC for improved TLS performance and reduced certificate size in IoT.
  2. IoT Security Anti-PatternsThis post identifies and details four security anti-patterns prevalent in IoT device development: 1. HTTP Pub/Sub without receiver validation leading to DDoS vulnerabilities. 2. Using self-signed TLS certificates on IoT devices instead of secure brokers. 3. Unencrypted bootloaders exposing sensitive data. 4. Using databases as inter-process communication (IPC) leading to lock contention and polling overload. It proposes mitigations for each, including using signed TLS certificates via brokers, hardware-based key storage for encrypted bootloaders, and message broker services with HTTP APIs instead of direct database connections.
  3. Introducing Cloudflare Orbit: A Private Network for IoT DevicesThis post introduces Cloudflare Orbit, a new product designed to secure IoT devices by providing a network-level security layer. Orbit acts as a shield before devices, allowing Cloudflare to filter malicious requests and apply security rules without requiring end-user intervention for device patching. It addresses the challenge of unpatchable or infrequently patched IoT devices by enabling IoT companies to write logic and firewall rules on Cloudflare's edge. Additionally, Orbit offers TLS Client Authentication, where Cloudflare's edge handles the TLS handshake and validates device client certificates, offloading this computationally expensive task from origin servers.