Security analysis and exploitation of arduino devices in the internet of things

Conference object, Unknown English OPEN
Alberca, Carlos ; Pastrana, Sergio ; Suarez-Tangil, Guillermo ; Palmieri, Paolo (2016)
  • Publisher: Association for Computing Machinery (ACM)
  • Related identifiers: doi: 10.1145/2903150.2911708
  • Subject: Linux distributions | Security analysis | Communications systems | Internet of Things (IoT) | Computer operating systems | Communication paradigm | Security systems | Proof of concept | Popular platform | Internet

The pervasive presence of interconnected objects enables new communication paradigms where devices can easily reach each other while interacting within their environment. The so-called Internet of Things (IoT) represents the integration of several computing and communications systems aiming at facilitating the interaction between these devices. Arduino is one of the most popular platforms used to prototype new IoT devices due to its open, flexible and easy-to-use architecture. Ardunio Yun is a dual board microcontroller that supports a Linux distribution and it is currently one of the most versatile and powerful Arduino systems. This feature positions Arduino Yun as a popular platform for developers, but it also introduces unique infection vectors from the security viewpoint. In this work, we present a security analysis of Arduino Yun. We show that Arduino Yun is vulnerable to a number of attacks and we implement a proof of concept capable of exploiting some of them.
  • References (8)

    [1] M. Banzi, D. Cuartielles, T. Igoe, G. Martino, and D. Mellis. Arduino o cial.

    [2] A. Baratloo, N. Singh, T. K. Tsai, et al. Transparent run-time defense against stack-smashing attacks. In USENIX, pages 251{262, 2000.

    [3] S. Bhatkar, D. C. DuVarney, and R. Sekar. Address obfuscation: An e cient approach to combat a broad range of memory error exploits. In USENIX Security, pages 105{120, 2003.

    [4] C. Doukas. Building Internet of Things with the Arduino. CreateSpace Independent Publishing Platform, USA, 2012.

    [5] A. Francillon and C. Castelluccia. Code injection attacks on harvard-architecture devices. In ACM CCS 2008, pages 15{26. ACM, 2008.

    [6] S. Gaitan, L. Calderoni, P. Palmieri, M.-C. Ten Veldhuis, D. Maio, and M. van Riemsdijk. From sensing to action: Quick and reliable access to information in cities vulnerable to heavy rain. Sensors Journal, IEEE, 14(12):4175{4184, Dec 2014.

    [7] N. Gershenfeld, R. Krikorian, and D. Cohen. The internet of things. Scienti c American, 291(4):46{51, 2004.

    [8] J. Habibi, A. Gupta, S. Carlsony, A. Panicker, and E. Bertino. Mavr: Code reuse stealthy attacks and mitigation on unmanned aerial vehicles. In IEEE ICDCS 2015, pages 642{652. IEEE, 2015.

  • Similar Research Results (2)
  • Metrics
    No metrics available
Share - Bookmark