Patching the Illusion: Safeguarding Embedded Linux IoT

Artem Karasev

October 18, 2023 - Senior Product Marketing Manager

The Internet of Things (IoT) market is growing rapidly. Investments in the IoT ecosystem will surpass $1 trillion in 2026, according to an International Data Corporation (IDC) Worldwide Internet of Things Spending Guide. Smart devices have become indispensable in many industries, including retail, shipping, mining, automotive, and healthcare. However, despite the rapid development of the smart systems market, there are still no unified cybersecurity standards in place. This raises concerns about the potential dangers of smart gadgets and how to protect against them. In this article, we will delve into the evolving landscape of embedded Linux IoT systems, exploring the current challenges, vulnerabilities, and best practices to safeguard these integral yet often underestimated components of our interconnected world.

The Myth of Inherent Security

A common myth surrounding embedded Linux IoT devices is the belief that open-source software inherently guarantees robust security. While Linux’s open-source nature allows for extensive scrutiny and rapid patching of vulnerabilities, it does not guarantee the security of IoT devices by default. Security in IoT depends on multiple factors, including proper implementation, regular updates, secure coding practices, and ongoing monitoring.

The misconception that Linux alone can make IoT devices impervious to threats can lead to complacency, neglecting essential security measures, and overlooking potential vulnerabilities. To ensure the security of these systems, a holistic approach that combines open-source advantages with rigorous security practices is essential.

Security Challenges Abound

IoT solutions for businesses encompass a vast array of technologies, communication protocols, and gadgets. Additionally, each individual project carries its own risks and threat model. Due to this diversity, it is practically impossible to establish a single security system that can be used across all IoT sectors.

There is also a lack of legislative framework regarding IoT security: equipment is not licensed, does not undergo audits, and regulators do not issue any certifications. Cybercriminals are well aware of these vulnerabilities. For example, in 2016, hackers exploited a vulnerability related to weak security in IoT devices, where manufacturers used identical passwords for all smart devices. The Mirai botnet disrupted the DNS provider Dyn’s servers, causing disruptions in the operation of numerous international services, including PayPal, Twitter, Reddit, Netflix, and others.

Corporate IoT devices are the weak link in a company’s defense. IoT solutions are actively used in urban planning, manufacturing, banking and insurance, aerospace, and telecommunications sectors. A cyberattack on any of these businesses can result in multimillion-dollar losses and, in some cases, pose a threat to people’s lives and health.

Attackers can use Linux-based systems as a foothold into a corporate perimeter while the IT security team might not even think to protect a device that contains no data of value. For example, a smart fish tank thermometer installed in a large casino’s aquarium once led to a cyber catastrophe: hackers hacked the device and gained access to the establishment’s internal network, stealing lists of key clients. Any IoT device can pose a danger if it is not adequately secured.

A Closer Look at the Risk Factors

Embedded Linux IoT devices exhibit several inherent shortcomings that pose significant security risks. Here are some key reasons why this technology is a major security concern:

These devices lack standardized interfaces and management systems. Consequently, it is nearly impossible to establish a unified security policy, update software, or even implement robust passwords without specific considerations for IoT security.
They operate on outdated or unsupported code architecture, firmware, or software, making them ineligible for security support or other updates.
Each additional device increases the attack surface. While mitigating this vulnerability is relatively straightforward with most familiar devices like phones and computers, the situation with IoT devices is not as simple.
Most organizations typically use a mishmash of various equipment, making it nearly impossible to manually inventory each individual device and track its activities.

These are some of the main reasons why hackers can easily compromise IoT devices running on embedded Linux in various industries and inflict damage by stealing personal data or intellectual property, or launching ransomware attacks.

Most IoT solutions are developed to enhance business efficiency and reduce costs. This is the main problem: project cost and economic efficiency take precedence, and cyber risks are often underestimated. However, even the simplest smart devices need to be well protected.

Security Essentials for Embedded Linux IoT Devices

Here is a list of key recommendations to follow to protect your organization from cyberattacks exploiting vulnerabilities in IoT devices:

Most organizations use weak default passwords that come pre-installed on IoT devices. This is because changing passwords can be challenging due to the sheer number of IoT devices that need management. So, when choosing IoT devices, ensure that you can easily change their passwords.
Ensure that the manufacturer of the device has provided a system update capability and continuously apply all possible updates. Following high-profile cyber attacks involving IoT devices, this issue has become especially relevant, and many manufacturers have started optimizing and releasing timely updates. You can use live patching solutions like KernelCare IoT to enable fully automated security updates for your IoT devices and Extended Lifecycle Support services for extended security maintenance of the systems that have reached their end of life.
Adopt the Zero Trust model where each device connecting to the network is evaluated based on the principle of “least privilege.” This can prevent attackers from moving laterally from the IoT device if they compromise it.

Overcoming Challenges for Business Gains

Today, much of IoT technology is still in its developmental stages, and – like any new technology – it continues to face numerous challenges and obstacles. IoT devices are unquestionably one of the weakest links in the corporate networks. However, companies are keenly interested in the rapid advancement of the IoT industry as it can help to significantly increase business efficiencies and reduce costs. The crucial point is that they need to understand the vulnerabilities in IoT security to effectively address them and reap the huge benefits this technology can provide.

Summary