Keynote: The "F" in IoT Stands for Future-proofing

Keynote: The "F" in IoT Stands for Future-proofing

Speakers: Yossi Oren, Head of the Implementation Security Lab, Ben-Gurion University

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=hA1gPqxUYxA

Overview

In his compelling keynote at Hardwear.io USA, Yossi Oren, Head of the Implementation Security Lab at Ben-Gurion University, tackled a critical yet often overlooked challenge in the realm of Internet of Things (IoT): future-proofing. The talk, provocatively titled "The 'F' in IoT Stands for Future-proofing," argues that IoT devices possess a unique lifespan problem – their physical utility often far outlasts the support, or even existence, of the companies and cloud services that enable their "smart" features. This fundamental mismatch creates a ticking time bomb of security vulnerabilities, functional obsolescence, and environmental waste.

Oren, drawing from his extensive experience in both academia and industry, highlighted that the security posture of IoT devices inevitably degrades over time due to evolving attack techniques, unsupported cloud infrastructure, and even user misconfigurations. He posits that hardware hackers, with their inherent skepticism and ability to "break" systems, are uniquely positioned to not only identify these vulnerabilities but also to drive solutions that ensure IoT devices remain secure and useful for generations. The keynote wasn't just about identifying problems; it presented a call to action, outlining concrete strategies for both manufacturers and the security community to build and maintain future-proof IoT ecosystems.

The core message resonates deeply within the hardware security community: devices that are designed to last physically must also be designed to remain functional and secure, independent of ephemeral corporate support. This perspective shifts the focus from short-term product cycles to long-term sustainability and user autonomy, advocating for open standards, local control, and comprehensive documentation as pillars of resilient IoT infrastructure.

Background

▶ Watch: Introduction and the role of 'breakers' (0:00)

The pervasive integration of IoT devices into our daily lives, from smart cars to home appliances, has revolutionized convenience but simultaneously introduced complex security and longevity challenges. Yossi Oren set the stage by illustrating this with a seemingly mundane yet highly relevant example: the garage door opener. He classifies it as a quintessential IoT device, possessing sensors (RF receiver), actuators (motor), computation, and connectivity. While a simple device, it perfectly encapsulates the vulnerabilities inherent in the broader IoT landscape when modernization efforts are poorly executed.

OOren demonstrated how users, seeking to enhance functionality or replace lost remotes, often turn to solutions like the Fingerbot. This device, essentially an IoT button pusher, is mounted over a physical button (e.g., the manual release on a garage door opener), connecting the previously isolated device to a cloud-based ecosystem. While this adds "smart" features like smartphone control or integration with other smart home systems, it drastically expands the attack surface. Oren pointed out that many of these Fingerbot vendors (e.g., UNSH, High Mojo, Mo) do not operate their own cloud infrastructure but instead rely on mega-scale, often Chinese, IoT cloud operators like Tuya. This introduces a chain of trust involving multiple third parties, each presenting potential risks to Confidentiality, Integrity, and Availability (CIA). Beyond official network interfaces, hardware-level attacks like fault injection, side-channel analysis, or flash memory readout become viable, potentially compromising the entire system.

This leads to Oren's central concept: the "success popularity mismatch" inherent in IoT products. Unlike traditional consumer electronics that eventually fade from use, IoT devices, such as vacuum cleaners, lawn mowers, respirators, or refrigerators, often have a physical useful life of 10-20 years. However, the companies manufacturing them, or the cloud services they rely on, may vanish due to supply chain disasters, legal issues, competition, or strategic pivots (e.g., Google killing a product line). When a company shuts down, its servers go offline, rendering "smart" features inoperable. Worse, domain names can be re-registered by malicious actors, potentially turning once-useful devices into botnet participants or malware distributors. Even if community-driven efforts emerge to maintain services (like the Renault Fluence EV example), the underlying software and hardware are constantly exposed to improving attack techniques. Furthermore, the "human element" contributes to degrading security over time, as users inadvertently tamper with settings, revert to defaults, or neglect updates. This results not only in security risks but also significant sustainability issues, transforming expensive, physically functional devices into "bricks" that must be discarded, despite their core components being perfectly viable.

Key Findings

▶ Watch: IoT devices must be secure as long as useful (12:00)

Yossi Oren's keynote delivered several critical findings and propositions regarding the future of IoT security and sustainability:

• IoT devices must be secure as long as they are useful: This is the foundational principle. Given the long physical lifespan of many IoT devices, their security and functionality cannot be tied to the ephemeral existence of a single company or cloud service. They must be designed to withstand the test of time, evolving threats, and corporate obsolescence.
• The "success popularity mismatch" is a unique IoT challenge: Oren highlighted that the traditional product lifecycle graph doesn't apply to IoT. Companies may cease to exist, but a significant installed base of their products remains in use, creating a vulnerability gap where devices are unsupported but still operational. This mismatch leads to both security risks (unpatched vulnerabilities, malicious domain takeovers) and environmental waste (devices becoming expensive "bricks").
• Security posture degrades over time: As attack techniques (software, hardware) continuously improve and human users inadvertently misconfigure devices, the average security posture of an IoT device naturally worsens with age. This necessitates proactive design strategies to counter this decay.
• Hardware hackers are uniquely positioned to solve this problem: Oren championed the "breaker" mindset – those who "take nothing for granted," "don't believe the specs," and "avoid the warranty" – as essential for future-proofing. Their ability to assert ownership and control over devices can be leveraged to build more resilient systems.
• Three pillars for future-proofing IoT: Oren proposed three actionable strategies for both builders and breakers:

1. Save your actuators: Design devices to separate core, useful functionalities (sensors, actuators) from ephemeral, cloud-dependent "gimmicks." This allows the essential hardware to remain functional even if the "smart" features become obsolete.
2. Enable local network control (but do it right): Prioritize secure, user-controlled local access to devices, reducing reliance on central cloud services. This involves implementing robust authentication mechanisms that are difficult to bypass or clone.
3. Document everything (for humans and AI): Encourage comprehensive documentation of hardware designs, code, and firmware. This ensures future generations, including AI-powered analysis tools, can understand, maintain, and adapt these devices.

Technical Deep Dive

▶ Watch: First future-proofing solution: Save your actuators (19:30)

Oren delved into specific technical considerations and design philosophies for achieving future-proof IoT. He began by elaborating on the Fingerbot example, underscoring how a seemingly simple "modernization" can introduce profound security risks. The Fingerbot, an IoT button pusher, connects an otherwise isolated device to a vast, often opaque, cloud ecosystem. Many Fingerbot vendors, such as UNSH, High Mojo, and Mo, don't host their own cloud infrastructure but instead leverage large, third-party IoT providers like Tuya. This multi-layered dependency means users must trust not only the Fingerbot hardware vendor but also the mega-cloud operator, their home router's security, and the entire chain, drastically expanding the attack surface for CIA (Confidentiality, Integrity, Availability) breaches. Beyond network attacks, the physical accessibility of such devices makes them vulnerable to unofficial interfaces like fault attacks, side-channel analysis, and direct flash memory readout, potentially exposing sensitive data or enabling arbitrary control.

The first proposed solution, "Save your actuators," is a design philosophy for manufacturers. Oren suggested that IoT devices typically combine genuinely useful features (e.g., a shaver's motor, a garage door's opener) with "gimmicky crap" (e.g., competitive shaving features in the Philips Groom Tribe app). To future-proof, designers should consciously isolate these two categories. His conceptual schematic illustrated this with two distinct integrated circuits (ICs): one IC controlling motors and sensors (the essential, long-lived components) and another IC handling cloud connectivity, AI, and ephemeral features. The key is to introduce jumper blocks or similar physical separation mechanisms between these ICs. This design choice, while requiring foresight, allows future users or community projects to bypass or replace the obsolete "gimmick" IC while retaining full control over the core, useful hardware functions. This approach directly leverages "breaker skills" by designing in points for future access, such as exposing GPIO pins, JTAG interfaces, or debugging consoles, enabling direct command injection or alternative control mechanisms.

The second pillar, "Enable local network control (but do it right)," addresses the over-reliance on cloud services. Oren emphasized that adding Wi-Fi to a device is now incredibly cheap (under a cent for a chip). He categorized existing local access implementations into three classes:

1. Unrestricted Local Access: Devices that allow control simply by knowing their IP address. This is problematic because any compromised device on the local network can then control the IoT device. Oren specifically called out obfuscated passwords (e.g., a well-known function calculated on a device's MAC address or serial number) as effectively "unrestricted local access with extra steps" because they are easily reverse-engineered and published.
2. Enabled Local Access: Requires physical presence and often cloud authentication to switch the device into a local control mode. This provides user consent and an opportunity to warn users about risks. However, Oren cynically noted that users are unlikely to take advanced security measures like VLANs to isolate such devices.
3. Hardware-Bound Access Tokens: This is Oren's recommended, most secure approach. It involves granting access tokens that are bound to a specific host, for a specific purpose, and for a limited duration. Crucially, these tokens are tied to the hardware characteristics of the host device using hardware binding mechanisms. This means even if an attacker reads out the RAM of a running device and clones it, the token should not work. Simple measures like using a MAC address for binding can significantly harden against software attacks, while more advanced techniques like Physically Unclonable Functions (PUFs) offer even stronger binding. This approach ensures that exploiting the connection requires taking over the host computer itself, which presents a much higher bar for attackers.

Finally, Oren stressed the importance of "Documenting as much as we can." He urged manufacturers to expose every possible detail about their hardware design, even if incomplete or partial. This includes releasing schematics, code listings, open-sourcing parts of the design, binaries, and firmware updates. The critical insight here is that this documentation is no longer just for human engineers but also for AI. With the advent of multimodal AI capabilities, these systems can analyze PDFs, schematics, and even video. By providing these artifacts, future generations and AI tools will be able to understand, troubleshoot, and adapt existing hardware, significantly extending its useful life. Oren playfully remarked that hackers are "the best in the world in producing bad documentation" (blog posts, analyses), suggesting that continuing these habits, now with a conscious effort to make them available, will be invaluable for AI training and future community support.

As a practical example of his vision, Oren highlighted the open-source projects Home Assistant and ESP Home. Home Assistant is a powerful, open-source home management software that integrates diverse IoT devices, offering local control, robust security, and extensibility through integrations. Its open-source nature provides agency for the community to improve security. ESP Home is a custom firmware for ESP32 microcontrollers that integrates seamlessly with Home Assistant. It allows users to connect GPIOs to various components, enabling them to bring "dumb" devices into their smart home ecosystem with over-the-air updates and good security. Oren detailed three recent additions to ESP Home's capabilities:

• Infrared remoting: Connecting an IR LED to an ESP32 GPIO allows control of any IR-controlled device (e.g., air conditioners), with local control and data collection.
• RF control: Using an CC1101 RF chip with an ESP32 enables control over devices operating in the 300-400 MHz range, particularly those with weak security vulnerable to brute-force attacks (e.g., older garage door openers, transport cards).
• Serial proxying: Connecting an ESP32 to a device's serial line allows it to be brought under local control, understood, and upgraded, effectively "connecting it to the cloud, your way."

These tools exemplify how breaker skills can be repurposed for beneficial, sustainable outcomes, allowing communities to take over maintenance and extend the life of devices.

Demo / Proof of Concept

▶ Watch: Second solution: Enable secure local network control (23:00)

While the talk did not feature a live, hands-on demonstration of a specific exploit or tool developed by the speaker's lab, Yossi Oren masterfully used real-world examples and existing open-source projects to illustrate his core arguments and proposed solutions. He effectively "demonstrated" the problem through the illustrative case of the Fingerbot and its integration with the Tuya cloud ecosystem, highlighting the security risks introduced by such modernization efforts.

For proving the concept of future-proofing, Oren pointed to the robust and active communities around Home Assistant and ESP Home. He showcased these as living, open-source proof-of-concepts for how local control, community-driven development, and user agency can extend the life and enhance the security of IoT devices. The discussion around ESP Home's capabilities, such as infrared remoting, RF control (using chips like the CC1101), and serial proxying, served as a conceptual demo of how hardware hackers can leverage their skills to connect otherwise isolated or obsolete devices to a modern, secure, and user-controlled ecosystem. These examples, though not a live hack, powerfully demonstrated the practical application of his future-proofing principles.

Defensive Implications

▶ Watch: Practical future-proofing with Home Assistant & ESPHome (30:00)

Yossi Oren's keynote provides crucial defensive implications for various stakeholders in the IoT ecosystem:

For IoT Manufacturers and Product Designers:

• Design for Longevity and Isolation: Manufacturers must consciously separate core, useful actuators and sensors from ephemeral, cloud-dependent "gimmick" features. Implementing physical isolation (e.g., via jumper blocks between ICs) and exposing secure, documented local interfaces (GPIO, JTAG, serial) will enable future maintenance and adaptation.
• Prioritize Secure Local Control: Integrate robust local network control mechanisms from the outset, moving away from exclusive cloud reliance. The ideal implementation involves hardware-bound access tokens that tie access to specific hosts, purposes, and times, leveraging hardware characteristics like MAC addresses or PUFs to prevent cloning and unauthorized software access.
• Embrace Open Documentation: Proactively release detailed hardware schematics, code listings, open-source components, binaries, and firmware updates. This data serves not only future human maintainers but also enables AI-driven analysis for long-term support and understanding.
• Consider Open-Source Foundations: Explore building new products or components on open-source platforms like ESP Home or designing for seamless integration with Home Assistant. This offloads long-term support to a community and provides inherent transparency and agency for security improvements.

For Consumers and IoT Device Owners:

• Exercise Caution with "Smart" Upgrades: Be highly skeptical of third-party "modernization" solutions (like Fingerbots) that connect existing devices to unknown cloud ecosystems. Understand the hidden security risks and expanded attack surface these introduce.
• Demand Local Control: Prioritize purchasing IoT devices that offer robust, secure local network control options, reducing dependence on remote cloud services that may eventually become obsolete or compromised.
• Leverage Open-Source Home Automation: Utilize platforms like Home Assistant to integrate and manage existing IoT devices. This empowers users to take control of their data, maintain functionality, and potentially extend the life of devices that would otherwise become "bricks."
• Understand Obsolescence Risks: Be aware of the "success popularity mismatch" and the inherent risks of unsupported IoT devices. Plan for eventual replacement or community-driven solutions.

For Security Researchers and "Breakers":

• Shift Focus to "Pone for Good": Beyond identifying vulnerabilities and achieving arbitrary code execution ("pone"), researchers should consider how their skills can be used to enable future-proofing. This includes developing methods to connect pwned or unsupported devices to open-source platforms like ESP Home or Home Assistant.
• Contribute to Open-Source Projects: Actively participate in and contribute to open-source hardware and software projects (e.g., Home Assistant, ESP Home) that aim to provide long-term support and enhance the security of IoT devices.
• Continue "Bad Documentation" (for AI): Maintain the practice of publicly documenting vulnerabilities, reverse engineering efforts, and hardware analyses through blog posts, conference talks, and online repositories. This "bad documentation" now serves as invaluable training data for future AI systems that will aid in understanding and maintaining legacy hardware.
• Educate and Advocate: Play a vital role in educating the public, industry, and policymakers about the long-term security and sustainability challenges of IoT and advocate for design principles that prioritize future-proofing and user agency.

Key Takeaways

• IoT devices must be secure and functional for their entire useful lifespan, which often spans generations, far exceeding typical corporate support cycles.
• The "success popularity mismatch" in IoT leads to widespread security vulnerabilities and environmental waste as companies and their cloud services inevitably vanish.
• Manufacturers should design for future-proofing by physically isolating core actuators and sensors from ephemeral "gimmicky" features and exposing secure local interfaces.
• Implementing hardware-bound access tokens for local network control is crucial for providing secure, user-controlled access to devices without relying on central cloud infrastructure.
• Comprehensive documentation (schematics, code, firmware), produced by both manufacturers and the hacking community, is essential for enabling future human and AI-driven maintenance and adaptation of IoT devices.
• Open-source platforms like Home Assistant and ESP Home offer practical, community-driven solutions for extending device longevity, enhancing local control, and improving the security posture of existing and new IoT hardware.

About the Speaker(s)

Yossi Oren is the Head of the Implementation Security Lab at Ben-Gurion University, where he leads research into the practical security of hardware and embedded systems. His lab is known for its work on implementation security and side-channel attacks, and has been credited with numerous CVEs and bug bounties. Oren emphasizes the importance of collaboration between academia and industry, recognizing that academics can provide critical, independent security assessments while industry insights can guide relevant research. He is a passionate educator, offering free online courses on implementation security and side-channel attacks, complete with online labs. Through his work, he aims to inspire and equip "breakers" – individuals with a natural inclination to dissect and understand systems – to channel their skills towards building more secure and sustainable technologies.