QuestionQ36

Procedures and Methodology

Megan, a CHFI investigator, is investigating a complex breach at a cutting-edge IoT technology company that develops smart-home systems. The company's IoT devices have suffered a massive-scale breach, with many devices transmitting unauthorized data to an external server. The company uses a public cloud-based model to manage its IoT devices. Megan's unique challenge is that the breach did not occur through traditional IoT vulnerabilities: the devices were designed with state-of-the-art security features, yet the attacker bypassed every security measure. Which of the following is the most plausible method the attacker could have used to compromise the IoT devices?

  • A Used a botnet to flood the network with traffic
  • B Manipulated the Cloud API to gain unauthorized access
  • C Exploited weak encryption protocols in the company’s IoT devices
  • D Hacked into the TOR Bridge Node used by the company
Explanation

A cloud-management API can serve as the control plane for many IoT devices. An authorization or access-control weakness in that API can let an attacker obtain unauthorized access and operate devices at scale, bypassing protections implemented on the individual devices. OWASP identifies broken API authorization as a common source of unauthorized access to protected objects and functionality.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!