STEP IoTSF webinars on Default Passwords and Software Updates in consumer IoT devices

This is a copy of the slides and recordings from a UK NCSC and IoTSF effort. This relates to EN 303 645.

This is effort is canonically at https://www.iotsecurityfoundation.org/consumer-iot/.

There is an Introduction by Emily Taylor. [Note starts for real at 2:30, will re-edit]

• Slides on No Universal Default Passwords: PDF with animations, (ODP)
• Oct. 27 video with questions

• Slides on Software Updates PDF with animations, (ODP)
• Oct. 30 video with questions

Links from Passwords Resource slide

• Device Provisioning Protocol https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect
• Bootstrapping Remote Secure Key Infrastructure (BRSKI)
  • https://datatracker.ietf.org/doc/draft-ietf-anima-bootstrapping-keyinfra/
  • https://openconnectivity.org/developer/specifications/fairhair/
  • Also used in Thread
• Thread Commissioning
  • https://openthread.io/guides/build/commissioning
  • https://www.threadgroup.org/Portals/0/documents/support/CommissioningWhitePaper_658_2.pdf
• Amazon/Google IoT: https://www.trustonic.com/solutions/iot-security/automatic-cloud-enrollment/
• Intel Secure Device Onboarding (SDO) https://software.intel.com/content/www/us/en/develop/tools/secure-device-onboard.html
• FIDO IoT-WG: https://fidoalliance.org/specs/fidoiot/FIDO-IoT-spec-v1.0-wd-20200730.html
• Android10 + DPP: https://source.android.com/devices/tech/connect/wifi-easy-connect
• https://www.troyhunt.com/everything-you-ever-wanted-to-know/
• https://postmarkapp.com/guides/password-reset-email-best-practices
• https://en.wikipedia.org/wiki/RSA_Factoring_Challenge
• https://en.wikipedia.org/wiki/EFF_DES_cracker
• https://stormpath.com/blog/what-the-heck-is-oauth
• https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2
• https://www.supermicro.com/support/BMC_Unique_Password_Guide.pdf

Links from Software Update Resource slide

• https://datatracker.ietf.org/wg/suit/about/ and https://tools.ietf.org/html/draft-ietf-suit-architecture-11
• http://www.openmobilealliance.org/release/LightweightM2M/V1_0_2-20180209-A/OMA-TS-LightweightM2M-V1_0_2-20180209-A.pdf
• https://www.timesys.com/security/secure-boot-encrypted-data-storage/
• https://source.android.com/security/verifiedboot
• https://casualhacking.io/blog/2013/2/11/embedded-trust-p2-u-boot-secured-boot.html
• https://labs.f-secure.com/assets/BlogFiles/2020-05-u-booting-securely-wp-final.pdf
• https://www.youtube.com/watch?v=nT-TGvYOBpI https://www.blackhat.com/us-14/video/cybersecurity-as-realpolitik.html Dan Geer : Cybersecurity as Realpolitik by Dan Geer presented at Black Hat USA 2014 transcript