Researchers Find Flaw in IoT Devices' Random Number Generator

guest · Aug 8, 2021

Researchers Find Flaw in IoT Devices' Random Number Generator
...a vulnerability that fails to properly generate random numbers, researchers report.
August 6, 2021
https://www.darkreading.com/iot/researchers-find-flaw-in-iot-devices-random-number-generator

A vulnerability in the foundation of Internet of Things (IoT) security affects billions of devices that have a random number generator (RNG), researchers with Bishop Fox disclosed this week.

Lead researcher Dan Petro and security consultant Allan Cecil, who will present their research at this week's DEF CON 29, say the RNG fails to properly generate random numbers and, as a result, undermines security for any upstream use.

"In order to remediate this issue, a substantial and complex feature has to be engineered into the IoT device."
As of 2021, most new IoT systems-on-a-chip (SoCs) have a dedicated hardware RNG peripheral that is designed to address this problem.
Click to expand...

The core vulnerability doesn't exist in a single device's SDK or in a specific SoC implementation, they explain. Researchers suggest the IoT needs a CSPRNG subsystem, which they define as a "cryptographically secure pseudo-random number generator (CSPRNG) subsystem" that is made available to applications as an API.
Click to expand...

You're Doing IoT RNG

There’s a crack in the foundation of Internet of Things (IoT) security, one that affects 35 billion devices worldwide. Basically, every IoT device with a hardware random number generator (RNG) contains a serious vulnerability whereby it fails to properly generate random numbers, which undermines security for any upstream use.

Okay, so devices aren’t checking the error code of the RNG HAL function. But how bad is it really? It depends on the specific device, but potentially bad. Very bad. Let’s take a look.
Click to expand...

Log in or Sign up

Researchers Find Flaw in IoT Devices' Random Number Generator

guest Guest

Log in or Sign up

Researchers Find Flaw in IoT Devices' Random Number Generator

guest Guest

Useful Searches