Another look at TLS ecosystems in networked devices vs. Web servers

Abstract

High-speed IPv4 scanners, such as ZMap, now enable rapid and timely collection of TLS certificates and other security-sensitive parameters. Such large datasets led to the development of the Censys search interface, facilitating comprehensive analysis of TLS deployments in the wild. Several recent studies analyzed TLS certificates as deployed in web servers. Beyond public web servers, TLS is deployed in many other Internet-connected devices, at home and enterprise environments, cyber physical systems, and at network backbones. In Apr. 2017, we reported the results of a preliminary analysis based on measurement data of TLS deployments in such devices (e.g., routers, modems, NAS, printers, SCADA, and IoT devices in general) collected in Oct. 2016 using Censys. We also compared certificates and TLS connection parameters from a security perspective, as found in common devices against top Alexa sites. Censys has evolved since then and its data volume has increased with the addition of several new device types. In this paper, we perform a similar but more comprehensive measurement study to assess TLS vulnerabilities in devices, and compare our current results with our 2016 findings, showing how such systems have evolved in the last one and half year. Indeed, there are noticeable improvements in the TLS ecosystem for devices, especially in terms of adoption of TLS itself (from 29.4% in 2016 to 73.7% in 2018) and stronger cryptographic primitives. However, we also note the continuity of significant weaknesses in devices for which immediate remediation is warranted (e.g., the use of known private keys, SSLv3, MD5-RSA, and RC4). We have also contacted the top manufacturers of vulnerable devices to convey our findings. Most of them blamed users for not updating their devices with latest firmware images that apparently would mitigate the reported findings.

Easing the Conscience with OPC UA

“…Different works examine TLS deployments, i.e., the TLS and certificate configuration of Internet-facing embedded devices [57], the spread of flaws in key generation [27] or TLS implementations [61], and the shift to newer versions and features [1]. Further, related work analyzed security certificates regarding configuration [32], validity [7], wrong issuance [38], and certificate transparency logs [22].…”

“…However, until now, it is unclear whether system operators adhere to such security recommendations and therefore prevent unauthorized access to modern industrial deployments. In other domains, active Internet-wide scanning has proven to be a valuable and accepted method to perform this task [23,31,57,61]. Likewise, different works identify the risks of Internet-connected industrial devices using legacy protocols without security functionality [3,20,44].…”

IoT Vulnerability Scanning: A State of the Art

“…Even scanners that are tweaked to discover such devices do not usually account for many devices due to the large variety of them [3]. Therefore, scanning such devices constitutes a great challenge that has been addressed in the literature by several works [1,3,17,25].…”

“…Others provided home users with clarified request to approve the collection of user-triggered vulnerability scanning data [11]. Other works claimed that they only queried (Passive scanning) Shodan and Censys without performing any active scanning [1,25]. The rest of the studied works either used their equipment in their networks or did not mention ethical considerations.…”

“…Moreover, Bureau Veritas, a leading certification company, has recently targeted the certification of IoT devices by performing security assessments using IoT vulnerability scanning techniques to improve the market value of their customers' products [17]. In addition to that, proactive vulnerability scanning has been utilized to improve the security posture of the TLS certificate ecosystem [25].…”