Beacons use basic technology; hence they can be compromised in various complex ways. Although most companies have developed strategies to protect their beacons against any attack, no one has found a comprehensive solution for beacon security. People are developing a solution to fix that problem.
Beacons are small-sized, embedded devices that transmit information in small quantities. They apply a radio frequency (RF) protocol using Bluetooth Low Energy (BLE) for the identification of proximity. When configured, beacons can use two beaconing protocol outlines, like Eddystone and iBeacon.
As beacons do not receive information, they release a signal with a detailed identifier that permits a particular, selected mobile application to assemble and send important information using a mobile application.
Assessing beacon security
Low-cost beacons that utilize the Physical Web (Eddystone URL) configuration are being used to deliver malicious attacks. The beacons can send these malicious attacks to users who are near these devices. Google chrome has introduced a change that allows the user to disable proximate notifications on the application.
Although this solution cannot fully eradicate these attacks as other applications can still receive information from Physical Web beacons, they can help reduce the risk. Therefore it is essential always to follow Physical Web beacons with precautions to prevent all the risks associated with the beacon security technology.
Examining the ecosystem of a beacon
Most beacon ecosystems consist of the following components:
These components of the beacon ecosystem broadly vary depending on the deployment of the products. It is essential to closely examine and test every element of the ecosystem in detail.
- Embedded device– It is vital to test whether the manufacturer’s code is well secured from interference and removal. The over-the-air (OTA) method can be used to update the device firmware of a beacon. Therefore, it is essential to carefully scrutinize if attackers can modify the device’s code or install another code on the device.
- Cloud web services – It is essential to test all devices and applications that communicate with cloud services. Check-in details how the end-user and management applications interrelate with the internet cloud services. It is significant to secure all the data stored in the cloud appropriately. Also, ensure that all API functions are properly authenticated and have no vulnerabilities that permit malicious attacks or access to unauthenticated data.
- Product management software– It can be installed in various ways, such as web services, mobile applications, or desktop applications. Therefore, it is essential to evaluate all the methods, including; encryption of data storage and communication, OTA information capturing, session management, etc.
- End-user mobile applications – They are intended to help the beacons. It is crucial to conduct mobile application testing thoroughly, such as authentication and session management, encrypted communication and storage, data collection, etc.
Why should your beacon security be a concern?
The implementation of beacons is rapidly moving from the introduction phase to serious business involving more money, third parties, and information most people are interested in.
In IoT devices, security is the second most essential thing. When a beacon is turned on and well-secured, that is the only time it efficiently does its job like proximity location, transmitting data via secure channels, or interacting with the actual world around a beacon.
How beacons are attacked
Every communication in Bluetooth beacon is decoded and happens clearly. Since beacons are promptly becoming gateways to complex connections, some people are increasingly using them in ways not intended resulting in attacks. Three processes can be used to attack beacons, and each process requires different kinds of defense mechanisms to protect the beacon from any attack. Beacons can be attacked through;
Piggybacking and Cloning
Piggybacking happens when hackers snoop at a beacon, capture its UUIDs, Majors, and Minors, and add them to their app without the owner’s consent. Hackers can rely on the beacon’s infrastructure in their application as most beacons transmit the same signal for several years. Although it becomes inconvenient to share the beacon’s infrastructure with strangers for free, it has no adverse effects on customers and doesn’t damage the application.
Whenever hackers capture a beacon’s information, they can also easily clone the beacon. Cloning involves copying the beacon’s configuration and setting it to another application, thereby misleading the users. This is devastating as the hacker controls where and when a beacon activates, but it still triggers app payments.
Hijacking
Beacons are set such that they only communicate but cannot encrypt the information sent to them. Therefore, when linking to a beacon and a hacker sees the password you used to connect, they can use or change it such that it becomes impossible to connect anymore. This gives the hacker complete control over your beacon putting your whole IoT infrastructure at risk.
Cracking
Even when a beacon is secured from remote attacks, someone can still probe the beacon’s memory by physically removing the beacon from the wall and opening it up. Although this type of attack has a low probability of occurrence, it is still essential to defend your beacon against this if you have a beacon that controls sensitive applications.
How to make beacons more secure
No one has been able to secure beacons from attacks as it is pretty tricky. Although many companies have developed strategies to protect their beacons from piggybacking and chip manufacturers’ defenses that protect a device from cracking, the efforts are worthless as they do not cover the entire data chain. Furthermore, no one has developed a mechanism that can protect devices from hijacking. As the beacon technology is brilliantly simple, you can use any of the two iBeacon security mechanisms below to efficiently secure your beacon from all kinds of attacks.
Secure Communication
Secure Communication protects beacons from hijacking. It is an beacon cyber protocol that uses Bluetooth Low Energy (BLE) and is supported by various devices. The entire communication channel is fully encrypted from the beacon to the managing device. A beacon customized with the Secure Connection is impossible to hijack as it has an end to end encryption and does not require the password to be sent between the SDK and the beacons. This secure communication channel is managed through the SDK or Proximity API. Any beacon with this communication channel is adequately secured from any attack. This is because the device is efficiently protected against any malicious attack that hackers may try to exploit.
Software Lock
The software lock can secure all our beacons against direct cracking. Any attempt to access a device’s memory installed with a software lock wipes off all data in the memory. Although the simple beacon configurations remain available, the cracker cannot access any other information. When a software lock is installed in your beacon, you can be assured that your infrastructure is safe. Initially, we used to have this service in all our beacons, but we now do this only when customers need it as some develop the firmware by themselves.
Using Secure UUID to secure iBeacon advertising
Secure UUID is a security mechanism that safeguards a beacon’s real ID. It gives you improved control over access to the beacon’s signal. It is an optional added layer of beacon security that can be enabled easily at any time. It is recommended for the deployment of every beacon.
During manufacturing, a unique beacon key can be allocated to each beacon. The key can only be recognized by the beacon or the IoT cloud platform. When encrypting and decrypting the beacon’s visible ID, the secure UUID algorithms use a beacon key along with its most recent rotation timestamp.
Since the beacon is liable for encryption, it creates a new visible beacon ID according to its unique rotation interval. The beacon transmits the new visible IDs in an iBeacon packet. Decryption occurs in the cloud that resolves the beacon key, thereby exceptionally recognizing the beacon. There is an iOS/Android device between the beacon and the cloud. The device listens to the beacon’s visible IDs and links with the cloud to discover the real ID of the beacon.
As the device only acts as a proxy, it cannot recognize the beacon key. Hence, a malicious party can easily remove the key from your app and decrypt any beacon’s visible ID in the future. This can be prevented by setting the decryption in the cloud, although the secure UUID must have an active internet connection to work.
What’s next on protecting your beacons
If you are looking for a way to secure your beacons from any attack, then you are in the right place. MOKOSmart is a global frontrunner with highly quality Bluetooth beacons. Always feel welcome to visit or contact us for further assistance.
