Security analysis of Cloud IoT services

Below is my analysis of Google’s “Cloud IoT Core” and Amazon’s “AWS IoT Core”, from a security perspective.

The “Core” service from both of these providers is very similar, and consists of a message broker that supports a publish/subscribe model. In both cases, it is possible for an external host to subscribe to messages, as well as to have messages sent to various compute resources within the respective provider’s cloud offerings. As the internals of these provider’s implementations are not available, this document makes no attempt to analyze the security within the provider’s network, but to evaluate the security concerning the communication between the individual devices and the service.

This is a bit unusual of a post, as it is more of a brain dump than a nicely written prose. I may fill this in over time.

TLS and why it is hard

• Introduction

  In an ideal magical world, TLS is a thing you drop into a connection and it becomes secure. Both parties just communicate as if they were read/write send/recv packets, but everything is secured.

  The problem is that, although the communication is “secure”, it is crucial that you know who you are talking to. Without this, the encrypted part of the communication is completely meaningless, as you may be communicating with your adversary.

Recently, I’ve been looking at using Amazon Glacier for some of my off-site backup needs. I already have a small amount of my data being stored in s3, and the lower cost of Glacier ($0.004/GB-month) make it a possibility for backing up even more data.

Since I intend for these backups to be fairly long time, I wanted to do a little analysis, comparing it with something like LTO-6. A LTO-6 tape drive looks to cost about $3000. There’s probably a little bit more cost involved for the needed SAS controller to be able to use the drive, but I’ll just use the $3k for my analysis here. Tapes (which hold 2.5TB, I’ll assume no compression, since most of my backup solutions will use already compressed data), run about $25, which amounts to $0.01/GB.

My regular job has me working, from time to time, with both Go and Rust. Both of these languages have a good following, and strong communities behind them, and there are things I enjoy about both languages.

For the most part, if I am writing a utility for personal purposes, I will choose one of these two languages (notably, not Python). Several of my projects, I find myself maintaining in both Go and Rust, because I can’t make up my mind as to which I prefer, or which is a better fit for the problem.

I have been paying for an Adobe Creative Cloud subscription for around a year now. In order to help justify this expense, I’ve given myself a goal to learn the other programs in the suite that I don’t yet use (I primarily use Illustrator, Photoshop and Acrobat).

I started with Premiere. Coming from Final Cut (before the “X” version which seems to have turned it into a toy), the user interface initially felt very different. However, even just going to one tutorial on manipulating the interface, it seems that Premiere and Final Cut are very similar programs. They both have a very similar model, and how it is presented mostly the same. After getting used to clicking on different things and a few different keyboard shortcuts, I’m able to make pretty good use of it.

I am unable to access the Adobe forums, at least if I am logged in with my Adobe account.

I thought I’d start by contacting Adobe Support. It seems that their support is only set up to help people with their applications, and they have nothing in place to help someone that is having a problem with their website.

• Vinay Pratap: Hello! Welcome to Adobe support.
• Vinay Pratap: We appreciate your patience and apologize for the wait.
• Vinay Pratap: Hello David,How are you doing today?
• David Brown: Good.
• Vinay Pratap: As I have understood that you need help with the
• Creative Cloud membership (one-year) subscription ? Is that correct ?
• David Brown: Well, roughly, are you able to see my initial question above? I am not able to access the forums, whereas the same link works for a friend with a similar CC account.
• Vinay Pratap: Could you please explain your exact issue ?
• David Brown: If I go to https://forums.adobe.com/thread/2124415 for example, I will get an error, for example Safari gives me:
• David Brown: Your file was successfully uploaded: Screen Shot 2017-10-10 at 8.48.32 AM.png.
  
• Vinay Pratap: Thank you let me check. David Brown: I’ve cleared cookies, and tried this from multiple computers.
• Vinay Pratap: https://forums.adobe.com/welcome Vinay Pratap: Please try to open the link to safari or Google chrome browser.
• David Brown: I get the same error on that welcome page. Chrome says: “This page isn’t working. forums.adobe.com redirected you too many times. Try clearing your cookies. ERR_TOO_MANY_REDIRECTS”. and I have tried clearing cookies.
• Vinay Pratap: May I know which adobe product are you using ?
• David Brown: Multiple, actually. It happens any time I google for help, and the answer is found on the forum. I use After Effects, Illustrator, Photoshop, Lightroom, Premiere, and Animate, mostly, though.
• David Brown: Those all seem to work find, and the CC file syncing stuff works great.
• Vinay Pratap: Please tell me the exact issue so I can help you further.
• Vinay Pratap: Please try to visit the the link to differnt browser.
• Vinay Pratap: Are we still connected?
• David Brown: I have posted the exact error, I have tried this in every browser I have, on multiple computers, and all give the same error.
• David Brown: The webpage gives me a redirect loop, which the browser then gives up on.
• Vinay Pratap: I am sorry we can only help with the adobe product if you are facing issue your browser please check your proxy or contact your IT team.
• David Brown: Your file was successfully uploaded: Screen Shot 2017-10-10 at 9.01.03 AM.png.
  
• David Brown: I have a direct connection, I have tried this in multiple locations, it is not on my end.
• David Brown: There is something wrong with the forum itself, which I would consider an adobe product.
• Vinay Pratap: Would you mind waiting for 2-3 minutes while I research this issue?
• David Brown: No problem, thanks.
• Vinay Pratap: Thank you
• Vinay Pratap: I would like to suggest you please check your Internet speed.
• David Brown: I have a gigabit internet connection. And, as I’ve mentioned, this happens no matter where I log in from.
• Vinay Pratap: http://www.adobe.com/
• David Brown: The main adobe page works fine.
• David Brown: It is only the forum.
• Vinay Pratap: Please try to login this link
• David Brown: That works fine.
• David Brown: Your file was successfully uploaded: Screen Shot 2017-10-10 at 9.09.49 AM.png.
  
• Vinay Pratap: click here
• David Brown: That gives me the problem loading page error.
• David Brown: Your file was successfully uploaded: Screen Shot 2017-10-10 at 9.12.28 AM.png.
  
• David Brown: Your file was successfully uploaded: Screen Shot 2017-10-10 at 9.13.23 AM.png.
  
• Vinay Pratap: Please try to login after some times.
• David Brown: I’ve posted a snapshot of the web debugger.
• David Brown: It has been this way for months.
• Vinay Pratap: Okay I am really sorry for the inconvenience.
• David Brown: Is there someone there you can forward this to, that perhaps manages the forums? I can access the forums by logging out, but it would be nice to be able to post my own questions.
• David Brown: Should I try contacting Jive Software? Perhaps this is a problem with them syncing data about my account?
• Vinay Pratap: Please disabled the add blocker and then ty to login this website.
• David Brown: I doesn’t matter if the ad blocker is disabled.
• David Brown: I’ve tried with browsers that don’t have ad blocks.
• David Brown: This happens with all addons disabled in the browser.
• Vinay Pratap: Please disabled the anti virus and try to open the link.
• David Brown: There is no anti virus software
• Vinay Pratap: Please try to use with the another computer or restart the computer and then try to login again.
• David Brown: I’ve done this on several different computers, on my tablet, and multiple places.
• David Brown: I’ve tried this from Mac OS, iOS, and Linux.
• Vinay Pratap: Please restart the computer and then try again.
• David Brown: This has been happening for months, and there have been reboots since then. I am not able to reboot my computer at this time.
• David Brown: It’s not going to help anyay.
• Vinay Pratap: I am sorry for the inconvenience I would like to suggest please contact your IT team and then try to open the link.
• David Brown: I am my IT team. This computer is at home.
• David Brown: It is a problem, probably between Adobe and Jive Software. Is there any way you can forward this issue to someone who might be able to look into the issue, rather than just the basics of clearing cookies, and rebooting, which I’ve already tried?
• David Brown: I’ve sent you logs of the network traffic, and I’m just getting a redirect chain from the Jive form server. It isn’t on my end.
• David Brown: I’ve sent a message to Jive, but they probably won’t help me since I’m not their customer, Adobe is.
• Vinay Pratap: We appreciate your patience and apologize for the wait.
• Vinay Pratap: Are we still connected?
• Vinay Pratap: Are we still connected?
• David Brown: Yes.
• David Brown: You have’t said anything other than “Are we still connected?”
• David Brown: (or is that automated message from your chat software)?
• Vinay Pratap: Please try to delete the cache and cookies.
• David Brown: I have done that.
• Vinay Pratap: I am sorry we are unable to help you in this issue please to open the link to another computer.
• David Brown: I actually tried all of those things before contacting support.
• David Brown: It fails on every computer I’ve tried it on. I’m pretty sure this problem is not on my end.
• David Brown: I give up.
• David Brown: I know you are likely supporting multiple people, but it kind of feels like you aren’t listening to what I’m saying.
• Vinay Pratap: I am sorry we can not help you with this issue please contact your IT and tell they will allow to access the all website.
• David Brown: Fuck off!
• David Brown: You’re just parroting the same things.

After going through a bunch of tutorials for the various Adobe Creative Cloud Suite, I have made my first animation.

• I drew the clock in Illustrator (which I’ve known for many years, at least 30), with each hand on a separate layer. This took about 20 minutes.
• Then, I animated the hands using After Effects. This took maybe another 20 minutes.
• Then, I brought that animation into Premiere Pro and made a sequence that repeated for 2 minutes.
• Lastly, I uploaded it to Youtube from within Premiere Pro.

For reference, this is the same clock animated with Adobe Animate:

This post summarizes the relevant RFCS (and other standards) related to cryptography and, specifically, relevant to MCUboot.

I intend to update this post with more RFCs as I refer to them in my work.

Last update: 2018-05-31

Cryptography

The following documents describe protocols and encodings relevant to digital signatures.

• RFC3447: Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1

• RFC4279: Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)

• RFC5208: Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification Version 1.2 (obsolete)

Update: After a little digging, I understand where the leading 0x00 comes from on the EC public key.

I’ve recently been working on the MCUboot project. A key feature of this bootloader is its use of digital signatures to verify images both before performing upgrades, and optionally, also before running them. The code currently supports RSA and ECDSA signatures, and we are working on adding support for EdDSA signatures (specifically Ed25519).

I’ve now been using an Amazon “t2.nano” EC2 instance for my web hosting. These are designed to allow “Burstable Performance”. Amazon has a few different descriptions from the simplistic:

T2 instances accrue CPU Credits when they are idle, and use CPU credits when they are active.

to a much more detailed explanation.

The later document says that the credits are processed at millisecond resolution. But, the free monitoring tools only sample at 5-minute granularity, so it is difficult to see anything of finer granularity than that.