Security and Privacy in Informatics, Computing, and Engineering (SPICE), at Indiana University, hosts a Hackathon for students in partnership with the Cyber Security Club and the IoT House. The Hackathon was a two-night event held March 5th and 7th. Fifteen students attended in total. One student who attended, Olivia Kenny, said “I thought it was a great experience. I got to learn more about various attacks on IoT devices, plus free pizza is always great.”
On the first night, students went through a threat model analysis on various smart toys in Luddy Hall. This lead to an open discussion about various hacks and threats specific to the IoT devices. Then students participated in an activity where they used Bluetooth Low Energy (BLE) scanners to find the smart toys, called ClouldPets, which had been hidden on all four floors of Luddy Hall. These toys are easy to find in this manner, because designers labeled their identifier as ‘CloudPets’ on Bluetooth, and they can be detected from fifty feet away.
On the second night, students got to try their hand at hacking network printers at the IoT House. Using a variety of donated printers as targets, participants spent their time examining attacks that ranged in complexity. Some attacks were based on physical access to the printer, while others were made across a shared network. “Printers are often underestimated as devices that need protection on a network,” said IoT house manager and class leader, Joshua Streiff. “But they store data, can be used as jump-off points to other devices, or just be tricked into making users’ lives difficult.” At the IoT House, students were successful with denial of use attacks on these printers, while their attempts at data recovery showed promise before they ran out of time. Streiff explained,
Giving students opportunities to work on real-life projects, drives home classroom learning in ways that are very memorable and germinate ideas in a way that is hard to duplicate. When a student realizes that they can find a child’s toy from the distance of a neighborhood street to a child’s bedroom, they suddenly can feel just how dangerous bad design in IoT can be. It is an experience and impact that is hard to convey on a chalkboard or in a powerpoint slide.
SPICE is dedicated to giving students opportunities and experience with cybersecurity related issues. The IoT House is operated by SPICE through an NSF Grant. This Hackathon is a reflection of SPICE’s dedication to student opportunities and is held with students in Spring, Summer, and Fall semesters.