Overview

Deral Heiland is the IoT research lead at Rapid7, responsible for the company’s Internet of Things (IoT) practice area. He came into the role with more than a decade of experience as a security penetration tester and nearly 15 years of experience conducting security research across such areas as protocol-based attacks, embedded device exploitation and web vulnerabilities.

Deral focuses on the ecosystem around IoT – not just the device – helping to educate manufacturers about potential security risks in their products, enterprises about the risk IoT devices in their environments represents, and consumers about the risk they take on when using IoT devices.

In July, Deral published a report on Osram LIGHTIFY, citing nine issues affecting the Home or Pro versions, with the practical exploitation effects including the accidental disclosure of sensitive network configuration information. Deral worked with Osram to create a patch that helped configure the mobile app to prevent storing potentially sensitive information, such as WiFi PSKs and passwords in cleartext. With Deral’s assistance, Osram was able to patch the vulnerabilities.

In October, Deral discovered three vulnerabilities in Bluetooth-enabled trackers made by TrackR and iTrack that attach to a key ring or wallet as a way for consumers to locate things such as car keys or other small items. He found that these devices were not encrypted, and, as a result, communications could potentially be intercepted and read by third parties. While these vulnerabilities were not easily fixed, Deral helped TrackR develop a strategy to better protect its customers and ensure hackers could not listen in on their conversations or steal secure data. The company CEO praised his work and thanked the research team for helping to solve a potentially dangerous problem.