XPE General Topics, page-1041

security, pdf page 68 of the prospectus;

Security
The use of IoT technology in itself does not introduce any new risks above what is already
present in other IP enabled products. However it can become a problem due to the predicted
massive size of the unit numbers and the limited ability to update or patch software and
firmware in “things”. Many adopters of IoT devices will get them to work with minimal security
settings and default passwords then leave them alone. This means the fine tuning of security
parameters, the ongoing monitoring, and patching of the device is unlikely to be a common
occurrence. We see this today in many solutions connected to the Internet, for example baby
monitors and standalone IP video surveillance cameras where hackers take control of
“things” and use them for a multitude of sinister outcomes.
Xped style technology is exposed to security risks on a number of fronts:
 Internet - The Xped hub can be an Internet facing device that is susceptible to
hacking.
 Radio – The Xped DeB application, or the IoT stack in the thing, may be vulnerable
to NFC related spoofing leading to identity theft. This then opens up the devices and
things to unauthorised access.
 Firmware – The process of upgrading the IoT stack in the thing needs special
attention as the lack of automated upgrades can lead to out of date and insecure
code remaining on a device. On the other hand automated processes can be
hijacked to spread non desirable firmware to things in order to take over these
devices. A balance is required to provide the optimum security.

Security is normally an afterthought to the design phase. Xped have designed security into
the ADRC process, but until a comprehensive investigation (Penetration Test) of the Xped
solution is carried out it is hard to declare the effectiveness of security present in the current
solutions. After such a test it will be possible for Xped to mitigate against security flaws that
may or may not be found. This is planned to occur during the Xped technology development
roadmap. The outcome of this test cannot be predicted in this report.

They have it covered.