Avast Blog_ViewPoints: The state of things in the internet of things

[harlan4096]

Security is not being designed into new smart devices because a rush to market takes precedence

Smart technology and the internet of things (we’ll call it IoT for business, and smart devices for the home) is developing fast, often with little or no built-in security. At home, seduced by the attraction of new technology, we buy and use these smart technologies with little or no understanding of the dangers they can bring.

A 2018 survey found that only 20% of users have a comfortable understanding of smart technology, and more than 50% are unconcerned about privacy issues. There's a failure of communication between the hardware innovators, the security industry, and consumers. Our understanding of what is and isn’t a smart device, how it interacts with the internet, and how it all correlates to our personal data is often hazy. Security is not being designed into new smart devices because the manufacturers’ rush to market takes precedence.

“Smart” implies two things: some processing capability and internet connectivity. Anything with a processor can be hacked; and anything with a processor and internet connectivity can be hacked remotely. It is the implication of this that gets left behind by manufacturers’ rush for profit, and our own rush for cred.

This applies to big smart devices and small smart devices; important devices and silly devices; devices inside the home and devices outside of the home.

Smart devices connect to our home networks to take advantage of the cloud. We often download an app to our phones to be able to control them conveniently and remotely. We probably also know some of the most familiar smart devices: Amazon’s Alexa speakers, robot vacuums like the Roomba, our smart and internet-connected TVs, and so on.

Big and important smart things

Our lives entrusted to smart

The possibility of widely available self-driving cars in the near future has captured our imaginations, but also fed our paranoia. A 2015 video demonstrated how hackers were able to hack into a smart Jeep Cherokee. The vehicle’s entertainment center was the only component directly connected to the cloud, but once that was compromised the hackers were able to take complete control of the vehicle, including steering, acceleration and braking, much to the driver’s terror.

Things haven’t improved much in the last few years. In 2018, a team of ethical hackers from China discovered and disclosed 14 security vulnerabilities in BMW cars that had been present since 2012.

Even scarier than our cars being hacked, medical devices like pacemakers, insulin pumps and vital signal monitors have been shown to be hackable, with potentially dire results. Readers may recall Gunnery Sergeant Nick Brody from the television series “Homeland.” Brody engineered the murder of Vice President William Walden by facilitating a pacemaker hack that increased Walden's heart rate until he had a heart attack. It’s not entirely implausible.

Third-party smart systems

It's not just our own smart devices that should worry us. Modern public surveillance equipment and CCTV networks are also smart devices. However, such devices that are meant to enhance our security can sometimes have the opposite effect. Many different connected camera systems have security vulnerabilities. This was demonstrated by security firm Senrio, which was able to execute what it called Rube Goldberg Attacks. Senrio first took complete control of a single security camera, then jumped to the connected router, then spread its control to the entire network. When the right vulnerabilities are present, a single device can compromise the entire network. And if that happens, who knows who is watching you, where, or why?

In April 2017, a hacker or hackers breached the Dallas outdoor warning system. This is a network of sirens designed to warn the public to stay indoors. They were activated over a dozen times in a two-hour period before and after midnight — until engineers succeeded in manually disabling them.

Electronic traffic alert signs have been a favorite target. Hackers have taken over the electronics and transmitted their own warnings: “Rogue Panda on rampage,” “Zombie attack! Evacuate,” and “All you f***s gon be late, LOL.”

Continue Reading