Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

06:40 PM
Connect Directly

Surge in Consumer-Grade IoT Devices Undermining Enterprise Security

Individuals and business groups are connecting everything from Amazon Echo devices to data-sampling sensors on networks with sensitive systems with little regard to safety, two reports show.

Enterprises are under growing risk from an explosion of often unmanaged, consumer-grade Internet of Things (IoT) devices on their business and operational technology (OT) networks.

For attackers, the devices — including Amazon Alexa and Echo as well as smart lights, smart meters, IP cameras, shop-floor sensors, and so on — are relatively easy targets for distributing malware, stealing data, triggering denial-of-service conditions, and causing other internal disruptions, according to two studies released this week.

One of the reports, from Ordr, is based on the company's analysis of data gathered from more than 5 million unmanaged IoT and IP-enabled medical devices between June 2019 and June 2020.

For the study, Ordr defined an IoT device as any network-connected device that was both unmanaged and did not have a network user account associated with it. Ordr collected its data from such devices on customer networks across multiple industries, including healthcare, retail, life sciences, and manufacturing.

The analysis showed that "IoT devices are pervasive and oftentimes owned and deployed by different business units — meaning facilities, operations, security, and IT — that are not considering the security risks inherent in these devices," says Jeff Horne, CSO at Ordr.

Many of these IoT devices are inherently vulnerable and either cannot be patched or need specific controls for securing them, he says. "Therefore, a resilient network segregation policy that is focused on the security risks of these devices is necessary in order to mitigate the inherent risks these devices bring to the network."

Ordr's analysis showed that a significant percentage of devices on its customer networks — between 15% and 20% — were unknown or unauthorized.

Amazon Alexa and Echo devices were among the most common of these consumer-grade shadow IoT tools. The devices were especially prevalent on healthcare networks, with 95% of them having Alexa and Echo on the same network as other sensitive medical devices. Researchers consider such voice assistants a security threat because of their ability to eavesdrop on conversations. In one instance, Ordr found a Tesla connected to the corporate network and, in another, a Peloton exercise bike.

One in five organizations that had unmanaged IoT devices on them had issues that potentially put them in violation of the payment-card industry's PCI data security standard. For instance, these networks had at least one IP-enabled retail device on the same subnet or virtual LAN as a printer, copier, tablet computer, or physical security devices, which is a violation of PCI requirements.

Nearly one in five (19%) of the organizations in Ordr's study had unmanaged Internet-connected devices running on unsupported Windows 7 or older operating systems. Many of these devices were healthcare-imaging devices such as MRI and X-ray systems, some even with Facebook and YouTube applications running on them. In some instances, Ordr researchers discovered point-of-sale systems running legacy operating systems as well, Horne says.

"If malware was installed on these devices through legacy OS vulnerabilities, they would likely be able to communicate with malicious servers if they were not blocked by firewall/IPS rules," he says.

More Than a Theoretical Threat
According to Ordr, the threat from these devices is more than just theoretical. The company's researchers identified vulnerable IoT products on enterprise networks being used for cryptocurrency mining and communicating with servers in high-risk countries such as Iran, North Korea, and Russia.

Horne says many organizations don't appear to have the ability to spot these devices on their network or to maintain an accurate inventory of them on an ongoing basis. "We've seen several TVs classified as generic Linux systems and the IT team doesn't really know that these TVs also contain camera and microphones in sensitive areas that can record and send and receive data."

The second report this week, from Nozomi, showed that shadow IoT devices present a threat not just to the corporate network but to the OT environment as well. According to Nozomi, IoT botnets were one of the fastest-growing threats to operational networks in the first half of 2020 because of the proliferation of IP-connected devices.

Moreno Carullo, co-founder and CTO of Nozomi, says it has become virtually impossible to find an OT network that also doesn't have several IoT devices connected to it, including security systems, sensors for building automation, and IoT devices for data sampling in the field.

"In general, IoT devices don't undergo the same security scrutiny as other OT/IT devices commonly found in a network," he says. They are often harder to update, inspect, and monitor for visibility. "For this reason, they can become a useful launching point for attackers, especially when they have Internet-facing services," Carullo says.

Attackers are actively trying to exploit these devices, he says. As one example, Carullo points to SNAKE, a relatively new ransomware family that packs what he describes as an "OT-awareness" capability. Among the many pointers to this fact were strings in the code that related to processes typically that are found in industrial control system environments. Nozomi also discovered that SNAKE is able to kill multiple processes including some that are specific to ICS.

"At the highest level, when it comes to mitigating IoT threats on OT networks, segmentation and monitoring are key," Carullo says. Organizations need to be careful about exposing IoT devices to the public Internet when possible. 

If an OT device does need to be connected to the Internet, organizations should first thoroughly assess the security posture of the connected device and implement proper monitoring. "It's also important to limit the services exposed for any IoT device to those strictly required for core functionality, even when the device is used on internal networks," Carullo says. "And verify with the vendor that any undocumented remote access mechanism is removed from production firmware."

Related Content:



Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Average Cost of a Data Breach: $3.86 Million
Jai Vijayan, Contributing Writer,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-05
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
PUBLISHED: 2020-08-04
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipm...
PUBLISHED: 2020-08-04
Extreme Analytics in Extreme Management Center before allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
PUBLISHED: 2020-08-04
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
PUBLISHED: 2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.