Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

1/22/2015
05:20 PM
Liviu Arsene
Liviu Arsene
Partner Perspectives
Connect Directly
Twitter
Google+
LinkedIn
RSS
50%
50%

The Internet of Abused Things

We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.

IP-enabled devices have become much more than just a fashion or trend; they’re now a necessity that’s being consumed by millions worldwide. According to Gartner, more than 4.9 billion connected devices are forecasted to be in use by 2015, irreversibly disrupting society – for better or worse – as we know it.

Consumer technology has never seen such a whirlwind of low-cost and mass-sale Internet-connected devices, raising the question of whether companies are only interested in driving sales and not necessarily in the security implications. You probably know the answer by now, as you may have already heard about firmware vulnerabilities in IP cameras or hacked baby monitors. Will this be the future?

“Smart” Everything

Chips can now be built into any device to make them “smart,” Internet-connected, and fully remote controlled via mobile. Devices that we have always wanted to talk back to us (or to control from distance) are now a reality. Technology has never before had the potential of making our lives simpler and better.

Car companies have already begun adding systems and technologies designed to make vehicles more autonomous, ranging from self-parking to constant Internet connectivity. Just imagine your car dropping you off in front of the mall and then going on its way to find a parking space. Building a smart car may solve everything from being stuck on a highway for hours at a time to getting home without being pulled over by a police officer. But could these be the world’s most hackable cars?

Daily household appliances are also starting to be endowed with “smart” skills. Imagine a world where your coffeemaker tells the toaster to get the toast ready, because coffee is almost done. At the same time, the smart fridge is ordering milk and eggs because it noticed you’re running out; and all this “chatter” happening while you’re still lying in bed.

Smart technology such as smartbands, smart watches, smart clothes, pacemakers, thermostats, and even smart homes will be a significant part of our lives and will help augment every aspect of our activities or health. But if we’ve learned anything from decades of Internet-connected PCs, it’s that the more interconnected technologies you have, the more someone is interested in controlling them.

Beware the Evil Eye

The amount of information that interconnected devices could be broadcasting is simply staggering, not to mention that it’s your own body and activities producing much of it (biometrics, location, etc.). Imagine what would happen if someone were to tap into all your personal data to constantly watch or profile you.

The evil eyes of cybercriminals could instantly turn to your smart devices, because there’s always a way to profit from information. For instance, if your smart car or smart house is being held “hostage,” you could end up paying ransom for its “release.”

In a more dangerous scenario, hacking entire fleets of smart cars could not only jeopardize human lives but also cause other serious problems. Getting stuck in traffic is already an issue, but imagine not going anywhere because your car either refuses to accept your commands or it just decides to crash into the guy in front of you.

Interconnectivity (or better yet, poor security) could be the Achilles heel for the IoT. The vertical and horizontal expansion of smart devices can only mean more information, more power, and more money for cybercriminals.

Is There Any Hope?

In the wake of this revolution – with some 25 billion smart devices estimated by 2020, according to Gartner – some companies have realized the potential dangers and have begun looking for better ways to toughen security, or at least investigate better security practices that could make it harder for someone to tap into the data being broadcast by smart devices.

The undoing of IP-enabled devices could be the lack of timely firmware updates that plug vulnerabilities. Although today’s incentive model for manufacturers is not high enough, it might be stimulated by the rise of attacks, vulnerabilities, and customer demand.

The Internet of Things will ultimately envelope our way of life (if it hasn’t done so already), and thankfully there is still hope for better security mechanisms. Rapid deployment of new code for patching vulnerabilities in smart devices will not only be required, but also necessary.

Securing smart home appliances, for example, will probably be solved by enforcing security at the gateway level. Having some sort of security appliance that’s able to shield your home network from outside attacks could be the next big thing.

Whatever the future may bring in terms of abusing the IoT, one fact remains clear: If we are to continue on this path, we need to protect ourselves from the potential consequences.

Liviu Arsene is a senior e-threat analyst for Bitdefender, with a strong background in security and technology. Reporting on global trends and developments in computer security, he writes about malware outbreaks and security incidents while coordinating with technical and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.