Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

1/22/2015
05:20 PM
Liviu Arsene
Liviu Arsene
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
50%
50%

The Internet of Abused Things

We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.

IP-enabled devices have become much more than just a fashion or trend; they’re now a necessity that’s being consumed by millions worldwide. According to Gartner, more than 4.9 billion connected devices are forecasted to be in use by 2015, irreversibly disrupting society – for better or worse – as we know it.

Consumer technology has never seen such a whirlwind of low-cost and mass-sale Internet-connected devices, raising the question of whether companies are only interested in driving sales and not necessarily in the security implications. You probably know the answer by now, as you may have already heard about firmware vulnerabilities in IP cameras or hacked baby monitors. Will this be the future?

“Smart” Everything

Chips can now be built into any device to make them “smart,” Internet-connected, and fully remote controlled via mobile. Devices that we have always wanted to talk back to us (or to control from distance) are now a reality. Technology has never before had the potential of making our lives simpler and better.

Car companies have already begun adding systems and technologies designed to make vehicles more autonomous, ranging from self-parking to constant Internet connectivity. Just imagine your car dropping you off in front of the mall and then going on its way to find a parking space. Building a smart car may solve everything from being stuck on a highway for hours at a time to getting home without being pulled over by a police officer. But could these be the world’s most hackable cars?

Daily household appliances are also starting to be endowed with “smart” skills. Imagine a world where your coffeemaker tells the toaster to get the toast ready, because coffee is almost done. At the same time, the smart fridge is ordering milk and eggs because it noticed you’re running out; and all this “chatter” happening while you’re still lying in bed.

Smart technology such as smartbands, smart watches, smart clothes, pacemakers, thermostats, and even smart homes will be a significant part of our lives and will help augment every aspect of our activities or health. But if we’ve learned anything from decades of Internet-connected PCs, it’s that the more interconnected technologies you have, the more someone is interested in controlling them.

Beware the Evil Eye

The amount of information that interconnected devices could be broadcasting is simply staggering, not to mention that it’s your own body and activities producing much of it (biometrics, location, etc.). Imagine what would happen if someone were to tap into all your personal data to constantly watch or profile you.

The evil eyes of cybercriminals could instantly turn to your smart devices, because there’s always a way to profit from information. For instance, if your smart car or smart house is being held “hostage,” you could end up paying ransom for its “release.”

In a more dangerous scenario, hacking entire fleets of smart cars could not only jeopardize human lives but also cause other serious problems. Getting stuck in traffic is already an issue, but imagine not going anywhere because your car either refuses to accept your commands or it just decides to crash into the guy in front of you.

Interconnectivity (or better yet, poor security) could be the Achilles heel for the IoT. The vertical and horizontal expansion of smart devices can only mean more information, more power, and more money for cybercriminals.

Is There Any Hope?

In the wake of this revolution – with some 25 billion smart devices estimated by 2020, according to Gartner – some companies have realized the potential dangers and have begun looking for better ways to toughen security, or at least investigate better security practices that could make it harder for someone to tap into the data being broadcast by smart devices.

The undoing of IP-enabled devices could be the lack of timely firmware updates that plug vulnerabilities. Although today’s incentive model for manufacturers is not high enough, it might be stimulated by the rise of attacks, vulnerabilities, and customer demand.

The Internet of Things will ultimately envelope our way of life (if it hasn’t done so already), and thankfully there is still hope for better security mechanisms. Rapid deployment of new code for patching vulnerabilities in smart devices will not only be required, but also necessary.

Securing smart home appliances, for example, will probably be solved by enforcing security at the gateway level. Having some sort of security appliance that’s able to shield your home network from outside attacks could be the next big thing.

Whatever the future may bring in terms of abusing the IoT, one fact remains clear: If we are to continue on this path, we need to protect ourselves from the potential consequences.

Liviu Arsene is a Global Cybersecurity Researcher for Bitdefender, with a strong background in security and technology. Researching global trends and developments in cybersecurity, he focuses on advanced persistent threats and security incidents while assessing their impact ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29430
PUBLISHED: 2021-04-15
Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it mak...
CVE-2021-29431
PUBLISHED: 2021-04-15
Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform a...
CVE-2021-29432
PUBLISHED: 2021-04-15
Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.
CVE-2021-29447
PUBLISHED: 2021-04-15
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has be...
CVE-2021-30245
PUBLISHED: 2021-04-15
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to ...