Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

1/22/2015
05:20 PM
Liviu Arsene
Liviu Arsene
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
50%
50%

The Internet of Abused Things

We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.

IP-enabled devices have become much more than just a fashion or trend; they’re now a necessity that’s being consumed by millions worldwide. According to Gartner, more than 4.9 billion connected devices are forecasted to be in use by 2015, irreversibly disrupting society – for better or worse – as we know it.

Consumer technology has never seen such a whirlwind of low-cost and mass-sale Internet-connected devices, raising the question of whether companies are only interested in driving sales and not necessarily in the security implications. You probably know the answer by now, as you may have already heard about firmware vulnerabilities in IP cameras or hacked baby monitors. Will this be the future?

“Smart” Everything

Chips can now be built into any device to make them “smart,” Internet-connected, and fully remote controlled via mobile. Devices that we have always wanted to talk back to us (or to control from distance) are now a reality. Technology has never before had the potential of making our lives simpler and better.

Car companies have already begun adding systems and technologies designed to make vehicles more autonomous, ranging from self-parking to constant Internet connectivity. Just imagine your car dropping you off in front of the mall and then going on its way to find a parking space. Building a smart car may solve everything from being stuck on a highway for hours at a time to getting home without being pulled over by a police officer. But could these be the world’s most hackable cars?

Daily household appliances are also starting to be endowed with “smart” skills. Imagine a world where your coffeemaker tells the toaster to get the toast ready, because coffee is almost done. At the same time, the smart fridge is ordering milk and eggs because it noticed you’re running out; and all this “chatter” happening while you’re still lying in bed.

Smart technology such as smartbands, smart watches, smart clothes, pacemakers, thermostats, and even smart homes will be a significant part of our lives and will help augment every aspect of our activities or health. But if we’ve learned anything from decades of Internet-connected PCs, it’s that the more interconnected technologies you have, the more someone is interested in controlling them.

Beware the Evil Eye

The amount of information that interconnected devices could be broadcasting is simply staggering, not to mention that it’s your own body and activities producing much of it (biometrics, location, etc.). Imagine what would happen if someone were to tap into all your personal data to constantly watch or profile you.

The evil eyes of cybercriminals could instantly turn to your smart devices, because there’s always a way to profit from information. For instance, if your smart car or smart house is being held “hostage,” you could end up paying ransom for its “release.”

In a more dangerous scenario, hacking entire fleets of smart cars could not only jeopardize human lives but also cause other serious problems. Getting stuck in traffic is already an issue, but imagine not going anywhere because your car either refuses to accept your commands or it just decides to crash into the guy in front of you.

Interconnectivity (or better yet, poor security) could be the Achilles heel for the IoT. The vertical and horizontal expansion of smart devices can only mean more information, more power, and more money for cybercriminals.

Is There Any Hope?

In the wake of this revolution – with some 25 billion smart devices estimated by 2020, according to Gartner – some companies have realized the potential dangers and have begun looking for better ways to toughen security, or at least investigate better security practices that could make it harder for someone to tap into the data being broadcast by smart devices.

The undoing of IP-enabled devices could be the lack of timely firmware updates that plug vulnerabilities. Although today’s incentive model for manufacturers is not high enough, it might be stimulated by the rise of attacks, vulnerabilities, and customer demand.

The Internet of Things will ultimately envelope our way of life (if it hasn’t done so already), and thankfully there is still hope for better security mechanisms. Rapid deployment of new code for patching vulnerabilities in smart devices will not only be required, but also necessary.

Securing smart home appliances, for example, will probably be solved by enforcing security at the gateway level. Having some sort of security appliance that’s able to shield your home network from outside attacks could be the next big thing.

Whatever the future may bring in terms of abusing the IoT, one fact remains clear: If we are to continue on this path, we need to protect ourselves from the potential consequences.

Liviu Arsene is a Global Cybersecurity Researcher for Bitdefender, with a strong background in security and technology. Researching global trends and developments in cybersecurity, he focuses on advanced persistent threats and security incidents while assessing their impact ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).