Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT/Embedded Security

// // //
8/2/2017
12:30 PM
Pawani Vaddi
Pawani Vaddi
News Analysis-Security Now

How Secure Are Your IoT Devices?

The IoT can be a huge attack surface: What are you doing to keep your smart devices free from stupid security faults?

In 1982, a modified Coca-Cola machine at Carnegie Mellon University became the first Internet-connected device. The vending machine could self-report its inventory and detect whether the newly loaded drinks were being kept cold. You've probably noticed: This type of technology is everywhere today. From fitness trackers to home security systems and smart kitchens, connectivity surrounds us. It's amazing how technology continues to evolve and transform our lives, increasing comfort and providing immense control over our daily routines.

A recent Gartner study says 8.4 billion connected things will be in use in 2017, and this number is estimated to reach over 20 billion by the year 2020. I believe we will continue to see a stunning variety of ordinary devices that are computerized and connected -- impacting how we work, play and live.

The Internet of things (IoT) is a dazzling industry where the possibilities seem endless. At the same time, we shouldn't let ourselves forget that these life-altering devices are, at their core, still computers. And for as long as computing devices have existed, there have also been ways to manipulate them for nefarious purposes. While it's true that the devices are getting smarter and more sophisticated, hackers and their tactics are advancing too. We must make a conscious effort to protect these devices and make sure we, as consumers, are safe in the connected world.


Get real-world answers to virtualization challenges from industry leaders. Join us for the NFV & Carrier SDN event in Denver. Register now for this exclusive opportunity to learn from and network with industry experts -- communications service providers get in free!

During development, the primary focus for IoT products has been to bring the greatest new technology to market. Unfortunately, this means IoT manufacturers aren't always diligent about implementing security at the manufacturing level. As a result, consumers are at risk.

Let's consider the destructive Mirai malware which made its notorious debut in 2016. Hackers targeted webcams and DVRs to enable a swarm of devices to create the botnet (a controlled network of computers infected with malicious software) which was then used to accomplish a distributed denial of service attack (DDoS). Webcams and DVRs are some of the forerunners in the IoT product realm, and weren't built with security in mind.

The IoT infrastructure, as it is stands today, is extremely vulnerable to attacks. As consumers, we must take precautions to keep ourselves and one another safe. Here are a few simple suggestions:

  • Change the default usernames and passwords on the devices immediately. You might be surprised at how many people skip this step, leaving the proverbial front door wide open for hackers.
  • Update to the latest firmware. Any time a device vulnerability is discovered, (reputable) companies push security patches to their customer base. It's very important to diligently update devices before the bad guys use a vulnerability as a gateway.
  • Consider using smart home WiFi solutions. Vendors such as Luma, Cujo and few others help scan home networks for potential malicious activity. Additionally, consumers should avoid connecting to public WiFi as much as possible. Instead, consider using secure WiFi (VPN) solutions to connect to home networks, which is a lot more secure.

Unfortunately for now, it will continue to be our collective responsibility as consumers to keep our devices up-to-date and in check. Looking forward, we can hope that manufactures will begin to integrate security into IoT devices from the ground up, helping secure the connected world for everyone.

Pawani Vaddi joined Webroot in March 2017 as the product manager for its consumer product line. She has worked in the cybersecurity industry for more than six years in different careers, moving from engineering roles into product management. Before Webroot, she worked for Symantec and Sonicwall.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file