The other day, I attended a meeting of the North Texas chapter of ISACA. There, the information technology veteran, Austin Hutton, gave a presentation on the dangers of the Internet of Things (IoT). I have written about the IoT and how it can be used to devastating effect. One of the problems that Hutton talked about is that there are more IoT devices than there are people on earth. Thousands are being manufactured and sold each day, and each one of these devices can be hacked to assist in an attack. And the problem is getting bigger.
Most of those devices were poorly designed, and thus have no way of being updated. The companies who make these devices have thin profit margins, so they cannot afford to make them secure. In some cases, the manufacturer buy the chips from other companies, so they are not directly responsible for its security. The average IoT device can be easily hacked: a number of them have easy to crack passwords, or have flaws that were not detected when they were being designed. There are even programs which can auto-hack some of these devices. All the hacker needs to do is learn the make and model of the IoT device, select the program, sit back, and gain control over it. For those devices which are used as intended, they may be doing something illegal.
Hutton gave the example of a Tempur-Pedic bed which can send the user’s data back to Tempur-Pedic for analysis so as to improve the user’s experience. He then gave an example of someone else (specifically, his 14-year-old granddaughter) sleeping in the bed, and their data being sent to Tempur-Pedic without their permission. This can be considered breaking the law because she’s a minor. How would that situation be resolved? How can we at least minimize the damage from IoT devices?
For one, education. Though companies are really selling the convenience of IoT devices, consumers must learn how harmful IoT devices can be. The public needs to learn that these devices can be used to cause harm to our cities, and possibly to themselves. Recently, the business of a utilities company in Finland was disrupted due to a DDoS attack, resulting in the heating for their customers being disabled. What if this was the smart thermostats of many of their customers getting hacked? The attacker could lower the temperatures in these houses, or disable the thermostat, which would be a dangerous situation to homes in Finland during the winter. How else could these devices be attacked? An attendant to the meeting, David Hayes of Verizon, had one other scenario.
There are utility companies in North America and Europe that use monitors called SCADAs which can remotely control machines vital to a functioning city (one example is the water pumps which keep drinking water flowing through the city). What if, Hayes suggested, a hacker takes control of these pumps, and threatens to take them offline, or even increases their work to the point of destroying them, unless he is paid $100,000? Now we’re starting to see the cost of this problem. This cost will only increase, as malicious hackers devise ways of misusing these IoT devices.
Another way we can minimize the damage from IoT devices is to ensure that your IoT devices can be modified such that only you can control it. If you can change the password, do it. Check that a default root password hasn’t been hardcoded into the device. If you can, find a device that can be updated (though few IoT devices have the capacity to be updated). On the government side, we’re going to need some form of oversight. For instance, no IoT device bought by the government can lack the ability to be updated. How about current IoT devices? There is little we can do about them. If we’re dependent on them, then it’s going to be difficult to replace them. Maybe for the average person it’s easy to change their IoT lightbulbs. But how can a maintenance manager at a company tell his bosses that, due to the threats these IoT devices have to the security of the company, they all have to be changed. How much will that cost?
This is a growing problem that will grow more as these hacked IoT devices are used to facilitate these attacks. It is imperative that this problem be addressed now, rather then have some catastrophe occur, and involve the lives of thousands.