Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

4/12/2019
10:54 AM
Joe Stanganelli
Joe Stanganelli
Joe Stanganelli
50%
50%

IoE: The Internet of Espionage

As employees live their lives across an increasingly IoT-enabled landscape (with devices often installed discreetly and with hidden functionalities), enterprise security is threatened by outside factors it cannot control.

The Internet of Things has been expanding exponentially over the years. Gartner predicts that within the next five years, there will be approximately 1.7 billion new devices per annum attaching to enterprise networks -- and, accordingly, that the number of endpoint devices that CIOs will be expected to manage will triple in that time. This in and of itself introduces enormous complexity to the security and integrity of enterprise IT environments.

IoT devices outside the organization, however, present a hidden yet no less serious threat. At home, while traveling, and on the job offsite, third parties have the capability to use IoT to spy on enterprise employees -- the things they say, the things they do, the things they look at, and even the things they type.

In some cases, this is already happening.

IoT spying at home Over the past several years, headlines have been rife with espionage-enabling vulnerabilities and exploits of smart cameras, smart appliances, smart thermostats, and even smart toys. More recent IoT controversies and snafus, however, have driven the point of the problem home.

On Wednesday, Bloomberg reported that -- instead of relying entirely on cold and distant algorithms when recording and "listening" to users of Alexa (the "smart assistant" embedded in Amazon's smart speaker, the Amazon Echo) -- Amazon "employs thousands" of living, breathing humans to listen to, transcribe, analyze, and annotate what Alexa hears.

To be sure, with machine learning in its infancy, a certain amount of direct human intervention is to be expected when it comes to maintaining and improving voice-activated IoT devices. At the same time, the recordings are hardly unidentifiable. While full names are not directly shared, Bloomberg reports that Alexa-recording reviewers can match specific recordings with the user's first name, account number, and device serial number.

Conversely, Google and Apple claim that recordings of users of their respective smart assistants are stripped of personally identifiable information -- although researchers across various disciplines and contexts have found ways of re-identifying "anonymized" data.

Google still has its own smart-assistant controversies. On February 4, the tech behemoth released an update to its "smart" home-security device, Nest, to enable smart-assistant functionality in pre-existing/pre-installed devices. The problem was that nobody outside of Google previously knew that Nest devices came equipped with a microphone -- a fact that Google conveniently "forgot" to mention.

Meanwhile, the IoT smart-home sector (variously estimated to be a $44-billion to $54-billion industry) represents a potential data-leakage threat even when what passes for full disclosure is present. Localytics, a mobile-engagement firm, calls the smart-home industry the "mother lode for mobile marketers" thanks to voluminous data generated by IoT smart-home devices themselves and additional data generated via apps and mobile devices used to manage and control IoT devices -- giving third parties access to nearly everything done and discussed in a person's sanctuary.

Personal privacy concerns aside, the upshot for the enterprise is that employees working or talking about work at home with Nest or other devices may have no idea who is watching or hearing information related to proprietary work product.

IoT spying on the road
This is a variation of what is known as the "evil maid" threat. The scenario commonly presents as a maid or other worker -- having access to the employee's quarters (whether a home or a hotel room) -- steals sensitive data, often by stealing or compromising an endpoint device. Here, however, the threat is less visible; through IoT devices that users or bystanders may not even be aware of, a hacker, a rogue employee, or even a bad-actor first-party or third-party company is potentially free to leverage any enterprise data that happens to be observed.

Away from home, too, devices are watching, listening, and tracking around the world. Last month, South Korean law enforcement busted a spycam ring that allegedly secretly recorded guests across 30 motels nationwide. More lawfully (but still disturbingly), since 2017, in-flight entertainment systems on airplanes have increasingly included cameras designed to watch passengers in turn, Orwellian style. The airlines have allegedly all but pinky-sworn to never use the cameras, but according to tech professionals, they appear ready to be enabled at any time by airlines and third parties (authorized or not) alike.

"We keep on hearing about all kinds of devices increasingly containing microphones or cameras, [and instances where IoT] devices are not apparent," Katell Thielemann, a Gartner analyst, told Security Now. "The best approach is not to allow any such device in hotel rooms or office environments -- and remove or unplug them if there are -- and to keep sensitive conversations [within] areas that can at least be visually inspected for lack of connected devices."

Related posts:

—Joe Stanganelli is managing director at research and consulting firm Blackwood King LC. In addition to being an attorney and consultant, he has spent several years analyzing and writing about business and technology trends. Follow him on Twitter at @JoeStanganelli.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12505
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 ve...
CVE-2020-12506
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version ...
CVE-2020-4629
PUBLISHED: 2020-09-30
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
CVE-2019-17098
PUBLISHED: 2020-09-30
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior version...
CVE-2020-15731
PUBLISHED: 2020-09-30
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.