Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

1/22/2015
05:20 PM
Liviu Arsene
Liviu Arsene
Partner Perspectives
Connect Directly
Twitter
Google+
LinkedIn
RSS
50%
50%

The Internet of Abused Things

We need to find ways to better secure the Internet of Things, or be prepared to face the consequences.

IP-enabled devices have become much more than just a fashion or trend; they’re now a necessity that’s being consumed by millions worldwide. According to Gartner, more than 4.9 billion connected devices are forecasted to be in use by 2015, irreversibly disrupting society – for better or worse – as we know it.

Consumer technology has never seen such a whirlwind of low-cost and mass-sale Internet-connected devices, raising the question of whether companies are only interested in driving sales and not necessarily in the security implications. You probably know the answer by now, as you may have already heard about firmware vulnerabilities in IP cameras or hacked baby monitors. Will this be the future?

“Smart” Everything

Chips can now be built into any device to make them “smart,” Internet-connected, and fully remote controlled via mobile. Devices that we have always wanted to talk back to us (or to control from distance) are now a reality. Technology has never before had the potential of making our lives simpler and better.

Car companies have already begun adding systems and technologies designed to make vehicles more autonomous, ranging from self-parking to constant Internet connectivity. Just imagine your car dropping you off in front of the mall and then going on its way to find a parking space. Building a smart car may solve everything from being stuck on a highway for hours at a time to getting home without being pulled over by a police officer. But could these be the world’s most hackable cars?

Daily household appliances are also starting to be endowed with “smart” skills. Imagine a world where your coffeemaker tells the toaster to get the toast ready, because coffee is almost done. At the same time, the smart fridge is ordering milk and eggs because it noticed you’re running out; and all this “chatter” happening while you’re still lying in bed.

Smart technology such as smartbands, smart watches, smart clothes, pacemakers, thermostats, and even smart homes will be a significant part of our lives and will help augment every aspect of our activities or health. But if we’ve learned anything from decades of Internet-connected PCs, it’s that the more interconnected technologies you have, the more someone is interested in controlling them.

Beware the Evil Eye

The amount of information that interconnected devices could be broadcasting is simply staggering, not to mention that it’s your own body and activities producing much of it (biometrics, location, etc.). Imagine what would happen if someone were to tap into all your personal data to constantly watch or profile you.

The evil eyes of cybercriminals could instantly turn to your smart devices, because there’s always a way to profit from information. For instance, if your smart car or smart house is being held “hostage,” you could end up paying ransom for its “release.”

In a more dangerous scenario, hacking entire fleets of smart cars could not only jeopardize human lives but also cause other serious problems. Getting stuck in traffic is already an issue, but imagine not going anywhere because your car either refuses to accept your commands or it just decides to crash into the guy in front of you.

Interconnectivity (or better yet, poor security) could be the Achilles heel for the IoT. The vertical and horizontal expansion of smart devices can only mean more information, more power, and more money for cybercriminals.

Is There Any Hope?

In the wake of this revolution – with some 25 billion smart devices estimated by 2020, according to Gartner – some companies have realized the potential dangers and have begun looking for better ways to toughen security, or at least investigate better security practices that could make it harder for someone to tap into the data being broadcast by smart devices.

The undoing of IP-enabled devices could be the lack of timely firmware updates that plug vulnerabilities. Although today’s incentive model for manufacturers is not high enough, it might be stimulated by the rise of attacks, vulnerabilities, and customer demand.

The Internet of Things will ultimately envelope our way of life (if it hasn’t done so already), and thankfully there is still hope for better security mechanisms. Rapid deployment of new code for patching vulnerabilities in smart devices will not only be required, but also necessary.

Securing smart home appliances, for example, will probably be solved by enforcing security at the gateway level. Having some sort of security appliance that’s able to shield your home network from outside attacks could be the next big thing.

Whatever the future may bring in terms of abusing the IoT, one fact remains clear: If we are to continue on this path, we need to protect ourselves from the potential consequences.

Liviu Arsene is a senior e-threat analyst for Bitdefender, with a strong background in security and technology. Reporting on global trends and developments in computer security, he writes about malware outbreaks and security incidents while coordinating with technical and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15564
PUBLISHED: 2020-07-07
An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be map...
CVE-2020-15565
PUBLISHED: 2020-07-07
An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs....
CVE-2020-15566
PUBLISHED: 2020-07-07
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, o...
CVE-2020-15567
PUBLISHED: 2020-07-07
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes...
CVE-2020-15563
PUBLISHED: 2020-07-07
An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM g...