The world of IoT security just became more complex. IoT devices are no longer a potential threat to their owners, now they pose a significant threat to everything connected to the Internet.
For the past year, the cybersecurity and IoT communities have been at odds regarding how to keep devices from harming their owners. Much of the focus emerged around industrial controls (IC) and transportation equipment. Vulnerable IC devices could cause cascading effects to power stations, water distribution, chemical plants, heavy machinery, and other industrial facilities, posing a threat to workers or downstream users. There have been hacks, compromises, and stern warnings. Concerned governments are putting pressure and establishing requirements to protect services at a national level.
Vehicles, most notably airplanes and smart cars, have taken the bulk of the public’s attention. Hacks against Jeep, Tesla, and Volkswagen have shown how doors can be unlocked and total operating control commandeered with steering, breaks, and acceleration taken over by an attacker. A car which is rendered unusable by its owner or made to crash and injure occupants is frightening but somewhat trivial if you don’t own that type of vehicle. The public has seemed to be entertained by these research exploits but not too concerned. It may seem beyond the everyday consumer and effects likely limited to only those who could afford such conveyances. These attacks are too distant and not very pressing to everyday people or businesses.
On the lower cost side, there are home appliances, wearables, toys, and drones which are already a part of the everyday world of the consumer, but smart toaster or rice cooker being hacked seems harmless, beyond some burnt bread.
Eventually, we will have more risks than we can imagine. As IoT devices are woven into the fabric of people’s daily lives we will be at risk of their misuse. In the future they will begin to control the stoplights on the way to work, the equipment in the emergency room, control of progressively more vehicles on the road and in the sky, and the distribution of such necessities such as electricity, food, medicine, water, and communications. We will begin to understand how these little technical minions become critical to smooth delivery of services in our future digital lives.
This is the space where thought-leading IoT manufacturers are working feverishly. The automobile industry in particular, have been fast to invest in security to ensure their products don’t cause accidents. Such work has begun, but still has a long way to go in cars and across all the other billions of devices we will weave into our lives and businesses in the next few years.
The next generation of IoT devices are appearing and will work to help protect our property, monitor our health, automate our homes, keep our children safe, increase our communication, eliminate time wasting chores, make us more efficient, and optimize our businesses. A great future to be sure, but it will need to be trustworthy and secure, as our reliance on the smallest elements will ultimately impact the biggest parts of our lives. These are all known and accepted security challenges in the world of IoT. This is not the end of the security story, only the beginning.
We are now facing a new set of problems which have emerged for IoT. Unlike the known challenges, where IoT devices might impact local owners and bystanders, the new threat is a powerful weapon which can be pointed to anything connected to the Internet. Recent Distributed Denial of Service (DDoS) attacks have been fueled by hacked IoT devices, called bots. DDoS attacks saturate internet connected devices and services to bring them down or make them unavailable. Such attacks have been around for years, in fact were some of the first types of Internet attacks, but the scale is now changing the game at a pace and scale not tenable by security workarounds.
The game has changed. These IoT DDoS attacks are typically run by ‘bot-herders’. These herders compromise devices and install malware which allows them to be controlled remotely. By pointing hundreds or thousands of devices to flood a target with requests and data, they can overwhelm it to the point it can no longer maintain functions. There are several anti-DDoS services available which offer protection for a price. But the scale of the new IoT backed attacks, which are larger than anything ever seen, makes protection difficult and costly. Josh Shaul, Akami’s vice president of web security, warned that if such an attack were sustained it could cost the victim millions of dollars in cyber security services to stay online.
Traditionally, PC’s were the prime targets to turn into bots, as many people did not bother with installing anti-malware. But over the last few years, PC’s became much more protected and therefore difficult to maintain persistent control over by the bot-herder. The other problem is the shift to laptops. A bot is only good if it is online, can receive instructions from its master, and then execute those orders continuously. Laptops don’t fit this model well, as they spend much of their time off, to save battery life.
What bot-herders really wanted was a massive number of devices, which were easy to hack, that would be ignored by their owners, and were constantly connected to the Internet. Recent attacks have proven IoT devices are the perfect solution for cybercriminals.
The rise of IoT is a dream come true for bot-herders. Most IoT devices are not powerful enough to have any type of anti-malware. A majority of consumer products come with a default login and password, which are published by the manufacturer and easily found on the web. Many stay continuously connected to the Internet and end-users rarely monitor or update these devices, especially consumers. The biggest factor is around scale. Unlike the hundreds or thousands of PC’s which might be in a herd, IoT botnets can number in the hundreds of thousands!
With legions of exploitable devices, attackers are mustering massive DDoS armies and the results of IoT botnets are devastating.
The problem is not just what to do now, with the current exploits, but also how to protect the future. Attackers are using the most simple and easy path to take control, the default passwords. But they will adapt as controls come into play. This is the pattern witnessed the past with many other attack vectors. It is a repeating cycle where attackers follow the path-of-least-resistance to achieve their objective. IoT devices are just too perfect for botnets for the attackers to give up easily. This is shaping up to be a long and drawn-out fight.
We must secure the future of IoT. This means blocking the current exploits as well as interdicting the likely future maneuvers of attackers. This is what must be done to protect the lifecycle of IoT devices, from inception to retirement.
Security and privacy take effort, resources, and commitment. To change from the status-quo, we must hold manufacturers accountable for their devices. If they fail to design and architect security into their products, make them liable and stop buying their wares. For critical functions where the safety of people is at risk, enact regulations and subject them to government penalties.
As part of the best-practices, which manufacturers and service providers must deliver against, institute the aspects which make provisioning and initial configuration secure by default. Industry consortiums are working to define the best-practices, configurations, and default settings for different device classes.
Lastly and perhaps most difficult, is to up-level the awareness and involvement of end-users. It is their security and the operational availability of potential Internet targets which is at risk. Without some assistance from consumers and businesses, these controls will be easily undermined or neglected. Social interaction must take place. We all have a responsibility, as a digital community, to maintain reasonable hygiene for devices connecting to our common resource, the Internet.
It may seem like a lot to consider, but remember the attackers just need to find a reasonable vulnerability to press. The opportunity is, to make it challenging enough so they are not motivated to pursue these devices. We find ourselves in a situation where billions of IoT products will be flooding every industry and quickly find their way into our homes, schools, governments, and businesses. We must make the necessary efforts to not bring vulnerabilities in with them. The effects overflow well beyond our own lives, data, and devices. They may be turned into legions of bots which could cause havoc to even the biggest of organizations on the Internet. We all become victims if we don’t work together to make our future technology trustworthy, safe, and secure. Interested in more?
Follow me on Steemit, Twitter (@Matt_Rosenquist) and LinkedIn to hear insights and what is going on in cybersecurity.
