CYBER

Steps to
SAFEGUARDING
THE IOT
Our world is becoming more connected than ever
as the Internet of Things (IoT) has evolved from a
sci-fi ideal to a reality in our homes and cities. Who
could have predicted that our connected car could
think for itself, and dolls could hold a conservation
with a child? As crazy as these ideas sound, they
are now squarely within the realms of possibility.
There is a catch, however. Unlike laptops or smartphones, IoT
devices are often lacking when it comes to cyber security, with
manufacturers swept up in the drive to impress us all with new
and exciting WiFi wizardry. Their expertise simply does not lie
in IT. Consumers tend to care even less for cyber security and
in many cases will sell their password for a bar of chocolate,
[1] and so we quickly come to understand both the incredible
potential and the serious insecurities of the IoT. But why does
this matter?
Hacking the IoT
What many people don’t realise is that by connecting a device
to a computer network, it is instantly transformed from a
simple gadget into a gateway attack vector. Your WiFi-enabled
kettle or talking Barbie provides opportunities to get inside the
network boundary, helping attackers gain access to personal
data. The network is only as strong as its weakest component,
and this is increasingly likely to be an IoT device.
Ruthless commercial pressures are also to blame for bringing
insecure IoT products to the market before they are robust
enough to fend off hacking attempts. And this carries a
significant safety risk. Take the Jeep Cherokee case for
example: Just last year, two hackers demonstrated remote
access to vital functions (including brakes and steering),
leading to 1.4 million vehicles being recalled in order to patch
the software. [2]
The IoT army
While an individual’s motivation for securing connected
devices might be focused on their personal safety and
security, we recently witnessed an even greater threat to the
internet as a whole.
Distributed Denial of Service (DDoS) attacks are by no means
new, but these are now being taken to a whole new level by
hackers using the IoT. This is exactly what happened on
the 21st October 2016, when Dyn (a large DNS provider)
was attacked, wiping out major websites including Twitter
and Amazon across the East Coast of the United States. [3]
Malware known as Mirai was discovered as the cause, and
this is where it gets interesting. Mirai continuously scans
the Internet for IoT devices and attempts access via known
factory default usernames and passwords pulled from a
database. If successful, it then conscripts these devices to
join botnets and bring about powerful DDoS attacks like never
experienced before.
Although documented hacks and DDoS attacks have so
far been either high-impact and focused or disruptive and
widespread, what if the next targets were both high-impact and
widespread? Imagine the chaos caused by breaking hospital
infrastructures, power stations or air traffic control centres.
Recent attacks have highlighted how the IoT’s vulnerabilities
can be exploited in unexpected ways, and as a society we
cannot afford to ignore these warning signs.
28
28