Internet of Things and security

Ruslan Rakhmetov, Security Vision

In the last article we told you about the application of smart devices in various spheres, and in the current article we will consider important security issues and tell you about the ways of protection so that the comfort of life is accompanied by security and safety of data. The fact is that IoT devices, like any other computer system, are vulnerable to various cyberattacks:

- Malware infection to steal data, control or disable devices;

- traffic overload (DDoS) to make the IoT inaccessible to legitimate users;

- hacking into smart devices to gain access to personal data or device control, such as wiretapping devices with a microphone;

- man-in-the-middle (MitM) attacks can intercept data transmitted between IoT devices and servers to spoof their content or view your communication history with the devices.

In recent years, we have seen an increase in incidents involving smart devices:

In 2014, the US National Security Agency (NSA) spied on people around the world using their smart TVs.

In 2015, hackers breached the database of Fitbit fitness trackers and stole the data of millions of users. A similar attack also allowed the perimeters of military bases to be located on maps using the routes of those patrolling using smart watches.

In 2016, hackers hacked millions of smart cameras around the world and streamed live video on the website Creepy Streaming, while the Mirai botnet of infected IoT devices attacked the DNS Dyn hosting service, causing massive disruption to sites such as Amazon, Twitter and Netflix.

In 2017, Chinese company Xiaomi was found to be collecting data on users of its smartphones, including their location and browser history. Hackers hacked into VTech's smart lock system and stole the data of millions of children. A smart camera in a couple's home in California was used to talk to their one-year-old son. The Nest smart thermostat system was also hacked and remotely raised the temperature in some homes to dangerous levels. The Mēris botnet attacked several websites and services using a botnet of infected smart devices.

In 2018, hackers hacked into the system of Philips Hue smart bulbs and made them flicker and flicker, causing epileptic seizures in some people. A botnet of infected IoT devices was used to attack the cryptocurrency service CoinHive (the attack led to millions of computers around the world being infected with malware that mined cryptocurrency for hackers). The phishing attack was used to steal the credentials of August smart lock users. Hackers then used these credentials to remotely unlock the locks and steal property from homes.

In 2019, Google collected users' location data without their consent from their smart watches. Ring was hacked and the data (names, addresses, and camera footage) of millions of users was stolen. A botnet of infected devices was used to attack the website of Delta Air Lines (the attack caused the airline's website to be unavailable for several hours).

Hacking of new companies around the world over the past five years has expanded to include more frequent attacks on Russian services, and practice shows that we have yet to see the most ‘recent’ leaks disclosed in the future.

As the Internet of Things develops, we can expect to see new threats and vulnerabilities similar to those listed above, but not all leaks and hacks are intentional - some are due to software bugs or user negligence. With careful planning and implementation, the technology we consider can make our homes and flats more comfortable, secure, energy efficient and fun, and we can tell you how you can improve your home and office security.

Use unique and complex passwords for all your devices. A strong password includes numbers, letters and special characters, the combination of which makes it harder to find. Don't use the same password for multiple accounts, because if one of your accounts is compromised, attackers can use the known password to access the rest of your data. Change your passwords regularly, put a reminder on your calendar at least once a year, and try not to use names and birthdates, as they do for Wi-Fi networks in various establishments.

1) The longer the password, the harder it is to crack. Use a combination of upper and lower case letters, numbers and special characters such as ‘.’, ‘/’, ‘-’, ‘_’, ‘;’, etc. and passwords of at least 12 characters.

2) Do not use dictionary words (dictionary attacks are a common method of password cracking), avoid using words that are easy to guess, even if you replace some letters with numbers or symbols, and do not use your phone number, date of birth, name or other easily accessible data in your password.

3) Change your passwords regularly. Experts recommend updating them every 3-6 months, but definitely not less than once a year.

4) Don't share your password even with people close to you and be wary of phishing sites that try to trick you into entering your credentials. Be careful about the links you open and don't enter your passwords on unfamiliar sites.

5) Use two-factor authentication, which adds an extra layer of security to your accounts by requiring you to enter a code from an SMS or app in addition to your password.

6) Use a password manager that not only helps you store and use strong passwords for all your accounts, but also allows you to create them automatically.

Use encryption to protect data travelling between your IoT devices and servers - it makes it harder for hackers to intercept and read your data. Firewalls to restrict communication to your devices from the internet - these can block unauthorised access. Antiviruses to spot smart device infections on your home/office network. Apply two-factor authentication for smart locks so that only a trusted person can access a locked room - similar services require a code from an SMS or app in addition to a password.

The tips in this box are relevant not only for creating a secure network, but also apply to sophisticated devices like smart doorbells, which allow you to see and communicate with visitors from the comfort of your home, as well as answer intercom calls from your smartphone. The devices record video of visitors, which can be useful in the event of an incident, and integrate with other smart home systems (like lighting and locks).

1) You can focus on your router: choose a device that supports the latest security protocols (e.g. WPA3), change the default Wi-Fi network name and password to unique and strong ones (see point above).

2) Disable guest Wi-Fi networks if you don't need them (these networks are often less secure than the main network). This will reduce the risk of intruders accessing your network when close to you - shutting down an extra network is like barricading extra doors into a room or putting bars on ground floor windows.

3) Most routers have a built-in firewall. Switch this on and configure it to block unauthorised access to your network - the firewall will act as a responsible concierge, letting in only those you expect.

4) Look for MAC address filtering in the settings and only allow devices with authorised MAC addresses to access your network. This is similar to entering a nightclub using a list made in advance - uninvited guests simply won't be allowed in by the security guards;

5) If you don't use remote control of your router, disable this feature - it allows access to settings by unauthorised users, its counterpart (remote PC control) can also often be used by hackers.

6) Regularly check for firmware updates for your router and install them - such updates contain fixes for security vulnerabilities. And for convenience, you can set yourself another reminder to ‘update your router’ in a year.

Make sure your smart devices have the latest software updates installed, which usually contain security patches. Choose IoT from trusted manufacturers that have a reputation for security and learn from incidents to keep customers safe.

Only connect the devices you really need to your network : the fewer things that can go wrong, the more effective any solution is, including cyber defence. Close the lenses of smart cameras when not in use, create a list of devices that use the cameras. For computers, tablets and smartphones, you can improve security by using a VPN - this type of connection encrypts your internet traffic, making it more secure. This may not be relevant for home networks, but is often used in offices, and can be particularly effective if you use public Wi-Fi networks.

If you notice anything unusual, change your passwords and let the device manufacturer know - your involvement could protect millions more people. It's important that your family members know about cybersecurity risks and how to protect themselves - talk to them about the importance of using strong passwords, not clicking on suspicious links or opening attachments from unknown senders.

Remember that cybersecurity is an ongoing process. You need to keep an eye out for new threats and vulnerabilities and take the appropriate steps to protect your devices. Using our tips, you can make your IoT devices more secure and turn your home and office into a comfortable, cost-effective and efficient cyber fortress.