4 IoT Security Vulnerabilities You Need to Know About

Hacking, Internet of things, IOT, Network, Security, Security Threats, , , , ,
27
Feb 2018

The Internet of Things (IoT) is amazing, but it’s not perfect and, in particular, there are plenty of security vulnerabilities that you need to know about.

You can barely move without bumping into an IoT device now and, whilst this allows you to be more productive, it also means that the security risk to your organization’s network is increasing. We’ve all heard about how coffee machines can get hacked and it’s these types of stories that demonstrate the extent of IoT security concerns.

Whilst you may rely on a humble kettle rather than a fancy Wi-Fi controlled coffee machine, there are still plenty of IoT security vulnerabilities you need to be aware of. Let’s take a look at of the most important ones you should be aware of.

  1. Network Services Present a Back Door

IoT devices often come with diagnostic and debugging services built in to help facilitate troubleshooting tasks, but these are often operating on ports which are not secure. Now, maintenance services are probably one of the least likely to be secured pieces of code to be found on an IoT device, so this scenario is highly attractive to hackers. Therefore, you need to make sure that you investigate all potential security concerns on new IoT devices you install.

  1. Lack of Transport Encryption

When data is transported across the internet or your local network, it needs to be encrypted to thwart any external parties who are listening to your data traffic. However, many IoT devices fail to employ transport encryption in their data transmissions when sending data – this is estimated to be around 41% of all IoT devices. And this is why you need to make sure that your organization only works with highly secure IoT devices to protect data security.

  1. Weak Password Protection

The lack of strong password protection is a major security vulnerability when it comes to IoT devices. A good password should incorporate more than 8 characters and these should include numbers, symbols and mixed case letters – more often than not, though, these can often be nothing more than four digits such as an iPhone’s default password protection. And, as we all know, the weaker a password, the quicker and easier it can be hacked by brute force.

  1. Different Computer Languages Prevent Security

PCs all speak a common language, so getting a network full of PCs to operate on the same network in the same manner is not too big a problem. However, a smart photocopier running on a code all of its own is going to struggle to communicate effectively with the rest of your network. And this means that guaranteeing a secure connection between network devices is more difficult than ever. You also need to consider the fact that many IoT devices fail to receive regular updates, so this has the potential to be a long term security risk.

We’re all still learning about the security vulnerabilities that the IoT is bringing to the security table, so a firm knowledge of the potential pitfalls is vital. By taking note of the above you should be able to improve your security just enough to prevent being hacked.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The 5 Most Important IoT Security Concerns Coming in 2018

Cyber Attack, Hacking, Internet of things, IOT, IoT Attacks, malware, Phishing, Ransomware, Security, Security Threats, , , ,
20
Feb 2018

If you want to keep the IoT (Internet of Things) secure in 2018 then you’re going to have your work cut out due to the number of threats on the horizon.

Significant progress has been made in the last couple of years when it comes to understanding the security concerns presented by IoT devices, but this is only encouraging hackers to become more innovative. And 2018 is going to deliver more IoT security threats than ever before, so you’re going to need to be ready for this surge in activity and the new hacking methods employed.

Let’s take a look at the most pressing IoT security concerns coming in 2018.

  1. IoT Attacks Being Undetectable

Many IoT attacks take place on a micro scale compared to large scale attacks such as Distributed Denial of Service Attacks. The problem with micro attacks is that conventional security systems are unlikely to recognize them as a threat, whereas major attacks are likely to ring alarm bells very quickly. Therefore, investing in highly sensitive security systems and manual monitoring may become vital to any organization using IoT devices.

  1. Automation Will Become More Important

Some organizations can have thousands of IoT devices operating on their network at any one time, so manually monitoring this activity is virtually impossible. And that’s why automation and artificial intelligence could prove highly popular in 2018 when it comes to providing a front line defence against IoT attacks e.g. installing crucial firmware upgrades immediately.

  1. The Irresistible Allure of Cryptocurrency

You only have to take a quick look at the financial headlines to understand just how valuable cryptocurrencies are at the moment. And, to a hacker, the financial rewards on offer are hard to resist. The Satori botnet, for example, takes control of IoT devices and also allows the hackers to exploit Bitcoin mining software. So, if your organization is involved with cryptocurrencies in any capacity, it’s going to pay to monitor your activity very closely.

  1. More and More Devices Will Be Targeted

Automobiles, security cameras and baby monitors are just a small selection of the IoT devices which have been hacked in the last couple of years, but this is set to increase further in 2018. In particular, devices which come with weak passwords (or even no password) are constantly being scouted by hackers. And, when they discover one, this can easily be leaked online, so the need to enforce a strong password culture remains essential.

  1. Privacy Concerns

Trusting IoT devices to transmit and receive personal and sensitive data is going to come under serious scrutiny in 2018. Due to the recent IoT attacks which have exploited weak passwords and poor security protocols in IoT devices, the public concern is growing over how their data is handled. Naturally, hackers are excited by the prospect of being given a free run at such a huge number of vulnerable devices without adequate security frameworks in place. 2018, therefore, is going to find organizations having to soothe customer concerns by only working with secure hardware and software.

For more ways to secure and optimize your business technology, contact your local IT professionals.

 

Read More

Creating a Culture of Security in the Internet of Things

Cyber Attack, Hacking, Internet of things, IOT, malware, Password Security, Security, Security Threats, , , , , ,
30
Jan 2018

Hackers aren’t the only threat to the security of your organization’s Internet of Things (IoT), your employees can be just as culpable for security risks.

Let’s face it, the IoT is a relatively new phenomenon and, even though most of your employees will have smart devices at home, the majority of your workforce won’t be aware of the many security dangers. It’s this lack of knowledge which can lead to major security flaws which leave your network open to hackers and their accompanying chaos.

However, humans have a huge capacity for learning and if you can ingrain the basics of IoT security in the business culture, you’ll find that your employees are soon on top of things. And this knowledge can provide an extra layer of defense, so let’s take a look at how you can provide this.

Ban All Guest Access

Many organizations provide guest access to, at the very least, their Wi-Fi network so that visitors can check emails, liaise with their own staff and, more likely, check Facebook! However, whilst this is a generous gesture, it opens your network up to a whole host of security risks. If there’s a freely available guest network then it’s likely that everyone in your organization will know the password and it can be passed on to any visitors.

Now, you’re never going to know every single visitor to your company and, crucially, you’re never going to know how secure these visitors’ devices are. Therefore, it’s a highly dangerous move to allow your employees to grant free access to any section of your network. The simplest way to combat this and prevent bad security practices is to ban all guest access to your organization’s Wi-Fi. It may seem drastic, but it will really hammer home the security risk to your employees.

Improve the Password Culture

Passwords are one of the oldest forms of computer security, but they’re also one of the most effective. IoT devices, though, have a reputation for coming pre-loaded with highly weak default passwords, so the effort required to hack them is relatively low. Changing not only default passwords, but also regularly changing existing passwords remains a highly important task to secure your smart devices.

Your employees are likely to be highly busy, though, so changing their password will tend to fall down their list of things to do. This is where you, as an employer, need to ensure that regular reminders are sent out to your employees to indicate when passwords require changing. Ideally this should be between 6 – 12 weeks of the last password change and the best way to enforce this is by restricting access to applications if the password is not changed.

Whilst employees will initially grumble about having to change their password and remember a new one, these complaints will soon subside and employees will become compliant with the process.

Regular Training

As mentioned in my opening, the IoT is a new phenomenon and the collective knowledge of your employees will be limited. And that’s why you need to make sure that your staff are given regular training sessions on the importance of IoT security.

Ideally, the IT induction that all new starters take should include a section on IoT security; after all, almost of all your employees will bring a personal smartphone into work and, of course, certain employees will be issued with company laptops and smartphones, so the need for good security practices from the off are vital.

It may seem time consuming to complete inductions and regular refreshing training, but the enhanced knowledge among your workforce will ensure that your networks remain safe from the most simple (yet damaging) IoT security mistakes.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

You Can Now Hack Networks with a Fish Tank

Cyber Attack, Hacking, IOT, malware, Security, Security Threats, Uncategorized, , , ,
23
Jan 2018

The Internet of Things (IoT) can help run almost any device in use in your organization, but this also means you could be hacked by a fish tank.

This may sound highly unlikely, but this is exactly what happened to a North American casino and underlines just how vulnerable IoT devices are. It also demonstrates how every single IoT device, no matter how insignificant and harmless it may appear, is at risk. Hackers, after all, do not discriminate – if there’s a way to gain access to a network then they’ll exploit it.

As this is one of the more unusual attacks to have affected an IoT device, I’m going to take a closer look at it before advising you on a few tips to avoid getting hacked by a fish tank.

Hacking the Tank

The fish tank – which was situated in the unnamed hotel – had been installed with state of the art sensors which monitored and regulated factors such as water temperature, saline levels and release of food. Making devices such as these sensors compatible with IoT technology allows the tank to be controlled remotely, but this accessibility also opens up such IoT devices to the interests of hackers. Although the hotel had security measures in place, they were evidently not secure enough.

Many IoT devices lack advanced, internal security technology so any external security measures need to be as advanced as possible to pick up the slack. In this particular case, the fish tank’s sensors were hacked which allowed the hackers to transmit 10GB worth of data to a remote server based in Finland. The casino’s existing security tools were able to identify that data was leaking externally, but were unable to identify where from and where it was being transmitted to.

Thankfully, security experts Darktrace were able to pinpoint where the vulnerability was and were able to advise the casino to disconnect the fish tank sensors immediately. 10GB worth of data may not sound like a huge amount of data in this day and age, but when you consider the amount of personal and financial details a casino may hold, 10GB could cause a lot of concern for any patrons of the casino.

Securing IoT Devices

Being hacked through a fish tank is a highly embarrassing security flaw for any organization, so understanding how to secure IoT devices is paramount. Make sure you’re implementing the following security measures with IoT devices:

  • Change Default Passwords – Many IoT devices come preloaded with a default password and, by leaving this in place, you’re reducing the number of guesses and effort that a hacker needs to put into brute-force hacking the password. It’s estimated that around 15% of IoT device owners do not change this default password, so make sure you change this as soon as the device is installed.
  • Install Firmware – As I’ve previously mentioned, the security technology loaded onto IoT devices is sometimes sadly lacking. However, even worse than poor security software is outdated security software. And that’s why it’s crucial that any firmware updates are installed immediately to patch any potential vulnerabilities.
  • Separate Networks – The number of IoT devices operating in any one organization can easily run into the hundreds. Essentially, this means that there are hundreds of routes into your network and this could cause real chaos if just one device is breached. Therefore, penning off IoT devices into separate networks is a preventative step which can limit the reach of any hackers.

For more ways to secure and optimize your business technology, contact your local IT professionals.

 

Read More

Nearly All PCs At Risk From Spectre and Meltdown Security Flaw

Hacking, hardware, ,
07
Jan 2018

Microsoft has been forced into rushing out an emergency security update to help counter security flaws that have been discovered in modern processors.

Discovered by Google’s Project Zero team, these bugs, called Meltdown and Spectre, have the potential to offer up highly sensitive information such as encryption keys, live access to running applications and passwords. As you can imagine, this is a major issue especially as the problems are likely to affect Intel, AMD and ARM processors.  This accounts for nearly all computers, smart phones, servers tablets and laptops on the planet.

Due to the widespread reach of these security flaws, I’m going to give you the lowdown on the situation and how the emergency security update is going to help.

Compromised Processors

To understand what’s happening with these compromised processors we need to take a look at the kernel. Now, you may be wondering what the kernel is, so here’s a quick explanation: the kernel is the beating heart of any operation system and, much like a heart, helps to manage everything happening in the PC. And this is why the kernel memory holds such sensitive information such as login and password details.

Meltdown demo showing a password being read from memory

Unfortunately, a flaw in the aforementioned processors allows other programs – which aren’t part of the kernel – to access the kernel memory. Usually, processors would simply ban any non-kernel applications accessing the kernel memory, but, by an admittedly rather complicated process, it’s possible to exploit this vulnerability and remove any obstacles. The kernel’s memory can then be not only accessed, but also changed by any external application.

Sample code showing the execution of Spectre

Microsoft has issued security patches pretty quickly in response to Google’s findings, but just how effective are they? Well, seeing as the fault lies within a piece of hardware, it’s difficult for a software patch to be an all-in-one solution. Whilst Microsoft’s patches will address the issue it’s not as effective as they would like, with the main drawback being a reduction in performance. The nature of a software patch is that it contains additional instructions for the kernel to carry out and adhere to, so this creates extra work for the operating system.

Whilst the patches for AMD and ARM processors are not affected by this slowdown in performance, Intel processors are going to be significantly affected with estimates of up to a reduction of 5 – 30% in performance. Naturally, any organization that wants to remain competitive needs their technology to be working to its full potential, so the impact of this lag in performance is very troubling in a business sense.

It’s reasonable to assume that older machines, with much less available memory, are likely to be hit hardest by these firmware and software updates. Going forward, new processors by the affected manufacturers are likely to avoid this error during their testing and manufacture thanks to information shared with them by Google, but this isn’t going to help those using PCs suffering the most extreme slowdowns.

However, the performance slowdown for most users is likely to be around 10% and this reduction is unlikely to be noticeable unless your PC has an exceptionally heavy workload. And, most importantly, the slight reduction in processor speed is surely more favorable than having highly sensitive data exposed to malicious parties.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 6 7 8 9