A Long-Awaited IoT Crisis Is Here, and Many Devices Aren't Ready

ronjor · Apr 9, 2018

Lily Hay Newman 04.09.18

You know by now that Internet of Things devices like your router are often vulnerable to attack, the industry-wide lack of investment in security leaving the door open to a host of abuses. Worse still, known weaknesses and flaws can hang around for years after their initial discovery. Even decades. And Monday, the content and web services firm Akamai published new findings that it has observed attackers actively exploiting a flaw in devices like routers and video game consoles that was originally exposed in 2006.
Click to expand...

zapjb · Apr 9, 2018

Like 100% IOT devices are not ready for hacking.

Stefan Froberg · Apr 9, 2018

Speaking of routers.... You don't even really need to "hack" or anything. Just go to shodan.io, search few of the most common routers that are out there and try the default login/passwords that can easily be found out with quick googling......

For example, with quick search found few open ones from one big cable company ....

Minimalist · May 24, 2018

A Basic Z-Wave Hack Exposes Up To 100 Million Smart Home Devices

So-called "smart" locks and alarms are proliferating across people's homes, even though hackers have shown various weaknesses in their designs that contradict their claims to being secure.

Now benevolent hackers in the U.K. have shown just how quick and easy it is to pop open a door with an attack on one of those keyless connected locks. And, what's more, the five-year-old flaw lies in software that's been shipped to more than 100 million devices that are supposed to make the home smarter and more secure. Doorbells, bulbs and house alarms are amongst the myriad products from 2,400 different vendors shipping products with the flawed code. Tens of millions of smart home devices are now vulnerable to hacks that could lead to break-ins or a digital haunting, the researchers warned.
Click to expand...

https://www.forbes.com/sites/thomas...k-threatens-to-expose-100-million-smart-homes

Minimalist · Aug 9, 2018

IoT security: Lessons we can learn from the evolution of road safety

I was recently chatting with my father about his life as a young boy growing up in rural Ireland in the middle of the last century, and the conversation moved onto cars and how when he was young cars were a relatively new technology.
Click to expand...

https://www.helpnetsecurity.com/2018/08/09/iot-security-lessons/

guest · Aug 28, 2018

IoT failures plague most users worldwide
August 28, 2018
https://www.helpnetsecurity.com/2018/08/28/iot-failures/

52% of consumers worldwide are now using Internet of Things (IoT) devices, yet 64% of those have already encountered performance issues [...] and 62% of people fear the number of problems they encounter, and the frequency, will increase due to the rise of IoT.
IoT on the road
The digital performance failures consumers are already experiencing with everyday technology is potentially making them wary of other uses of IoT. 85% of respondents said they are concerned that self-driving cars will malfunction – leading to high speed collisions.
IoT in healthcare
62% of consumers stated they would not trust IoT devices to administer medication; this sentiment is strongest in the 55+ age range, with 74% expressing distrust.
85% of consumers expressed concern that performance problems with these types of IoT devices could compromise clinical data.
IoT in the home
Smart locks are used for security, while other IoT devices control thermostats, lighting, and cameras. However, the research revealed 83% of consumers are concerned about losing control of their smart home due to digital performance problems.
Click to expand...

guest · Sep 5, 2018

Smart Home Users Failing on Security Basics
September 5, 2018
https://www.infosecurity-magazine.com/news/smart-home-users-failing-on/

Bitdefender [...] The security vendor’s latest report, The IoT Threat Landscape and Top Smart Home Vulnerabilities in 2018, is compiled from data collected from its BOX IoT security product and interviews with consumers.

Yet despite 60% of users claiming they’re concerned about identity and data theft and malware infection, many are failing to adequately protect IoT devices. Six out of 10 said they’d never performed a firmware update on their router, a figure dropping slightly to 55% for smart TV owners. [...]

The firm said its BOX product blocked 461,718 threats in just a 30-day period, with most of them (76%) dangerous websites.

Yet not only users are to blame. “Smart device manufacturers share responsibility for the current state of IoT security because most of them are overlooking the security aspect,” he added. “In their rush to launch the product ahead of the competition, they are leaving attack avenues wide open to attackers interested in user sensitive data.”
Click to expand...

Whitepaper: https://www.bitdefender.com/files/News/CaseStudies/study/229/Bitdefender-Whitepaper-The-IoT-Threat-Landscape-and-Top-Smart-Home-Vulnerabilities-in-2018.pdf

guest · Dec 19, 2018

Connected light bulbs give off more than just light
December 19, 2018
https://www.scmagazine.com/home/security-news/connected-light-bulbs-give-off-more-than-just-light/

A new Symantec report has revealed that some of these connected, Wi-Fi-enabled IoT devices are unsecure and can enable a hacker to quickly come away with passwords, email addresses and other important information. While looking at some of the lower-end models, the company’s researchers found that the security in place is far below what is needed for a device that resides on a home network.

In order to obtain the most usefulness from these devices, the owner must download an app and create an account. Then the bulb can be controlled via a phone.
“The first thing we noticed while analyzing the network traffic was that the smartphone application was mostly using plain HTTP requests to interact with the back end in the cloud. [...]"

This, in turn, could allow a malicious actor with network access to sniff the traffic and brute force the password hash.
One particular product takes its lack of security to another level entirely by not allowing the user to change the password after it is initially set.
Click to expand...

guest · Jan 26, 2019

Report: IoT Still Wildly Insecure as New ‘Credential Compromise’ Threat Emerges
January 24, 2019
https://securityledger.com/2019/01/...-as-new-credential-compromise-threat-emerges/

Researchers at Barracuda Networks did a deep security dive on a popular, connected security camera and found multiple vulnerabilities in the ecosystem of Web and mobile apps that support the camera.
Together, the flaws allow a hacker to get into someone’s local IoT network and take control of the camera–and potentially other devices on the network.

“Using these vulnerabilities, the team was able to perform … attacks to acquire credentials and compromise an IoT device, all without a direct connection to the device itself,” according to the report.

Barracuda researchers published a report Thursday on the exploit, calling it “IoT credential compromise.” However, they declined to name the device and its manufacturer to avoid “shaming anyone,” Fleming Shi, CTO of Barracuda told Security Ledger.
Click to expand...

guest · Jan 29, 2019

Researchers Allege ‘Systemic’ Privacy, Security Flaws in Popular IoT Devices
January 29, 2019
https://threatpost.com/researchers-...security-flaws-in-popular-iot-devices/141244/

Researchers are highlighting the insecure nature of Internet of Things devices in a report released Tuesday alleging a bevy of popular consumer connected devices sold at major retailers such as Walmart and Best Buy and are riddled with security holes and privacy issues.

In analyzing 12 different IoT devices, researchers with Dark Cubed and Pepper IoT reported security failures that ranged from a lack of encryption for data and missing encryption certificate validations.
Data privacy collected and transmitted between the IoT devices and their complementary applications was another cause for concern highlighted by researchers.

Pepper IoT researchers stressed that these issues are systemic and cannot be fixed merely by patching.
Click to expand...

guest · Feb 5, 2019

IoT Scale Flaws Enable Denial of Service, Privacy Issues
February 5, 2019
https://threatpost.com/iot-scale-flaws-enable-denial-of-service-privacy-issues/141537/

Here is an internet of things flaw that can tip the scales to a hacker’s advantage.

Researchers have discovered a bevy of flaws a consumer smart scale that could allow hackers to launch a variety of attacks, from man-in-the-middle to denial of service attacks. Checkmarx researchers reported the vulnerabilities on Monday and outlined four “medium” severity bugs linked to the connected scale.
“The Checkmarx Security Research Team found several security issues that have impact on the clients using the smart scale, its associated apps, and for the company itself,” said David Sopas, researcher with Checkmarx in a Monday report.
Denial of Service
The most severe of the flaws discovered in the IoT device is a Denial of Service vulnerability, which allows attackers to trigger a special request via Bluetooth that crashes the smart scale. The flaw has a CVSS score of 7.1, making it a medium-severity vulnerability.
Click to expand...

IoT security issues are only getting worse – not better. In the first half of 2018, researchers at Kaspersky Lab said they picked up three times as many malware samples targeting IoT devices as they did for the entirety of 2017.
Click to expand...

guest · Mar 7, 2019

Devices’ UPnP Service Emerges as Key Threat to Home IoT Networks
March 6, 2019
https://securityledger.com/2019/03/devices-upnp-service-emerges-as-key-threat-to-home-iot-networks/

“In a nutshell, we found that most devices still use old versions of UPnP libraries,” wrote Tony Yang, a Trend Micro home network researcher, in a blog post. “Vulnerabilities involving the UPnP libraries have been years old, are potentially unpatched, and leave connected devices unsecure against attacks.”
Significant exploit potential
Many devices such as cameras, printers and routers use UPnP to facilitate their ability to automatically discover other devices on a local network, as well as communicate for data sharing or media streaming.
Research collected in the month of January detected 76 percent of routers as well as 27 percent of media devices–such as DVD players and media-streaming devices–with UPnP enabled, according to Yang.

Yang acknowledged that “it could be tricky for users to determine if a device has a UPnP-related flaw or has been infected” because some devices could be hidden behind NAT, making it difficult for a user to see any immediate impact of an exploited vulnerability.
Click to expand...

guest · Mar 20, 2019

Researchers Use UPnP Protocol to Unmask IPv6 Address
March 20, 2019
https://www.securityweek.com/researchers-use-upnp-protocol-unmask-ipv6-address

Comparative scans of discovered hosts on both IPv4 and IPv6 revealed not only that the newly discovered technique is valid, but also that “there are significant security discrepancies in filtering between IPv4 and IPv6 interfaces of these hosts and unintended IPv6 connectivity will be a growing problem.”

The current IPv6 address space is very sparse and the number of actual addresses in use is very small and somewhat random. With adoption growing fast, however, an ever larger number of hosts will remain hidden in future Internet surveys, and this represents a security issue, the researchers say.

To help uncover active, Internet-connected, IPv6 hosts and solve this problem, Talos proposes a technique that relies on UPnP NOTIFY packets to uncover pairs of IPv4 and IPv6 addresses of dual-homed hosts (this reveals mostly end-user, client-side, consumer devices, the researchers say).
The researchers also noticed that 98% of the hosts are embedded Linux devices, including security cameras, media and NAS servers, and Android devices (smart TVs and media dongles).
Click to expand...

The tests revealed that the problem of exposed UPnP devices isn’t going away (the number of open devices on the Internet is likely higher than what Talos has observed) and also unveiled that many devices run severely outdated software and operating systems.
Click to expand...

hawki · Jul 20, 2019

"Pampers is making a ‘smart’ diaper. Yes, really...

It’s come to this: There’s about to be an app for your baby’s diaper.

Pampers this week announced a line of smart diapers that it says will track a child’s urine as well as sleep...

The Lumi by Pampers line, which Pampers says has a waitlist ahead of its US launch this fall, includes an activity sensor that secures to a “landing” on the front of a baby’s diaper. It comes with a baby monitor and a 10-day supply of diapers. The sensor works with a corresponding app to log the kid’s pee and identify patterns...

Parents using the Lumi diapers will in theory not have to worry about checking any of that because they’ll get smartphone alerts. The app will display one of three diaper statuses: dry, wet, very wet...

The baby industry has recently been flooded with connected products, including connected onesies that double as sleep trackers and a robotic crib that’s supposed to help rock a baby to sleep...

Like other connected products, smart diapers could have issues with security and privacy. Baby monitors can be susceptible to hackers, and any app that holds personal information could potentially expose that information either to hackers or to the app’s maker or its partners....

A Pampers spokesperson said the account information will include a baby’s name, sex, date of birth and a 24-hour archive of video from the monitor, plus a profile photo if the parents choose to use one...

https://wtop.com/parenting/2019/07/pampers-is-making-a-smart-diaper-yes-really/

We're doomed 00

Peter2150 · Jul 20, 2019

So then the diapers will be hacked and...... Hmm Smart diapers stupid parents.

Log in or Sign up

A Long-Awaited IoT Crisis Is Here, and Many Devices Aren't Ready

ronjor Global Moderator

zapjb Registered Member

Stefan Froberg Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

Peter2150 Global Moderator

Log in or Sign up

A Long-Awaited IoT Crisis Is Here, and Many Devices Aren't Ready

ronjor Global Moderator

zapjb Registered Member

Stefan Froberg Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

Peter2150 Global Moderator

Useful Searches