There Are Real And Present Dangers Around The Internet of Things (IoT) - But Not Everything Is A Threat

Modern electric cars are just one category of Internet of Things
devices that will be targeted by hackers.

As reported by The Guardian: As with any buzz topic in the tech world, there’s a lot of misinformation around the Internet of Things. And in the security sphere, there’s much unnecessary FUD - Fear, Uncertainty and Doubt – spread by industry vendors to get people suitably scared so they splash cash on purportedly necessary protection.


Take the case of the spamming refrigerator. Researchers suggested the smart fridge had been compromised to relay reams of annoying emails, as often happens to normal PCs. Yet Symantec discovered the fridge was simply on the same network and using the same IP address as a hacked Windows PC, which was really the thing responsible for the spam. Digital listeria this was not.

Yet there are reasons to be fearful of the Internet of Things (IoT), a name covering the networks of embedded devices, from smart meters to connected automobiles, which communicate with each other in an automated fashion to help make our lives more efficient.

Such connected, autonomous machines have been around for years, but the reason it is now on the tips of tech firms’ PR tongues every day is that the number of connected devices is escalating rapidly into new areas, like toothbrushes and bathtubs. According to Gartner estimates, the IoT will consist of 26 billion units by 2020, and by that time the industry will be worth $300 billion.

The problem is that many of the manufacturers of these machines are not taking the secure-by-design approach. “They are learning on the job at this point in time,” says Gunter Ollmann, chief technology officer at IOActive, a consultancy firm that has done much research on IoT security.

Hacking vehicles

There are a handful of real and present threats. In automobiles, trucks are a major concern. Many contain standardized code to manage vehicles, such as the control area network (CAN) bus protocol, used for internal communications between devices in a vehicle.

“CAN messages that control physical attributes are standardized. Therefore, if you figure out a hack for one manufacturer others could be quite similar if not identical,” says Chris Valasek, director of security intelligence for IOActive.


One of the functions that has understandably worried onlookers in the trucking and security industries is the kill switch that powers the vehicles down. “Some fleets use the GPS tracking and ‘check-out’ systems to control access to the trucks when they are in depots or secure overnight storage locations to prevent the truck being stolen,” Ollmann adds.

“The open architecture of the trucks CAM bus has made it much easier for the integration of fleet tracking and control technologies like these. But conceptually, any wireless technology that can receive remote commands and affect the operation of a truck is a potential target for researchers and targets. What if someone figures out the master shutdown code for all the trucks, and they get all the trucks in London to stop at 7am?”

It’s a nasty thought, but this isn’t science fiction. Trucking companies are working with Ollmann and his team to close off any potential flaws that could lead to disaster. “We’re working with some of them and doing additional research on this now … they’re worried about it.”

The car industry is aware of the problems too, at least in its more progressive corners. When Valasek and noted security researcher Chris Miller showed on video how they could hack a car when inside the vehicle (below), it gave rise to both mirth and misery in the car industry.


Tesla has reacted the most positively. Having recruited some noted security pros, including former Apple “hacker princess” Kristin Paget, it has set up a vulnerability disclosure program rewarding researchers for uncovering flaws. It’s similar to bug bounty programs run by major software firms, like Facebook, Google and Microsoft. Evidently, the Rubicon has been crossed.


Hacking the home

The home is a viable target too, amusingly highlighted by the discovery of a hackable Japanese smart toilet last year. More recently, IOActive detailed flaws in home automation kit made by Belkin, including switches to turn electrical devices on and off, which could have been used to cause real-world damage, possibly a fire.

Those vulnerabilities were eventually addressed, but Ollmann says there are numerous flaws in connected home technologies from other manufacturers that will be disclosed in the near future.
TVs that run Google’s Android operating system are vulnerable to many of the same attacks that affect smartphones. MWR Infosecurity, a consultancy, has tested out an Android exploit on a Kogan TV running Android.

The attack took advantage of a documented weaknesses that allow hackers to use of a piece of code known as a JavaScriptInterface, included in ad libraries to let further actions be initiated on Android machines.
In theory, anyone hacking a TV in this way could take photos, if the TV had a built-in camera, or create invasive applications to spy on viewers. That weakness has been found in numerous ad libraries used by many of the world’s top free apps.

“It should affect any TV running Android and definitely if they’re running apps which use the flawed ad networks,” says David Chismon, researcher at MWR.


Home routers are ridden with vulnerabilities too, as uncovered by digital security non-profit Team Cymru in March. It found a network of 300,000 home and office routers had been compromised, thanks to worrying weaknesses in the devices’ software, from predictable or non-existent passwords to flaws in the web applications used to control them.

The hackers decided to use these security holes to redirect victims to whatever website they wanted when they started using the internet.


Taking over industrial controls

Connected, and therefore hackable, devices can also be found in control systems running nations’ critical infrastructure. Researchers across the world have been panicking about supervisory control and data acquisition (SCADA) systems, used to monitor and manage industrial machines, from nuclear power plants to oil and gas pipelines.
 

SCADA machines produced by various manufacturers have been shown to contain various weaknesses, like those exploited by Stuxnet, the infamous malware that disrupted centrifuges at an Iranian nuclear plant. What’s worrying is that more vulnerabilities continue to emerge.


In January, the US government’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) issued a warning about a buffer overflow vulnerability, a type of weakness that allows an outside hacker to write code to a device and which has been largely eradicated from modern systems.

The Guardian knows of one major security firm that is aware of a number of theoretical flaws, ones that could be used to play with the power controls on SCADA systems, but they do not currently have the right labs to test the potential for real-world impact.

This is another key problem: the threat is poorly understood, with many apparent vulnerabilities that may or may not be exploited to endanger critical infrastructure. “We keep seeing small examples of attacks that may or may not be cyber attacks against SCADA systems, but it’s still a theoretical threat in terms of spectacular and long lived degradation of a specific service,” says Steve Santorelli, a researcher at Cymru.

His outlook for the future of SCADA-like machines is not optimistic, though. “The internet is not secure frankly, in any way at all. That matters when it comes to control systems.”


Could your internet fridge be vulnerable? Yes. Photograph: Martin Argles for the Guardian

Send in the Cavalry

Santorelli has a similarly bleak prospectus for IoT in general. “Someone asked me recently: is my fridge going to DDoS me and, frankly the answer is, yes … probably,” he adds. “Anything with an IP address is a commodity in the underground economy, to be bought or bartered for if there is a way to make money from it.”

“The privacy and criminal implications are diverse and they need to be at the heart of the design of these new technologies. The bottom line is that we've never truly seen security be at the heart of a new technology and anything that connects to the Internet will be inherently insecure by its very nature. The future is not looking bright.”

Time to batten down the hatches and prepare for cybergeddon then? Perhaps not. Help is on the way, even if it’s not from government.

A movement started by noted security professional Josh Corman has been gathering pace in recent months, since it was first conceived at last year’s DEFCON hacking convention. Its name is I Am The Cavalry. Its intention is to act as a hub for vulnerability research that affects four areas: medical devices, automobiles, home services and public infrastructure.

The plan is to give altruistic researchers a place to share their findings in a pro bono fashion, in the hope that the weaknesses will be covered off by whatever manufacturers are affected. I Am The Cavalry will act as a hyperactive middleman, coordinating vulnerability disclosures and pushing for more than just quick fixes. It wants to encourage total cultural change to instill  security across organisations’ processes.

It’s an ambitious plan, born out of a sense of responsibility in a world ridden with hackable technologies. But will researchers really give away their secrets for free, especially the most technically gifted who can make millions by selling just a handful of the most serious flaws to nation states? Corman believes the ethical side of the hacking community will come out in force.

“I’m not making an economic argument yet,” he says. “Our role and what sets us apart is that we’re speaking to those who have something in them ... that altruistic gene. We’re describing something that is a shared risk and a shared concern and if that appeals to someone, they should gravitate to us.”

Praise for Tesla

Even ahead of its formation as an official organisation (it is consulting with lawyers on whether to become an educational foundation or an industry association), I Am The Cavalry has already facilitated some vulnerability disclosures.

Corman says the body has had successes in both the car and medical industries, but can’t disclose whom they involved. He has also been invited to consult with car manufacturers in the US and Europe, and is particularly impressed with the way in which Tesla has responded to the problems at hand.


“We are very encouraged to see such a policy [at Tesla]. A fear we've had as a research community is that we would have a 10-15 year learning curve where this new industry was in the denial and lawsuit stage towards researchers,” says Corman.

“If this is an indicator of how the rest of the automotive industry will respond in kind, this will dramatically accelerate the maturity and the engagement of white hat researchers who wish to help.”
As a sign of his sway with mandarins walking the murky halls of power, Corman has already met with Senator Ed Markey of Massachusetts, who recently urged car makers to act on cyber security issues, and others on Capitol Hill to discuss the weaknesses that urgently need addressing.

Despite limited “in the wild” attacks, Internet of Things threats are real. As connected devices proliferate, the hope is that they do so securely. If they volunteer for the Cavalry, that might just happen. Then we can go about our quotidian lives feeling a little less insecure.