IoT threats: same hacks, new devices

F-Secure finds IoT threats and attacks are increasing, but rely on well-known security weaknesses.

Tuesday, 2nd April 2019 Posted 5 years ago in by Phil Alsop

The internet of things explosion has proven controversial due to the insufficient security measures in many of these internet-connected devices. And a new report from cyber security provider F-Secure finds that threats and the number of attacks continue to increase, but still rely on well-known security weaknesses, such as unpatched software and weak passwords.

The report, using data collected and analyzed by F-Secure Labs, highlights that threats targeting internet-connected devices are beginning to multiply more rapidly than in the past. The number of IoT threats observed by F-Secure Labs doubled in 2018, growing from 19 to 38 in the space of a single year. But many of these threats still use predictable, known techniques to compromise devices. Threats targeting weak/default credentials, unpatched vulnerabilities, or both, made up 87% of observed threats.

F-Secure Operator Consultant Tom Gaffney says that larger device vendors are paying more attention to security than in the past, but there’s a lot of devices from many different manufacturers that don’t offer consumers much in the way of security or privacy.

“The big guys like Google and Amazon have made strides in their smart home products with the help of massive backing and ethical hackers like our own Mark Barnes, who executed the first proof of concept for a hack of an Echo in 2017,” said Gaffney. “But for years manufacturers have been releasing products without giving much thought to security, so there’s a lot of ‘smart’ devices out there vulnerable to relatively simple attacks.”

IoT threats were rarely encountered before 2014, the report explains. But that changed around the time the source code for Gafgyt – a threat that targeted a variety of IoT devices, including BusyBox devices, closed-circuit television (CCTV) devices and many digital video recorders (DVR) devices – was released.

In October 2016, Mirai, which was developed from Gafgyt’s code, became the first IoT malware to achieve global infamy when its massive botnet was used to launch one of the largest distributed denial-of-service attacks in history.

Mirai’s code has been public “for Research/IoC Development Purposes” since 2016. Originally, it used 61 unique combinations of credentials used for infections. Within three months, that number had reached almost 500. And it’s incredibly prevalent as a malware family. Approximately 59 percent of attack traffic detected by F-Secure’s honeypot servers in 2018 targeted exposed telnet ports, with Mirai’s attempts to spread as the main culprit behind the attacks.

According to F-Secure Labs Principal Researcher Jarno Niemela, the root cause of many of the IoTs problems starts with the manufacturers’ supply chains.

“Most device vendors license software development kits for the chipsets they use in their smart cameras, smart appliances, and other IoT devices. That’s where the vulnerabilities and other issues are coming from,” explains Niemela. “Device vendors have to start asking for more in terms of security from these suppliers, and also be prepared to issue updates and patches as they become available.”

F-Secure’s report, IoT threats: same hacks, new devices, also includes:

A quick history of IoT threats from the turn of the millennium through 2018
An overview of the failures and potential hopes for regulation
A look at potential privacy risks associated with IoT devices