Non-Secure IoT Devices Are Powerful Weapons

The Institute for Critical Infrastructure Technology (ICIT), a cyber-security think tank, has published a new paper in which it argued that future IoT devices need to be secure-by-design and that there should be some regulation setting minimum security standards, too.

Failing that, the group warned that non-secure IoT devices or devices that have backdoors could be transformed into powerful weapons that rival nations could wield against each other.

Mirai, The Beginning of Massive DDoS Attacks

Since the open source Mirai botnet software was published on the Internet, we’ve started to see some powerful distributed denial of service (DDoS) attacks that can take down major websites or at least cause severe disruption to their service.

The attacks were mainly enabled by non-secure Internet of Things (IoT) devices, which are often not designed with security in mind and even come with backdoors or hardcoded credentials. This allows attackers to discover easy entrance into millions of devices and take them over.

However, despite all of this, many experts seem to agree that Mirai is only the beginning. As billions of IoT devices are predicted to come online over the next decade, we could see attacks that are orders of magnitude more powerful.

At that point, the non-secure or back-doored IoT devices are not just a threat to a handful of large companies or organisations, but to entire nation states. Massive DDoS attacks could be used to shut down critical infrastructure and cause chaos.

Rise of the Machines: The Dyn Attack Was Just a Practice Run

In the report called  “Rise of the Machines: The Dyn Attack Was Just a Practice Run”, which was written by James Scott and Drew Spaniel, both of whom are members of ICIT,  the authors warned that in the future it’s possible that China or other states could weaponise non-secure or back-doored IoT devices and then use them against rivals.

If that’s the case, and it at least looks like we’re heading in that direction, then the governments of all countries need to realize that non-secure IoT devices, or devices that ship pre-back-doored and can later be exploited by anyone, represent a serious national security risk.

Making IoT Devices "Secure-By-Design"

Throughout most of the paper, the authors argued for IoT devices that employ “security-by-design.” What that means is that manufacturers will have to ensure that their IoT devices are developed with security-first thinking.

All code will need to be written in a way that won’t cause too many security vulnerabilities later on, and multiple anti-exploit protections will have to be deployed. Both of which should end up saving the manufacturers some money with patching the systems, or even with recalls or lawsuits.

The ICIT authors said that right now, neither the buyers nor the sellers of IoT devices feel any responsibility for the damage their devices cause when they are taken over by botnets due to poor security. The buyers don’t care because DDoS attacks don’t impact their devices in a major way, and the sellers have simply moved on to selling a new version of their product, instead of investing in patching the older one.

Bruce Schneier, a well-known security expert, has recently argued that the non-security of IoT devices should be seen as invisible pollution that affects everyone. Therefore, just like with pollution, the only solution is some kind of government regulations on companies polluting the environment.

The ICIT authors also share Schneier’s view that governments should impose some minimum security standards on IoT manufacturers, along with liabilities in case something goes wrong. Companies affected by DDoS attacks from non-secure IoT devices should also be able to sue the makers of those devices.

The authors also said that regulation should be done responsibly so as not to hinder innovation too much. They suggested following security standards similar to those in other industries, such as the healthcare industry, as well as following security best practices such as the ones promoted by the NIST or other relevant agencies.

Back-doors should also be avoided at all costs. The authors said that whatever good may be achieved through them is outweighed by orders of magnitude by the potential of a nation state one day being able to use those same back-doors to attack and cripple national infrastructure of various critical services.

In the meantime, back-doors will also be discovered and used by many other “bad guys” for their own malicious purposes.

TomsHardware:          Rise Of The Machines:    

 

« Stolen Health Records Flooding Dark Web Markets
Protecting Employees From Data Breaches »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cyber Security National Lab (CINI)

Cyber Security National Lab (CINI)

The Cyber Security National Lab brings together Italian academic excellence in Cyber Security research.

Preempt Security

Preempt Security

The Preempt Platform delivers adaptive threat prevention that continuously preempts threats based on identity, behavior and risk.

Telecommunications Industry Association (TIA)

Telecommunications Industry Association (TIA)

TIA works to secure trust in networks by advocating public policy positions on the security of ICT equipment and services related to critical infrastructure, supply chain and information sharing.

Blake, Cassels & Graydon (Blakes)

Blake, Cassels & Graydon (Blakes)

Blakes is one of Canada’s top business law firms serving national and international clients in specialist areas including cyber security.

Pluribus One

Pluribus One

Pluribus One develops customized solutions and other data-driven applications to secure your business and your devices.

Elemental Cyber Security

Elemental Cyber Security

Elemental is a game changing cyber security compliance automation and enforcement technology provider.

Quantinuum

Quantinuum

Quantinuum is the combination of Cambridge Quantum with Honeywell Quantum Solutions, structured to drive the future of quantum computing.

Trellix

Trellix

Trellix is an extended detection and response (XDR) solutions provider created from a merger of McAfee Enterprise and FireEye Products.

Arcanna.ai

Arcanna.ai

Using a wide range of out-of-the box integrations, Arcanna.ai continuously learns from existing enterprise cybersecurity experts and scales your team’s capacity to deal with threats.

The PenTesting Company

The PenTesting Company

The PenTesting Company is owned and operated by offensive security professionals. Penetration Testing is essentially all we do.

ZILLIONe

ZILLIONe

ZILLIONe is one of Sri Lanka´s top enterprise technology solutions providers.

Epic Machines

Epic Machines

Epic Machines is a Value Added Reseller and Managed Security Services provider offering Security Transformation using Cloud-native solutions to commercial and government markets.

Recast Software

Recast Software

Recast Software exists to simplify the work of IT teams and enable them to create highly secure and compliant environments.

eGyanamTech (EGT)

eGyanamTech (EGT)

eGyanamTech provides robust security solutions tailored for Operational Technology (OT) and Supervisory Control and Data Acquisition (SCADA) systems used in critical infrastructure systems.

12Port

12Port

12Port network security solutions help companies tackle modern cybersecurity threats cost-effectively while implementing zero-trust architectures.

EK3 Technologies

EK3 Technologies

EK3 Technologies mission is to provide comprehensive cybersecurity and IT solutions that allow our clients to focus on sustaining their business.