Warnings about the security of IoT (internet of things) and smart devices, among others, have come from various quarters and both at home and abroad recently from official bodies. Among others, the Dutch Cyber Security Council released a report in which it addressed the potential dangers of the digital society.
It seems that the Internet of Things (IoT) is starting to make its way into businesses; more and more machines are being connected online, with predictions of over 20 billion connected devices by 2020, according to Ericsson and Gartner. From wearables, smart refrigerators and thermostats to smart street lights, containers, bins, traffic lights and dairy cows.
However much potential the Internet of Things has to offer, there are also dangers lurking in the digital revolution. Over the past few weeks, official warnings have come out from various bodies, both national and international, around this topic.
Also at home
For instance, scientists at MIT brought out a report that hackers are able to disable production lines or even blow up factories via the smartphone apps used to manage them. In the Netherlands, the Cyber Security Council warns about the poor security of IoT devices.
MTI researchers Alexander Bolshev of IOActive and Ivan Yushkevich of Embedi examined 34 management apps, all randomly downloaded from the Google app store. They found as many as 147 security flaws. Only two apps were completely secure. In some apps, it was possible to modify the information the machine sends to the administrator. The administrator then gets a message saying everything is fine, while in real life the temperature rises far too high, for example. It was also possible to get servers to give incorrect commands to entire production lines.
To spread the risk, factories often use multiple sources of information. Yet Bolshev and Yushkevich came through. "Not crazy," thinks cyber-safety specialist Beau Woods of the Atlantic Council. 'The apps are made so that administrators can always access each device in different ways. This is precisely to increase security the moment something breaks or short-circuits. But this also increases the chances for malicious people to break in.'
Action needed
In the Netherlands, it is the Cyber Security Raad, an independent government advisory body, that is sounding the alarm. The Scientific Research and Documentation Centre has commissioned an exploratory study and argues that the expansion of Internet-enabled smart devices could also cause a proliferation of unsafe devices. It therefore calls on the government to take additional measures to protect consumers from harmful excesses of the Internet of Things. 'This research shows that if no measures are taken, IoT can have far-reaching consequences. At present, IoT - applications are often poorly secured, posing a threat to our security and privacy. The Mirai - botnet, consisting of hacked IoT - devices, shows that the impact can already be significant and this will only increase in the future. It is important that security and privacy risks are addressed to minimise and prevent damage. To secure our prosperity and well-being for now and the future, targeted action is needed.'
Taking the right measures is difficult because there are many different devices, all secured in different ways and levels. Moreover, they are rarely updated.The CSR recommends:
- to provide certification, labels and access requirements, to keep unsafe devices off the (European) market;
- making publicly available information on which manufacturers and suppliers are not adequately securing their devices;
- via a 'labelling' system to inform consumers about (i) the level of security of the device in question; (ii) whether the device can receive security updates automatically; (iii) the length of time the product will be maintained by the vendor; and (iv) whether the device can be disconnected from the internet while retaining 'regular' functionality;
- manufacturers to be held legally liable for also economic damages
- asking internet service providers to help clean up infected IoT devices in their networks, analogous to the successful handling of botnets;
- by ensuring sufficient mandate and capacity for regulators to properly enforce
Last week, a report also appeared on AD.nl stating that 2018 will be the year when companies will definitely embrace the Internet of Things. Among others, KPN is featured, a company that three years ago already developed a special nationwide network: the Long Range Low Power network (LoRa). It is intended for devices that only occasionally connect to the internet, such as a rubbish container that needs to give a notification when it is full. KPN has now connected over 3 million devices to the internet. A number the company is happy with, but which it thinks could be much more. '2018 should be the year that companies really get going with IoT,' Vodafone and T-Mobile also built their own IoT networks in recent years.
By: Kelly Bakker
Source: CSR, engineersonline
