Unconfigured IoT is a security risk, warns researcher

Coffee makers could be a risk

Businesses could be at risk from consumer IoT devices such as coffee makers or drinks dispensers that are put in the corporate environment, but do not go through an IT security risk assessment and are thought to be safe because they are not connected to the internet.

“There is also the additional risk that if these consumer IoT devices are equipped with a camera or microphone, if the device is compromised, these could be activated to enable eavesdropping in an office environment,” said Munro.

And the risk does not stop there, he added, because appliances that have not been connected to the internet are unlikely to have had a software update since they were first installed.

“This means that an attacker could upload a rogue version of the device’s firmware to modify the way the device works,” said Munro. “A compromised IoT washing machine could be modified so that water pressure causes it to explode or a fire alarm system could be modified to prevent it detecting and responding to a fire. So not configuring a device by not connecting it to the internet is not without risk.”

This is particularly risky with devices such as wireless screen-casters, which are typically used in business environments to share laptop or mobile displays by casting them to a projector in the boardroom.

“Our research has found that these devices are often connected to corporate networks through the network ports when they are installed, sometimes without the company knowing,” said Munro. “This effectively creates a backdoor to the network through an unconfigured device that is not connected to the internet.

“The installer is directly responsible, but the manufacturer is also responsible for not really thinking about how it should be installed, and the end- user for not checking how it was installed.”

Bluetooth connectivity poses an even greater risk than Wi-Fi, said Munro, because users often have no process in place for authenticating or authorising the mobile device they are connecting to, enabling anyone within range to connect.

The inherent security risk of IoT devices has led to calls around the world for government intervention in the form of legislation to ensure all IoT devices conform to minimum security requirements.

In what many regard as a precursor to IoT legislation in the UK, the government has published a voluntary security code of practice for the consumer IoT market that is backed by the EU’s General Data Protection Regulation (GDPR) and the UK’s new GDPR-aligned Data Protection Act in the hope that device manufacturers will follow best practice to win market approval and competitive advantage.

Munro has hailed the code of practice as an important first step to improving IoT security that puts the UK ahead of many other countries, but points out that the code does not appear to address the risk posed by unconnected, unconfigured devices.

“I don’t think it sets out a specific recommendation for radio frequency transmitters and receivers on IoT devices to be off by default,” he said, “and in my experience, as soon as you power up most of these devices, the wireless capability is enabled, with few exceptions.”

Munro believes the wireless connectivity of IoT devices should be off by default and that they should be equipped with a button or some other means to enable users to choose to turn it on and put it into pairing mode. “Currently, IoT devices with this kind of functionality are few and far between,” he said.

Proof-of-concept attacks

Although Munro has carried out proof-of-concept attacks that compromise more complex unconfigured IoT devices, such as screen-casters, to compromise corporate networks and bypass firewalls, he said that if organisations are targeted in this way, they are unlikely to be aware of it without carrying out a forensic analysis of the affected device, but that this is not possible on most IoT devices because of limited functionality.

“Even if you suspected that a device in your organisation had been targeted in this way, it would be very difficult to prove it,” he said, adding that organisations should ensure that all IoT devices are either connected and configured securely or that their wireless connectivity is turned off.

In November 2018, Munro called for government action on IoT security at the EEMA ISSE 2018 cyber security conference in Brussels.

At the time, he said that although the UK code of practice was a good start, there was still a long way to go and he would like to see some basic regulation.

Since then, UK digital minister Margot James has gone on record as saying that legislation on IoT security is likely in the long run, said Munro.

“This is a big step forward and something that I have been advocating for a long time,” he said. “I think IoT suppliers have probably got about a year to start paying attention and to get things right.

“We have to regulate because there are just too many smart products on the market by too many manufacturers who just don’t care about the security risks.”