Five ways attackers can create havoc in smart homes
New research from security firm Trend Micro suggests that some devices found in the average home are more of a risk than others when it comes to cyber attacks, there are still plenty of ways for attackers to create havoc.
According to Trend Micro’s IoT Device Security: Locking Out Risks and Threats to Smart Homes report, the number of smart home devices is predicted to increase globally by almost 17% every year until 2023.
As homes become more connected, it makes sense to understand what threats these connections may bring, and how to prevent them from happening.
But why would attackers want to target smart home devices? The research suggests motives such as burglaries, cyber stalking, botnet creation, cryptocurrency mining hubs, theft of personal information or financial information – the list is broad and almost endless.
Here are five findings from the research:
1. Smart locks unlock the house for intruders to easily enter; lock out users or residents and block the house remotely, or change the lock password remotely
2. Smartwatches spoof the user’s smartphone from the smartwatch; steal the user’s health data; and sends fake text messages from the smartwatch
3. Smart toys record the voices of the toys players and leak the recordings online, or use the toy to gain access to the home network
4. Smart vacuums track the home layout or monitor room activities remotely which can lead to planning further activities and movement
5. Home gateways can connect to a fake or malicious website to download malware, steal personal information, or control connected devices remotely.
“Individually many of the attacks mentioned above can be overlooked as harmless by many users. However, once a device or system has been compromised, hackers can strategise and formulate a combination of actions to escalate their attacks in hopes of exacting direr consequences,” the report says.
Take the humble connected robot vacuum cleaner for example.
“Thinking that the device is connected only to the home network, the owner of the smart home does not fear exposure through the smart robot vacuum cleaner. In truth, however, the vacuum’s Universal Plug and Play (UPnP) function automatically connect to the home router, thereby exposing it to the internet.”
“With no security measures in place against such an exposure, attackers are free to compromise the device as part of their campaign. Once the vacuum is compromised, at the outset the hackers use the device to familiarise themselves with the layout of the house, and then they move laterally to compromise other devices in the network. Using a combination of different possible actions and compromised devices inside the home, the hackers can strategise and plan a number of different attacks.”
So what can users do about it? The report suggests the following actions:
1. Patch vulnerabilities. Timely patches and firmware updates are two initial actions users can take since updates are usually related to security issues. Users can opt to enable the auto-update feature on supported devices to ensure that updates are applied as soon as they become available.
2. Change default settings and passwords. When users go through the settings of their devices one by one, they can take the opportunity to make necessary modifications to make the devices more secure. They should change the default or easy-to-guess passwords immediately, and use unique and strong passwords for multiple accounts. In setting up the devices, users should avoid using personally identifiable information, especially with the router settings.
3. Isolate devices. Users should also consider implementing network segmentation for certain devices and isolating them from the entire home network. This is especially needed for vulnerable devices that cannot be patched and yet cannot be replaced or removed by users.
Industry: Cyber Security & IoT / Internet of Things
- IAM Consultant- OKTA
- upto €90,000 plus benefits
I am looking for an experienced IAM process Manager to help drive forward a series of IAM implementation for a global Manufacturing business, Ideally you will be skilled with Okta and have knowledge of PAM Solutions, You will be responsible for: Driving the design and continuous improvement of complex IAM solutions in close collaboration with business partners Consult on the optimisation of IAM processes and design proper IT-based solutions to meet availability and quality targets Define technical specifications for SW-development (standards, design patterns, test cases, scenarios) and manage the life cycle of designed solutions Actively scan for relevant innovations and new technologies to identify further potential for improving IAM solutions and processes using OKTA Analyse new features of the regular Okta releases We are looking for someone with strong IAM experience as an Architect, Analyst, Technical Engineer, or similar role in the Identity and Security domain Experience with relevant certifications in development/administration, design and configuration of the Okta IAM platforms Familiar with LCM - joiners, movers, leavers, application federation - SAML, OIDC, SCIM and many other IAM terms Good mix of competences in IAM business process and project management concepts and tools e.g., ServiceNow, Jira, PRINCE2, SCRUM (agile)
- SAP Security Consultant
- upto €70,000 plus benefits
I am looking for an experienced SAP Security Consultant. The ideal candidate will have a strong understanding of SAP security concepts and be able to apply them to real-world scenarios. ideally you will also have experience with Securitybridge or Onapsis, or a similar SAP security tool. Your responsibilities will include: Reviewing and auditing SAP security settings and controls Identifying and remediating security vulnerabilities Implementing security best practices Educating users on SAP security Experience experience in SAP security Experience with Securitybridge or Onapsis, or a similar SAP security tool would be very advantageous Strong understanding of SAP security concepts Excellent problem-solving and analytical skills Excellent communication and presentation skills Fluent in French & English
- Post Grad MSc Cyber security - Junior Cyber Risk Analyst wanted. UK
- United Kingdom
- Entry role
The perfect start to your new Cyber Security Career. Post Graduate Cyber Risk Analyst Wanted. Are you are fresh from earning your Cyber Security MSc and eager to start your career in Cyber Security? We are looking for a recent post graduate to join a forward thinking Cyber Security Consultancy for the ideal entry role into Cyber Security. Whilst employed industry experience is not expected, as full training and support will be provided, a history of recent education in Cyber Security / Cyber Risk is essential. We are looking for someone with an inquisitive mind, who is confident to ask the right questions and who isn't afraid to challenge the status quo. Superb communication skills are a must (in person, written and verbal) This is a UK based role that is remote first with monthly travel (1-2 a month) to meet with the team and in time to meet clients. If you aren’t available to travel this isn’t the opportunity. We are unable to provide VISA sponsorship as there will be a requirement to achieve Security clearance If you're adaptable, open to fresh perspectives, and excited to be part of a forward-thinking team and looking for an opportunity to help make a difference in a Cyber consulting role, this opportunity is for you. For more information apply here……
- Microsoft Exchange Contractor | London | OUTSIDE IR35 | SC Cleared
- OUTSIDE IR35
Microsoft Exchange Contractor | London | OUTSIDE IR35 | SC Cleared • We require someone that has experience of migration exchange from windows server 2012 to 2019. • In depth understand of On-Prem exchange server management and deployment. • Experience migrating On-Prem exchange servers from 2012 upwards. • Secure Email Gateway experience essential Due to the nature of the requirement the individual must be commutable to London 2-3 days a week.