Why smart homes are at high risk of being hacked

It has become a cliche that the smart fridge – one with sensors inside and connection to the internet on the outside – will one day automatically order milk or replenish other items before they run out.

The reality is not only different, but also darker: smart appliances have little protection from hackers and may be a way for cybercriminals to hijack devices, as well as invade privacy. Especially as smart TVs become standard – both in South Africa and across the world – we are exposing ourselves to dangers we don’t even know exist.

From TVs and fridges to security cameras and Wi-Fi routers, the very devices meant to make lives easier are also the ones that make us more vulnerable. And this is not theoretical.

As long ago as 2014, cybercriminals created a “botnet” – when a large amount of hacked computers are used in concert to mount a spam or other attack – which hijacked 100 000 devices, including routers, TVs and even a fridge.

“For some time we’ve seen attacks on security cameras, routers, and networking equipment,” said Marco Preuss, head of research at cybersecurity leaders Kaspersky Lab.

“There are a lot of things happening to abuse these devices for malicious activities against other users, but also using them as entry point to the owner’s system.”

Preuss was speaking at the Kaspersky Transparency Summit in Zurich last week, when Kaspersky Lab announced the opening of a Transparency Centre in Switzerland for regulators and other organisations to view its software code directly.

Picture: iStock

A panel discussion on the risks and rewards of transparency in cybersecurity highlighted the absence of trust in technology. In the past, if a cybersecurity company said it could be trusted, most people believed it. But that time has past, said Jan-Peter Kleinhans, project director for Security in the Internet of Things at a German think tank, Stiftung Neue Verantwortung.

“The term ‘trust me’ is 1990s cybersecurity,” he said. “If someone says trust me, I want proof of it. How do we trust them?”

This problem will become far worse once we cannot trust even appliance makers, Kleinhans said in an interview. “In the future, every product will be connected. For commercial off- the – shelf devices (Cots), we already see rapidly increasing demand for voice assistants, smart lighting and smart TVs. So the question is not if something gets connected but when.”

The worst of it, he said, is that there is little the consumer can do. Kleinhans called on regulators to step in and pointed to the European Union’s Cybersecurity Act as a potential solution.

“It focuses on voluntary certification and security standards in the hopes that manufacturers see IT [information technology] security as a competitive advantage. I don’t think voluntary certification by itself is enough, but it’s a solid first step,” he said.

“At the same time, there is a growing debate about ‘software liability’ in many European countries. I think over the next five years we will see tighter and clearer regulation regarding IT security in general.”

In the meantime, it is not only the home user who is at risk, said Preuss. “It affects everyone from consumer to small and medium businesses, to enterprises.

Nuclear power plant. Picture: iStock

“There is no limit in this whole environment, because more and more gets connected. In Germany, you have smart connected production facilities and public infrastructure like power plants and water supply that gets more and more connected, so that one can control what power needs to be produced to keep the network as stable as possible.”

The danger will escalate as energy production shifts from “classic nuclear and coal power plants” to solar and wind-based energy systems, which all depend on smart connected systems to pull their energy into the grid and keep it stable, he said.

“Every company is an IT company nowadays, whether they’re working with wood or stone or clothes,” said Preuss. “You’re an IT company because all your machines are connected, your manufacturers are connected and all your customers are online and connected. You have all this customer information digitalised.”

He outlined a wide range of potential cyber attacks in this environment, from ransom attempts by encrypting company data to stealing company information, to pretending to have cracked an account through password leaks and demanding payment not to publish sensitive information.

“The borders between consumers, small and medium business, enterprise and government are less and less visible, and everyone of us is now a node in the whole network,” said Preuss.

“On the internet, there is no longer a difference anymore between personal and business life. When I am private on a social network, I can still be targeted by people trying to get into my company. Everything is connected.”

The best-known example of a potential danger is the idea that smart fridges can be accessed by hackers and pulled together into a massive network, or “botnet”, that launches what is known as a distributed denial of service attack. This happens when a large number of computers attempt to connect to the same computer at the same time, causing it to crash.

Picture: iStock

The most widely distributed software used for this is called Mirai, which looks for unprotected internet of things devices. It is available as open source software for any hacker to download.

Preuss said: “Mirai was automated to spread on web cameras connected to the internet by using default username and password combinations. In most cases, users don’t change the default username and password or don’t know how or are not aware that they should.”

How safe are your devices?

Mirai is known as a compatible, self-propagating botnet virus, meaning that it runs on almost any computer processor and does not require human intervention to spread to other devices.

It is sent out using an internet protocol that connects to two ports on devices (ports 23 or 2323), that are not usually configurable by the end-user.

Mirai is designed to infect poorly protected internet-connected devices by attempting to log-in with usernames and passwords that are commonly provided by manufacturers. These could be anything from Wi-Fi router and network printers to wireless baby monitors.

Arthur Goldstuck is founder of World Wide Worx and editor-in-chief of Gadget.co.za Follow him on Twitter and Instagram on @art2gee

For more news your way, download The Citizen’s app for iOS and Android.