Dive Brief:
- Hackers are increasingly targeting internet of things devices, including on home networks, in attacks that can serve as launching pads for campaigns against enterprises, security firm Bitdefender and networking vendor Netgear said in a report on Wednesday.
- “As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices,” the report said, describing home IoT devices as “an ideal foothold,” because they are “always on, reliable, and rarely monitored.”
- While the report focuses on home networks, it has implications for businesses that run similar devices on enterprise networks, as well as for companies whose executives are vulnerable to compromise at home.
Dive Insight:
The Bitdefender/Netgear report contains a wide range of data about exposed IoT devices, the vulnerabilities they carry, and the attacks they experience.
Smart TVs are the most vulnerable category of IoT device, accounting for roughly 23% of all vulnerabilities that researchers identified through public internet scans. Smart plugs and network-attached storage (NAS) devices followed close behind (22% each), with IP cameras (7%) rounding out the top-four list.
“Devices meant to simplify life, like smart plugs, end up as the easiest entry points,” the report said, “while data-heavy appliances like NAS units become the most valuable targets.”
Connected TVs in particular are a serious cybersecurity risk if not properly managed, according to the report. That finding is especially relevant to businesses, many of which place TVs in conference rooms and then largely ignore them.
TVs create multiple attack vectors for hackers, who can either spy on people using their microphones, pivot from the TVs to other network assets or use the devices as residential proxies to relay traffic for other hacks without raising red flags.
Virtually all of the IoT exposures that Netgear and Bitdefender found involved known vulnerabilities with available patches. “Only a fraction of attacks leverage weak passwords or plaintext authentication,” the report said.
Three high-severity Linux flaws topped the list of firmware CVEs affecting IoT devices, according to the research. In an analysis of the full list of relevant CVEs, researchers found that nearly half of them received a severity score of 7.8, with only a small number rating higher than that.
Slightly more than half of the vulnerabilities expose IoT devices to overflow errors — in which a device tries and fails to process data that exceeds its available storage capacity — while denial-of-service and memory-corruption flaws each account for roughly one-fifth of observed vulnerabilities.
As businesses survey the IoT cybersecurity landscape, the report’s predictions offer guidance for how to prioritize asset inventorying and continuous monitoring.
Among those predictions: More disclosures of flaws that affect multiple vendors “because their products share firmware components, connectivity libraries or underlying hardware platforms.”
