Beware Of The Internet Of Things' Despicable Side

With John Chambers' Internet of Everything vision from CES 2014 and Google's acquisition of Nest Labs ringing in my ears, it's easy to get carried away with the promise of connected smart gadgets and embedded systems. But despite the hype and hyperbole with the Internet of Things, it is expected to generate tremendous economic value -- as much as $6.2 trillion annually by 2025, according to the McKinsey Global Institute.

Beyond the dollar signs, what I find exciting are examples where connectedness actually improves the lives of people. I'm not talking about a smartwatch telling me how I can burn extra calories, or my toothbrush dutifully reminding me my teeth need an extra polish. But rather innovation focused on improving the quality of life for people who often have no access to valuable technology.

[Sensor-equipped objects and their networks will reshape your life. Read CES 2014: Cisco's Internet of Everything Vision.]

Take for example the smart homes project in Australia -- where low-cost, non-invasive sensor, monitoring, and video systems are being developed to help the elderly live longer safely in their own homes. Or Safecast, a crowd-sourced global sensor network developed following the Fukushima nuclear disaster to collect and share radiation measurements.

But with all the power to work for the greater good, there is unfortunately a dark side. There are cases where security exposures in physical devices and embedded systems could easily cause severe disruption. So just like the main character Gru (below) in the brilliant, computer-animated movie Despicable Me, I could -- if I was so inclined and had the technical smarts -- engage in some pretty nefarious and wicked activities. For example:

Figure 1:

I'm too nice to do any of this, but these examples remind us that the Internet of Things is becoming the new playground for a variety of hackers. These range from nuisance factor "script kiddies" with access to publically available tools, to more coordinated groups who have the means and inclination to cause harm. 

This all creates a new challenge for security professionals  -- understanding and mitigating the risks associated with what is often out of scope: safety. And it's a huge issue requiring non-traditional, even "despicable" ways of thinking.

Understand your devices
Unfortunately, systems that have computing embedded into the device can be vulnerable. This could range from outdated open-source code to processor backdoors that can easily be exploited.

Products could also be made up of specialized OEM components where patching is not top-of-mind for the manufacturer -- especially those operating on razor thin margins. As such, OEM security shortcomings can be as basic as hardcoding passwords into components that find their way into many products. An example: Last year, the FDA and Department of Homeland Security were forced to issue an alert urging medical device manufactures to upgrade security protections to protect against potential cyber threats.

It's important therefore that security pros become much more familiar with embedded systems and equipment beyond PCs, servers, and networks. This shouldn't be restricted to the technology itself, but also to understanding compliance and legal issues when hardware and software are provided by other manufacturers.

Walk on the nefarious side
Any IT pro worth his salt constantly surveys the security landscape for risks and vulnerabilities. But IoT exposures have been largely rare and hidden. When they have surfaced, vendors have been slow to disclose and fix them -- possibly because they're not yet motivated to do so or lack IT expertise.

My advice is to become more familiar with security issues openly discussed via new channels. This should include organizations such as the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). But check out other resources too such as Black Hat security conferences where experts present on IoT-related security topics.

Develop a killer instinct
Security experts have been trained to defend and protect applications and information. Now there's a twist -- any models and processes must be extended to consider the actual safety of people.

So, while it's still important to understand how a system can be attacked and information compromised from a privacy perspective, it's now crucial to extend that analysis to Internet of Things safety-related scenarios. This was illustrated just last year when a popular brand of smart LED lighting system was vulnerable due to authentication issues, which if compromised, could cause home blackouts. Maybe that's not particularly dangerous, but what if a botnet controlled malware attack infiltrated insecure lighting systems on a mass scale -- at sporting venues or in hospitals?

Unlike the ending in Despicable Me, I can't see a happy ending here -- at least for the time being. But I'm an optimist. In time all aspects of security will improve, but for now think about and work to prevent the more devious ways your connected things can be hacked. If you don't, someone else will.

Peter Waterhouse is a senior technical marketing advisor for CA Technologies' strategic alliance, service providers, cloud, and industry solutions businesses.

Interop Las Vegas, March 31 - April 4, 2014, brings together thousands of technology professionals to discover the most current and cutting–edge technology innovations and strategies to drive their organizations' success, including BYOD security, the latest cloud and virtualization technologies, SDN, the Internet of things, Apple in the enterprise, and more. Attend educational sessions in eight tracks, hear inspirational and industry-centric keynotes, and visit an Expo Floor that brings over 350 top vendors together. Register for Interop Las Vegas with Discount Code MPIWK for $200 off Total Access and Conference Passes.