Hackers can exploit the insecurity of IoT devices for the purposes of espionage or DDoS attacks
Image: iStock
Cyberattacks exploiting the insecurity of the Internet of Things and hackers increasingly attempting to compromise industrial connected devices represent some of the biggest threats to the UK, those responsible for ensuring national security have warned.
Citing incidents including the internet crippling Mirai botnet cyberattack and vulnerabilities in a children’s doll which could potentially be exploited to conduct espionage on unsuspecting victims, a new report by the intelligence services has warned that the rise of IoT devices is providing threat actors with even more opportunities to attack targets than ever before.
The joint National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) ‘The cyber threat to UK business’ report details the growing threats to individuals and organisations from cyberattacks of this variety and much more.
Noting how many IoT devices are shipped with insecurities which make them vulnerable to remote takeover – and without means to update or otherwise fix the devices – the report warns about the increased threat of IoT botnet attacks; and that this form of cyberattack is going to get more frequent and more damaging in future.
If attackers continue turn their efforts towards attacking industrial connected devices, then it could have potentially devastating consequences, with the threat of hackers turning off infrastructure such as electricity, water or heating by hijacking or overwhelming insecure IoT devices.
The NCSC/NCA report warns that “sufficient safeguards are still not in place to protect these systems that were never designed to connect to the internet” which could ultimately result in damaging physical, real world consequences.
Indeed, the National Cyber Security Centre cites a cyberattack in Finland, which saw just a DDoS attack disabled residential automated heating systems in apartment blocks for more than a week.
The report also warns on the increasing threat posed by ransomware, which has risen to become one of the biggest threats on the internet.
Citing ransomware-as-a-service schemes on the dark web which allow almost anyone to become a cybercriminal, the report warns how ransomware allows “individuals and groups to have an impact disproportionate to their technical skill” – especially as those carrying out the attack are increasingly targeting businesses.
Cybercriminals are already targeting smartphones with ransomware, but the report warns how 2017 will see hackers attempt to lock down other types of mobile devices including fitness trackers and TVs.
While the information stored on these is unlikely to be worth much for anyone looking to sell it on the digital underground, the report predicts that “the device and data will be sufficiently valuable to the victim that they will be willing to pay for it”
“Cyber attacks will continue to evolve, which is why the country must work together at pace to deliver hard outcomes and ground-breaking innovation to reduce the cyber threat to critical services and deter would-be attackers,” said Ciaran Martin, CEO of the NCSC, speaking ahead of the agency’s CYBER UK conference in Liverpool.
Nonetheless, the NCSC – part of the GCHQ intelligence service – believes that IoT security is likely to “eventually” improve, but the government needs to play a role in ensuring these devices are secured.
“Government also has a part to play in promoting smart device security and helping to develop standards such as the NCSC’s and the Department for Business, Energy & Industrial Strategy’s work to ensure the Smart Metering System has proportionate security measures in place,” says the report.
However, the threat is set to loom large for the immediate future thanks to the millions of insecure smart devices which are already connected to the internet – especially as millions more will be connected in the years to come, the report warns.
“Malware authors will continue to exploit them to mount attacks and will continue working to find fresh vulnerabilities. The ‘botnet of things’ will present a serious challenge to cyber security for a considerable time to come”
The release of the NCSC/NCA report comes shortly after tech industry body the Online Trust Alliance (OTA) issued a rallying cry for vendors, retailers, and users to act together to “avoid digital disaster” caused by insecure IoT devices.
