Wireless printers, webcams, DVRs and other connected devices can become tools hackers can use for no good, according to a new report. It’s already happened, and online security professionals say too many people still don’t know how to protect against those kinds of attacks.
Advertisement
Every year, Pwnie Express, a computer security company that started in Vermont and still does product development in Burlington, publishes a report called the “Internet of Evil Things.” It uses feedback from IT professionals as well as data from Pwnie Express itself to examine how these connected devices, which make up an internet of things, can be — or have been — used for hacking.
“What are the devices? And what are the threats? And what kinds of actual problems are people seeing in the real world with them?” said Pwnie Express marketing officer Dimitri Vlachos.
“We’ve seen attacks and it’s no longer theoretical that IOT devices pose a risk,” he said.
An attack in 2016 marked a major turning point.
“It was very serious. It took down New York Times, Twitter — I mean major internet providers — for hours,” Vlachos said.
The malware behind the attack was called Mirai. It took over countless devices, like webcams and DVRs, without the owners ever knowing it, and turned them into an army that knocked out major internet infrastructure for hours. Twitter, the New York Times,Netflix and many other websites were all impacted.
“And that’s a very loud attack, that’s someone saying ‘Hey look what I can do,’ and I think what people are really starting to wake up to is, they’re more concerned with what are they going to do to me,” Vlachos said.
In other words, businesses, especially those that handle credit card data and other sensitive information, are waking up to the new threat now that they’ve seen it in action. The report highlights a risk of ransomware, which hijacks your files.
“And a message comes up that says ‘Hey David, if you want access to this you need to pay me $50,000 and you have three days or I’ll delete all your data,'” Vlachos said.
Vlachos said the report also highlights possible vulnerabilities in some of the industry’s biggest companies. It said HP printers and Netgear routers are vulnerable if the settings aren’t changed.
“In default configurations these devices are meant to be very easy to use, set up. You probably have some at home. And they’re meant to be, ‘Hey, connect, open up a Wi-Fi network so I can connect. But that comes at a cost in terms of openness and ability to actually gain access. So those are just two examples — HP printers and Netgear equipment — are two examples of very prevalent equipment that is highly at risk,” he said.
HP didn’t give an official statement by the time this story originally ran, but they did say they make some of the safest printers and take security very seriously. Netgear noted security measures in place, encouraged users to set their own passwords, and also said they have a public “bug bounty program” to identify potential vulnerabilities.
You can find the 2017 “Internet of Evil Things” report here.
WEBVTT TODAY — IT IS NOT OUT YET –TODAY — IT IS NOT OUT YET –AND THEY GAVE US A FIRST LOOK.AND MAKE NO MISTAKE.THEY SAY THE THREAT IS GROWING.DAVID: THE INTERNET OF EVILTHINGS.IT’S AN OMINOUS-SOUNDING REPORTTHAT LOOKS AT HOW WIRELESSDEVICES THREATEN ONLINESECURITY.DIMITRI VLACHOS: WHAT ARE THEDEVICES?WHAT ARE THE THREATS?AND WHAT KINDS OF ACTUALPROBLEMS ARE PEOPLE SEEING INTHE REAL WORLD WITH THEM?DAVID: DEVICES INCLUDEEVERYTHING FROM PRINTERS ANDWIRELESS ROUTERS TO HOSPITALEQUIPMENT AND MORE.IT’S THE INTERNET OF THINGS, OR”IOT.”VIRTUALLY ANY NETWORKED DEVICE.AND THEY ARE VULNERABLE.DIMITRI VLACHOS: WE’VE SEENATTACKS, AND IT’S NO LONGERTHEORETICAL THAT IOT DEVICESPOSE A RISK.DAVID: COMPUTER SECURITY COMPANYPWNIE EXPRESS PUTS TOGETHER THEINTERNET OF EVIL THINGS REPORT.THEY SAY AN ATTACK IN 2016MARKED A MAJOR TURNING POINT.DIMITRI VLACHOS: IT WAS VERYSERIOUS.IT TOOK DOWN “NEW YORK TIMES,”TWITTER.I MEAN MAJOR INTERNET PROVIDERSFOR HOURDAVID: THE MALWARE BEHIND THEATTACK WAS CALLED MIRAI.IT TOOK OVER COUNTLESS DEVICES,LIKE WEBCAMS AND DVR’S, ANDTURNED THEM INTO AN ARMY THATKNOCKED OUT MAJOR INTERNET SITES, LIKE TWITTER, THE “NEW YORKTIMES,” AND NETFLIX, FOR HOURS.IN OTHER WORDS, BUSINESSES,ESPECIALLY THOSE THAT HANDLECREDIT CARD DATA AND OTHERSENSITIVE INFORMATION, AREWAKING UP TO THE NEW THREAT NOWTHAT THEY’VE SEEN IT IN ACTION.THE REPORT ALSO SAYS HEALTHCAREAND OTHER INDUSTRIES ARE MOREVULNERABLE TO RANSOMWARE, WHICHHIJACKS YOUR FILES.DIMITRI VLACHOS: AND A MESSAGECOMES UP THAT SAYS, “HEY, DAVID,IF YOU WANT ACCESS TO THIS, YOUNEED TO PAY ME $50,000, AND YOUHAVE 3 DAYS, OR I’LL DELETE ALLYOUR DATA.”DAVID: VLACHOS SAYS THE REPORTHIGHLIGHTS SOMETHING ELSE THATMAY AFFECT EVEN MORE PEOPLE.IT SAYS H.P. PRINTERS ANDNETGEAR ROUTERS ARE PARTICULARLYVULNERABLE IF THE SETTINGSAREN’T CHANGED.DIMITRI VLACHOS: IN DEFAULTCONFIGURATIONS, THESE DEVICESARE MEANT TO BE VERY EASY TOUSE, SET UP.YOU PROBABLY HAVE SOME AT HOME.AND THEY’RE MEANT TO BE HEY,CONNECT, OPEN UP A WIFI NETWORK,SO I CAN CONNECT.”BUT THAT COMES AT A COST INTERMS OF OPENNESS AND ABILITY TOACTUALLY GAIN ACCESS.SO THOSE ARE JUST TWO EXAMPLES,HP PRINTERS AND NETGEAREQUIPMENT, ARE TWO EXAMPLES OFVERY PREVALENT EQUIPMENT THAT ISHIGHLY AT RISK.DAVID: VLACHOS SAYS ONE OF THEBIGGEST TAKEAWAYS FROM THISYEAR’S REPORT IS THAT THE THREATFROM THE INTERNET OF THINGS ISREAL, NO LONGER JUSTTHEORETICAL.HP DIDN’T GIVE AN OFFICIALSTATEMENT BY THIS MORNING, BUTTHEY DID SAY THEY MAKE SOME OFTHE SAFEST PRINTERS OUT THERE.NETGEAR NOTED SECURITY MEASURESIN PLACE, ENCOURAGED USERS TO
