How do I protect my IoT devices from being hacked?
Hi, everyone.
Leo Notenboom here for askleo.com
Let's dive right into this question.
"I am concerned about denial of service attacks that have evidently be driven
by huge numbers of compromised Internet connected devices.
I don't want any of my devices to be part of that attack.
All of my Internet connected devices are located behind my router.
(granted, an old Linksys BEFSR81)
and password protected.
Is everything sufficiently hidden from Internet attacks,
in any event, are strong passwords enough to prevent rogue access?"
So what you're talking about is very much a concern.
Two things have become excruciatingly clear over the past couple of years.
We're connecting more and more random things to the Internet than ever before,
and it appears security on those things is abysmal.
So what does that mean?
How do you protect yourself from being part of this problem?
Well, it may not be as easy as we would hope, but there are a couple of ideas.
IoT
that stands for the Internet of things.
It's not a separate Internet.
It's not a separate network at all.
All it really refers to is that up until the past couple of years,
or some years ago, we talked about connecting computers to the Internet.
Your computer, obviously, your laptop,
your mobile phone was very clearly a computer in your pocket
routers themselves are computers, printers, all those kinds of things.
It's very easy for us to conceptualize
those things as computers of one sort or another.
But then computers got cheap and small and portable and all sorts of other
interesting things that really increased their power and their utility.
So we started putting them in other things.
Now we're talking about things like smart
TVs, security cameras, light switches, light bulbs,
refrigerators, washing machines, and even toasters of all things.
Yeah, those are the things
when we talk about the Internet of things. It's not a separate network.
It is simply referring to the fact
that all of these things that we don't usually consider
being computers are now being connected to the Internet, and basically
they're just more computers on the Internet for hackers to hack.
And that, of course, is the problem here.
When these devices, I'll just use the toaster as an example,
get
technology added to them.
It is apparently extremely easy to overlook some basic
security principles, and that's actually,
I don't want to say it's forgivable, but it's at least somewhat understandable,
because let's face it, who wants to hack your toaster?
I mean, the worst case, the absolute worst case is that your toast comes out
dark instead of light black instead of uncooked.
That's not the thing,
but that's the kind of thing we think about when we talk about hacking a device,
taking over a light bulb, taking over a switch,
taking over a toaster. Making it behave in ways
that it wasn't designed to behave doesn't seem very lucrative.
And to be honest, it's not.
What is lucrative, however,
is that there is a small computer in each of these devices,
and in fact, it's a small computer connected to the Internet.
It knows how to connect to the Internet.
So what's been happening, of course,
is that hackers have been compromising these Internet of things devices
and using them not to control the device, not to do malicious things, to
what would apparently be
the device itself, but rather to use their Internet
connectedness to do other things, like participate in denial of service attacks.
That's where you have thousands, if not millions of different devices
all trying to reach the same website at the same time.
That tends to bring down the website
because it can't keep up with the requests.
Well, there's millions of these little
Internet connected devices all over the place with poor security.
They're great resources for hackers to use to do exactly that.
Computing power is dirt cheap,
and it's everywhere your light bulbs and your toasters.
So what is it you can do?
Well, as it turns out,
maybe not a lot.
The first thing you've done, of course, is the right thing to do.
And that is be behind a router.
That actually does stop a vast majority of all sorts of different hacks.
I tend to refer to your router often as a firewall.
It actually prevents connections from being initiated from the outside.
Unfortunately, a lot of Internet connected things don't work that way.
They're not waiting for someone to connect to them.
They are often in constant or periodic contact with upstream controllers.
Your light bulb might actually be working
with an upstream service provider that's basically listening for you to tell
the light switch what to do or the light bulb what to do.
That means, of course, that they're connecting across the Internet.
They're communicating across the Internet.
They're initiating the contact over the Internet,
and that gives hackers an opportunity to potentially compromise the connection.
So definitely the router is the first good thing to do.
Most of us are already doing that the other thing.
And this is an easy one to overlook.
And it's not always possible
is the other suggestion you made, and that is to change the default password.
Make sure that every internet connected
thing you have that came with the default password has a new one.
You've changed it to something.
Honestly, at this point, I would normally say you should make it long and strong.
And yadda, yadda, yadda.
In reality, change it.
That's the most important thing.
Make it strongish.
But you don't have to go all over the place to make sure that it's
super strong for most of these internet connected devices because the hackers are
simply leveraging the fact that so many people don't do this,
they just go out and they try and connect to all these different devices
using their default password and a surprising amount of time
it just works.
So.
What if it doesn't have a password?
Well, unfortunately, you can't fix bad design.
We can hope that things get better over time.
But the bottom line is that especially
for some of the older devices, especially for some of the devices that,
as it turns out, share the little computing component.
They all get it from the same third party vendor that has flaws in it.
They're not updating their software
because they were never designed to do that.
They really didn't have security baked in from the beginning.
They may not have passwords.
There's really not a lot you can do.
All you can really do is to try, I guess, and keep an eye on your network traffic.
But to the extent that you can as you get new Internet connected things,
try and make sure that they're relatively secure.
Look at the reviews, look at the information available for them.
If there's a way to update the software on them.
That's fantastic, because that means that
if something is discovered, it can be updated and fixed.
I am not saying that you shouldn't use these devices.
I'm not saying that you should disconnect from the Internet.
The utility that they provide is actually fairly impressive.
Heck, I'm sitting in a home full of these
devices, from light switches to my Amazon Echo, and I've got other things as well.
I've got doorbell cameras,
my smart TVs are disconnected because the smartness didn't really add any value.
But I've got my Roku and a couple of Google Chromecast devices.
I've got lots of things connected
to the Internet, and I'm absolutely positive that not all of them are as
secure as I would want them to be right now.
I'm not perceiving a huge risk. If I do,
well, I'd probably upgrade them with things that are more secure.
But the bottom line is that I find
the risk-convenience trade off to be in our favor right now.
That doesn't mean there isn't risk.
That doesn't mean that perhaps one of my devices, one of my light switches,
is occasionally participating in a DDoS attack.
I hope not, but I don't really have a good way to find out.
And no, I don't have an Internet connected toaster.
Ultimately, what's frustrating
for anybody that's been on the Internet for any amount of time
is that the issues that have been raised here actually aren't all that new.
They predate things like Internet of things.
The issue is that security all too often is an afterthought.
Devices will be designed and implemented because what they do is cool or valuable.
But the fact that they might need security
isn't something that's really thought through until after something happens.
We've even seen that with the WiFi protocol.
It's one of the reasons WEP encryption,
which was supposed to keep your connection safe, is no longer recommended.
It's as good as having no encryption at all.
And yet that's the encryption that WiFi
started with, so we haven't seemed to have learned from our lessons.
Yet.
But hopefully over time the devices we use will get better.
They will become more secure.
And issues like this won't be the issue that they sometimes seem to be today.
I hope that's somewhat helpful.
If you've got opinions, if you've got thoughts, leave a comment at
askleo.com/23843
I'm Leo Notenboom.
This is askleo.com