Connected devices have huge security holes

An iPhone and iPad app that enables iPhone and iPad to function as a remote controller for home electronics such as TV, is seen
An iPhone and iPad app that enables iPhone and iPad to function as a remote controller for home electronics such as TV, is seen on January 25, 2012 in San Francisco, California

The surge of Web-connected devices—TVs, refrigerators, thermostats, door locks and more—has opened up huge opportunities for cyberattacks because of weak security, researchers said Tuesday.

A study by the Hewlett-Packard security unit Fortify found 70 percent of the most commonly used "Internet of Things" devices contain vulnerabilities, including inadequate passwords or encryption, or lax access restrictions.

"While the Internet of Things will connect and unify countless objects and systems, it also presents a significant challenge in fending off the adversary given the expanded attack surface," said Mike Armistead, vice president and general manager for Fortify's enterprise security.

"With the continued adoption of connected devices, it is more important than ever to build security into these products from the beginning to disrupt the adversary and avoid exposing consumers to serious threats."

The study comes amid recent security warnings about hacking of medical devices, cars, televisions and even toilets that have an Internet connection.

The researcher scanned the most popular devices and their cloud components and found on average 25 vulnerabilities per device. These products included TVs, webcams, home thermostats, remote power outlets, sprinkler controllers, hubs for controlling multiple devices, door locks, home alarms, scales and garage door openers.

The study said eight of 10 devices tests leaked private information that could include the user's name, email address, home address, date of birth, credit card or health information.

Most of the devices lacked passwords, making it easier for hackers or others to gain access while some included simple default passwords such as "1234."

Some 70 percent of the devices analyzed failed to use encryption for communicating with the Internet and local network, another weakness that makes for easy outside access.

HP said that while demand for these devices is surging, security has failed to keep pace, and this "opens the doors for security threats" from a variety of sources.

The study said some estimates indicate as many as 26 billion devices will be connected to the Internet by 2020.

"Fortunately, there's still time to secure devices before consumers are at risk," the report said.


Explore further

Security experts reveal weakness in WiFi connected LIFX light bulbs

© 2014 AFP

Citation: Connected devices have huge security holes (2014, July 29) retrieved 20 May 2019 from https://phys.org/news/2014-07-devices-huge-holes.html
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.
1 shares

Feedback to editors

User comments

Jul 30, 2014
I was going to suggest that manufacturers be liable for certain sloppy practices. But here's another idea: through the insurance industry (as they end up paying for a disproportionate part of this problem), some sort of certification process. Clients who avoid non-certified equipment get a discount on their insurance.

Jul 30, 2014
Why do our home electronic utlities have to be connected to the internet anyway?
Surely an in-house minicomputer could control and analyse the usage data of all devices (using bluetooth) without having to broadcast this info. into the ether/cloud. A display panel could tell the owner of the status of all connected devices. If there is a problem with any of them, the owner can decide what to do about it.

I for one do not wish to pay for the continuous dissemination of data into the internet such as the contents of my refrigerator or about how often I open it.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more