Personal security camera. Image: alice-photo/Shutterstock
What IoT devices are the worst to own from a cybersecurity perspective? New research suggests that, ironically, it’s the ones that are supposed to ensure our personal security.
The Mirai botnet that struck some high-traffic websites last October was a wake-up call for those invested in the internet of things (IoT), highlighting how one vulnerability could unleash cyberattacks on an unprecedented scale.
But what devices are the most vulnerable to attack and is there anything to be done to stop future large-scale attacks?
Potential roles in Mirai botnet
That was the question posed by the cloud security company Zscaler, which analysed a number of different common IoT devices on the market to see whether they were particularly vulnerable.
To determine the size of the digital footprints left by IoT devices since July of this year, Zscaler analysed the types of devices in use, the protocols they used and the locations of the servers with which they communicated.
It also analysed inbound and outbound communications over a two-month period between 26 August 2016 and 26 October 2016.
This would help it determine if they posed a threat to the device owners, and also pinpoint if they had any part in the Mirai botnet used against Dyn in October.
Weak security, by default
Based on its findings, the big reveal showed that by a considerable distance, the most affected IoT devices are personal security cameras, due to their use of plain-text HTTP protocol for authentication.
This leaves them open to be sniffed out by speculative malware and harmful man-in-the-middle attacks.
Of the cameras analysed by Zscaler, some of the major flaws included poorly encrypted communications and firmware updates, as well as leaky user credential information.
Network video recorders (NVRs) used to monitor security through these cameras have also been highlighted as potential dangers, like the VideoEdge NVR and D-Link DNR 202L, that were found to have weak default credentials.
While security technology was found to have some of the leakiest IoT devices on the market, a number of other common office products have also been found to be particularly vulnerable.
Sheer numbers of devices offers unique threat
Looking at more common household items like the Google Chromecast and the Roku streaming TV player, both devices were found to be well secured from any potential part in a cyberattack.
“IoT devices present a unique threat, because of their minimal security and their sheer numbers,” Zscaler said.
“The Mirai malware has shown us how these devices can wreak widespread havoc through targeted DDoS attacks.”
It went on to advise companies to restrict IoT devices as much as possible from external networks and change the default credentials to something more secure.
Updated, 10.55am, 11 April 2017: This article was amended to remove a reference to a Fuji Xerox printer that was actually not licenced by Fuji Xerox.
