The Internet of Things (IoT) has become a popular selling point for devices; on paper, IoT functionality is a great way to improve the usefulness of devices and their capabilities. Smart refrigerators that can connect with your phone to let you know what you’re running low on when you go out shopping. Your phone, iPad and Spotify all keep each other informed about what you like to listen to, seamlessly and without you ever telling it to do so. The IoT lets devices work together in parallel to bring you a more cohesive service, but that cohesiveness requires certain compromises. IoT devices must communicate freely with each other to work, they don’t ask for permission every time they share data because that would remove the selling point of seamless communication. IoT devices need to work quickly, users want to be able to hop around from device to device without having to enter in their passwords again; IoT devices rarely ask for permission more then once. This all leads up to a massive security flaw; IoT devices are only as secure as the least secure device in the chain. Due to the free-flowing nature of IoT, as well as the minimal verification, IoT is vulnerable to a single compromised device being used to roll up the entire chain. This is especially true for medical devices, where a single hacked pager or smartphone could lead to an entire hospital being compromised. The lack of multi-factor authentication and enhanced privileges for devices in the network means that attackers can move easily through networked devices. IoT is a powerful tool, but security should be at the forefront of its development.
Source: IoT security warning: Cyber-attacks on medical devices could put patients at risk
The Trump administration has officially accused Russia of using cyberattacks against US infrastructure (along with condemning them for the nerve agent attack in the UK). Russia has been known to use this method of attack before, and they’ve done so against other countries in Europe, such as Ukraine. They’ve used malware to take control of power plants, water distribution and sanitation plants. Once control is achieved the plants are shut off or tampered with, which makes them a powerful tool to be used against a population. There is an ongoing debate about whether or not this qualifies as a war crime, as deliberately targeting civilians is illegal. These attacks don’t just target power plants that supply military bases, or their infrastructure, but rather anything they can get into. The US government has reported that they’ve successfully excised Russian malware wherever they’ve found it, but the questions remains as to whether or not they’ve found all of it. The United States is also guilty of doing the same thing to Iran in Operations “Nitro Zeus” where US cyberforces successfully took control of Iran’s infrastructure. The implanted code allowed them control over the infected sites, and with some time could have been used to set up forced disasters such as explosions or other ways to permanently damage infrastructure.
Source: Cyberattacks Put Russian Fingers on the Switch at Power Plants, U.S. Says
Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.