Malware May Come Preinstalled on Internet of Things (IoT) Devices

What all is your smart blender connecting to?

The Internet of Things, commonly abbreviated as IoT, is simply a term used to describe the way numerous household devices are now becoming a part of the Internet, connected to wireless networks and sharing data with users remotely. A good example of this are things like smart thermostats, which allow users to control their home’s temperature from mobile devices like their phones. With this, users could make adjustments to their home’s temperature while they are out and about, or even simply in another part of the home that may be distant from the actual thermostat. This is of course very convenient, and has many advantages for a variety of users, but unfortunately often comes at the cost of security.

One of the most common issues in the Internet of Things is a lack of security built into IoT products. Often as developers race to provide their customers with new features and connectivity, they leave gaps in their products security; if they even bother to secure it at all. These gaps are often quite simple for cyber-criminals to exploit, and can even infect the technology before the customer even purchases it.

Such was the case when Mike Olsen, co-founder of Proctorio,purchased a set of security cameras off of Amazon. As he installed the cameras he purchased, he noted they were acting unusually. He proceeded to use his developer’s tools to search the code, and found an imperceptible iFrame was running in the background, and set to download malware from a site known to be dangerous.

How the malware got on these cameras is unknown, but Olsen doesn’t imply that Amazon or the seller were at fault in this incident. Still, in an interview with Security Week, Olsen pointed out the ease of which infected devices can end up on websites such as Amazon. One could in fact purchase several of the devices, infect them with malware, and then sell them once again on Amazon as new, or even return them as unneeded items. As long as care is taken with the packaging, the items will be resold, and cyber-criminals proceed to profit from stolen data.

When it comes to IoT devices, it is important to weigh the risks, and determine how worthwhile the connectivity is to you. While you may not be concerned with theft of temperature data from your thermostat, what if that thermostat is infecting your router, phone, or even computers? Research on the security features of these devices is critical, and better yet, if you don’t need it to be connected to your network, don’t even connect it.

What experiences have you had with the Internet of Things? Are the features of the devices beneficial enough to outweigh the risks in security? We at Astria Business Solutions would love to discuss your thoughts in the comments below.