At the start of 2014, security specialists named the categories of Internet of Things devices they expected to be most exposed to attack over the year. The categories included in-car Wi-Fi, mobile medical devices and wearables such as Google Glass. Their warnings were aimed at security chiefs, who were being told to treat connected devices as a new route into corporate data.
The IoT then meant billions of connected devices, from cars to wearable gadgets. Cisco’s Internet Business Solutions Group had estimated 12.5 billion connected devices worldwide as of 2010. The argument in the 2014 outlook was that convenience was spreading faster than security.
In-car Wi-Fi
Visiongain projected that 2013 connected-car revenues would reach US$21.7 billion, with 2014 higher still. John Pescatore, director of emerging trends at the SANS Institute, said Ford and GM would increasingly offer in-car Wi-Fi from the start of 2014. That would turn vehicles into mobile hotspots linking passengers’ phones, tablets and other devices to the Internet.
Pescatore’s concern was that in-car Wi-Fi carried the same weaknesses as ordinary hotspots. Cars lacked the firewalls found in small-business Wi-Fi setups, so the car and its data were exposed. He said an attacker inside the network could pose as the car, connect to outside data sources such as OnStar servers, and collect the owner’s personal information, including credit card data.
Jerry Irvine, CIO of Prescient Solutions, said security chiefs at organisations with travelling staff should worry about these weaknesses. In his view, attackers could use them to reach company information.
Mobile medical devices
ABI Research’s lead analyst Jonathan Collins forecast that the market for wearable wireless devices across sports, fitness and mHealth would grow from 42 million devices in 2013 to 171 million in 2018.
Rodney Joffe, senior technologist at Neustar, said that from 2014 attackers would increasingly target mobile medical devices that ran Windows, pacemakers included. He said Windows was popular on such devices because it was cheap, widely used and familiar to programmers. Unlike Windows on a desktop, he said, these devices had no patching mechanism. He added that the more they connected over wireless links such as Wi-Fi, the more easily viruses could spread among them.
Joffe contrasted this with traditional manufacturers, whose proprietary embedded systems were hard to attack because their code was closed and tightly restricted. Irvine said security chiefs should worry about remote access to such devices. He listed the risks as attacks on employees, leaks of health information, and attacks on senior executives aimed at influencing or controlling an organisation’s financial stability.
Wearables and Google Glass
The third category was wearable devices, with Google Glass the example. The risk was confidential corporate information and intellectual property. A compromised pair of glasses could expose what the wearer saw and heard around the office.
An organisation might not know what kinds of data a wearer picked up, or how much, while moving through offices and other enterprise locations. An attacker who took over the device could copy that audio and video.
What the list meant for security teams
The common thread was that these devices sat outside the usual patching and firewall routines. They could carry or capture corporate and personal data, and they travelled with employees. The advice to security chiefs was to understand which categories of device were entering their organisations, and what those devices could reach, before attackers used them.
Later events showed how seriously IoT exposure came to be treated. Researchers described the Mirai botnet attack, which used unprotected IoT devices, mostly webcams, to disrupt major internet service providers. Microsoft’s healthcare technical blog dates it to October 2016. That episode concerned cameras rather than the cars, medical devices or wearables named in the 2014 outlook, so it did not confirm any of those specific predictions.