Seven common enterprise Internet of Things (IoT) devices, including IP-connected security systems, smart HVACs and energy meters, video conferencing systems and connected printers, have proven to be hackable in less than three minutes.
In tests by ForeScout Technologies and ethical hacker Samy Kamkar (including a physical test situation and analysis from peer-reviewed industry research), the devices were shown to lack embedded security. Some were outfitted with rudimentary security, but Kamkar's analysis revealed many were found to be operating with dangerously outdated firmware. All of them pose significant risk to the enterprise.
Kamkar's research included a physical hack into an enterprise-grade, network-based security camera. Entirely unmodified and running the latest firmware from the manufacturer, the camera proved itself vulnerable and ultimately allowed for the planting of a backdoor entryway that could be controlled outside the network. using the very same method that caused the Dyn DDoS attack: exploiting the default password.
In another test, it proved easy to leverage jamming or spoofing techniques to hack smart enterprise security systems, enabling them to control motion sensors, locks and surveillance equipment.
Should any of these devices become infected, hackers can plant backdoors to create and launch an automated IoT botnet DDoS attack. But some consequences are more specific: Via connected HVAC systems and energy meters, hackers can force critical rooms (e.g. server rooms) to overheat critical infrastructure and ultimately cause physical damage. And with VoIP phones, exploiting configuration settings to evade authentication can open opportunities for snooping and recording of calls.
Hackers can also easily pivot on insecure devices into the secure network, and ultimately access other enterprise systems that could store bank account information, personnel files or proprietary business information.
While the devices proved to be quickly hackable, they also can take days or weeks to remediate.
"IoT is here to stay, but the proliferation and ubiquity of these devices in the enterprise is creating a much larger attack surface—one which offers easily accessible entry points for hackers," said Michael DeCesare, president and CEO, ForeScout. "The solution starts with real-time, continuous visibility and control of devices the instant they connect—you cannot secure what you cannot see."
The IoT footprint continues to expand, showing little to no signs of slowing down. Analyst firm Gartner predicts that 20 billion connected devices will be deployed by 2020, with as many as a third of these sitting unknowingly vulnerable on enterprise, government, healthcare and industrial networks around the globe.
Photo © Michiel de Wit