Login
It’s only a smart lightbulb. Why would anyone want to hack that?
Great question. Because it gets to the heart of security matters for your IoT smart home devices.
Internet of Things (IoT) devices have certainly made themselves at home in recent years. Once a novelty, they’ve become far more commonplace. The numbers bear that out. Recent research indicates that the average U.S. household has 20.2 connected devices. Europe has 17.4 on average, while Japan trails at 10.3.
Of course, those figures largely account for computers, tablets, phones, and internet-connected smart TVs. Yet the study uncovered a sizable jump in the presence of other smart devices.
Comparing 2022 to 2021, smart homes worldwide had:
Consider that connected devices in the home rose just 10% globally during the same timeframe. It’s clear that IoT smart home device ownership is on the upswing. Yet has security kept up with all that growth?
That security question brings us back to the lightbulb.
An adage in security is this: if a device gets connected, it gets protected. And that protection has to be strong because a network is only as secure as its weakest link. Unfortunately, many IoT devices are indeed the weakest security links on home networks.
Some recent research sheds light on what’s at stake. Cybersecurity teams at the Florida Institute of Technology found that companion apps for several big brand smart devices had security flaws. Of the 20 apps linked to connected doorbells, locks, security systems, televisions, and cameras they studied, 16 had “critical cryptographic flaws” that might allow attackers to intercept and modify their traffic. These flaws might lead to the theft of login credentials and spying, the compromise of the connected device, or the compromise of other devices and data on the network.
Over the years, our research teams at McAfee Labs have uncovered similar security vulnerabilities in other IoT devices like smart coffee makers and smart wall plugs.
Vulnerabilities such as these have the potential to compromise other devices on the network.
Let’s imagine a smart lightbulb with poor security measures. As part of your home network, a motivated hacker might target it, compromise it, and gain access to the other devices on your network. In that way, a lightbulb might lead to your laptop—and all the files and data on it.
So yes, someone might be quite interested in hacking your lightbulb.
One Friday morning in 2016, great swathes of the American internet ground to a halt.
Major websites and services became unresponsive as internet directory services got flooded with millions and millions of malicious requests. As such, millions and millions of people were affected, along with public agencies and private businesses alike. Behind it, a botnet. An internet drone army of compromised IOT devices like digital video recorders and webcams.
Known as the Mirai botnet, its initial purpose was to target Minecraft game servers. Essentially to “grief” innocent players. Yet it later found its way into other hands. From there, it became among the first high-profile botnet attacks on the internet.
Botnet attacks can be small and targeted, such as when bad actors want to target a certain business (or game servers). And they can get as large as Mirai did. Regardless of size, these attacks rely on compromised devices. Consumer IoT devices often get targeted for such purposes for the same reasons listed above. They can lack strong security features out of the box, making them easy to enlist in a botnet.
In all, the threat of botnets makes another strong case for securing your devices.
To put a fine point on it, security in your smart home is an absolute must. And you can make your smart home far more secure with a few steps.
Many smart home devices use a smartphone as a sort of remote control, and to gather, store, and share data. So whether you’re an Android owner or an iOS owner, protect your smartphone so you can protect the things it accesses and controls—and the data stored on it too.
One issue with many IoT devices is that they often come with a default username and password. This could mean that your device and thousands of others just like it share the same credentials. That makes it easy for a hacker to access to them because those default usernames and passwords are often published online.
When you purchase any IoT device, set a fresh password using a strong method of password creation. Likewise, create an entirely new username for additional protection as well.
Banks and other online services commonly offer multi-factor authentication to help protect your accounts. In addition to using a username and password for login, it sends a security code to another device you own (often a mobile phone). It throws a big barrier in the way of hackers who try to force their way into your device with a password/username combination. If your IoT devices support multi-factor authentication, consider using it with them too.
Another device that needs good password protection is your internet router. Make sure you use a strong and unique password as well to help prevent hackers from breaking into your home network. Also consider changing the name of your home network so that it doesn’t personally identify you.
Fun alternatives to using your name or address include everything from movie lines like “May the Wi-Fi be with you” to old sitcom references like “Central Perk.” Also check that your router is using an encryption method, like WPA2 or the newer WPA3, which will keep your signal secure.
Older routers might have outdated security measures, which might make them more prone to attacks. If you’re renting yours from your internet provider, contact them for an upgrade. If you’re using your own, visit a reputable news or review site such as Consumer Reports for a list of the best routers that combine speed, capacity, and security.
In addition to fixing the odd bug or adding the occasional new feature, updates often fix security gaps. Out-of-date apps and devices might have flaws that hackers can exploit, so update regularly. If you can set your smart home apps and devices to receive automatic updates, select that option so that you’ll always have the latest.
Just as you can offer your guests secure access that’s separate from your own devices, you can create an additional network on your router that keeps your computers and smartphones separate from IoT devices. This way, if an IoT device is compromised, a hacker will still have difficulty accessing your other devices on your primary network that hosts your computers and smartphones.
You can take another strong security step before you even bring that new smart device home. Research.
Unfortunately, there are few consumer standards for smart devices. That’s unlike other household appliances. They must comply with government regulations, industry standards, and consumer-friendly standards like Energy Star ratings. So, some of the research burden falls on the buyer when it comes to purchasing the most secure devices.
Here are a few steps that can help:
A positive or high customer rating for a smart device is a good place to start, yet purchasing a safer device takes more than that. Impartial third-party reviewers like Consumer Reports will offer thorough reviews of smart devices and their security, as part of a paid subscription.
Likewise, look for other resources that account for device and data security in their writeups, such as the “Privacy Not Included” website. Run by a nonprofit organization, it reviews a wealth of apps and smart devices based on the strength of their security and privacy measures.
Whether you’re looking at a device made by a well-known company or one you haven’t heard of before, a web search can show you if they’ve had any reported privacy or security issues in the past. And just because you might be looking at a popular brand name doesn’t mean that you’ll make yourself more private or secure by choosing them. Companies of all sizes and years of operation have encountered problems with their smart home devices.
What you should look for, though, is how quickly the company addresses any issues and if they consistently have problems with them. Again, you can turn to third-party reviewers or reputable news sources for information that can help shape your decision.
Some smart devices will provide you with options around what data they collect and then what they do with it after it’s collected. Hop online and see if you can download some instructions for manuals for the devices you’re considering. They might explain the settings and permissions that you can enable or disable.
As mentioned above, multi-factor authentication provides an additional layer of protection. It makes things much more difficult for a hacker or bad actor to compromise your device, even if they know your password and username. Purchase devices that offer this as an option. It’s a terrific line of defense.
Some manufacturers are more security- and privacy-minded than others. Look for them. You might see a camera that has a physical shutter that caps the lens and blocks recording when it’s not in use. You might also find doorbell cameras that store video locally, instead of uploading it to the cloud where others can potentially access it. Also look for manufacturers that call out their use of encryption, which can further protect your data in transit.
Even the smallest of IoT smart home devices can lead to big issues if they’re not secured.
It only takes one poorly secured device to compromise everything else on an otherwise secure network. And with manufacturers in a rush to capitalize on the popularity of smart home devices, sometimes security takes a back seat. They might not thoroughly design their products for security up front, and they might not regularly update them for security in the long term.
Meanwhile, other manufacturers do a fine job. It takes a bit of research on the buyer’s part to find out which manufacturers handle security best.
Aside from research, a few straightforward steps can keep your smart devices and your network safe. Just as with any other connected device, strong passwords, multi-factor authentication, and regular updates remain key security steps.
For a secure smart home, just remember the adage: if a device gets connected, it gets protected.
The post Make Your Smart Home a Secure Home Too: Securing Your IoT Smart Home Devices appeared first on McAfee Blog.
The pop-up toaster as we know it first hit the shelves in 1926, under the brand name “Toastmaster.” With a familiar springy *pop*, it has ejected toast just the way we like it for nearly a century. Given that its design was so simple and effective, it’s remained largely unchanged. Until now. Thanks to the internet and so called “smart home” devices.
Toasters, among other things, are all getting connected. And have been for a few years now, to the point where the number of connected Internet of Things (IoT) devices reaches well into the billions worldwide—which includes smart home devices.
Businesses use IoT devices to track shipments and various aspects of their supply chain. Cities use them to manage traffic flow and monitor energy use. (Does your home have a smart electric meter?) And for people like us, we use them to play music on smart speakers, see who’s at the front door with smart doorbells, and order groceries from an LCD screen on our smart refrigerators—just to name a few ways we have welcomed IoT smart home devices into our households.
In the U.S. alone, smart home devices make up a $30-plus billion marketplace per year. However, it’s still a relatively young marketplace. And with that comes several security issues.
First and foremost, many of these devices still lack sophisticated security measures, which makes them easy pickings for cybercriminals. Why would a cybercriminal target that smart lightbulb in your living room reading lamp? Networks are only as secure as their least secure device. Thus, if a cybercriminal can compromise that smart lightbulb, it can potentially give them access to the entire home network it is on—along with all the other devices and data on it.
These devices make desirable targets for another reason. They can easily get conscripted into botnets, networks of hijacked computers and devices used to amplify Distributed Denial of Service (DDoS) attacks that organize the devices into an attacking host that can flood a target with so much traffic that it cannot operate. DDoS attacks can shut down websites, disrupt service and even choke traffic across broad swathes of the internet.
Remember the “Mirai” botnet attack of 2016, where hackers targeted a major provider of internet infrastructure? It ended up crippling traffic in concentrated areas across the U.S., including the northeast, Great Lakes, south-central, and western regions. Millions of internet users were affected, people, businesses, and government workers alike.
Another headline-maker was the Amazon Web Services (AWS) attack in 2020. AWS provides cloud computing services to millions of businesses and organizations, large and small. Those customers saw slowdowns and disruptions for three days, which in turn slowed down and disrupted the people and services that wanted to connect with them.
The Mirai and AWS stand out as two of the highest-profile DDoS attacks, yet smaller botnet attacks abound, ones that don’t make headlines. Still, they can disrupt the operations of websites, public infrastructure, and businesses, not to mention the well-being of people who rely the internet.
How do cybercriminals harness these devices for attacks? Well, as the case with many early IoT devices, the fault lies within the weak default passwords that many manufacturers employ when they sell these devices. These passwords include everything from “admin123” to the product’s name. The practice is so common that they get posted in bulk on hacking websites, making it easy for cybercriminals to simply look up the type of device they want to attack.
Complicating security yet further is the fact that some IoT and smart home device manufacturers introduce flaws in their design, protocols, and code that make them susceptible to attack. The thought gets yet more unsettling when you consider that some of the flaws were found in things like smart door locks.
The ease in which IoT devices can be compromised is a big problem. The solution, however, starts with manufacturers that develop IoT devices with security in mind. Everything in these devices will need to be deployed with the ability to accept security updates and embed strong security solutions from the get-go.
Until industry standards get established to ensure such basic security, a portion of securing your IoT and smart home devices falls on us, as people and consumers.
As for security, you can take steps that can help keep you safer. Broadly speaking, they involve two things: protecting your devices and protecting the network they’re on. These security measures will look familiar, as they follow many of the same measures you can take to protect your computers, tablets, and phones.
Many smart home devices use a smartphone as a sort of remote control, not to mention as a place for gathering, storing, and sharing data. So whether you’re an Android owner or iOS owner, use online protection software on your phone to help keep it safe from compromise and attack.
One issue with many IoT devices is that they often come with a default username and password. This could mean that your device and thousands of others just like it all share the same credentials, which makes it painfully easy for a hacker to gain access to them because those default usernames and passwords are often published online. When you purchase any IoT device, set a fresh password using a strong method of password creation, such as ours. Likewise, create an entirely new username for additional protection as well.
Online banks, shops, and other services commonly offer multi-factor authentication to help protect your accounts—with the typical combination of your username, password, and a security code sent to another device you own (often a mobile phone). If your IoT device supports multi-factor authentication, consider using it there too. It throws a big barrier in the way hackers who simply try and force their way into your device with a password/username combination.
Another device that needs good password protection is your internet router. Make sure you use a strong and unique password there as well to help prevent hackers from breaking into your home network. Also consider changing the name of your home network so that it doesn’t personally identify you. Fun alternatives to using your name or address include everything from movie lines like “May the Wi-Fi be with you” to old sitcom references like “Central Perk.” Also check that your router is using an encryption method, like WPA2 or the newer WPA3, which will keep your signal secure.
Older routers may have outdated security measures, which may make them more prone to attack. If you’re renting yours from your internet provider, contact them for an upgrade. If you’re using your own, visit a reputable news or review site such as Consumer Reports for a list of the best routers that combine speed, capacity, and security.
In addition to fixing the odd bug or adding the occasional new feature, updates often address security gaps. Out-of-date apps and devices may have flaws that hackers can exploit, so regular updating is a must from a security standpoint. If you can set your smart home apps and devices to receive automatic updates, even better.
Just as you can offer your guests secure access that’s separate from your own devices, creating an additional network on your router allows you to keep your computers and smartphones separate from IoT devices. This way, if an IoT device is compromised, a hacker will still have difficulty accessing your other devices on your primary network, the one where you connect your computers and smartphones.
Read trusted reviews and look up the manufacturer’s track record online. Have their devices been compromised in the past? Do they provide regular updates for their devices to ensure ongoing security? What kind of security features do they offer? And privacy features too? Resources like Consumer Reports can provide extensive and unbiased information that can help you make a sound purchasing decision.
As more and more connected devices make their way into our homes, the need to ensure that they’re secure only increases. More devices mean more potential avenues of attack, and your home networks is only as secure as the least secure device that’s on it.
While standards put forward by industry groups such as UL and Matter have started to take root, a good portion of keeping IoT and smart home devices secure falls on us as consumers. Taking the steps above can help prevent your connected toaster from playing its part in a botnet army attack—and it can also protect your network and your home from getting hacked.
It’s no surprise that IoT and smart home devices are raking in billions of dollars of years. They introduce conveniences and little touches into our homes that make life more comfortable and enjoyable. However, they’re still connected devices. And like anything that’s connected, they must get protected.
The post What is a Botnet? And What Does It Have to Do with Protecting “Smart Home” Devices? appeared first on McAfee Blog.
The expansion of smart home devices in our households is remarkable, with nearly everything from our lights to our laundry machines now connected to the internet. These devices, while convenient, introduce new security challenges. Understanding these challenges and how to mitigate them is crucial to maintaining a safe and secure home environment.
This Smart Home Security Guide is an essential resource to help you navigate these challenges and keep your smart home secure. As we’ll discuss, the task of maintaining a secure smart home largely falls on you, the homeowner. But don’t worry, we’ve got you covered with some straightforward steps and recommendations.
If a device is connected to the internet, it must be protected. This familiar adage speaks volumes about the critical importance of securing smart home devices. Any device connected to the internet provides potential access to your home network for hackers. Even seemingly harmless devices like smart outlets have proven to be vulnerable.
For example, an unsecured smart plug, using weak factory-set passwords and failing to encrypt communications with the router, can be exploited by hackers to gain access to your home network, posing a significant security risk. As the saying goes, “Your home network is only as secure as your weakest device.”
→ Dig Deeper: Make Your Smart Home a Secure Home Too: Securing Your IoT Smart Home Devices
In a household filled with a dozen smart devices, the security standards can vary significantly. Some devices may have robust security features built-in, with manufacturers regularly updating their software for optimal protection. However, other devices may not provide robust security, presenting vulnerabilities that can compromise the overall safety of your entire network. Here are some risks you need to watch out for if you have a highly connected smart home:
→ Dig Deeper: So, Your Phone Got Stolen. Here’s What to Do.
To mitigate these risks, it’s essential to stay informed about security best practices, regularly update firmware and software, use strong and unique passwords, and implement network security measures like firewalls and network segmentation. Remember, a single poorly secured device could potentially risk the security of all your connected devices and the data contained within them. This makes it paramount that every smart device in your home has sufficient security measures in place.
While security is a crucial aspect of smart home management, so is privacy. Data privacy policies differ substantially from one device to another, and these policies determine how your personal data is collected, stored, and shared. Some companies may sell your data or share it with third parties, while others may use it for their own advertising purposes.
→ Dig Deeper: What Personal Data Do Companies Track?
Given the significant variation in privacy policies, it’s crucial for homeowners to understand how their data is being handled. Privacy policies can often be complex and lengthy, but understanding them is integral to maintaining your privacy in a smart home environment.
It’s essential to remember that you possess more control over your smart home’s security and privacy than you might think. Numerous measures can help make your smart devices more private and more secure than they were right out of the box. Our Smart Home Security Guide presents these straightforward steps to enhance the security of your smart home.
The guide is a part of our McAfee Security Guide Series and offers an in-depth analysis of measures that you can take to protect your smart wall outlets, coffee makers, door locks, refrigerators, and more. It covers the basics of safeguarding your devices and guides on shopping for more private and secure smart devices. The guide also contains a dedicated section about smart speakers and how to protect your privacy while using them.
The truth is that security isn’t always included with smart home devices. Just like with your computers, smartphones, and other devices, the best security is reliant on you. Smart devices often come with default settings that assume a certain level of knowledge and responsibility from their owners for their correct and secure use. Unfortunately, many consumers are not aware of these responsibilities or how they can protect their smart home devices.
This gap in knowledge is what our Smart Home Security Guide aims to fill. It provides comprehensive, easy-to-understand steps to secure your smart home devices without requiring any specialized technical knowledge. By following these steps, you can enjoy the convenience of a smart home with the peace of mind that your devices, data, and privacy are secure.
McAfee Pro Tip: Smart devices can be hacked, and security is not always included in every smart home device. Know what to expect when your smart home devices get hacked.
To sum up, the security and privacy of your smart home are in your hands. While smart home devices bring convenience and new functionalities, they also introduce potential vulnerabilities that need to be addressed. Being aware of these vulnerabilities and taking proactive steps to mitigate them can go a long way in ensuring a secure smart home environment.
Our Smart Home Security Guide has been designed with this very purpose in mind: to empower homeowners like you with the knowledge and tools to protect your smart home. Remember, the best security measure for your smart home is you. Read more of our reports and guides on our resource page.
The post The Smart Home Security Guide appeared first on McAfee Blog.
FreshRSS 