476
B. Russell
value targets, for example, databases that store sensitive information. This “lateral
movement” through the system is difficult to protect against and one of the reasons
that traditional perimeter security measures such as firewalls are no longer sufficient
to protect an organization’s data. An incident in 2014 against target shows the
exposure to unexpected attack vectors now constantly faced by IoT system security
engineers.
In 2014, attackers gained access to target networks via credentials stolen from a Heating,
Ventilation and Air Conditioning (HVAC) vendor. Fazio Mechanical Service – the HVAC
vendor was the victim of a phishing campaign which led to the compromise of their network
login credentials, giving the attackers access to Fazio systems. Fazio also had an established
connection with Target in order to support electronic billing and contract management. This
allowed attackers to leverage the login credentials stolen to access Target networks and
identify a method to implant the Trojan.POSRAM malware onto target’s payment card
systems [2].
As can be seen, the target payment card system was breached only after
bad actors identified a weakness exposed by a third-party vendor. The original
weakness was not even a technology weakness. Instead the attackers targeted the
humans associated with the system in an attempt to trick them into giving up their
credentials. Indeed, technological implementations are not the only aspects of a
system that must be secured. Users of systems must also understand their unique
weaknesses and how their actions can impact the security of the enterprise. Although
the target breach occurred 5 years ago, we have seen additional security research
that demonstrates that users still represent a weakness to IoT system security. Smart
cameras, for example, are still being compromised through unauthorized access to
their owner’s usernames and passwords, allowing strangers to view them in their
homes [3].
Another consideration is the need to protect the integrity of the data generated
within IoT systems. Even video is susceptible to manipulation when sufficient cyber
security safeguards are not applied. Systems that collect and act upon video footage
must protect the video from manipulation. This includes the deletion, modification,
or even replacement of collected footage.
Security expert Josh Mitchell demonstrated in 2016 the ability to remotely
compromise police video cameras in order to download, edit, and then re-upload
video footage [4]. Consider this threat in terms of analytics systems that process
data from distributed sensors and video recorders. If the source data is untrusted,
then actions based on that data are of limited worth.
Unfortunately, video camera products are one of the worst offenders in terms of
IoT cyber security weaknesses. Well-known default passwords, insecure configurations, known-insecure network services, and software vulnerabilities have exposed
many IoT products to attack by the various threat actors in the world whose goal is
to compromise systems.
B. Russell
value targets, for example, databases that store sensitive information. This “lateral
movement” through the system is difficult to protect against and one of the reasons
that traditional perimeter security measures such as firewalls are no longer sufficient
to protect an organization’s data. An incident in 2014 against target shows the
exposure to unexpected attack vectors now constantly faced by IoT system security
engineers.
In 2014, attackers gained access to target networks via credentials stolen from a Heating,
Ventilation and Air Conditioning (HVAC) vendor. Fazio Mechanical Service – the HVAC
vendor was the victim of a phishing campaign which led to the compromise of their network
login credentials, giving the attackers access to Fazio systems. Fazio also had an established
connection with Target in order to support electronic billing and contract management. This
allowed attackers to leverage the login credentials stolen to access Target networks and
identify a method to implant the Trojan.POSRAM malware onto target’s payment card
systems [2].
As can be seen, the target payment card system was breached only after
bad actors identified a weakness exposed by a third-party vendor. The original
weakness was not even a technology weakness. Instead the attackers targeted the
humans associated with the system in an attempt to trick them into giving up their
credentials. Indeed, technological implementations are not the only aspects of a
system that must be secured. Users of systems must also understand their unique
weaknesses and how their actions can impact the security of the enterprise. Although
the target breach occurred 5 years ago, we have seen additional security research
that demonstrates that users still represent a weakness to IoT system security. Smart
cameras, for example, are still being compromised through unauthorized access to
their owner’s usernames and passwords, allowing strangers to view them in their
homes [3].
Another consideration is the need to protect the integrity of the data generated
within IoT systems. Even video is susceptible to manipulation when sufficient cyber
security safeguards are not applied. Systems that collect and act upon video footage
must protect the video from manipulation. This includes the deletion, modification,
or even replacement of collected footage.
Security expert Josh Mitchell demonstrated in 2016 the ability to remotely
compromise police video cameras in order to download, edit, and then re-upload
video footage [4]. Consider this threat in terms of analytics systems that process
data from distributed sensors and video recorders. If the source data is untrusted,
then actions based on that data are of limited worth.
Unfortunately, video camera products are one of the worst offenders in terms of
IoT cyber security weaknesses. Well-known default passwords, insecure configurations, known-insecure network services, and software vulnerabilities have exposed
many IoT products to attack by the various threat actors in the world whose goal is
to compromise systems.