Blogs

3 IoT (Internet of Things) Cyber Threats to Privacy in Your Home That Might Surprise You

09.19.14

TexasBarToday_TopTen_Badge_Small (1)

Most people freely attach devices to the Internet throughout their home without contemplating any privacy risk, but a recent home inspection of “network-attached storages (NAS), Smart TVs, router, Blu-ray player” by Kaspersky Lab security analyst David Jacoby proved otherwise. As a result of this inspection a report was issued entitled “Hacking a Living Room: Kaspersky Lab Finds Multiple Vulnerabilities in Popular Connected Home Entertainment Devices” which included these three vulnerabilities:

1. Remote code execution and weak passwords: The most severe vulnerabilities were found in the network-attached storages. Several of them would allow an attacker to remotely execute system commands with the highest administrative privileges. The tested devices also had weak default passwords, lots of configuration files had the wrong permissions and they also contained passwords in plain text. In particular, the default administrator password for one of the devices contained just one digit. Another device even shared the entire configuration file with encrypted passwords to everyone on the network.

2. Man-in-the-Middle via Smart TV: While investigating the security level of his own Smart TV, the Kaspersky researcher discovered that no encryption is used in communication between the TV and the TV vendor’s servers. That potentially opens the way for Man-in-the-Middle attacks that could result in the user transferring money to fraudsters while trying to buy content via the TV. As a proof of concept, the researcher was able to replace an icon of the Smart TV graphic interface with a picture. Normally the widgets and thumbnails are downloaded from the TV vendor’s servers and due to the lack of encrypted connection the information could be modified by a third party. The researcher also discovered that the Smart TV is able to execute Java code that, in combination with the ability to intercept the exchange of traffic between the TV and Internet, could result in exploit-driven malicious attacks.

3. Hidden spying functions of a router: The DSL router used to provide wireless Internet access for all other home devices contained several dangerous features hidden from its owner. According to the researcher, some of these hidden functions could potentially provide the ISP (Internet Service Provider) remote access to any device in a private network. What’s more important is that, according to the results of the research, sections of the router web interface called “Web Cameras”, “Telephony Expert Configure”, “Access Control”, “WAN-Sensing” and “Update” are “invisible” and not adjustable for the owner of the device. They could only be accessed via exploitation of a rather generic vulnerability making it possible to travel between sections of the interface (that are basically web pages, each with own alphanumeric address) by brute forcing the numbers at the end of the address.

What IoT cyber risks do you have in your home? If you do not know, you probably have a problem!

The publications contained in this site do not constitute legal advice. Legal advice can only be given with knowledge of the client's specific facts. By putting these publications on our website we do not intend to create a lawyer-client relationship with the user. Materials may not reflect the most current legal developments, verdicts or settlements. This information should in no way be taken as an indication of future results.

Search Tips:

You may use the wildcard symbol (*) as a root expander.  A search for "anti*" will find not only "anti", but also "anti-trust", "antique", etc.

Entering two terms together in a search field will behave as though an "OR" is being used.  For example, entering "Antique Motorcars" as a Client Name search will find results with either word in the Client Name.

Operators

AND and OR may be used in a search.  Note: they must be capitalized, e.g., "Project AND Finance." 

The + and - sign operators may be used.  The + sign indicates that the term immediately following is required, while the - sign indicates to omit results that contain that term. E.g., "+real -estate" says results must have "real" but not "estate".

To perform an exact phrase search, surround your search phrase with quotation marks.  For example, "Project Finance".

Searches are not case sensitive.

back to top