It’s become a cliché that the smart fridge – one with sensors inside and connection to the Internet on the outside – will one day automatically order milk or replenish other items before they run out.
The reality is not only different, but also darker: smart appliances have little protection from hackers, and may be a way for cybercriminals to hijack devices, as well as invade privacy. Especially as smart TVs become standard – both in South Africa and across the world – we are exposing ourselves to dangers we don’t even know exist.
From TVs and fridges to security cameras and Wi-Fi routers, the very devices that are meant to make our lives easier are also the ones that make us more vulnerable. And this is not theoretical. As long ago as 2014, cybercriminals created a “botnet” – when a large amount of hacked computers are used in concert to mount a spam or other attack – which hijacked 100 000 devices, including routers, TVs and even a fridge.
“For some time we’ve seen attacks on security cameras, routers, and networking equipment,” said Marco Preuss, head of research at cybersecurity leaders Kaspersky Lab. “There are a lot of things happening to abuse these devices for malicious activities against other users, but also using them as entry point to the owner’s system.”
Preuss was speaking at the recent Kaspersky Transparency Summit in Zurich, when the company announced the opening of a Transparency Centre in Switzerland for regulators and other organisations to view its software code directly.
A panel discussion during the event, on the risks and rewards of transparency in cybersecurity, highlighted the absence of trust in technology. In the past, if a cybersecurity company said one could trust them, most people believed it. But that time is past, said Jan-Peter Kleinhans, project director for a project called Security in the Internet of Things at a German think tank, Stiftung Neue Verantwortung.
“The term ‘trust me’ is 1990s cybersecurity,” he said. “If someone says trust me, I want proof of it. How do we trust them?”
This problem will become far worse once we cannot trust even appliance makers, he said in an interview after the event.
“In the future every product will be connected. For commercial off-the-shelf devices (COTS), we already see rapidly increasing demand for voice assistants, smart lighting, and Smart TVs. So the question is not IF something gets connected but WHEN.
“All these devices will be vulnerable. Here the question is more how easy it is for criminals to exploit those devices – right now it’s extremely easy. For COTS devices I think the biggest problem are botnets that form a globally distributed botnet that the criminal can rent out for attacks against websites or credit card fraud or attacking production servers.”
The worst of it, he said, is that there is little the consumer can do. Kleinhans called on regulators to steps in, and pointed to the European Union’s Cybersecurity Act as a potential solution.
“It focuses on voluntary certification and security standards in the hopes that manufacturers see IT security as a competitive advantage. I don’t think voluntary certification by itself is enough, but it’s a solid first step. At the same time there is a growing debate about ‘software liability’ in many European countries. I think over the next five years we will see tighter and clearer regulation regarding IT security in general.”
In the meantime, it is not only the home user whois at risk, said Preuss.
“It affects everyone from consumer to small and medium businesses to enterprises. There is no limit in this whole environment, because more and more gets connected. In Germany you have smart connected production facilities, and public infrastructure like power plants and water supply that gets more and more connected, so that one can control what power needs to be produced to keep the network as stable as possible.”
The danger will escalate as energy production shifts from “classic nuclear and coal power plants” to solar and wind-based energy systems, which all depend on smart connected systems to pull their energy into the grid and keep it stable, said Preuss.
“Every company is an IT (information technology) company nowadays, whether they are working with wood or stone or clothes. The problem is everybody still does not realise they are an IT company, because most are still in the mindset of just working with wood and creating furniture, for example. No, you’re an IT company, because all your machines are connected, all your manufacturers are connected, and all your customers are online and connected. You have all this customer information digitalised.”
Preuss outlined a wide range of potential cyber attacks in this environment, from ransom attempts by encrypting company data to stealing company information to pretending to have cracked your account through password leaks and demanding payment not to publish sensitive information.
“The borders between consumer, small and medium business, enterprise, and government are less and less visible, ands everyone of us is now a node in the whole network. On the Internet, there is no longer a difference anymore between personal and business life. When I am private on a social network, I can still be targeted by people trying to get into my company. Everything is connected.”
The best known example of a potential danger is the idea that smart fridges can be accessed by hackers and pulled together into a massive network, or botnet, that launches what is known as a DDoS, or distributed denial of service attack, when a large number of computer attempt to connect to the same computer at the same time, causing it to crash. The most widely distributed software used for this is called Mira (see sidebar), which looks for unprotected Internet of Things devices. It is available as open source software for any hacker to download.
Said Preuss, “Mira was automated to spread on web cameras connected to the Internet by using default user name and password combinations. In most cases, users don’t change the default user name and password or don’t know how or are not aware that they should. Many of these systems also ship with very old hardware and you can’t update them, or updates are not shipped by vendors.
“The result is that you have less control of these devices. Just on the consumer level, you already probably have a router, smart TV, and smart security system. You may have smart controllers in kitchen. We’re talking a lot of different devices and platforms from a lot of different vendors.”
The home user, said Preuss, needs to be like system administrators from enterprises in the past, but the home user is not an IT expert.
“Yet these devices still do not offer the ease of use or functionality, by design, to make them more secure by ease of update and configuration.”
What can consumers do?
“Consumers can think about which device they buy, ask about security, ask about transparency, what happens with data, and do I need to connect it to the Internet? Just because a fridge has Wi-Fi, doesn’t mean I need to connect it.”
Lenovo unveils world’s smallest desktop PC
ThinkCentre M90n-1 Nano is powered by 8th generation Intel processors and SSD storage, catering to flexible working
Lenovo has introduced the world’s smallest desktop PC, the ThinkCentre M90n-1 Nano, to the South African Market. It says it is designed to support diverse workplaces with the power of a full-size desktop and the space-saving convenience of a laptop.
“The ThinkCentre M90n-1 Nano is further proof of Lenovo’s commitment to helping small businesses drive efficiency in their operations,” says Thibault Dousson, General Manager at Lenovo South Africa. “In South Africa, SMEs make up a third of the country’s GDP and play an integral part in boosting the economy and creating jobs. Lack of capital, investment, resources or support are among the major challenges faced by our country’s entrepreneurs.
“Lenovo wants to help entrepreneurs grow their businesses through giving them better access to critical tools and services, such as our financial services offering and leasing option. The ThinkCentre M90n-1 Nano is ideal for small business owners as it is reliable and powerful yet compact and easily transportable.”
Delivering powerful performance in an ultra-portable size, the ThinkCentre M90n-1 Nano is the most compact commercial desktop series in the world. Compact models are one-third the size of the ground-breaking ThinkCentre Tiny, at just 0.35L in volume.
With fully functional USB Type-C Gen2 and USB 3.1 Gen2 ports located on the front and back of the device, multiple displays, docks and other hardware options can further boost productivity. The ability to be powered using just one cable to a USB Type-C monitor makes the M90n-1 Nano ideal for a clutter-free workspace, whether it be placed behind a screen or under a desk.
The ThinkCentre M90n-1 Nano is MIL-810G SPEC tested – built to withstand extreme conditions including shocks, drops, dust and humidity. The desktop’s HW TPM 2.0 chip encrypts data to keep sensitive data secure, while its Kensington lock slot enables users to physically secure the device to an immovable object, protecting it from theft.
With its Modern Standby feature, users can receive emails, VoIP calls and instant messages while remaining in standby mode. When ready to commence work, the M90n-1 Nano resumes full functionality in under one second.
These features make the ThinkCentre M90n-1 Nano an easy fit across all office environments, or wherever space is limited, and staff are mobile. The ThinkCentre M90n-1 Nano also reduces energy consumption by as much as 30 percent annually over the ThinkCentre Tiny.
Powered by the 8th generation Intel processors and backed by SSD (solid state drive) storage, the ThinkCentre M90n-1 Nano offers diverse connectivity and multi-user options to keep users connected.
Hackers target hotels
Kaspersky’s research of the RevengeHotels campaign aimed at the hospitality sector, has confirmed over 20 hotels in Latin America, Europe and Asia have fallen victim to targeted malware attacks. Even more hotels are potentially affected across the globe. Travelers’ credit card data, which is stored in a hotel administration system, including those received from online travel agencies (OTAs), is at risk of being stolen and sold to criminals worldwide.
RevengeHotels is a campaign that includes different groups using traditional Remote Access Trojans (RATs) to infect businesses in the hospitality sector. The campaign has been active since 2015 but has gone on to increase its presence in 2019. At least two groups, RevengeHotels and ProCC, were identified to be part of the campaign, however more cybercriminal groups are potentially involved.
The main attack vector in this campaign is emails with crafted malicious Word, Excel or PDF documents attached. Some of them exploit CVE-2017-0199, loading it using VBS and PowerShell scripts and then installing customised versions of various RATs and other custom malware, such as ProCC, on the victim’s machine that could later execute commands and set up remote access to the infected systems.
Each spear-phishing email was crafted with special attention to detail and usually impersonating real people from legitimate organisations making a fake booking request for a large group of people. It is worth noting that even careful users could be tricked to open and download attachments from such emails as they include an abundance of details (for instance, copies of legal documents and reasons for booking at the hotel) and looked convincing. The only detail that would reveal the attacker would be a typosquatting domain of the organisation.
A phishing email sent to a hotel impersonating a booking request from an attorney’s office
Once infected, the computer could be accessed remotely not just by the cybercriminal group itself — evidence collected by Kaspersky researchers shows that remote access to hospitality desks and the data they contain is sold on criminal forums on a subscription basis. Malware collected data from hospitality desk clipboards, printer spoolers and captured screenshots (this function was triggered using specific words in English or Portuguese). Because hotel personnel often copied clients’ credit card data from OTA’s in order to charge them, that data could also be compromised.
Kaspersky telemetry confirmed targets in Argentina, Bolivia, Brazil, Chile, Costa Rica, France, Italy, Mexico, Portugal, Spain, Thailand and Turkey. However, based on data extracted from Bit.ly, a popular link shortening service used by the attackers to spread malicious links, Kaspersky researchers assume that users from many other countries have at least accessed the malicious link – suggesting that the number of countries with potential victims could be higher.
“As users grow wary of how protected their data truly is, cybercriminals turn to small businesses, which are often not very well protected from cyberattacks and possess a concentration of personal data. Hoteliers and other small businesses dealing with customer data need to be more cautious and apply professional security solutions to avoid data leaks that could potentially not only affect customers, but also damage hotel reputations as well,” comments Dmitry Bestuzhev, Head of Global Research and Analysis Team, LatAm.
To stay safe, travelers are recommended to:
- Use a virtual payment card for reservations made via OTAs, as these cards normally expire after a single charge
- When paying for a reservation or checking out at hotel desks, use a virtual wallet, such as Apple Pay or Google Pay, or a secondary credit card with a limited amount of debit available
Hotel owners and management are also advised to follow these steps to secure customer data:
- Conduct risk assessments of the existing network and implement regulations regarding how customers data is handled
- Use a reliable security solution with web protection and application control functionality, such as Kaspersky Endpoint Security for Business. Web protection helps to block access to phishing and malicious websites while application control (in white list mode) allows to make sure that no application except the white listed ones can run on hospitality desk computers.
- Introduce staff security awareness training to teach employees how to spot spear-phishing attempts and show the importance of remaining vigilant when working with incoming emails.
Read the full report, RevengeHotels: cybercrime targeting hotel desks worldwide, on Securelist.