Proofpoint, an internet security firm, has uncovered what may be the first Internet of Things-based cyberattack involving “smart” appliances, including at least one refrigerator. The cyberattack involved more than 750,000 spam emails originating from more than 100,000 consumer gadgets. With the number of internet-connected devices anticipated to significantly increase in the next couple of years, evidence of an IoT-based cyber attack has serious consequences for smart device owners and Enterprise targets.
The firm’s findings show that cyber criminals have started to take over home routers and smart appliances and turn them into “thingbots” to launch large-scale cyberattacks. Criminals wishing to steal identities and gain access to Enterprise IT systems have discovered a target-rich environment in these poorly guarded internet-connected devices that may be easier to infect and control than PCs and tablets.
The cyberattack took place on December 23, 2013 and January 6, 2014, and was characterized by several waves of spam emails, usually sent in groups of 100,000, three times per day, focusing on Enterprises and individuals worldwide.
According to Proofpoint, more than 25 percent of the volume was sent by things other than laptops, desktop computers or mobile devices. No more than 10 emails originated from any single IP address, meaning that the attack was hard to block based on location. Amazingly, most devices were easy to compromise. Misconfiguration and the use of default passwords left the devices vulnerable on public networks.
According to Michael Osterman, principal analyst at Osterman Research, the “existing security model simply won’t work to solve the problem.”
What can consumers and vendors do to better protect internet-connected devices other than PCs, laptops and mobile phones?