IoT Device Compromise

Description

Many IoT devices carry weak or default passwords, rare updates, insecure firmware and open services that should never be reachable from the internet. Once compromised they can serve for DDoS, for espionage, as a way into the network, and more often as passive but sometimes active infrastructure for the attacker.

IoT is awkward because organizations often do not see it as IT. A camera is a camera, a printer is a printer, a sensor is a sensor. But to an attacker each of them is a device with a network, an identity, software and vulnerabilities.

Examples

• A camera with a default password joins a botnet and is used for DDoS.
• A router with old firmware becomes the entry point into the internal network.
• A smart device in the office sends unusual outbound traffic to a command server.

Notes

• Anything with an IP address, firmware and network access is part of the attack surface.
• An IoT device without updates and without segmentation should be treated as a device that will be compromised sooner or later.