Veracode Study Reveals the Internet of Things Poses Cybersecurity Risk

BURLINGTON, MA--(Marketwired - Apr 7, 2015) -  Veracode, a leader in protecting enterprises from today's pervasive Web and mobile application threats, today released a report finding that the foundation of the Internet of Things (IoT) -- the devices themselves plus their associated mobile applications and cloud services -- are often not designed with data security or privacy in mind, putting consumers at risk for cyberattack or physical intrusion of their homes. Veracode's security team probed and monitored a set of always-on, consumer IoT devices to understand the real-world impact of each product's security. The results show security vulnerabilities within these devices to be a potential pathway for robbery, theft of sensitive data or even stalking.

With around 4.9 billion connected devices in use today and an estimated 25 billion by 2020¹, cybersecurity is becoming a major concern. The Federal Trade Commission has warned that cyberattackers could potentially hijack and misuse sensitive information recorded by the technology or that the technology could even create physical safety risks for consumers². Attacks on connected devices have already been reported³ and are likely to continue to happen if manufacturers do not bolster their cybersecurity efforts. In this light, Veracode studied six common at-home devices, including the Chamberlain MyQ Internet Gateway, the Chamberlain MyQ Garage, the SmartThings Hub, the Ubi, the Wink Hub, and the Wink Relay.

The study found that the impact of security vulnerabilities in these devices could be significant for users. Leveraging information from Ubi could enable cybercriminals to know exactly when to expect a user to be home based on when there is an increase in ambient noise or light in the room, which could facilitate a robbery, or even stalking in the case of a celebrity or an angry ex. Taking advantage of security vulnerabilities within a Wink Relay or Ubi device, cybercriminals could turn the microphones on and listen to any conversations within earshot of the device, supporting blackmail efforts or capturing business intelligence from a user's employer in the case of a home office. Applying vulnerabilities found in the Chamberlain MyQ system, thieves could be notified when a garage door is opened or closed, indicating a window of opportunity to rob the house.

"It's hard to not be excited about what the IoT has enabled and will bring in the future, although that doesn't mean cybersecurity should be sacrificed in the process," said Brandon Creighton, Veracode Security Research Architect. "We need to look at the IoT holistically to ensure that the devices, as well as their web and mobile applications and back-end cloud services, are built securely from their inception. Security should not be treated as an afterthought or add-on, or we risk putting our personal information in jeopardy or even opening the door to physical harm."

Among the issues found were: open debugging interfaces that could allow remote attackers to run arbitrary code on the device itself such as spyware; serious protocol weakness that allow passive observers to access sensitive data or control of the device; and lack of adherence to best practices to protect users' accounts against weak passwords and common password-guessing techniques. The results showed that all but one device exhibited cybersecurity vulnerabilities across a majority of the categories tested.

The devices were purchased new in late December 2014. All test findings were against versions of the firmware that were up-to-date in mid-to-late January 2015. For more information about the study findings, methodology and recommendations, the full report can be downloaded here https://info.veracode.com/whitepaper-the-internet-of-things-poses-cybersecurity-risk.html

¹ Gartner, 2014, http://www.gartner.com/newsroom/id/2905717

² "Internet of Things, Privacy and Security in a Connected World," https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf

³ "Russian webcam hackers spy on bedrooms and offices," http://www.cnbc.com/id/102202954

About Veracode

Veracode is a leader in securing web, mobile and third-party applications for the world's largest global enterprises. By enabling organizations to rapidly identify and remediate application-layer threats before cyberattackers can exploit them, Veracode helps enterprises speed their innovations to market -- without compromising security.

Veracode's powerful cloud-based platform, deep security expertise and systematic, policy-based approach provide enterprises with a simpler and more scalable way to reduce application-layer risk across their global software infrastructures.

Veracode serves hundreds of customers across a wide range of industries, including nearly one-third of the Fortune 500, three of the top four U.S. commercial banks and more than 20 of Forbes' 100 Most Valuable Brands. Learn more at www.veracode.com, on the Veracode blog and on Twitter.