The age of the “Smart Home”, where everything from the doorbell to appliances to the heating and air conditioning system is connected to the IoT, is either already here or coming soon, depending who you talk to. But making sure those devices are secure is likely going to be a major hurdle going forward, according to researchers at Georgia Institute of Technology and the University of North Carolina at Chapel Hill.
The combined research team conducted a study assessing the security of representative consumer-grade IoT devices, awarding scores ranging from 28 (an F) up to 100. The results are published on a site https://yourthings.info. The site so far shows rankings for 45 devices, though a total of 74 have been evaluated. The researchers expect the project is to help consumers understand important issues before connecting a new IoT device to their home networks.
“A lot of people who purchase these devices don’t fully understand the risks associated with installing them in their homes,” said Georgia Tech Graduate Research Assistant Omar Alrawi, in a statement. “We want to provide insight by providing security ratings for the devices we have tested.”
Alexa and other voice-activated personal digital assistants could provide unwanted access to the home networks to which they are connected, if they are not properly secured, warned Manos Antonakakis, a cybersecurity researcher and associate professor in Georgia Tech’s School of Electrical and Computer Engineering.
“If you have an IoT app that is vulnerable, whoever has access to that app not only has access to your personal information but could also jump into your home and eavesdrop on your conversations,” he said. “Anything that is connected in the home in proximity to the personal assistant could also interact with it. If there is vulnerable software running on the device, it could be exploited within the home network.”
Complicating matters is that most home networks, unlike businesses, have thin layers of security that are not updated on a regular basis to protect against new viruses and other hacker attacks, according to Chaz Lever, a research engineer in Georgia Tech’s School of Electrical and Computer Engineering.
“The home network is beginning to look a lot like enterprise networks with a range of services that have to be protected,” Lever said. “But the average consumer is not going to be equipped to do that. They don’t have an IT staff that is doing audits and securing the devices. If these devices are not secure out of the box and there aren’t easy ways to secure them, they can open the home up to a new vector of attacks.”
The researchers conducted their study with the help of a framework they developed to analyze security components of the devices. They examined the devices themselves, how the devices communicate with cloud servers, the applications running on the devices, and the cloud-based endpoints.
The researchers found wide variations in security depending on the manufacturer. In some cases, equipment made by small and lesser-known companies outperformed devices from larger companies. “We saw the full spectrum of good and bad, and sometimes we were surprised at the results of our evaluation,” said Alrawi. “There are some devices that do security really well, and other manufacturers should learn from those exemplary devices.”
Exacerbating the problem is that consumer-grade IoT devices sometimes sacrifice security features for ease of installation and use. An example is a service known as UPnP, which makes devices known to the network during installation so communications can be established.
A device announcing itself on the network can attract attackers, Lever noted. “It’s helpful for the devices to communicate what they do, but that opens up vulnerabilities. The choice of protocols affects not only the device, but also the security of the network on which it is running.”
Costly IoT-connected devices such as refrigerators could also present security issues if they are not updated, according to Antonakakis.
“Ideally, the consumer shouldn’t have to be aware that their refrigerator needs updates that have to be downloaded to the device,” he said. “We want that to happen automatically and securely. Why should anyone have to know how to patch their refrigerator?”
Even seemingly low-risk devices, such as a slow cooker, could create security concerns. The researchers said that heating elements in these cookers could create a fire if the device was hacked to turn up the temperature.