How To Stop Reckless App Design From Endangering Your IoT Data

Whether it’s cars or baby monitors, early ventures into the Internet of Things have proved a troublesome undertaking. Whilst sophisticated hackers are the known enemy, it’s the rise of slapdash application development that currently exacerbates the security risks of this emerging technology.

The recent vulnerability found in iBaby monitoring devices allowed remote access to the software, introducing the risk of intruder access to every recorded clip. Although this exploit was discovered by a security company rather than a hacker, the truth is that these smart devices are just as vulnerable as desktop PCs, are even more connected and share large amounts of highly personal data.

For businesses, the threat of the IoT exists where these compromised personal devices resume their activity on home networks where business assets are regularly exposed. A compromise on an otherwise relatively low-value target like a baby monitor can quickly provide a path to external, corporate networks.

Keeping baby and business safe

One of the biggest mistakes that IoT pioneers make when developing a connected product is failing to work security considerations into the design and development stages. Instead, they often rely on the misguided impression that attackers will not be interested or won’t be sophisticated enough to look for it.

The reality is that hackers have honed their abilities to perform automated, opportunistic attacks that constantly scan the web looking for unprotected systems. To avoid being stung in this manner, designers must weigh up the pros of ‘connected’ features against the cons of the security holes they open up before beginning any app development.

A rigorous assessment of the security and privacy implications of a new feature is bound to change the cost-benefit calculation. In some cases, the cost of security can even outweigh the benefit of the feature itself and there’s no room for shortcuts. Products must be designed with the assumption that they will be purchased, dissected and studied for vulnerabilities. Quick security fixes such as embedded private keys or weak authentication might save time and speed up deployment, but there is a fine line between a global IT ecosystem and a global botnet network.

Another common design failure is poor diligence with identity and authentication. Research by experts like Billy Rios have found that the use of backdoor administrative accounts is apparent in a wide range of systems, from medical devices to workplace time clocks and even airport metal detectors. Such lapses are justified because they allow the manufacturer to remotely administer devices deployed in the field.

Despite the threat hackers pose to a customer’s personal and working life, device makers simply can’t assume good practice when it comes to password protection. In iBaby’s case, half the devices tested contained hardcoded account credentials where the username and password had not been changed from “user” and “guest”. Achieving more resilient IoT deployment means regular password updates and supporting updatable firmware by way of authenticated, signed software updates.

And when it finally does come to deployment, manufacturers must take steps to ensure that all of this work in the design stage pays off by ensuring devices can be remotely protected and managed over their entire lifespan.

Paddy Srinivasan is vice president & head of products, Xively Internet of Things, at LogMeIn

Do you know all about the Internet of Things? Take our quiz!