There is a sharp divide in the technology world. One camp is racing to connect our devices to the Internet, to make everything — from the watch to the refrigerator — smart, so to speak.
The other camp is terrified of what that means: everyday objects that can be hacked, easily, to spy on us and hand off valuable data to cybercriminals. The cynics are gathered in Las Vegas this week, at the security conference Black Hat.
The Nest Hacker
People who hack for good have come to Mandalay Bay to share their research.
Meet Grant Hernandez, 21, an undergraduate security researcher at the University of Central Florida. He hacked one of the smartest smart devices on the market: Nest. The home thermostat uses sensors to tell when you're home and adjust temperature accordingly. With a shiny silver rim and black center, it kind of looks like a big eyeball. And, Hernandez says, it's pretty easy to turn it into a spy.
Nest left the device on display at the conference unprotected. So by plugging in a USB, Hernandez can enter developer mode.
"Entering into that mode allows you to upload your own code, your custom code, which then allows you to attack the existing code, implant your own and reboot normally, but maybe have something else running in the background," says Hernandez.
If Hernandez wanted to, he could run to the Lowe's store, buy every Nest, reprogram it to shoot user data to him — and the customer wouldn't have a clue.
"We have access to the device on the highest level, and we can send stuff that Nest sends to us as well," he says.
Nest, which is owned by Google, says security is "very important," and the company's "highest priority" is on remote, wireless hacks. This hack, which is to the hardware, does not compromise the security of the data that's inside the Nest servers.
Bluetooth And Apps: Careless Design
Another genre of smart device that is wide open to wireless hacking is the wearable — the watch or running shoe with sensors inside that are connected to the Internet.
But surprisingly, at Black Hat, hardly anyone is wearing one.
"No, I'm not wearing a fitness device," says Orla Cox. "I haven't actually used it since we, uh — since we did this study."
Cox is director of security response at Symantec. They just published a breathtaking audit of the top devices and self-tracking apps in the Apple Store and Google Play.
These apps peer deep into the human body and log very personal information. Not only heart rate and calories burned, but, for example, Spreadsheets tracks the frequency and loudness of sexual activity. Another one, Poop Diary, takes a look at bodily functions.
In the cyber-underground, experts say, hackers are building profiles of individual people. And any data that could eventually be sold — say to an insurance company or marketer — is worth stealing.
Cox says the apps make that theft really easy. The makers typically share private data with other sites. And they don't even bother to protect usernames and passwords with encryption.
"These are basic security practices that are not new and that should have been implemented straightaway when these apps were being developed," says Cox.
The Symantec report also looks at the most popular self-tracking devices, like FitBit and NikeFuel. They run on Bluetooth, which emits location data 24/7.
Cox's team built a machine, for $75, to sniff the GPS coordinates of individual people wearing trackers in public places. She says unlike smartphones, these well-known brands were designed without an off switch.
Cox says a unique ID comes from these devices that allows them to be tracked more easily than a phone.
Smart Devices Are Attack Surfaces
Levi Gundert, senior threat researcher at Cisco, is asking the accountability question: When grandma's toothbrush or toaster starts participating in a denial of service attack, who's responsible?
Cisco just released a report estimating that by 2020, there will be 50 billion connected devices. That is a whole lot of surface area for hackers to attack and, Gundert says, for corporations to protect.
"I want to see an initial recognition that, yes, our devices are capable of being used in an attack scenario," says Gundert. "There's a responsibility to not necessarily just sell things to consumers, but also sell them in a responsible way."
One of the biggest players in the self-tracking market, Nike, had a booth at the conference. Several attendees speculated that the company is looking for talent to help secure its devices. Nike declined to comment.
Copyright 2020 NPR. To see more, visit https://www.npr.org.
