The smart kettle that joined an attack
A family buys a smart camera and plugs it in. They never change its password. Soon it is part of a gang of thousands of cameras sending junk to a website.
The camera still works. The family never knew.
Key words
| Word | What it means | Example |
|---|---|---|
| Internet of Things | everyday objects with a small computer that connect to the internet | a camera, a bulb, a lock |
| Encryption | scrambling data so only the right person can read it | |
| Default password | the password set at the factory, which many people never change | |
| Firmware | the built in software that runs a device | |
| Update | a new version that fixes faults and weaknesses | |
| Rollback | putting an older version back on a device | |
| Network | computers and devices joined so they can share data | |
| Vulnerability | a weakness that an attacker could use |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can describe four risks of Internet of Things devices and how to reduce each.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Four risks of IoT devices
| Risk | What goes wrong | What helps |
|---|---|---|
| Poor data protection controls | Few built in protections. Low power, so often no encryption. Often on a shared network | Choose devices with security built in. Keep them on a separate network |
| Poor password protection | Weak or guessable passwords, such as the factory setting | Change the password on day one. Use a long one |
| Insecure data transfer and storage | Sensitive data is not encrypted or controlled while it is processed, sent or stored | Use encryption in transit and at rest |
| Security updates | The device cannot be updated safely | Pick devices that can be updated, and update them |
The cells students fill in are left blank in this preview.
What goes wrong with updates
A device that cannot be updated safely keeps its weaknesses for ever. Three faults make it worse. The firmware is not checked before it is installed. The delivery of the update is not secure. There is no rollback protection, so an attacker can put an old, weak version back.
Also, the owner may never be told about a security change.
Check
Have a go
Check
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.