Two years after it was revealed that a creepy Russian website was allowing users to watch more than 73,000 live streams from unsecure baby monitors, the UK's data watchdog has warned that manufacturers still aren't doing enough to keep their devices safe from hackers.
Incidents involving parents stumbling upon pictures of their kids online—such as the one reported in 2014 by the Daily Mail—continue to occur, with images clearly being snaffled from Internet-enabled cameras that have been set up in people's homes.
The privacy breaches have prompted the Information Commissioner's Office to issue guidance to help users guard against opportunistic hackers, and people using the murky likes of the Shodan search engine to browse the Internet of Things.
"Internet of Things products such as baby monitors, music systems, and photo or document storage, which can be accessed online, are at risk of revealing your personal details to other people," said ICO technology manager Simon Rice.
"A lack of security when it comes to IoT devices could mean that a search engine is used by criminals to locate vulnerable devices and then gain access to them or others on your home network. An attacker could then use your equipment to mount attacks on others or take your personal data to commit identity fraud."
He lists six basic steps parents can take to help prevent casual hackers:
- Research the most secure products
- Secure your router with a strong password
- Secure the device by changing its default password
- Check manufacturer's websites for security updates to out-of-the-box software
- Read the manual to see if there are extra measures listed
- Use two-step authentication, if you can
The ICO declined to name any of the sites where streams are available, but a spokesperson told Ars that "you can connect to these devices directly, so there’s no intermediary website as such." She added:
With reports of many billions of IoT devices due to be connected by 2020, this is a problem that needs to be addressed now. We wouldn’t recommend any specific models but would advise consumers to follow our tips when purchasing and setting up an IoT device. Even the most secure device can be subject to unauthorised access if the username and password was set to, or left as, admin.
Manufacturers, meanwhile, should "subject IoT devices to a robust security test before launch and for every subsequent firmware update." She added: "They also need to commit to supporting devices for a reasonable length of time following launch and act quickly on reports of security vulnerabilities. They should also make the devices "secure by default" and make the user interface intuitive.
"Security should not be left up to the individual to configure the device through a difficult to navigate user interface."
reader comments
5