Ana Weaver
The Internet of things is penetrating the world, bringing substantial benefits to businesses and industries, and improving quality of life. It offers us a range of opportunities and fancy products, from smar-refrigerators sending a grocery list to the smartphone, fitness, and health tracking wearables to industrial plants.
In 2024 the global IoT market was worth about 389 billion U.S. dollars. The number of active IoT devices is forecasted to grow from 10 billion in 2024 to 25.4 bn in 2030. The rise of the Internet of things requires highly relevant and secure modern apps.
The rapid market expansion offers both benefits and challenges. A network of connected things and people implying real-time data sharing presents lucrative targets for cybercriminals that can take control of remote devices, knock them off, and steal sensitive data.
To reduce security concerns and vulnerabilities of smart devices and their apps, we highly recommend using the benefits of IoT security audit and you can read more about it here.
The more we use IoT devices, appliances, and networks, the more challenges we meet. Let us have a look at some crucial IoT security risks.
Poor compliance from manufacturers
Industries creating IoT devices are steadily increasing their manufacturing productivity to satisfy consumer demands but often issue products with security constraints that are easy to hack. Even smart toys can bear security risks, connecting and sharing audio and video data by Bluetooth, Wi-Fi, the cloud, and mobile apps.
Manufactures and app developers should first and foremost address such risk issues as hackable passwords, hardware vulnerabilities, unsecured communication and data storage, outdated embedded software and OS, insecure default settings, and firmware updates.
Poor user skills and awareness
Smart-device users need to get educated on the IoT vulnerabilities and potential risks, including those caused by human negligence and errors. Social engineering attacks succeed, exploiting the gullibility of users and their lack of knowledge.
In 2019 Toyota Boshoku Corporation lost USD 37 million when its finance executive, tricked by the attacker, changed the recipient bank account information in a wire transfer.
IoT security improvement demands better consumers risk awareness and due diligence.
Insecure firmware and update challenges
Most IoT embedded firmware and software lack security options and automatic updates. Updating and patching are a challenge.
Besides, these activities can provoke disruption and downtime. In addition, unprotected transmissions can result in data theft.
Insufficient physical hardness
Insufficient physical hardness bears threats of physical attacks on remotely located IoT devices. Attackers can physically breach devices (motion sensors, video cameras, light bulbs, traffic lights, etc.) or replace them with malicious ones, modify their programming, steal consumer information and obtain access to other connected appliances and networks.
The problem requires physical protective measures.
Botnets
Botnets attack IoT devices, infect them with malware getting access to personal and business data. Infected IoT devices evolve into zombies and join the botnet armies.
The most famous DDoS attack (The Mirai Botnet) in 2016 caused the breakdown of a range of web giants, including Twitter, the Guardian, Netflix, Reddit, and CNN.
In the first half of 2024, Mozi, a P2P botnet, reached 360,000 unique systems. A newly discovered botnet Meris, consisting of appr. 250000 malware-infected devices launched attacks on different networks in the summer of 2024, sending tens of million requests per second.
Botnets are introducing threats for the Internet of Things since they are capable of causing troubles for industries, utilities, and environments, dangerous for nature and people.
Eavesdropping and espionage
Hackers can breach our privacy, compromising sensitive personal data from any smart devices we use. There was a well-known story from 2017 when Germany banned an internet-connected doll Caila as an espionage device. German regulators also banned smartwatches for children for privacy concerns.
Industrial espionage via IoT networks with the help of malicious software and back doors can lead to substantial commercial losses providing hackers with access to the high–value business information, including trade secrets and intellectual property.
Hijacking and ransomware
Any malware aims at extracting sensible data and money damaging IoT networks. Ransomware does not ruin any systems. It encrypts files, denying the availability of files and connected systems and demanding a ransom for decrypting and unlocking.
Until recently, ransomware seldom attacked IoT devices, but nowadays, it is developing and becoming more sophisticated, often targeting medical institutions forcing them to pay a ransom.
560 US healthcare providers experienced ransomware attacks in 2024.
In 2018 an average ransomware payout was USD 5000. In 2024 the average fee amounted up to 283000.
In 2024 an insurance company paid out the ransomware charge of USD 40 million, setting a world record.
IoT Security in Healthcare
Wearables, patient monitoring devices, wireless data transmission systems, smart beds, physical hospital access control equipment, and other connected appliances create IoT environments in the health care sector. The connected devices and sensors provide doctors and patients with access to personal health records.
Health care operators collect and handle sensitive personal data, thus becoming a tempting target for hackers. Over 80 percent of medical organizations have experienced IoT-focused cyberattacks.
Rogue IoT Devices
Rogue IoT devices integrate into the networks being unauthorized. It can replace the authentic device or join the group breaching the IoT network perimeter. The goal is to gather or modify sensitive data..
The end users can be completely unaware of the rogue device integrated into their connected system.
Cryptomining
Cryptomining bots do not have the purpose of destroying IoT devices. Their single goal is cryptocurrency hidden mining. Nevertheless, these bots aren’t harmless. Evolving, crypto-miner bot attacks have a variety of new forms and techniques. They build the botnets infecting and involving IoT devices owned by other users, slowing them down and reducing their lifespan. Quite often botnets attack video tools for miners deployment and criminal mining activities.
Conclusion
The Internet of Things is boosting in popularity but remains scarcely protected and vulnerable. Manufacturers rarely provide ready-secured devices, and security issues are not yet among their priorities. If we cannot avoid these problems, we should mitigate them, starting with their detection and evaluation.
Mitigation of vulnerabilities of the Internet-connected devices and networks urgently requires robust security solutions to provide a secure IoT future.