A few years ago, IoT (Internet of Things) was still a strange terminology to most of us. Int means the internetworking of physical devices, vehicles (also referred to as “connected devices” and “smart devices”), buildings and other items—embedded with electronics, software, sensors, actuators, and network connectivity that enable these objects to collect and exchange data.
Now, IoT has infiltrated into all aspects of our lives, such as cloud monitors, network industrial equipment, satellite antenna equipment and so on. However, IoT security has been causing concerns and most of security experts also said that the current status of IoT security is not optimistic.
Just two days ago, researchers at Akamai Security Labs published a security report on IoT. Akamai’s security researchers have found that many IoT devices have massive malicious traffic on the Internet. When they tested these IoT devices, they found that hackers were able to exploit about two million IoT devices around the world using a very old OpenSSH vulnerability.
After collecting all the IoT devices currently on the public network, the researchers found that the following types of IoT devices were affected by this vulnerability:
• CCTV, NVR, DVR devices (video surveillance)
• Satellite antenna equipment
• Networking devices (e.g. Routers, Hotspots, WiMax, Cable and ADSL modems, etc.)
• Internet connected NAS devices (Network Attached Storage)
The main reason for this damage is due to a large number of IoT devices do not patch CVE-2004-1653 vulnerability, and this vulnerability can create and use unauthorized SSH tunnel, and get control of the device. As long as the hacker can access the IoT device’s Web control panel, you can establish SSH tunnel. What surprised the researchers was how many IoT devices had high-risk vulnerabilities 12 years ago, showing how the security awareness of most IoT vendors was weak.
