The Internet of Things (IoT) is developing at a tremendous rate. It is a combination of devices connected via the Internet and other networks which are capable of receiving information from the outside world, analyzing it and, if necessary, managing external devices as well as providing information for decision-making. The goal is to create a more comfortable, safer and efficient environment for both personal and public life. But like any rapidly evolving Internet technology, there are increasing risks from the point of view of cybersecurity. The most significant cyberincidents in the world of IoT, the reasons for the occurrence of such cases and possible ways to improve the situation with IoT cybersecurity are considered.
Kevin Ashton [
According to HIS Markit evaluation, the number of "smart" devices in 2015 was about 14.4
billion, it will increase by 60% to 23.4 billion in 2017, and is projected to reach 30.7 billion by 2020
and 75.4 billion by 2025 [
The use of smart devices in private life in many cases increases the comfort and safety of its users. In medicine, they provide the possibility of constant remote monitoring of patients' condition and can carry out, if necessary, urgent assistance. Industrial Internet of Things (IIoT) is the foundation of a new industrial revolution in which smart manufacturing will play a decisive role in improving production efficiency through better automation and data transmission as well as through data analysis with the use of artificial intelligence for decision making. Smart cities allow optimization of the usage of urban resources, improving mobility of the population and its security.
Unfortunately, the growth in the number of smart devices has not been accompanied by due attention to their safe use. As a result, hundreds of millions of devices were vulnerable in terms of both their own architecture and software, as well as communication protocols. Using cloud services to store and analyze data from these devices increased the danger of unauthorized access to confidential information.
Smart homes contain devices that provide security (video cameras, motion sensors, electronic locks, etc.), climate control, smart lighting, various household appliances (TV, coffee machine, refrigerator, oven, etc.). These devices can provide information to and to be controlled from the smartphone both directly (via Bluetooth or WiFi), and using Web-based applications. The spectrum of house-oriented devices is continuously growing.
As an example, one can consider the "smart" baby monitor Aristotle [
Sometimes smart devices perform a role that is not directly intended for them. During a family
quarrel [
According to the estimates of Zion Research, the global smart home market will grow from
USD 24.1 billion in 2016 to USD 53.24 billion by 2022 [
Wearable smart gadgets such as fitness trackers, body mounted cameras, smart watches, heart rate monitors, smart clothing, virtual reality glasses, GPS tracking devices, etc. are gaining more and more importance in the everyone’s personal life. Some of them initiate users to monitor their physical health, encourage sports activities, expand the horizon of interests, others help to monitor health.
Strong competition in the market of these devices drives the expansion of their functionality with a reduction in price. Modern smart watches can understand voice commands, send and receive messages, search the Internet, record memos, track your heart rate and steps, calculate calories burned, perform sleep monitoring, register your workout with GPS, offer you your favorite music and much more. Internal memory of 4-8 GB allows to download new applications when they appear.
According to Tractica, the global wearable devices market will grow to 187.2 million units by
2020, more than 10 times in seven years (2013: 17.0 million units). Growth is primarily due to smart
watches, fitness trackers and wearable cameras [
A separate area called mHealth (an abbreviation for "mobile health") uses wearable devices
and wireless communication for real-time health control and services provided by medical
professionals. Remote monitoring is especially important for the support of chronic patients (diabetes,
cardiovascular disease, tuberculosis etc.), as well as for people who need constant monitoring (e.g.
physical and mental health during the prenatal period or during rehabilitation after a serious
operation). More information about mHealth can be found in [
The team of Professor Dae-Hyeong Kim at Seoul National University in South Korea is
developing a wearable device for diabetics based on a graphene plaster. This device can control the
blood sugar level by analyzing the composition of sweat on the hand, and, if necessary, enter the dose
of metformin stored in the device [
The Industrial Internet of Things (IIoT) opens completely new opportunities in many sectors
of the industry: manufacturing, transportation, mining, energy production and distribution and many
others [
The information created by intelligent devices and industrial control systems allows timely and correct decisions concerning the efficiency of production, the support services and the business model of the enterprise and so helps companies to make better investments decisions. Because of the huge amount of data and its complexity, cloud computing, artificial intelligence, real-time analysis can be used to make decisions.
IoT strategy is the basis for creating cost-effective, comfortable, ecologically clean and smart
cities. Data from numerous electronic sensors distributed throughout the city and connected to the
Internet and other networks allow the collection, analysis and decision making on key issues of the
city's life in real-time: e.g. transportation, lighting, heat supply, waste disposal, goods turnover, etc. It
also provides important information and community services to city residents and visitors. Smart cars,
private or based on shared mobility solutions, will be able to choose the best way of travel while
saving passengers time and operational cost. Intelligent traffic light system can help emergency
vehicles to reach incidents with a minimum of delay. Smart street lighting, taking into account weather
conditions, the presence of transport and pedestrians, will allow the optimization of electricity costs.
There are some places where smart city technologies is being currently implemented successfully:
Dubai [
The Smart Agriculture project in Salerno (Italy) [
The rapid introduction of IoT technology, along with the huge benefits, brings new and significant risks associated with vulnerabilities present in smart devices. Vulnerabilities refer to both the software and hardware components of these devices, communication protocols, as well as storage and processing of data in smartphones, tablets, data centers and cloud structures.
Widespread use of default passwords and unpatched firmware mean that compromising the devices is relatively easy for the attacker. The developer company often leaves the default password in order to remotely service the device in case of questions from the customer. But even if the instruction says that the default password must be changed when installing the device, the customer does not always care about doing it, considering that he does not represent an interest for intruders. For the same reason, he takes little care of installing patches, which the developer suggests to fix detected vulnerabilities.
Another reason for low security is that the limited computational ressources of smart devices do not allow the implementation of complex cryptographic algorithms, especially as firms are trying to reduce the cost of their products in a competitive environment. As a rule, when choosing devices, for example, for a smart home, customers can not assess the security of the devices and are basically guided by affordable price. Sellers are more interested in increasing sales and are not responsible for giving advice on the security of the proposed product range.
Communication protocols used by smart devices have serious vulnerabilities. ZigBee is a
popular smart-home wireless communication standard used by the majority of Internet of Things (IoT)
devices today [
Studies of the Bluetooth protocol also show a lack of security [
The WiFi Protected Access (WPA) protocol was introduced by the WiFi Alliance in 2003 to
provide secure wireless data exchange in networks. The improved version (WPA2) became available
in 2004. The protocol is widely used in networks for communication with smart devices. A recent
study of this protocol [
It is quite easy to locate vulnerable devices and hack them by using search engines
like Shodan [
This situation significantly increases the number of cases of illegal penetration into private life, into individual firms and organizations.
Furthermore, a huge number of vulnerable devices, largely smart devices, creates new opportunities for cybercriminals: easy detection of vulnerable devices by scanning the Internet allows criminals to organize a large scale infection of the devices and to use them as an army of robots for criminal purposes. As a result: tens of millions of the smart devices can be organized in a powerful botnets (a combination of the words "robot" and "network") to send many millions of malicious requests to their targets.
For example, the malware Mirai, a self-propagating botnet virus, which first appeared in
August 2016, is able to compromise smart devices running Linux and combine them into a powerful
Mirai botnet. The Mirai-based botnets were used by cybercriminals to organize the most powerful
DDoS attacks. Victims were the journalist Brian Krebs's website [
During the attack on Dyn servers more than 70 services in USA were blocked during the period from 7 a.m. till 6 p.m. on October 21, 2016, including BBC, CNN, Fox News, PayPal and VISA. Malicious requests from tens of millions of IP addresses created a total flow of about 1.2 TB / sec, which completely blocked the Dyn Domain Name System Infrastructure.
The lack of attention to the security of smart devices, when their number is rapidly increasing, further increases the risks of using these devices for criminal purposes. The scale of the attacks goes to a completely new level and threatens not only individual organizations, but also vital infrastructure of the state: energy, transportation, informatization, etc.
The lack of security of smart devices is due to a number of reasons: the lack of standards or mandatory official recommendations for the security of the Internet of Things, the huge variety of devices; the lack of legislative acts regulating responsibility between the manufacturer, the seller and the client; to reduce their costs manufacturers save on security. For most users, low cost is more important than security; users do not consider themselves to be a serious target for intruders and do not even care about recommended security measures (strong passwords, patch updates, certified downloads).
The growing influence of the Internet of Things on the personal and social life of
people, on state activities and interstate relations is obvious. The Internet of Things is an integral
element of the new industrial revolution (Industry 4.0) - a new stage in the development of human
society [