Kaspersky Lab researchers have discovered vulnerabilities in a smart hub used to manage all the connected modules and sensors installed in the home.
Woburn, MA – February 27, 2018 – Kaspersky Lab researchers have discovered vulnerabilities in a smart hub used to manage all the connected modules and sensors installed in the home. Analysis reveals that it is possible for a remote attacker to access the product’s server and download an archive containing the personal data of arbitrary users, which is needed to access their account and take control of their home systems as a result.
While the popularity of connected devices continues to increase, smart home hubs are in high demand. They make house management much easier, combining all device settings in one place and allowing users to set up and control them through web-interfaces or mobile applications. Some of them even serve as a security system. At the same time, being a “unifier” also makes this device an appealing target for cybercriminals that could serve as an entry-point for remote attacks.
Earlier in 2017, Kaspersky Lab examined a smart home device that provided a vast attack surface for intruders, based on weak password generation algorithms and open ports. During the new investigation, researchers discovered that an insecure design and several vulnerabilities in the architecture of the smart device could provide criminals with access to someone’s home.
First, researchers discovered that the hub sends users’ data when it communicates with a server, including the login credentials needed to sign into the web interface of the smart hub – the user ID and password. Moreover, other personal information – such as the user’s phone number used for alerts – can also be listed there. Remote attackers can download the archive with this information by sending a legitimate request to the server that includes the device’s serial number. An analysis shows that the serial number can also be discovered by intruders as a result of simple methods of its generation.
According to experts, serial numbers can be brute-forced using logic analysis and then confirmed through a request to the server. If a device with that serial number is registered in a cloud system, criminals will receive affirmative information. As a result, they can log into the user’s web account and manage the settings of sensors and controllers connected to the hub.
All information about the discovered vulnerabilities has been reported to the vendor and is now being fixed.
“Although IoT devices have been the focus of cybersecurity researchers for the past few years, they are still proving to be insecure. We randomly selected the smart home hub and the fact that we found it vulnerable is not an exception, but rather another confirmation of the continuous security problems in the IoT world,” said Vladimir Dashchenko, head of the vulnerabilities research group, Kaspersky Lab ICS CERT. “It now seems that literally every IoT device – even very simple ones – contain at least one security issue. It’s highly important for manufacturers to ensure proper protection of their users and pay close attention to safety requirements when developing and releasing their products, because even small details of insecure design can lead to dangerous consequences.”
In order to stay protected, Kaspersky Lab strongly advises users to do the following:
- Always use a complex password and change it regularly.
- Increase your security awareness by checking the latest information on the discovered and patched vulnerabilities of smart devices, which is typically available online.
To ensure the safety of your smart home, Kaspersky Lab offers a free application for the Android platform – Kaspersky IoT Scanner. The solution scans the home Wi-Fi network, informing the user about the devices connected to it and their levels of security.
To mitigate cybersecurity risks, Kaspersky Lab advises manufacturers and developers to always conduct security tests before products are released and to follow IoT cybersecurity standards. Recently Kaspersky Lab contributed to the Recommendation ITU-T Y.4806 (International Telecommunication Union — Telecommunication sector) standard, created to help maintain proper protection of IoT systems, including smart cities, wearable and standalone medical devices and many others.
More information is available on Securelist.com.
About Kaspersky Lab
Kaspersky Lab is a global cybersecurity company, which has been operating in the market for over 20 years. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into next generation security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.
Media Contact
Jessica Bettencourt
774.451.5142
jessica.bettencourt@kaspersky.com
