Internet of things devices are the most vulnerable to cyberattacks

"Very often, we buy these devices to keep up with the latest trends, but what we don't realize is that they are all connected to the Internet", says Jordi Serra, member of the UOC's KISON research group – concerning ICT security – and professor on the Joint University Master's Degree in Information and Communication Technology Security at the UOC. "More and more devices are becoming more vulnerable", he adds.

The times are changing. Cybercriminals no longer focus their attacks on traditional desktop computers – sales of which are plummeting – but for some time now on mobiles and tablets, where most online purchases and banking transactions are made. And, to these, Serra advises that we should also add Internet of things devices.

Infected devices

Proof of this was the most serious cyberattack of the last decade, which occurred on 21 October 2016, against the DynDNS Internet provider via home devices connected to the Internet and which the hackers had previously injected with a hidden virus. The attack – which affected over one billion customers worldwide – was in fact possible because of cameras and video recorders in these cameras, all of which were connected to the Internet.

So, once they had infected hundreds of thousands of these devices, the hackers programmed them to operate all at the same time, generating a surge in traffic that led to the service collapsing.

Companies affected by this attack included Netflix, Amazon, Twitter and Spotify, but as well as the large multinationals, individuals can also become victims of the cybercriminals. "The danger is that they obtain your bank details, they steal your social network profiles to sell the data to companies or they use your devices to attack business, as was the case here", says Serra.

The importance of updating

Given this, the main piece of advice from Serra is to update the software on these devices. Something, however, that we do not tend to do frequently. "People don't know that they also need to update the router, television, car, automatic watering systems, thermometers, etc. Anything connected to the Internet", he says.

Updates tend to have two aims. To give the device new characteristics or for security purposes. "Providers bring out software updates to plug the security holes that have been detected", Serra explains. "It's usual for mobiles to receive automatic updates and without users interacting with the apps installed on them, but on many other devices, in the best of cases, all the manufacturer does is post these updates on its website. It's up to the users to go and download the update and install it. And if they don't, that's their problem. But people don't realize this."

"This whole Internet of things is constantly growing and people don't realize that they need a minimum level of security with all these devices", Serra concludes. "Because if we're not careful, we'll be making things easy for the hackers."