{"id":74704,"date":"2014-11-30T12:00:04","date_gmt":"2014-11-30T10:00:04","guid":{"rendered":"http:\/\/businesstech.co.za\/news\/?p=74704"},"modified":"2014-11-28T16:22:30","modified_gmt":"2014-11-28T14:22:30","slug":"if-its-connected-its-vulnerable-to-hacking","status":"publish","type":"post","link":"https:\/\/businesstech.co.za\/news\/internet\/74704\/if-its-connected-its-vulnerable-to-hacking\/","title":{"rendered":"If it’s connected, it’s vulnerable to hacking"},"content":{"rendered":"

The UK Information Commissioner Christopher Graham has drawn attention<\/a> to a webcam-monitoring Russian website, which offers thousands of private video streams, raising fears of unwitting and continuous surveillance<\/a>. Graham conceded that he has little legal power<\/a> to close such sites.<\/p>\n

This revelation from one of the highest authorities on such matters should not come as a surprise to anyone who owns devices connected to the internet \u2013 and yet it has been treated in just this way<\/a>. The rule<\/a> of such devices is simple: \u201cIf it\u2019s connected, it\u2019s vulnerable.\u201d<\/p>\n

Security is your responsibility, too<\/h2>\n

These reports raise a number of questions and concerns that all come down to a single key realisation. We are surrounded by poorly designed systems that are made worse \u2013 not better \u2013 when they are brought together in different combinations. Even worse, when systems include reliance upon the actions of people \u2013 as all do in some way \u2013 then the scope for disaster rises exponentially.<\/p>\n

The response so far has been for calls to shut down the website<\/a>, but little attention has been given to the fact that this situation can easily happen again at another domain and with other devices.<\/p>\n

The recent hacking of Apple\u2019s iCloud<\/a> to gather compromising photographs of celebrities proved indirectly that smartphones are similarly at risk. The Russian website is just the publicly visible end result in a longer chain of activities. Hacking access to an IP camera can be done by anyone with access to the internet and with sufficient knowledge and patience.<\/p>\n

The Russian site currently under scrutiny quite simply relies on using the default admin passwords for a variety of commercially available internet protocol (IP) cameras, which are sold as stand-alone units connected to the internet wirelessly.<\/p>\n

When a camera is sold out of the box it invariably has a default admin account which is combined with a default password. The instructions on that box will also direct the new owner to immediately change the admin password. But users often don\u2019t make the change and the Russian website proves that point.<\/p>\n

Device-makers need to fix their ways<\/h2>\n

The immediate solution is clear. With the attention that the site has now received, owners of every single IP camera worldwide, whether they are currently displayed on the site or not, should change the admin password that enables access to the video stream. But even with this remedy, assuming the action was to be done completely by all of those camera owners, the result is only a superficial sticking plaster.<\/p>\n

Despite the now apparent demise of the site at the centre of the scrutiny a new version will only take another suitably determined programmer to take up The concept. The manufacturers of thousands of internet-connected devices<\/a> need to design them to minimise the reliance upon people to setup minimum security protocols.<\/p>\n

Examples of good information security can be taken from social media and online shopping websites where the potential risks are well-known and better acknowledged. For example, manufacturers could \u2013 and some now do \u2013 force the default admin passwords to be changed the first time a device is used (and to something different from the original default password). A device could also automatically monitor and alert an owner when a \u201cforeign\u201d computer is accessing it.<\/p>\n

While the Internet of Things<\/a> is still an exciting vision, it is important to ensure that it is also secure. This security should be available in a way that does not unnecessarily burden its users with responsibilities in the name of reducing costs. So much can be more effectively managed by software and automated processes to help protect us from privacy breaches.<\/p>\n

By Gordon Fletcher<\/strong>, Centre for Digital Business at University of Salford<\/span><\/em><\/p>\n