How internet-connected domestic devices can be a critical tool of cyberattack

It can show you whorsquos at the door let out an alarm in case of an intrusion and give you a log of all the visitors who came by It can also be hacked and become a critical tool in a cyberattackIn January this year Ayyappan Rajesh a student of computer engineering at UMass Dartmouth decided to mess around with his neighbour Rajesh who was home on a short holiday saw that the neighbour had installed an Internetconnected smart doorbell The 22yearold was curious if he could hack itldquoMy fellow researcher and I wanted to test its security We ran a simple scan on the device and to our shock it had an application known as Telnet which was first produced in 1983 and not protected by a password After discovering this it was extremely easy for us to connect to itrdquo says Rajesh who submitted a report with research data that emerged from this episode to the Indian government the same monthAyyappan Rajesh decided to mess with his neighbourrsquos new internet connected doorbell as a prank and ended up exposing a serious flaw in the technologyHis findings were officially recognised in the form of a vulnerability advisory this month published by the Indian Computer Emergency Response Team CERTIn on its website It has also been assigned a Common Vulnerabilities and Exploits CVE number which is the global cybersecurity communityrsquos way of confirming a vulnerabilityldquoThe vulnerability allowed any user on the same WiFi network to remotely connect and run commands on the device If exploited the vulnerability would give hackers access to all the information stored in the devicerdquo Rajesh tells midday over a telephone callFor a product like a smart doorbell this information would include the live stream captured by the camera the visitorsrsquo log WiFI router and any other devices connected to the doorbell like the ownerrsquos computer and mobile phone for instance A smart doorbell like most Internetconnected devices will contain data pertaining to the current network and its owner The neighbourrsquos had stored user email addresses and passwords all useful to gain access to other systems connected to it Explaining the larger picture Rajesh says that a vulnerability such as this can equip a hacker to execute a malicious code and turn the device into a cog in the wheel of a botnet to be used for anything ranging from mining cryptocurrencies to launching DDoS attacksInternet connected refrigeratorA DDoS or Distributed Denial of Service attack is one where a single server is bombarded with millions of pings per second Any interaction with a server like opening a website is a ping Servers have a limited capacity to handle pings per second and an overload can cause them to crash denying service to their users This is done by putting together a network of crores of hacked devices called a botnet and using these devices to send pings simultaneouslyWhile botnets earlier were made only of hacked computers and mobile phones with the advent of IoT doorbells refrigerators speakers vacuum cleaners and smart home devices the scope for botnets has increased a thousandfold According to Kasperskyrsquos DDoS report for the third quarter of 2022 the longest DDoS attack recorded during this period lasted for a dizzying 18 days and 19 hours In simpler words malicious hackers have botnets that can enable them to make a server stay consistently crashed for nearly three weeks nonstop For this same time Kaspersky also observed that Indian devices ranked third in terms of the number of bots used to execute DDoS attacksThe targets too have changed While earlier DDoS attacks were aimed at entities corporations or government services hackers are now going after the domains that host these servers taking down scores of services in one fell swoop Rajesh cites the example of Mirai one of the largest botnets in cybersecurity history ldquoThe Mirai botnet orchestrated a series of DDoS attacks targeting the domain name system provider Dyn As a result numerous popular internet platforms and services became inaccessible to scores of users in Europe and North Americardquo he says And if you thought the vulnerabilities were only limited to a single type of smart doorbell Rajesh has more bad news His discovery with the doorbell sent him on a quest to assess the security of other IoT devices He found that most use a protocol known as MQTT While researching how many devices with MQTT were exposed to the Internet in India he came across two instances where two sensitive MQTT servers were left open with no password nor encryptionldquoThe first was an appbased taxi service that operates in Delhi Bengaluru and Goa It exposed names phone numbers and locations of all their customers along with detailed location logs of the vehicles The second was a company in Maharashtra that sells devices used in smart electric scooters The scooters are fitted with an app and also have a remote kill feature The devices were vulnerable to hostile takeover and control Along with this issue the server had live information of all the vehicles connected to it and live GPS coordinates for each vehicle along with its speed and other information which I was able to alter I changed the location of one of the scooters to that of my Universityrdquo Rajesh claims