FBI Warns About IOT Vulnerabilities

IOTOne of the major trends in technology is the proliferation of smart devices, also known as the Internet of Things (IOT).   The FBI recently released a public service announcement titled “Internet of Things Poses Opportunites For Cyber Crime.”  More and more devices are are coming with software, processors and network capability, and connecting to our home and business networks.  This is creating a new target for cyber-criminals.  

What sorts of devices are we talking about?

  • Automated thermostats and HVAC controls
  • Automated lighting controls
  • Security systems
  • Closed circuit and WiFi video surveillance equipment
  • Baby monitors, many with video live streaming capability
  • Medical devices such as heart monitors and insulin pumps
  • Wearable fitness devices like the FitBit
  • Smart TVs and DVRs
  • Smart appliances such as refrigerators
  • Web connected office printers
  • Web connected gaming platforms and entertainment devices like the Roku or Fire Stick
  • Fuel monitoring systems
  • And of course, computers, laptops, tablets and smartphones.

Often these devices use technologies such as Universal Plug and Play (UPnP) which males setup a breeze, but often allows people to leave the default passwords and settings in place.  This gives cyber-attackers a fresh set of entry points into your networks at home and at the office, from which they can gain access to computers and servers where the valuable information is stored.  The FBI recommends that home owners and business network administrators take the following steps:

  • Always change default user and password credentials for new ones.  Avoid using the same one on all devices; if an attacker breaches one device, they then have access to all of them.
  • Disable UPnP on networking devices such as routers and switches.  UPnP allows devices to identify themselves and connect automatically to a network without user intervention.  Handy, no doubt, but very insecure.
  • Creating separate networks different purposes is another recommendation.  We already do this in some cases when we provide a “Guest WiFi” network that is separate from the main network.  Creating a separate network for IoT devices will isolate them from the computer data network.
  • Evaluate which of these devices truly needs Internet connectivity. For instance, if you do not use print to the web capabilities on network printers, you should disable that feature.
  • Keep IoT devices and firmware updated.
  • Purchase IoT devices from know manufacturers with a good security reputation.


More information


About the Author:

I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at http://wyzguyscybersecurity.com
  Related Posts

Add a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.