Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Business Intelligence Sales & Marketing More Topics...
Network Security
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Security Firm Reports First Spam Attack Using a Refrigerator
Security Firm Reports First Spam Attack Using a Refrigerator

By Barry Levine
January 17, 2014 12:29PM

Bookmark and Share
David Knight of Proofpoint said devices in the Internet of Things "are poorly protected at best and consumers have virtually no way to detect or fix infections when they do occur." Businesses, he said, may find distributed attacks "increasing as more and more of these devices come on-line and attackers find additional ways to exploit them."
 


We now have the first evidence that the emerging Internet of Things is also the Internet of Things That Can Deliver Spam. A security firm has uncovered a global cyberattack that harnessed connected household devices, including a refrigerator.

Proofpoint Inc., based in Sunnyvale, California, said the attack utilized 100,000 consumer devices, employing them as other attacks have used captured computers -- to secretly deliver spamming e-mails numbering in the hundreds of thousands. The attack took place recently, between Dec. 23 and Jan. 6, and included in its botnet at least one smart refrigerator, as well as home-networking routers, connected multimedia centers and smart TVs.

The security company told news media that the attack "may be the first proven Internet of Things-based cyberattack involving conventional household 'smart' appliances." The attack, Proofpoint said, was sent in bursts of 100,000 e-mails three times daily, directed at companies and individuals around the globe, and over one-quarter of the spam was sent by compromised, non-computing devices.

'Poorly Protected'

No single IP address was used to send more than 10 e-mails, which made the attack's origin more difficult to locate, and the commandeering of the devices involved the relatively simple tasks of taking advantage of misconfigurations and default passwords.

David Knight, general manager of the Information Security Division at Proofpoint, said in a statement that devices in the Internet of Things "are poorly protected at best and consumers have virtually no way to detect or fix infections when they do occur." Businesses, he said, may find distributed attacks "increasing as more and more of these devices come on-line and attackers find additional ways to exploit them."

While not surprising, this new turn in malware raises a variety of questions about the addition of intelligence and connectivity to appliances and other non-computing products. If they can become "thingbots" and commandeered for nefarious purposes, will they also need the kind of anti-virus software, updates and continual vigilance that users are now required to do for their computers and mobile devices?

Application Control, ISP Vigilance

And how much additional effort and expense will it take to build and monitor a security fence around intelligent TVs, refrigerators, stoves, lighting devices in homes, connected coffee pots, smart thermostats and the like? According to some estimates, the Internet of Things already includes more than 2 billion devices, and industry research firm IDC has predicted there will be more than 200 billion connected things by 2020.

Peter Firstbrook, an analyst with Gartner, told us that "manufacturers have to get smart" about making all of these devices attack-proof, primarily by utilizing "application control, not anti-virus software," so that a connected device is built to run only specified applications and accept updates only from a single source, such as Westinghouse.

But some devices have become, essentially, computers able to run a large variety of applications, such as smart cars or connected TVs. Protection for those devices in particular, Firstbrook said, will need to happen at the network level, through a third party such as Zscaler or through an ISP, providing a continual scanning of all incoming and outgoing traffic.
 

Tell Us What You Think
Comment:

Name:



Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.


 Network Security
1.   Verizon Report Exposes Cyberthreats
2.   How Are Web Sites Post-Heartbleed?
3.   White House Updating Privacy Policy
4.   Target Hackers May Be Tough To Find
5.   Heartbleed Exploit Could Cost Millions


advertisement
How Are Web Sites Post-Heartbleed?
Questions on open source, security.
Average Rating:
Heartbleed Exploit Could Cost Millions
But it could have been prevented.
Average Rating:
Michaels: Nearly 3M Cards Breached
But the hack has been contained.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Verizon Data Breach Report Exposes Top Threats
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 
Where Do Web Sites Stand, Post-Heartbleed?
A security firm says the vast majority of Web sites have patched themselves to protect against the Heartbleed bug, but now there are questions raised on the reliability of open-source programs.
 
White House Updating Online Privacy Policy
A new Obama administration privacy policy explains how the government will gather the user data of online visitors to WhiteHouse.gov, mobile apps and social media sites, saying much is in the public domain.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Business Intelligence | Sales & Marketing | Contact Centers | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.