Cloud Hosting

Youve heard all about shadow IT, but theres another shadow lurking on your systems: Internet of Things (IoT) devices.

These smart devices are the IoT in shadow IoT, and they could be maliciously or unintentionally exposing information. Threat actors can use that to access your systems and sensitive data, and wreak havoc upon your company.

A refresher on shadow IT: shadow IT comes from all of the applications and devices your employees use without your knowledge or permission to get their jobs done and handle their work data. Some examples of shadow IT include departments purchasing and installing their own software, users making unauthorized changes to their endpoints and employees using cloud services that arent company standard.

Add a few IoT devices into the mix, and your security efforts are suddenly and obviously more vulnerable. However, whats not as obvious is that the shadow IoT phenomenon can include things like multicolored light bulbs, coffee makers and Bluetooth speakers.

These devices pose new security risks for the enterprise, as IoT is typically not as secure as it should be. In 2021, 12.2 billion devices connected to the internet worldwide, with an expected growth up to 14.4 billion active connections in 2022. If you think none of those devices are shadow devices on your network, think again. According to Infoblox, 35% of U.S., UK and German companies have more than 5,000 shadow devices connected to their network on any given day.

TikTok personality and security engineer Jose Padilla (@secengineer) knows how to see which devices might be at risk. His frequent TikTok posts test different IoT devices to determine just how risky they are and examine what kind of network traffic the devices are outputting.

The Mirai botnet was created almost entirely by IoT devices, he said. Thats what inspired me to start looking more into what these IoT devices are doing on my network. Of course, I want to use smart things. Theyre very convenient. I obviously love technology. But as a security engineer, I always have to second guess these kinds of things.

Padilla has tested almost two dozen devices and explains that he takes each through a rigorous process that requires at least three or four hours of sifting through logs to establish patterns to see if anything stands out.

What surprised Padilla most from his testing is the security issues arising from something as simple as a smart lightbulb. You can watch his video for more detail, but we wont name the product here.

Its such a well-known brand; a premium IoT brand, he said. I expected it to go completely smooth and be boring, and it definitely wasnt boring.

Padilla explained that the traffic generated from the smart bulb would raise serious red flags for any security team.

Here are the highlights of what he discovered:

What concerned Padilla the most was a vulnerability that, if exploited, could unleash significant damage.

One of those things that I found was the authentication sessions, he said. The authentication sessions are the connection between the companys cloud servers and the bulbs smart hub itself. So if you wanted control from the cloud, this is the connection thats going to do it.

Plus, he had this feature turned off in his tests, but the hub was still connecting to the cloud. All relevant tokens the single sign-on token, the session token and the authentication token were transmitting data in the clear.

According to Padilla, a similar bug or vulnerability was found in another of the manufacturers products a few years ago, a smart air filter, but was quickly fixed.

Theres no excuse for IoT devices to send traffic over the Internet unencrypted, he said. Its just opening up more risk. Its another threat vector, whether it will be easy to exploit or not.

While most of the attacks that could be potentially launched against the lightbulb are benign, there are proofs of concept that should raise eyebrows.

Weve seen that some light bulbs can have a faster flicker rate, and one potential attack could produce a strobe light effect, he said. It could be harmful to anyone thats photosensitive. But those are more minor in comparison to some of the other attacks or vulnerabilities and proof classes Ive seen for this lightbulb.

Padilla explains that security testers were able to upload malicious firmware to the light bulb, and it was not difficult for them to control the light bulb and force an unsuspecting user to connect to a bad bulb. The attack chain would go from the bulb to their phone to the hub.

The proof of concept demonstrates the kill chain that can happen from just controlling one device, he said. Its not just turning a light on or off; it can go from there to either running code on your phone or the hub and it can get your network to trust those two devices. From there, the skys the limit.

Preventing threats resulting from shadow IoT is never easy. After all, shadow IT and shadow IoT are so named because IT teams are in the dark. But, like everything in cybersecurity, good cyber hygiene goes a long way. If your organization is already deploying network segmentation, vulnerability scans, pen tests and patch management, youre many steps ahead.

The thing I can advise for organizations wanting to use smart devices is the same thing I suggest for home users: put it on an isolated network and dont allow it to talk to your main network, he said. Treat it as a completely untrusted zone. If the shadow IoT devices are on an isolated network, there should be a safe disconnect.

It should also come as no surprise that the most basic of security basics should be prioritized.

The same importance should be applied to patch management, he said, adding that scanning devices for vulnerabilities via vulnerability assessments and pen tests are also critical.

Finally, for the best protection against shadow IoT, Padilla suggests companies apply principles that align with zero trust.

Whether its shadow IT, shadow IoT or other common threats, users will only have access to the resources they need and only to the devices they should have access to. And shouldnt that be the table stakes for security policy today anyway?

Mark Stone is a Hubspot-certified content marketing writer specializing in technology, business, and entertainment. He is a regular contributor to Forbes Bra...

Continue Reading

Excerpt from:
Beyond Shadow IT: Expert Advice on How to Secure the Next Great Threat Surface - Security Intelligence