Hackers Head on Internet appliances

Suhan Gorya

From a command center in a non-descript high-rise here in the heart of Silicon Valley, security start-up Norse has been gathering shocking evidence of hackers usurping control of Internet-connected appliances, everything from web cams to climate-control systems.

This latest expansion of cybercrime revolves around the IP address assigned to each computing device connected to the Internet. Cybercriminals have begun capitalizing on the fact that many of the mundane digital devices we tie into the web are easy to locate and wide open to hacking.

"There's only one way onto the Internet, and that's through an IP address," says Norse CEO Sam Glines. "The adversary just wants IP space to launch attacks and doesn't really care if it's a baby monitor or a server at a Fortune 1000 company."

The bad guys are using automated programs to scan ranges of IP addresses for signs of vulnerable appliances. It's often a simple matter to take control by installing a few lines of malicious coding.
Norse has devised innovative technology for monitoring such cyberattacks in real time. A tiny sampling of its data, extracted exclusively for CyberTruth, revealed 724 infected appliances actively carrying out fraudulent tasks.
The corrupted appliances included firewalls, routers, modems, printers, DVRs, surveillance cams, web cams, IP cameras, VPN appliances, VOIP phone systems, FM radio transmitters, storage drives, video conferencing systems and climate-control modules. One of the big things these corrupted devices are being used for: payment card fraud.
"We are seeing credit card transactions from baby monitors, DVRs, TVs, printers, medical devices, you name it," says Tommy Stiansen, Norse founder and chief technology officer. "It's coming from all types of industries and from homes."
In a stunning demonstration, Stiansen clicked to the IP address for an activated ABS MegaCam, widely sold as a $220 baby monitor. The device was activated on the Internet by a resident of Glendale, Calif., who uses Charter Communications as an ISP.
Malicious software embedded on the web cam's Linux operating system causes a live cam view of the homeowner's living room to appear in the browser of anyone who clicks to the web cam's IP address. During Stiansen's demo, a woman and then a man enter the room and sit on a couch.
The bad guy who embedded the malware on the baby monitor probably doesn't care much about snooping; the web cam's computing power, instead, is being used to locate similar devices and help the attacker to control as many as 2,000 ABS MegaCams.
"This is happening at a large scale, and it's growing hugely every day," Stiansen says, "This is very powerful stuff, and the scariest part is this is only the tip of the iceberg."
There's clear logic behind methodically assembling digital appliances into niche networks, called botnets, under the control of a single operator.
Botnets have been the foundation of the cyber underground for more than a decade. Traditionally comprising infected personal and server computers, botnets are the engine that drives multibillion-dollar markets for spam, phishing, account hijacking, identity theft and denial-of-service attacks.
Norse's findings show how the advance guard of cybercriminals has begun pulling digital appliances into botnet service because, at the moment, it's easy to do so.

Norse notifies proper entities about problems. However, sheer numbers of issues make it impossible to notify everyone, says Glines. The company is working on processes to extend notifications. For the moment, there is no broad-based effort at defense, beyond what individual organizations are doing to protect themselves.
The Internet of Things has proved trivial to hack as the U.S. tech industry puts new consumer technologies on a fast track to store shelves, sometimes with meager quality control or accounting for security and privacy.
That trait is coming to the fore as the tech giants race to profit from the rising popularity of mobile devices and Internet-delivered services. Meanwhile, the cyber underground continues to mature into a smooth-running global industry that's quick to pounce on fresh opportunities.
"Competitive struggles force manufacturers into early release cycles, networks are becoming increasingly complex, and the complexity is hard to overcome," Stiansen says. "Meanwhile, hackers use social crowds to build hacker communities that allow them to move under the radar."
Stiansen grew up tinkering with computers on a Norwegian farm, which led him to a career designing air-traffic control and telecom-billing systems. After immigrating to the U.S. in 2004, Stiansen began thinking about a way to gain a real-time, bird's-eye view of the teeming world of botnet activity.
What he eventually came up with is IPViking, a globe-spanning network of millions of physical and virtual sensors — or honeypots — dispersed through 160 data centers in 40 countries. Each pot appears to be an Internet-connected web cam, router or other appliance — irresistible honey to hackers.
When an intruder tries to take control of a Norse honeypot, Norse grabs the attacker's IP address and begins an intensive counterintelligence routine. The IP address is fed into automated programs, called web crawlers, that scour the bulletin boards and chat rooms where hackers congregate for snippets of discussions tied to that IP address.
Analysts also do manual research to construct a dossier on the attacking IP. Norse delivers this intelligence to its clients, which include large financial institutions. The companies are then able to cut off communications from suspicious IP addresses and be on the lookout for derivative attacks.