IoT Devices Still Exposed: Majority of Traffic Unencrypted

As IoT use cases continue to grow, lax security practices such as retaining default passwords and not implementing updates and patches in a timely manner remain a problem.

With all of the Internet of Things hacks over the past five years, one would expect the industry to massively improve security standards and businesses to be more careful installing these devices.

Sadly, manufacturer-set passwords and encryption remain lackluster, while businesses continue to add unsecured devices to their IT system. Some big operators have made steps in the right direction, but as Unit 42’s IoT threat report reveals, there’s still a way to go.

One of the most shocking key findings on the report is 98 percent of IoT device traffic remains unencrypted. That means if a hacker were to plant themselves inside the network, they would be able to listen and collect all network traffic.

Unit 42 analyzed IoT devices used by healthcare organizations, which regularly send confidential information on patients over their IT network. If a hacker were to intercept this information, it could be used as blackmail or sold on the dark web.

Most IoT Devices Still Run Windows 7

Not only do most devices come with minimal security, but according to Unit 42, 83 percent of medical imaging devices run on unsupported operating systems. 56 percent run Windows 7, which Microsoft put into end of life stage in January.

Analysis of recent IoT attacks has led Unit 42 to see a shift in hacker’s priority, previously most were used as part of botnets to send DDoS attacks, now they are primarily the gateway for malware to spread across an organization’s network.

Around five billion IoT endpoints are currently in use and that is increasing by about 20 percent every year. While the use cases for IoT devices continues to grow, the security measures put in place remain stuck in the early 2010s. California’s SB-327 IoT law may force manufacturers to wake up to the fact IoT needs more security, but businesses need to also look into additional measures.

Unit 42 suggests that businesses patch printers and other older devices, segment IoT devices from the main network, and enable active monitoring.