Cybersecurity in the Internet of Things (IoT) World: 5 Most Common Types of Threats in 2020

 

According to predictions, In 2020 there will be around 30 billion actively connected-devices. From the past couple of years, the Internet of Things technology has grown by leaps and bounds. On the same note, in this article, we will understand the five types of underlying threats in cybersecurity within the IoT world.

 

Introduction

 

Internet of Things is described as a network of physical objects which are interconnected through the internet and these objects (or devices) have the ability to send data over the network without having any connection with humans. In the Internet of things, each “thing” has the unique ability of automatic transfer of the data over the network. With the IoT, devices collect, communicate, analyze, and act on the information received. 

 

Creation of many smart IoT devices like smart tv, virtual assistant devices like (Alexa, Google Home, Siri), fitness trackers like (Fitbit, Mi smart band), August Doorbell Cam, Kuri mobile robot, etc. are connected to some shape or form to the Internet.

 

However, these devices come up with a host of advantages but they also bring certain challenges that need to be addressed. IoT devices are continuously collecting our information in the form of personal and business data, and this data will exist in the cloud, and hence any weak link in the security chain will provide hackers thousands of possibilities to hack this vulnerable data of users. (Related article: How is Big Data Analytics shaping up the Internet of Things(IoT)’s?)

 

In Oct 2016, Distributed Denial of Service attack (DDoS) was coordinated through numerous Internet of Things (IoT)-enabled devices. This attack was accomplished through numerous DNS lookup requests coming from tens of millions of IP addresses. Many IoT devices such as printers, IP cameras, residential gateways, baby monitors, etc. had been affected by Mirai malware. 

 

A botnet “Mirai” affected these IoT devices and then used those devices to send millions of unprecedented requests to Dyn (a large DNS service provider). Because of this increased traffic, Dyn went offline and the number of potential customers goes offline as well- including Airbnb, Amazon, BBC, Twitter, HBO, etc. (As discussing famous consumer platforms, learn here how Amazon has made its online course available to the public through AWS machine learning University) 

 

 

What is Cybersecurity?

 

Cybersecurity or information technology security system refers to the protection body of computer systems which includes hardware, software, programmed devices, electronic data from potential theft, cyberattacks, or misdirection of the services they provide in case. Cybersecurity is becoming more important nowadays because of our dependencies on the internet of devices increasing exponentially with time.

 

 

What are the threats in Cybersecurity

 

Ensuring Cybersecurity in this big data world is becoming tougher every day as IoT devices are less secured, it opens possibilities of cyberattack, exploit vulnerabilities constantly. According to the Gallup study in 2018, 71% of Americans say that they frequently fear that computer hackers will access all their personal and financial data and 67% of those are worried about identity theft. Here are some of the challenges in Cybersecurity to overcome in 2020.

 

• Ransomware Attacks

 

Ransomware is a kind of malware that is used by attackers for financial gain, it blocks access to computers using encryption. Ransomware can be hidden in links with a normal email or on the web browser, once it gets activated you can not access your files, data or computer until a ransom is paid. Cybercriminals often demand a ransom in the form of anonymous currency (like Bitcoin) in exchange for providing a key to decrypt the victim’s files. (Related article: Do Blockchain and Artificial Intelligence Incorporate an Ideal Model?)

 

Ransomware is a serious threat to cybersecurity that often affects individuals, it has recently gained popularity because of targeting big organizations. The FBI has observed the following techniques to infect its victims with Ransomware:

 

1. Email Phishing campaigns - Cybercriminals usually insert a link of ransomware in an email, which deploys malware when clicking by any recipient.

2. Remote Desktop Protocol vulnerabilities - RDP is a protocol that allows users to control the data and resources of a computer over the internet. They used both brute-force (a technique using trial-and-error to obtain user credentials) methods to get user credentials or credentials purchased from the darknet marketplace to gain unauthorized RDP access to the victim’s system. If they get RDP access they can upload hundreds of malware in the victim system.

3. Software vulnerabilities - Cybercriminals can take advantage of victim security weaknesses in their software to take control of the system and deployed ransomware.

 

This is the biggest threat in Cybersecurity as an individual point of view, to protect yourself against this kind of ransomware is a robust system of backups.

 

• Botnet Attacks

 

As we have explained one of its examples in our introduction, Botnet is a number of devices inter-connected infected by malware whereby attacked computer system becomes attacker itself that the cybercriminal can remotely manage. Botnets can be used to perform Distributed Denial-of-Service attack (DDoS), steal data, credential leaks, unauthorized access, and allow hackers to take control of the device to its connection. 

 

A botnet can be understood in other words as a “network of robots”. The main purpose behind injecting a botnet attack is to create an army of infected systems, also called zombie machines. There are 4 main modules of a botnet system:

 

1. Command Module - Sends commands to child botnets.

2. Control Module - Controls the ownership, decides who should listen to whom.

3. Infection Module - Finds unpatched servers in the network.

4. Stealth Module - Does crucial jobs like disabling antivirus, achieving root or kernel access.

 

Don’t worry! You can read Cyber Attacks Botnets in detail of botnets and its working.

---

• Denial of Service

 

A Denial of Service (DoS) attack is meant to shut down machines or networks, preventing its users from accessing services. DoS attack typically functions by flooding targeted machines with millions of requests until its services inaccessible to its potential users. A distributed denial of service attack is when the incoming traffic or flooding comes from many different sources which makes it impossible to block. 

 

Cybercriminals often use DoS to target web servers with high profile organizations such as banking, e-commerce, Government organizations, media companies, etc. There are two types of DoS attacks: flooding services and crashing services.

1. Flooding services - As name flooding means the targeted server receives too much traffic which causing the server to slow down and eventually stop. Some popular flood attack types are Buffer overflow attacks, ICMP flood, and SYN flood.

2. Crashing services - This type of DoS attack trigger the vulnerabilities of the security system causing them to shut down or crash.

 

• Identity Theft

 

Identity theft has become one of the fastest-growing cybercrimes in the world today. It is used to usually perform financial thefts using or transactions another accounts name. We often hear about false phone calls of customer care saying your credit card or debit card is expired and they will renew it if you provide them with your card number and pin.

 

There are many phishing schemes where they ask about your personal information, be in popup form or an email form or in the mobile message form. (Recommend blog: Do you know the IoT’s Strategies and Planning Structures for Financial Services?)

 

According to the Federal Trade Commission, there are many common types of methods used by identity thieves:

1. Stealing - Mails, credit card details, pre-approved offers, tax information, etc.

2. Phishing - Fake email, messages pretending like they are coming from actual banks or institutions.

3. Dumpster Diving - Take your bills or any important document of your personal information from your trash.

4. Changing your address - By changing your billing address to another by filling change your address form.

5. Skimming -credit or debit card number is taken by using a special device while you are processing it.

 

Don’t worry again! There are many ways to recovering from identity theft. Read this blog on Identity Theft and Recovery.

 

• Social Engineering Attacks

 

If you are running an online business like a blog post website, social media indeed can do wonders for your business as well as an individual. (You can learn from here, the role of AI in the Media Industry). Social engineering attack involves some kind of psychological manipulation of targeting user to reveal sensitive data of their organizations. 

 

"Cybercriminals often use this exercise using email phishing and they also make their email look so legitimate that invokes urgency, critical, prompting to reveal sensitive information, click a malicious link."

 

According to Social media-enabled cybercrime is generating $3.25 billion a year. This report says one in five organizations is suffering from malware distributed by social media. Social media contains 20% more methods to deliver malware into users’ systems through adverts, plugins, shareable sources, etc. 

 

There are many examples of fraud call centre companies who put popup (via social media) in users’ systems and ask them to download some plugin. After that plugin installed, they say that you have to remove the virus from your system using some antivirus which costs in dollars. They injected malware into the victim’s system and charge them to remove it.

 

 

Conclusion

 

Cybersecurity is indeed a bigger concern for all the Governments because the internet is open for all. It does not have borders, everyone can access it from everywhere. It definitely opens a lot of opportunities but nothing is free in this world, it comes with some threats also. We have mentioned some of them, but in reality, there are many threats to Cybersecurity especially in this IoT world.

 

All the Governments are trying to make rules and regulations for using the internet rightly, cybercrime is being treated as similar to a physical crime. We will come up with many cybersecurity procedures blogs or what to do when hacked by someone.