When Gadgets Attack: Internet of Things Compromises Security

The number of electronic devices with Internet connection is growing rapidly. Many of them use simple default passwords and therefore run a high risk of getting hacked. In the worst case scenario, grave consequences are to be expected, Nordic security experts warn.

Everything from household appliances to industrial machinery may be controlled remotely via Internet. The phenomenon is called Internet of Things (IoT), and is expected to surpass mobile phones as the largest category of Internet-connected devices in just a year's time. A large part of these devices are still plagued by poor security, Swedish security analyst Leif Nixon, founder and owner of Nixon Security, told Finnish state broadcaster Yle. Most of them still use default usernames and passwords and are prone to hacker attacks.

"It is very unfortunate that quite a lot of home appliances have such poor security. Vulnerabilities may occur on the website they use or arise from the use of default passwords," Mark Lintula, security expert from the Finnish Cyber Security Center, told Yle.

Most often, the manufacturer uses identical passwords for their products, such as "admin" and "123456." For instance, Swedish Ouman company was reported to be still using default passwords on their nearly ten-year-old automation systems. The majority of Finnish properties utilize Ouman's building and energy saving automation solutions to reduce energy expenditure. According to Yle, a large number of customers never bother to change their passwords, which opens the door for potential unauthorized log-ins with unknown consequences.

In Finland's neighboring country, Sweden, public amenities have already fallen victim to hacker attacks.

"In Linköping, hot water suddenly disappeared from a housing association. Later, a cyber-intrusion was discovered, as someone had turned off the hot water as a prank," Leif Nixon said. "When such things happen, say, in February, things start to freeze and this may lead to serious damage," he added.

The Finnish Cyber Security Center also warned of so-called botnets, which specialize in finding vulnerable Internet-connected devices. Furthermore, several automation systems in Finland were reported to have sent spam or performed Denial-of-service attacks.

"We have had several examples of heat pumps and examples of elevators participating in DDoS attacks," Markus Lintula said.

With the spread of the Internet of Things, the number of potential targets is expected to rise further.