Jusletter IT

Do you remember the 2016 DDoS attack¹ by the «Mirai» botnet² and the 2017 cybersecurity incident with the casino aquarium? In 2016 the «Mirai» botnet hijacked Internet of Things (IoT) devices³ which led the managed DNS service⁴ of Dyn Inc. to break down⁵ It caused major Internet platforms and services (e.g. Airbnb, CNN, Netflix, PayPal, Twitter, Spotify⁶) to be unavailable to large swathes of web users in Europe and North America. In 2017 hackers obtained access to the servers of a US casino through the (temperature and food) sensors installed in the casino’s lobby aquarium⁷ Will the currently debated EU Cybersecurity Act⁸ (Act) prevent such IoT cybersecurity attacks in the future?

The Act, which was discussed in two trilogue meetings by the European Parliament, the Council and the Commission on 13 September and 1 October 2018, and is planned to be finalised by the end of this year, foresees, among others, the establishment of an EU cybersecurity certification framework for ICT products, systems and services.⁹ ICT products and services shall directly incorporate security features by design. Moreover, customers and users of ICT products need to be able to evaluate and ascertain the level of security assurance of the products and services they purchased.¹⁰ Similar to the CE certificate¹¹, which indicates to consumers that products sold in the EEA have been assessed to meet high safety, health, and environmental protection requirements, the general purpose of a European cybersecurity certification scheme is to attest that the ICT products and services comply with specified security requirements.¹² For this reason three types of certifications are proposed in the Act (art. 46 [2] of the proposed Act): basic, substantial, and/or high. These certificates shall be issued by accredited institutions.

However, according to the proposed Act, not only shall certification be voluntary (art. 48 [2]), but product manufacturers or service providers shall be entitled to conduct a self-assessment for the basic certification of low complexity IoT devices that present a low risk for the public interest¹³.

As one might imagine, there is already advice and guidance on security for IOT devices, e.g. by IoTSF¹⁴ or GSMA¹⁵. And yet, the German Federal Office of Information Security (BSI) assumes that the majority of IoT devices are infected with malware.¹⁶ The Act will need to prove that despite voluntary and self-assessed certification of IoT devices it can close the gap to increase security.

Critique has been raised by security experts because the root cause of IoT security threats seems to include lack of security awareness, time-to-market, difficult IoT firmware updates, and of course missing (security) funding.¹⁷ These are exploited by third parties to (intentionally) cause damage. Approximately 13 billion¹⁸ IoT devices are estimated to be implemented by 2020 in the electronic consumer segment, rendering IoT even more pervasive. With such estimated roll-out numbers the IoT elements of connected devices are likely to be produced at low cost. Funding for security might therefore not rank particularly high in the production budget, potentially leaving IoT devices insecure and exploitable by (malicious) third parties.

So what can you do at the moment to avoid your IoT devices, e.g. your WLAN loudspeakers, from being hijacked? You could, e.g., use strong passwords, update the firmware regularly, try to avoid UPnP¹⁹ where possible, use VPN²⁰ to connect your IoT device, and only trust other secured protocols, e.g. https websites.²¹

Daniel Ronanzi