Connected devices still at risk from hackers in UK
The Information Commissioner's Office has warned that, with the increasing prevalence of connected devices, manufacturers need to do more to make the Internet of Things (IoT) more secure. The watchdog has issued guidelines for parents to prevent IoT devices, including baby monitors, from being hacked. Among its recommendations are the use of two-step identification, securing routers with a strong password and regularly checking manufacturer's websites for software upgrades.

Two years after it was revealed that a creepy Russian website was allowing users to watch more than 73,000 live streams from unsecure baby monitors, the UK's data watchdog has warned that manufacturers still aren't doing enough to keep their devices safe from hackers.

Incidents involving parents stumbling upon pictures of their kids online—such as the one reported in 2014 by the Daily Mail—continue to occur, with images clearly being snaffled from Internet-enabled cameras that have been set up in people's homes.

The privacy breaches have prompted the Information Commissioner's Office to issue guidance to help users guard against opportunistic hackers, and people using the murky likes of the Shodan search engine to browse the Internet of Things.

"Internet of Things products such as baby monitors, music systems, and photo or document storage, which can be accessed online, are at risk of revealing your personal details to other people," said ICO technology manager Simon Rice.

"A lack of security when it comes to IoT devices could mean that a search engine is used by criminals to locate vulnerable devices and then gain access to them or others on your home network. An attacker could then use your equipment to mount attacks on others or take your personal data to commit identity fraud."

Advertisement

He lists six basic steps parents can take to help prevent casual hackers:

Research the most secure products

Secure your router with a strong password

Secure the device by changing its default password

Check manufacturer's websites for security updates to out-of-the-box software

Read the manual to see if there are extra measures listed

Use two-step authentication, if you can

The ICO declined to name any of the sites where streams are available, but a spokesperson told Ars that "you can connect to these devices directly, so there’s no intermediary website as such." She added:

With reports of many billions of IoT devices due to be connected by 2020, this is a problem that needs to be addressed now. We wouldn’t recommend any specific models but would advise consumers to follow our tips when purchasing and setting up an IoT device. Even the most secure device can be subject to unauthorised access if the username and password was set to, or left as, admin.

Manufacturers, meanwhile, should "subject IoT devices to a robust security test before launch and for every subsequent firmware update." She added: "They also need to commit to supporting devices for a reasonable length of time following launch and act quickly on reports of security vulnerabilities. They should also make the devices "secure by default" and make the user interface intuitive.

"Security should not be left up to the individual to configure the device through a difficult to navigate user interface."