Story image

Teens prove IoT device vulnerabilities by hacking them

01 Feb 2019

Recently a bizarre event took place, known now as the ‘PewDiePie IoT hack’.

Effectively, YouTube Swedish sensation was afraid of relinquishing his position as number one on the YouTube rankings, so he made a plea to his fans to spread the word. Some put up posters and shared on social media, while others took more extreme measures.

Two teenage megafans went on a mission and hacked hundreds of thousands of printers connected to the Internet around the world and forced them to print a page of paper with one key message: “Subscribe to PewDiePie”.

This earned the two teens – now known as ‘Hacker Giraffe’ and ‘User’ – overnight fame simply because of the extreme scope and audacity of their actions.

Recently they appeared in an interview with the BBC that was conducted anonymously because police around the world are pursuing the pair for their illegal actions. While their actions began as support for PewDiePie, they now insist that their intentions were to warn people about IoT vulnerabilities, asserting everyone wants their device to be smarter, but no one thinks about security.

“I felt like I was doing good and after this, vulnerable printers were going to drop off,” says User. 

And User was right, as following the hacks, the number of vulnerable printers around the world fell by nearly 50 percent. However, KYOCERA Document Solutions relationship marketing manager Aaron Anderson says there are now concerns that copycats with more malicious intents could soon be on the prowl.

“The only response to this fundamental and potentially imminent level of risk is an organisation-wide approach to cyber vigilance. These hacks exploited the existing gaps in software security and affected hundreds of thousands of machines worldwide. Emphasising that more remains to be done to prevent potential risks becoming reality,” says Anderson.

“Printers need to be encrypted as a means to safeguard against the loss of personal data. Encryption is one of the key technologies highlighted within GDPR, so it is imperative that data stored on printers be encrypted to limit the impact of a breach.”

Anderson says within an organisation there are several multiple and exit points from which data can flow, and the humble printer is one of these.

“Whether the data is in the form of e-documents or traditional paper formats, it is important to have a clear knowledge of the risks and an understanding of what data is being held in the printer,” says Anderson.

“Something businesses can do right now, to save yourself a lot of time and stress later, is conduct a thorough audit of all existing data practices, policies and equipment within their organisation.”

According to Anderson, the battle to eliminate IoT cyber threats is entering a new era with new risks and improved technological solutions. While there is cause to be optimistic, organisations must act now to bolster their defences.

KYOCERA Document Solutions has conducted an evaluation of all the potential multi-functional printer security weaknesses and compiled a checklist of the 10 key areas for organisations to secure, which are below:

  1. Capture - scanning and copying documents to uncontrolled destinations can breach data protection guidelines
  2. Output tray - documents left on the output tray account for the biggest loss of data
  3. Machine operating system - an unprotected operating system could allow takeover of the machine
  4. Ports and protocols - open and unused ports and protocols represent a risk that can be exploited
  5. Management - without regular device scanning, persistent security holes could be exploited
  6. Network - data can be intercepted across the network link
  7. Cloud connection - connecting to offsite locations may leave you open to data breach
  8. Device storage - content stored in devices could be accessed
  9. The human factor - employees can leave sensitive information on their desk
  10. Operation panel - an unlocked panel can allow users to tamper with settings
Veeam releases v3 of its MS Office backup solution
One of Veeam’s most popular solutions, Backup for Office 365, has been upgraded again with greater speed, security and analytics.
Too many 'critical' vulnerabilities to patch? Tenable opts for a different approach
Tenable is hedging all of its security bets on the power of predictive, as the company announced general available of its Predictive Prioritisation solution within Tenable.io.
Industrial control component vulnerabilities up 30%
Positive Technologies says exploitation of these vulnerabilities could disturb operations by disrupting command transfer between components.
McAfee announces Google Cloud Platform support
McAfee MVISION Cloud now integrates with GCP Cloud SCC to help security professionals gain visibility and control over their cloud resources.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
Organisations not testing incident response plans – IBM Security
Failure to test can leave organisations less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.