The warnings by the cybersecurity segment in the consumer segment still tend go relatively unheeded by consumer wireless vendors. Because of that we can expect nefarious activities in that sector to continue to ramp up. But we all know that. So why are they not doing more to thwart it?
So far, hacking consumer devices tends to be a low-yield activity compared to hacking government or enterprises. However, with the implementation of 5G and the expansion of the Internet of Anything/Everything (IoX), that is going to change.
While the non-consumer IoX segment is further down the line with security, the consumer vector seems stalled. So far, and luckily, this segment has not seen a pandemic-scale attack on its IoX devices. But it is just a matter of time until such an event occurs, simply because of the proliferation of smart consumer IoX devices.
One of the major talking points around 5G is security. Most agree that 5G will be the great enabler for the IoX. It makes sense, especially when one considers that many IoX devices will be capable of using mmWave frequencies. As this evolves, the attack surface increases logarithmically.
The consumer supply side is, and always will be (except for the well-off) a very competitive segment. Consumers are price conscious-so what else is new? That puts the pressure on the vendor to be price competitive; meaning (obviously there are exceptions), putting in just enough to make sell and be profitable.
And, Like it or not, security is not a big selling point for the consumer. However, the time has come (again) to rethink that, especially in light of 5G. And there are hints that this should happen sooner than later.
What caught my eye and spurned this discussion is I recently saw a story about a cybersecurity company, GeoEdge, which has uncovered a global-scale malvertising attack. This is noteworthy because it is the first ad-based cybercrime aimed specifically at home-network-based IoX devices. It is believed to have originated in Slovenia and the Ukraine.
It first became visible a couple of months ago. This particular malware silently install code on home-WiFi-connected smart IoX devices.
If we look at some of the predictions for how many IoX devices will be out there in the next few years, a reasonable figure is 30 – 40 billion, globally, by 2025. By any stretch of the imagination that is a huge attack surface. And most low-tier, consumer devices are not equipped to spot this kind of malware.
In case you are not familiar with malvertising, or malicious advertising here is a birds-eye view. This is the kind of code that is embedded in ads – yes, the kind we are inundated with constantly. These are the type of ads that load when the site is opened. No user action is required. One would wonder how an IoX device would open malware. The fact is they do not directly but hang on a moment.
Malvertising injects malicious code into online display ads via online advertising networks. Such networks are generally unaware they are serving up malicious content. And with a more recent version of this malware, users are not even required to click on the infected ad or navigate to a malicious page to initiate the attack on home network devices. That is why this is no nefarious.
This works so well because of the fragmented nature of online ads. Typically, the device, whether it is a computer, tablet, phone, whatever, is receiving and sending data all over the place via a variety of ad-related servers when it loads a website. One server delivers the online ads, another might play a video ad, and a third server might trigger a pop-up. This happens again when you click an ad as well.
The hacker hijacks the IoX device and inserts their code. Then the hacker can intercept or redirect traffic or insert malware into the channel. In simple terms, the IoX device is simply the medium running compromised code to allow infiltration of the users network. Now attackers simply intercept these traffic requests passing between the device and your browser and forcibly inject their malware or divert your traffic somewhere else.
It is the IoX device that will open the gate to this malware. Once it gets to the device, It is able to manipulate it by download apps without users’ consent, and risks theft of personal information and monetary data, as well as tampering with home systems such as smart locks and surveillance cameras.
Most antivirus measures, even firewalls of IoX devices are not able to spot or stop the code. To do so requires security capable of advanced, real-time ad blocking which is not a priority for such consumer devices.
This is only the tip of the ever-expanding malware iceberg. It is unlikely consumer IoX device manufacturers will move on this, at least not now.
In reality, these manufactures have no liability (unless gross negligence and verifiable damage can be proven) so there is no real motivation to up the security game. So again, it falls to the consumer to bear the costs.
The best defense, for now, is a good offence. Use the best available security options and software on your computers and smartphones. But, above all, be vigilant. Better to suspect a legitimate ad to be malware than to assume it is not.
Ernest Worthman is an executive editor with AGL Media Group.