### Way back when
We started our journey back in the day when the IoT was in its infancy. Our first published research was in June 2015 with a post about [extracting the Wi-Fi PSK from Fitbits Aria]() weighing scales. This led to a challenging disclosure process with Fitbit, though it ended positively and constructively, with Fitbit supporting our efforts to educate and improve cyber security. This included us delivering workshops and briefings at the world-famous DEFCON and BlackHat hacking conferences.
Seven years on and the security challenges that IoT device manufacturers, IoT platform providers and API coders fail to handle have not gone away. The growth in the market for smart things and the persistence of poor practice has amplified the problems. Our ever increasing catalogue of IoT security research (160+ posts and counting) is anecdotal evidence of this. Thats not to say that some responsible manufacturers havent listened. There are many great examples of secure smart devices but its not ubiquitous.
### Headlines
Along the way, we discovered a number of high profile vulnerabilities that made international media headlines. These included the fact that many Samsung smart TVs were listening to the viewer and sending text of conversations to the US for decoding in to text, but unencrypted. We discovered smart refrigerators that leaked the owners email credentials to passers-by. We demonstrated the first ever proof of concept ransomware on an embedded device (a smart thermostat) and many other world-leading pieces of research.
### Independent research
We spend a lot of time carrying out independent research, compromising devices, then convincing vendors to fix the issues. Seeing these problems fixed is good for us, and good for consumers, but it doesnt always address the root causes at the vendors involved. These stem from:
* A lack of security understanding
* A lack of sufficient care for users
* Not factoring security in to their product roadmaps
* A lack of comprehensive legislation to prevent bad vendors bringing products to market
* Discrepancies in regulation across different regions
* A lack of active enforcement of the regulations that do exist
Our flagship piece of research was back in January 2015 where we [hacked a smart childrens doll]() to modify its vocabulary and show it could be used as a surveillance device to spy on children. It made cyber security far more real to the average consumer.
### Collaboration = results
Weve collaborated with consumer protection lawyers to help ban vulnerable smart products. Weve also worked with consumer advocacy groups to highlight the poor state of smart consumer device security. These include BEUC, Consumer Reports, Consumers International and many others. We are constant advocates for positive change in the space:
*
Our work has led directly to vulnerable products being taken off the shelves e.g:
*
*
*
### Lobbying = results
We have lobbied hard over many years for improvements too. This has included briefing governments across the world:
* The EU Parliament:
* Norwegian Consumer Council invited us to brief Norwegian government ministers:
* ENISA The European Union Agency for Cybersecurity, and the EU Cybersecurity Act
* In the US we have briefed US Chamber of Commerce member organisations and the FTC
* We also assisted with the UK DCMS Product Security & Telecommunications Bill which covers IoT, now at its 3rd reading:
* The Atlantic Council and the World Economic Forum also invited us to brief their members about IoT security.
### Research = results
Over the years we have contributed research and support to many organisations influencing security of smart devices. These include the IoT Security Foundation, whose work and efforts helped lead to ETSI 303 645, a great standard for IoT security:
*
*
Weve also publicly called out where we believe that legislation has been unreasonably watered down:
*
*
*
### Research = Big results
Perhaps the highest profile piece of legislation we influenced is California Senate Bill 327. The security issues with My Friend Cayla, the vulnerable talking kids doll, were cited as one of the catalysts for the bill, regulating that IoT products sold to California residents were suitably secure
*
*
And finally weve given two TEDx talks about IoT security. The second was the 10th most watched TED talk in the world in April 2022:
*
* [https://www.ted.com/talks/ken_munro_we_need_to_talk_about_cyber_security]()
IoT cyber security is our passion. We will continue working tirelessly to expose poor practice, to help organisations get better at cyber and help protect consumers.
The post [Effecting positive change in the Internet of Things]() first appeared on [Pen Test Partners]().Read More
References
Back to Main
