Microsoft details IoT devices used in corporate breaches in new report.

Microsoft’s Security Response Centre has recently published a report listing several instances they have analysed where IoT devices were used as a beach head in attacks against corporate networks.

There are more IoT (Internet of Things) devices currently in use than the total number of mobile phones and personal computers combined. It is estimated that by the end of next year some 50 billion IoT devices will be in use worldwide.  However, the state of the art of IoT device management and security is lagging way behind the pace of device deployment.

Microsoft says in the report:

In April, security researchers in the Microsoft Threat Intelligence Center discovered infrastructure of a known adversary {STRONTIUM} communicating to several external devices. Further research uncovered attempts by the actor to compromise popular IoT devices (a VOIP phone, an office printer, and a video decoder) across multiple customer locations. The investigation uncovered that an actor had used these devices to gain initial access to corporate networks. In two of the cases, the passwords for the devices were deployed without changing the default manufacturer’s passwords and in the third instance the latest security update had not been applied to the device.

After gaining access to the IoT device, the intruder dropped a shell script in order to maintain network persistence and then started using tcpdump to sniff the network and identify additional targets to compromise in order to work their way up the value chain of systems within the network.

How to secure IoT device in a corporate network?

Steps you can take to secure your network where IoT devices are used include:

• Segment or VLAN the network to separate IoT device from the main network and from each other. Keep all Voip phones on one segment, cameras on another, sensors on another and so on. Assume for now that the IoT devices are the softest target on your network.
• Develop a security policy for each type of IoT device.
• Do not expose IoT devices to incoming internet traffic if at all possible.
• Monitor IoT devices for unexpected behaviour such as a camera browsing an intranet server
• Ensure devices are patched promptly when new firmware is issued
• Ensure all IoT devices are registered with, and managed by, the IT team and not treated as end user devices which can be plugged into any available network port in the office.
• Block or at least monitor all internet-bound traffic from IoT devices on your network.