February 13, 2020 By Sue Poremba 3 min read

Weak passwords can hurt any organization’s security efforts and make any device easily hackable, but could they also be the greatest point of failure for internet of things (IoT) security? Weak passwords certainly put companies deploying IoT devices at greater risk of falling victim to a cyberattack.

We have already begun to see attacks targeting IoT devices, and they are using weak passwords as their way in. In 2019, threat actors took advantage of poor password management to go after popular office IoT devices like printers and phones. Already in 2020, we’ve seen an IoT attack target routers and result in a password data dump on a hacker forum.

Included among the vulnerable (and hacked) passwords are default passwords used by manufacturers that give the appearance of IoT security layers. In reality, all these passwords do is create an illusion of safety for users who assume that because there is a password attached to the device when it comes out of the box, that is all that is needed. The actual outcome in these situations is a larger attack surface of poorly defended endpoints for malicious actors to penetrate with ease.

Without better password management, IoT security could quickly become unsustainable.

Weak Passwords Begin During Development

The IoT is a hot commodity. At the Consumer Electronics Show (CES) in January, IoT devices were everywhere, in every conceivable form. We are close to reaching a point where every item we can imagine has smart technology built in, which means there is a rush to get those devices to consumers before someone else does.

“Manufacturers are focused on getting smart devices into the market as quickly as possible, but in this race to capitalize on the IoT’s potential, security is often woefully neglected,” explained Michael Greene, CEO of Enzoic, in an email conversation.

How far down the priority list is password security — or any kind of security — for these manufacturers?

“Numerous connected devices ship with default passwords as standard, as was the case with 600,000 GPS trackers manufactured in China that had a default password of ‘123456’,” said Greene. Government doesn’t see IoT security as a high-priority issue either, so regulations around default passwords — and the need to build security into IoT devices at all — are currently minimal. This means the responsibility of securing these devices lands on the shoulders of users and IT departments.

But users and IT departments aren’t keeping up. The work here isn’t limited to simply replacing default passwords, according to Greene. Rather, it must include growing smarter about overall password management. To illustrate why this is necessary, consider the fact that nearly 60 percent of users employ the same password across multiple devices, websites and other access points, according to a survey from LogMeIn.

“In this environment, a hacker can easily obtain a password that was previously exposed in a breach and use it to gain access to other systems and devices,” Greene added. Because of poor password management and weak passwords overall, he believes we’ll see more attacks directed at smart devices, especially if matters of IoT security aren’t viewed as pressing concerns from the start and addressed across the entire development and sales ecosystem.

IoT Security Is Everyone’s Responsibility

Change won’t come easily. Users are set in their ways regarding passwords, and IT departments often have more immediate issues than the need to monitor IoT passwords, especially if they are responsible for dozens or hundreds of devices across their organizations.

Yet the IoT is becoming a major player in the overall threat landscape, said Yaniv Balmas, head of cyber research at Check Point Software Technologies, during a conversation at CPX360 in New Orleans. The security level of these devices is already relatively low, but any change that improves device security costs money, either on the development side — in which case the cost is typically passed on to the consumer — or on the user side.

“Cost tends to win,” said Balmas, “and we want cheaper products.”

But all is not lost when it comes to securing IoT devices. Companies are turning to solutions beyond passwords for authentication. For example, Amazon is looking at connecting its payment kiosks in brick-and-mortar stores to biometric identification methods that would prompt the customer to use the palm of their hand to verify their identity, which would be linked to a credit or debit card. Another positive step is the IoT Security Rating Program instituted by UL, formerly Underwriters Laboratories. The UL Verified Mark will alert consumers to the security risks and standards associated with a wide array of IoT devices.

Manufacturers must take security more seriously in the development stage, and companies must leverage advanced authentication options as they become available. Until then, it will be up to users and company security policies to ensure IoT devices are secure. This will require a simple first step: immediately changing default passwords to something strong and unique. As long as we continue to use weak passwords on IoT devices, we will be putting our organizations’ networks and data at risk unnecessarily.

More from Endpoint

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Endpoint security in the cloud: What you need to know

9 min read - Cloud security is a buzzword in the world of technology these days — but not without good reason. Endpoint security is now one of the major concerns for businesses across the world. With ever-increasing incidents of data thefts and security breaches, it has become essential for companies to use efficient endpoint security for all their endpoints to prevent any loss of data. Security breaches can lead to billions of dollars worth of loss, not to mention the negative press in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today