{"id":591,"date":"2016-01-03T08:00:30","date_gmt":"2016-01-03T07:00:30","guid":{"rendered":"https:\/\/www.boc.de\/watchguard-info-portal\/?p=591"},"modified":"2016-06-16T17:14:10","modified_gmt":"2016-06-16T15:14:10","slug":"watchguard-security-vorhersage-2016-8-breaches-come-to-the-iot-frontier","status":"publish","type":"post","link":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/2016\/01\/watchguard-security-vorhersage-2016-8-breaches-come-to-the-iot-frontier\/","title":{"rendered":"WatchGuard Security Vorhersage 2016 #8 \u2013 Breaches Come to the IoT Frontier"},"content":{"rendered":"\n\n\n
<\/td>\n\n

WatchGuard Security Prediction #8 \u2013 Breaches Come to the IoT\u00a0Frontier<\/u><\/a><\/h2>\n

by Corey Nachreiner<\/u><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

When a hacker hijacks a computer, gaining persistence (or making sure his malicious trojan stays on the computer) is easy. The attacker just has to load malware onto the computer\u2019s hard drive and make sure it runs when the computer reboots. However, hijacking the Internet of Things (IoT) is a different story. Many IoT devices don\u2019t have local storage, and are often small embedded systems with low resources. Gaining persistence on these devices is much more difficult and may actually involve modifying the software these devices use to boot, which we call firmware.<\/p>\n

Prediction video link: https:\/\/www.youtube.com\/watch?v=iU63Bhmv6LU<\/u><\/a><\/em><\/p>\n

Next year, we expect to see more researchers release proof-of-concept attacks that permanently modify and hijack the firmware of IoT devices. It\u2019s not enough to just find a vulnerability in these devices, but you also have to figure out how to inject malicious code that can stick around. We expect to see vendors start to harden the security of\u00a0their IoT devices by implementing secure boot mechanisms that makes it more difficult for attackers to modify firmware.<\/p>\n

Visit our\u00a0WatchGuard security predictions site<\/u><\/a><\/p>\n

\u2014\u00a0<\/em><\/strong>Corey Nachreiner, CISSP<\/u><\/em><\/a>\u00a0(<\/em>@SecAdept<\/u><\/em><\/a>)<\/em><\/p>\n