ESET is a CPG Business Partner and member of the Business Club by CPG – Find out more here

Does every device in your business really need to be connected to the internet? And could your smart appliance be turned against you?

If you try to purchase a new appliance these days, there is a good chance you will be guided toward the most up-to-date, state-of-the-art, smart appliances first. Whether you are in the market for a new dishwasher, fridge or even toaster, the chances are there is an internet-enabled device waiting to target you, but why the increase in IoT (internet of things)? Do we really crave every item in our houses and places of work to be smart, or do these companies have something a little more sinister up their sleeves where they actually just make things smart in order to learn more about us?

READ ALSO: On course for a good hacking 

From the toothbrush that sends you a notification in the form of a graph of how well you brushed your teeth in the morning to the smart fork that senses if it thinks you’re eating too fast (I really am not making this up), we might just be walking into a future of IP-connected mayhem. IoT has boomed in the last decade and while I love a good gadget with a truly smart capability, where should we draw the line?

Some devices are arguably being produced with internet capability just for the sake of it. With more and more smart products coming to market as standard, what if I really don’t want an internet-connected washing machine? Does it make my life easier? And what about the security implications of having all these extra IP addresses in the home? Let’s not forget the saying that the ‘S’ in ‘IoT’ stands for security!

Data collectors

I was recently in the market for a new dishwasher and after lots of research, I found one that came highly reviewed and recommended. It happened to come with smart functionality by default and an app to download for all your smart home needs – apparently. I found a statement in marketing material about IoT dishwashers suggesting that you can take advantage of knowing ‘how long until the wash is done’, though I don’t see that as much of an issue when I’m out and about. I’m not sure about you, but this usually isn’t on my mind when I go out for a walk; then again, I guess they are catering for all people.

Such smart appliances are often around the same price as their equivalent non-smart model now too. Now I know I didn’t really need my dishwasher to be smart, but it was the same price and the techie inside me actually wanted to know its capabilities or to see if it could improve my life somewhat, so I carried on with the purchase and installed the app.

While setting up the app on my iPhone, I noticed a lot of data was being collected and linked to me, including my location, user content and contact info plus other identifiers. I went through all the settings and discovered a lack of two-factor authentication too, but this is typical with a lot of IoT.

Once I’d connected the app to the dishwasher, I wanted to see what type of connectivity I could take advantage of. I played around with the app for a bit and learned what was on offer. I opened the door to load the dishwasher, but I was soon interrupted as I had been sent a notification. I checked my phone and realized that I had been notified that the door had been opened…. I know! I opened it!

I quickly turned this notification off, but I soon found the app was not all that intuitive and in fact quite cumbersome. Later that evening and although I could have turned it on remotely, I was standing right next to it as I had just placed the last plate in; although I had my tablet with me, it was far quicker to turn it on physically, and like the reviews said, the dishwasher was refreshingly quiet when it started.

However, two hours later, it all changed in the house. I was standing next to my new appliance when the door began to open on its own accord as if it was possessed and was coming after me! Had my dishwasher been hacked and was now riddled with malware being remotely operated in order to kill me?! As the steam rose from the glistening plates, I soon realized that it was in fact the automatic door-opening feature that had sprung into action to improve the “drying performance”.

Ok, I overreacted a little, but this strange new spaceship-like feature caught me off guard and made me jump in the process. However, what this ordeal made me question was whether appliances and other gadgets really need to be smart? In this case, I am certain that the app was not, in fact, making my life more streamlined, so I deleted the app and made a conscious effort to stand clear of the door near the end of a cycle.

My hypothesis is that companies are in desperate need of our data. Cars have been sending a wealth of information back to their manufacturers for many years now and they are often the first to tell you that you have gone over the 10,000 miles threshold and now require service. This is now the norm for other gadgets around the home and we are seemingly willingly accepting this.

However, this information could be used against us if it were to get into the wrong hands. Malicious actors are constantly attacking websites looking for data and unfortunately some personal data inevitably still gets compromised and ends up on the dark web. Theoretically, threat actors could gain access to this live data in the cloud and even learn our daily habits, which could include when we have vacated the premises.

Although I am not aware of any data leaks involving smart household appliances, it is worth noting that these devices suck up a lot of personal data and store it in the cloud for multiple purposes – with, in my personal opinion, very little of this trade-off actually helping the products. This data trove can be seen as currency to some stakeholders and could be targeted so we must limit the amount of data we release in the first place.

If your device has to be internet enabled to function, consider reducing the amount of data you hand over to the developers of smart products. Furthermore, use unique passwords or passphrases, enable two-factor authentication where possible, and keep your devices updated to steer clear of as many vulnerabilities as possible.

Just consider this: If a malicious actor were to hold my dishwasher to ransom, there is a good chance they would get my money as I really hate washing up that much. So, until smart dishwasher apps come with being able to load the dishwasher, put the dishes in and unload it after a wash as standard, I think I’ll stick to traditional appliance usage in the kitchen for now.

RECEIVE FUTURE CPG NEWS

VISIT THE ESET BLOG

ESET is a CPG Business Partner and member of the Business Club by CPG – Find out more here

Is your business a serial shredder, tending not to think about what personal data is thrown in the waste? Have you ever thought what a cybercriminal could do after simply going through your rubbish? Now that online ordering of golf clubs, apparel and other goods and services in golf is becoming a regular way of life, the scope to be throwing away sensitive information is massive, and criminals are well aware of this treasure trove of information right on your kerbside.

Like most people around the world, since COVID-19 I started to become very good friends with my local delivery drivers as the number of items I received in the post and by a delivery service dramatically increased. From groceries to everyday supplies, my wife and I really started to buy virtually everything online.

Online shopping has come a long way in the past few years and there isn’t much that can go wrong when using reputable websites and shops with great reviews, right? Well, I’m afraid I’m about to draw your attention to yet another potential problem you need to be aware of and remain cautious.

READ ALSO: On course for a good hacking 

Your personal data is extremely sought after by malicious actors and it needs to remain private, or at least as private as you can make it. You need to be very careful of how you dispose of any sensitive data, since you never know who might just end up looking at it, including what you’ve bought online and other details that are on the paperwork that may be cast into the recycling.

I recently received a parcel and to my absolute astonishment my phone number was on the outside of the parcel, something I hadn’t seen before. Not only might this be a data protection faux pas; I wondered if cybercriminals could take advantage of this and what they could possibly achieve by joining the dots with the criminal underworld and previous data breaches and scrapes. After all, when Facebook admitted earlier this year that 533 million phone numbers were now searchable on the internet with corresponding email addresses, I thought this was potentially rather damaging.

But what about what is inside the envelopes and parcels and what if any of these contents head to the recycling bin? Assuming intercepting items in the postal and delivery services is difficult without an insider, I fear that many people may in fact just throw away parcel notes and addresses rather than destroy them with a shredder. It is my assumption that even if some people own a shredder, they may primarily use it for financial information and other extremely important documents that are no longer required, instead of using it on envelopes too.

I even hold up my hand as I was previously only shredding apparently sensitive and private information on paper, but then at the same time folding up and placing any cardboard parcels in the recycling pile – often with my address still clearly visible – but now this could contain my phone number, or maybe even an email address?

This parcel with my phone number clearly visible on it came from an eBay seller but it got me thinking about other documents that I receive now on a daily basis. Other receipts I looked at in my house from other eBay users have sometimes included my email address. Looking at some other receipts of mine – a few, including from a few independent online shops and a major shoe company – included my email address and phone number.

None of my Amazon parcels from the Amazon warehouse have ever included any more personal information in the paperwork other than name and address but one from an Amazon seller did send my email address written on the paperwork inside the envelope.

With the agreement of my friend James, who is both a good friend and also one of the school dads, I decided to test another recycling bin to see how much information I could piece together on him and his family. James happily allowed me to pilfer through his recycling bin the day before it was left at the kerb, with two weeks’ worth of paper and card in it. In 30 minutes of rummaging I found his or his wife’s name and address 24 times, email address three times and phone number twice. I was even able to profile them and piece together what they were into purchasing – something marketeers and advertisers are really struggling with at the moment due to GDPR – but it soon dawned on me that most people’s bins still remain hackers’ treasure troves!

Trash talk

Your paper and card waste can be worth rather a lot of money to cybercriminals due to the amount of sensitive information and what they can do with further tricks into manipulating people with this information. For example, with your phone number and the receipt of what you have just bought, they could potentially call or text you with an update on the product purchased and request you to visit a website that could then entice you to hand over more information such as a password or payment card details. There is the potential of them being able to then access your shopping accounts and purchase items from any stored cards or, worse still, attempt identity theft.

How else can you stay safe when shopping online?

• Shred and destroy any personal data before you place it in the trash and don’t forget to check the envelopes/parcels.
• Use unique, complex passwords and change them if they become compromised.
• Use multi-factor authentication on all accounts.

RECEIVE FUTURE CPG NEWS

VISIT THE ESET BLOG

ESET is a CPG Business Partner and member of the Business Club by CPG – Find out more here

According to new research from ESET, 80% of businesses worldwide are confident their home-working employees have the knowledge and technology needed to handle cyberthreats to company finances.

ESET surveyed the attitudes of 1200 senior managers across the UK, US, Japan and Mexico for the business segment of its global financial technology (FinTech) research, exploring their attitudes toward security and FinTech.

While many businesses expressed confidence in the face of cyberthreats, the same research also showed that nearly three-quarters (73%) of these businesses also think they are likely to be impacted by a cybersecurity incident, and half said they had experienced a cybersecurity breach in the past. Could businesses be overestimating how safe their employees are?

It is no secret that since the COVID-19 lockdowns began, we have seen a significant increase in cybercrime targeting remote workers. COVID-19 has created a range of opportunities for cybercriminals, with the panic around the coronavirus and the uncertainty caused by the rapid transition to remote work setups affording malicious actors a greater chance of success in their attacks on individuals and organisations.

As employees left the office and dispersed across various locations, devices and networks, certain deficiencies in some businesses’ security stance have likely been exposed. Many companies have had to transition from the firewall approach of the traditional office to a new distributed model. While ESET’s research shows that the majority of businesses feel that their employees are able to handle the accompanying risks, there are a series of new challenges that they may be underestimating.

The inherent risks of remote working

Working from home means employees are connecting to the internet via their personal home router, and this means that company data can be exposed to all the dangers of public networks. So when accessing corporate intranets, using a virtual private network (VPN) is vital to creating a secure, encrypted connection.

However, issues such as slow internet, domestic distractions and simple forgetfulness can cause even the most security-conscious employee to make a mistake and connect without a VPN. This has the potential to expose individuals to malicious actors looking to spy on personal and company data. Therefore, don’t allow employees to connect to your company’s internal systems without using a VPN. For extra security, require your employees to enter a one-time code (multifactor authentication) in addition to a password in order to access your intranet.

Another issue posed by home working is that it can be tempting to switch from device to device. We live in a highly connected world, and with opportunities for socialising and leisure activities limited, we are all spending more time on our personal computers and mobile devices. Using said personal devices to check work emails or do a small task here and there can be potentially dangerous, as non-work devices are less likely to have the same levels of protection that work devices often have installed.

Similarly, it is just as easy to make the same mistake the other way round, by visiting risky websites such as torrent pages or adult sites. These may expose work laptops to online threats, which is particularly dangerous when the device in question can provide hackers with access to invaluable corporate data.

Lastly, there is the ever-present threat of phishing, which has been a prominent threat through the pandemic. With the health crisis providing new hooks for creating convincing phishing emails and text messages, there is a heightened risk that employees will click on malicious links or attachments and allow themselves to be duped by social engineering attacks.

How to secure your employees and your business

Because remote working has changed the way in which we interact with our teams and our colleagues, it can be hard to keep tabs on the extent to which each employee is aware of the steps they need to take to protect themselves and the company. This is why it is important to have regular training and guidance on the importance of cyber hygiene.

It is crucial that every member of staff is proactive in making sure that their devices and files are secure, and in order for this to happen they must be made aware of the dangers that can be caused by behaviours such as using an insecure connection or device, indiscriminately clicking on links, or visiting risky websites. For some pointers on how to stay safe when working remotely, check out ESET Chief Security Evangelist Tony Anscombe’s top tips on WeLiveSecurity.

With that being said, the internet can be a dangerous place, and threats can be difficult to keep track of. No matter how much we know about cybersecurity, it is always possible that we could slip up. As a result, it is more vital than ever to have trustworthy, reliable security software to protect your business. To find out about ESET’s solutions for businesses, head over to their website for more information.

READ THE ESET BLOG

VISIT ESET