Bett 2018: Schools and colleges need to be aware of risk from IoT devices

Hacking demo shows educators how easy it is to hack into a network from a smart kettle

The internet of things shows great promise, but always-on mobile and smart devices can pose a risk to academic environments.

Delegates at the Bett show, held at Excel in East London this week, were given an ethical hacking demonstration from a security consultant showing how seemingly innocuous devices can be used by ne'er-do-wells.

Sam Robshaw, senior cyber security consultant at Blackberry, explained how a smart kettle could be leveraged to hack into an academic network.

He said that while some IoT devices took security seriously (he mentioned Hive from British Gas being particularly security-focused), some other devices weren't as security hardened.

In a demonstration, Robshaw set up a test network with a smart kettle on it. The kettle was easy to access and with some research, he could find a manual for the unit and a default password to access it. From there, he discovered the kettle used AT+ commands as well as Telnet, an old and unencrypted protocol. It wasn't long before the kettle revealed the password of the network he wanted to hack into in plain text. This part of the demo lasted no more than a minute, but he had managed to access an otherwise secured network.

Using network sniffing tools, Robshaw showed delegates that he could find out if a Windows server had ports 139 and 445 running. This was an indication that the SMB protocol was running. He fired up Metasploit, downloaded and ran EternalBlue to see if he could exploit the Wannacry vulnerability on the test server. A minute later, he showed delegates that he had access to a command shell on the demo Windows server. From here he showed he had system privileges and added himself as a user.

He showed that it was all too easy to then search through files on the server for information on exams, test results and papers.

He said that the aim of the demonstration was to encourage schools and colleges to not only update servers and other computers against exploits, such as Wannacry, but to also take into account the susceptibility of smart devices to allow attacks through poor security practices in IoT.

Main image credit: IT Pro

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Most Popular

SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021