Bett 2018: Schools and colleges need to be aware of risk from IoT devices

Hacking demo shows educators how easy it is to hack into a network from a smart kettle

The internet of things shows great promise, but always-on mobile and smart devices can pose a risk to academic environments.

Delegates at the Bett show, held at Excel in East London this week, were given an ethical hacking demonstration from a security consultant showing how seemingly innocuous devices can be used by ne'er-do-wells.

Sam Robshaw, senior cyber security consultant at Blackberry, explained how a smart kettle could be leveraged to hack into an academic network.

He said that while some IoT devices took security seriously (he mentioned Hive from British Gas being particularly security-focused), some other devices weren't as security hardened.

In a demonstration, Robshaw set up a test network with a smart kettle on it. The kettle was easy to access and with some research, he could find a manual for the unit and a default password to access it. From there, he discovered the kettle used AT+ commands as well as Telnet, an old and unencrypted protocol. It wasn't long before the kettle revealed the password of the network he wanted to hack into in plain text. This part of the demo lasted no more than a minute, but he had managed to access an otherwise secured network.

Using network sniffing tools, Robshaw showed delegates that he could find out if a Windows server had ports 139 and 445 running. This was an indication that the SMB protocol was running. He fired up Metasploit, downloaded and ran EternalBlue to see if he could exploit the Wannacry vulnerability on the test server. A minute later, he showed delegates that he had access to a command shell on the demo Windows server. From here he showed he had system privileges and added himself as a user.

He showed that it was all too easy to then search through files on the server for information on exams, test results and papers.

He said that the aim of the demonstration was to encourage schools and colleges to not only update servers and other computers against exploits, such as Wannacry, but to also take into account the susceptibility of smart devices to allow attacks through poor security practices in IoT.

Main image credit: IT Pro

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020