Bett 2018: Schools and colleges need to be aware of risk from IoT devices

Hacking demo shows educators how easy it is to hack into a network from a smart kettle

The internet of things shows great promise, but always-on mobile and smart devices can pose a risk to academic environments.

Delegates at the Bett show, held at Excel in East London this week, were given an ethical hacking demonstration from a security consultant showing how seemingly innocuous devices can be used by ne'er-do-wells.

Sam Robshaw, senior cyber security consultant at Blackberry, explained how a smart kettle could be leveraged to hack into an academic network.

He said that while some IoT devices took security seriously (he mentioned Hive from British Gas being particularly security-focused), some other devices weren't as security hardened.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

In a demonstration, Robshaw set up a test network with a smart kettle on it. The kettle was easy to access and with some research, he could find a manual for the unit and a default password to access it. From there, he discovered the kettle used AT+ commands as well as Telnet, an old and unencrypted protocol. It wasn't long before the kettle revealed the password of the network he wanted to hack into in plain text. This part of the demo lasted no more than a minute, but he had managed to access an otherwise secured network.

Using network sniffing tools, Robshaw showed delegates that he could find out if a Windows server had ports 139 and 445 running. This was an indication that the SMB protocol was running. He fired up Metasploit, downloaded and ran EternalBlue to see if he could exploit the Wannacry vulnerability on the test server. A minute later, he showed delegates that he had access to a command shell on the demo Windows server. From here he showed he had system privileges and added himself as a user.

He showed that it was all too easy to then search through files on the server for information on exams, test results and papers.

He said that the aim of the demonstration was to encourage schools and colleges to not only update servers and other computers against exploits, such as Wannacry, but to also take into account the susceptibility of smart devices to allow attacks through poor security practices in IoT.

Main image credit: IT Pro

Featured Resources

Transform the operator experience with enhanced automation & analytics

Bring networking into the digital era

Download now

Artificially intelligent data centres

How the C-Suite is embracing continuous change to drive value

Download now

Deliver secure automated multicloud for containers with Red Hat and Juniper

Learn how to get started with the multicloud enabler from Red Hat and Juniper

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now
Advertisement

Most Popular

Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/data-insights/big-data/354311/google-reveals-uks-most-searched-for-terms-in-2019
big data

Google reveals UK’s most searched for terms in 2019

11 Dec 2019