President Biden’s Peloton raises cyber security concerns

Spies could use its camera and microphone to eavesdrop on confidential conversations

Peloton bike's wheels with a person's feet on the pedals

President Biden's fitness regime may be derailed by cyber security concerns, as reports indicate his Peloton bike could be a risk.

According to a Popular Mechanics report, Max Kilger, director of the data analytics program and associate professor in practice at the University of Texas at San Antonio, said spies could use the bike’s microphone and camera to eavesdrop on confidential discussions.

"Because you're connected to the internet, even though there are firewalls and intrusion detection software ... those things can be gotten around if you’re really good and skilled,” he said. "If you really want that Peloton to be secure, you yank out the camera, you yank out the microphone, and you yank out the networking equipment ... and you basically have a boring bike.”

Garrett Graff, director of the cyber security initiative at the Aspen Institute, told the New York Times: “The threat is real, but it is presumably a manageable risk given enough thought and preparation.”

Related Resource

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

How to manage security risk and compliance - whitepaperDownload now

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told IT Pro we should assume all IoT devices have hardware that allows them to access information beyond their function. 

“That might be a microphone that the designers added in anticipation of a future feature, logging of Bluetooth targets for possible pairing, or interactions with third-party services,” he said.

According to Mackey, while this isn’t an overarching threat for most home users, IoT devices deployed in sensitive areas, like the White House or Congressional residences, should be inspected for any latent hardware and undergo a firmware analysis. 

“This can help to determine whether it has any unpatched security issues, but also to determine if it has any embedded phone home mechanisms or interacts with third-party APIs in an undisclosed manner," Mackey said.

"Since many IoT devices have some form of over the air (OTA) update mechanism for their firmware, understanding the conditions under which that update occurs, what data is sent with a request, and what the updated firmware’s security risks might be are all part of operating any network containing IoT devices.

"Such risks only increase when there are high-profile users of the IoT device where the user might be a target for a well-funded attacker."

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

NSA and CISA publish guidance on hardening Kubernetes following cloud infrastructure cyber attacks
Security

NSA and CISA publish guidance on hardening Kubernetes following cloud infrastructure cyber attacks

4 Aug 2021
Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Department of Veterans Affairs signs a $497M deal with Peraton
IT infrastructure

Department of Veterans Affairs signs a $497M deal with Peraton

2 Aug 2021
Google, Microsoft fight over documents in antitrust lawsuit
Policy & legislation

Google, Microsoft fight over documents in antitrust lawsuit

30 Jul 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021