When people talk of data leaks, the first thing that comes to mind is probably the image of a faceless hacker sitting crouched at a computer and tapping away at his keyboard. Most will also probably – and rightly – think that the hacker will be targeting data servers in remote places using software aimed at overcoming or overwhelming hosting providers’ defenses.
Yes, this is the most common way data is stolen from businesses – both big and small – and so, you wouldn’t be too off track if you were to assume that is probably the only way you could lose your data.
But, as we shall see below, one of the least known ways you can lose your data is by having it handed out (or made readily available for the picking) by the seemingly harmless electronic gadgets and devices that you use in your day-to-day business activities.
Gadgets like refrigerators, television sets, various desktop thingummies and even your printer could be the source of a leak. This is a serious fact to take into consideration if you have any intention of adopting the Internet of Things (IoT) or Bring Your Own Device (BYOD) – an amalgamation of various input/output devices that will be added to your network fringe and which will be used to enhance your business services.
Below, we will see some gadgets that have proven to be “leaky” in their characters:
- Printers and/or Copiers: not many people know that printers, scanners, copiers, et al. all have in-built memories that are used to store data right before it is printed. Although these memories are temporary (they are flushed once the device has been switched off, for example, something that most people do when they have sent the wrong document to be printed) they can still be substantial in size and anyone specifically targeting these memories could actually get hold of critical information regarding you and your business.
And that is not even the half of it: what if someone (even if they were an employee, albeit an unauthorized one) were to simply walk into your copying room, scan sensitive documents and walkout with hardcopies of them? Even if you were to use passwords to prevent people from accessing others’ printouts, a lax one could easily be cracked.
Such scenarios have occurred on a major scale and in multinational companies; so believe that it could happen.
- GPS and Smartphones: one great thing about is that, well, you get to bring whatever gadget you feel comfortable working on or with – smartphones included. Now, a smart data thief (we won’t call them hackers here, since all they do is observe and grab) can use your geo-location data from the phone via the GPS app and paint a perfect habit-oriented picture of you and your favorite activities and collect even more personal data about you in a method called “spear phishing attack.”
With this information in hand, an attacker can, for example, create an email that is more believable based on these observations increasing the chances that the recipient will believe it is a genuine message.
- Spam and Unsolicited Emails from the Cold: back in 2014, Proofpoint, Inc., one of the leading security-as-a-service providers (yes, it is a thing), managed to uncover a massive cyber-attack that involved everyday gadgets in our home.
In the investigation it was found that over 750,000 emails were sent from over 100,000 home utility devices that included home-networking routers, connected multi-media devices, TV sets and even one … wait for it… refrigerator!
- Other Gadgets: other devices that were found to be lax in security included a digital photo frame that transmitted all the traffic and feeds to its storage server in clear text – something anyone with a decent packet sniffer could capture and decode. Included in the traffic was data like the owners’ email addresses and users’ current activity (uploading, downloading, etc.).
An IP camera was also found to transmit the data it captured in clear text over HTTP port 80. Again, as in the earlier case, anyone collecting the transmission data between camera and server could easily gain access to the device and, hence, the data feed.
Although it was later fixed, a simple test on a rather popular thermostat brand found that the simple and innocent looking device could be the source of rather sensitive information. Yes, your thermostat!
Apparently, when the device was in use, it received weather report updates that included the location information of the house (like zip codes) it was installed in as well as the conditions. What’s worse, the data wasn’t even encrypted – it was again in clear text.
Now, if these devices haven’t started ringing alarm bells in your head yet think of it this way: what if someone with just the right amount of tech knowhow were to access all these devices at once? Don’t you think they would be able to paint a rather sharp picture of you, your business and even personal habits?
Well, be careful the next time you decide to simply install a gadget: first make sure they are safe and even then do not leave it to chance, talk to networking and security experts.
