As wireless devices flourish, network security pros break into cold sweats | McClatchy Washington Bureau

Sure, your office may seem clean. But it’s probably not. Invisible network pollution contaminates the space, and it may open a door to evildoers.

The pollution comes from the growing list of internet-connected devices: cellphones, security cameras, thermostats, door locks, printers, speakerphones, even coffeemakers. Not all of them have up-to-date security patches or strong password protection. All of them are potential foot soldiers for hackers.

In a report titled “Internet of Evil Things” to be released Monday, a Boston-based company says the connected devices that surround us at home and work give indigestion to technology security experts, who see the rise of a menacing new force.

“Our devices live in an open and free world. They connect to anything. They connect to good things and bad things. They don’t know the difference,” said Paul Paget, chief executive of Pwnie Express, the Boston cyber threat detection firm.

The problem, Paget said, is that much of the internet-connected world is contaminated with malicious code, or malware, “and your devices swim in that pollution.”

Increasingly, employees carry their own devices to work, perhaps unwittingly bringing cyber infections and malware into contact with an office network, or bringing devices with weak defenses that can be forcibly recruited into in a hostile robotic network, or botnet, for attacks elsewhere.

The first major alarm about these zombie botnets arose on Oct. 21 when hackers used malware, which security professionals dubbed Mirai, to harness an army of enslaved connected devices, mainly security cameras, to overwhelm a New Hampshire firm, Dyn, that is a backbone of the internet. The massive attack, the largest of its kind ever, took down internet access in some metropolitan areas of the East Coast.

Rather suddenly, the risk of connected devices became a hot topic. Even the most mundane home or office device could seem, well, potentially virulent.

“We now work in offices where the conference room whiteboards are smart, security cameras are wireless and speakerphones are Bluetooth. Even the coffeemakers are connected and can potentially open a backdoor to a rogue actor,” the report says.

To gain a sense of shifts in the mood of information security experts, Pwnie Express surveyed 868 of them in 80 countries during a three-week period that ended Jan. 5.

Nine out of 10 said they were concerned about vulnerabilities in the connected world, which some call the Internet of Things, the survey found, and 44 percent said they now worried more about random connected devices than traditional network security.

And there’s bad news: Two-thirds of respondents said they didn’t know how many connected devices employees brought into their workplaces. The same percentage said they either hadn’t checked or didn’t know how to check devices for the Mirai malware.

“They are highly concerned about it, and they don’t know what to do,” Paget said. “If they don’t know what to do, then the fear starts to creep in.”

Once focused only on the safety of equipment and computers they directly controlled, 3 out of 5 network security pros now realize they have to worry about any connected devices brought through the doors of their workplaces, the survey found.

Yet only 8 percent said they could continuously monitor and detect such devices.

“That means less than 1 in 10 IT security departments could detect Mirai on a webcam, a printer or a device brought from home into an office,” the report says.

Paget said company security professionals would increasingly have to monitor all connected devices in range of their networks, including the odd visitor with a Bluetooth-connected phone or even the wireless drone that flew overhead.

“Privacy laws come into play,” Paget said, adding that security pros will simply need to monitor the activity of such devices, “not touch the data, not inspect it, not drop agents onto machines, but understand what the behavior is.”

Other experts say the use of malicious Mirai botnets will increase in the foreseeable future.

“If left un-combatted, (Internet of Things) botnets are expected to evolve in sophistication and impact for at least the next three years,” said a research report in December from a cybersecurity think tank, the Institute for Critical Infrastructure Technology. The report carried the ominous title “Rise of the Machines: The Dyn Attack Was Just a Practice Run.”