IoT 101: What Every Homeowner Should Know

While the Internet of Things (IoT) has opened up an extensive array of technological possibilities, not being aware of its subtle implications can lead to undesirable outcomes.

What is IoT

IoT, short for Internet of Things, is a technology that facilitates the interconnection of devices, allowing them to communicate with each other and the cloud service they operate on.

Nowadays, the IoT umbrella encompasses a broad range of devices, including autonomous vehicles, speakers, refrigerators, lamps, wearables, air quality monitors, purifiers, washing machines, TVs, ovens, vacuum cleaners and even toothbrushes.

In fact, most devices that can connect and exchange data with other systems and devices over the Internet can be classified as IoT devices.

Although the concept of IoT extends far beyond the home, this guide will focus on household IoT devices and their implications for the typical homeowner.

Why is IoT a gamechanger

The consumer market often draws an equivalence between IoT and “smart home” products. The convenience of interconnected home appliances is tremendous, as a properly configured ecosystem can save you a lot of time and effort spent on menial tasks.

Controlling light fixtures, setting your desired ambient temperature, preheating the oven, warming up your car, or even the ability to play music without getting up from your chair, or even from outside your home, all sound very appealing.

Add automation to that list of perks and even the most skeptical homeowner would raise an eyebrow in disbelief. Aside from saving you time and effort, an IoT ecosystem can help you cut energy costs by automatically adapting energy usage in your home based on predefined scenarios.

Last but not least, IoT’s utility is increasingly exploited in households sheltering elderly and disabled individuals, as it can greatly help accommodate a broad range of disabilities. Voice controls, alert systems, safety features, and monitors are all IoT-related features that can greatly improve the quality of life of vulnerable users.

The hidden side of IoT

Despite its innate convenience, IoT paves the way for new breeds of digital threats. In a world where not even air-gapped (i.e. disconnected from the internet and other devices that have internet access) systems are completely safe, IoT ecosystems can quickly become a liability.

A typical non-IoT household can still be subject to attacks from threat actors. The degree of risk stems from the number of access points that can be exploited. In other words, any internet-enabled device could potentially be used as an access point in a cyberattack.

It makes sense that IoT households, where the number of internet-connected devices can be considerably higher, suffer greater risk, proportional with the number of internet-exposed devices.

Common IoT shortcomings

Although internet connection seems to be the common denominator in major incident involving IoT devices, several other factors could increase the risk of cyberattacks, including:

• Insecure default settings – Most users skip reading the device operation manual and fail to configure it in a secure, efficient manner.
• Lack of encryption – By default, IoT devices are shipped without encryption pre-enabled, to foster a frictionless initial setup. However, some devices can lack encryption altogether, turning them into a liability to your secure IoT ecosystem.
• End of support (EOS) devices – Older devices that reach their EOS state would no longer receive security updates, exposing them to a plethora of risks.
• Not prioritizing firmware updates – Even if a device is outside its EOS timeframe, not prioritizing firmware updates could pave the way to attacks exploiting unpatched security vulnerabilities.
• Cheap, off-brand devices – Setting up an efficient IoT ecosystem could set you back significant amounts of money, which drives some users to opt for cheaper, less secure devices.

Insecure default settings

Most IoT devices ship pre-configured to make configuration easier. Most of the time, the user simply has to connect the device to a power source, then use a dedicated app to grant it access to the internet and add it to the IoT ecosystem.

However, it is crucial to keep in mind that default settings, such as access point names and passwords, are not always secure and are only there for convenience. In a real-life scenario, a threat actor could exploit these settings, often found in online user manuals, to breach your network.

Lack of encryption

IoT devices that ship without passwords are less common, but they still exist. The lack of encryption is usually there to ensure that home users who skip on reading the manual can set up the device without significant effort.

However, most of the time manufacturers include restrictions that force the user to configure a password, or at least warn them of the risks associated with password-less devices, before allowing them to use the device after its initial setup.

End of support (EOS) devices

Nowadays, devices have a pre-determined “lifespan,” during which the manufacturer releases periodical security updates to ensure the device’s wellbeing.

While this does not happen immediately, devices that reach their EOS status can slowly form a weak point in your IoT ecosystem, as threat actors may discover vulnerable points in their design that would remain unpatched.

Although the financial effort is typically significant, upgrading to a newer, non-EOS device could save you from the headache of undergoing a devastating cyberattack.

Not prioritizing firmware updates

Although less common than EOS devices, not prioritizing firmware updates can pave the way for the same type of digital threat: unpatched vulnerability exploits.

While most devices have automatic updates enabled by default, some devices may need user confirmation to check and install the latest security patches.

It is wise to periodically check if your device has the latest security patches installed and is running on the latest firmware.

Cheap, off-brand devices

Last but not least, going with the cheaper option can expose IoT users to a plethora of risks. Nowadays, cheap knockoffs of popular products plague online markets.

While the low price of such a product can entice people into buying it, it can also mean that the product’s security is subpar. Some manufacturers even implement backdoors into their products and sell access to malicious actors.

Buying well-regarded, genuine products can significantly lower the risk of exposure to cyberattacks via an undisclosed backdoor.

Conclusion

While the IoT landscape looks promising, it also harbors many negative aspects that are often overlooked. Properly configuring an IoT ecosystem with trusted, secure products can save you a lot of hassle in your day-to-day activities.

However, failing to do so can increase the chance of ruthless cyberattacks on your home network. Threat actors may exploit every vulnerable device in your household to breach your network and potentially engage in further malicious activities.

Frequently Asked Questions about IoT

• What are the 4 types of IoT?

The Internet of Things (IoT) can be split into four main categories: consumer IoT, commercial IoT, infrastructure IoT and industrial IoT.

• What are the 7 levels of IoT?

IoT architecture functions based on 7 layers that are crucial to its operation: sensors, sensors to gateway network, gateways, gateways to internet network, data storage and processing, internet to user network and value-added information.

• What is the IoT framework?

IoT frameworks are sets of tools, protocols and standards that facilitate specific structures for development and deployment, serving as the cornerstone of building products and applications.