IEEE Spectrum - North American - March 2015 - 52

ATTACK
TAKE CONTROL

STEAL INFORMATION

DISRUPT SERVICES

Controls for smart door locks and
lighting systems can be vulnerable.

Door locks
have been
unlocked
remotely.

Malwareinfested
refrigerators
have sent
spam.

Infotainment
systems offer
multiple ways
into a car's
electronics.

Personal-fitness
devices can tell
a hacker where
you are.
Pacemakers
can be
attacked
remotely.

High-capacity
insulin pumps
are vulnerable.
Hacked vehiclecontrol systems
can allow remote
control of brakes.

No pLaCe to hiDe: with the internet of things spreading throughout our homes, cars, and even bodies, new vulnerabilities seem to emerge

tricity to security systems. That would certainly simplify a
burglary attempt. A Web-connected security system could
also be hacked directly, with a hacker using a brute-force
attack to guess your password. In fact, a Russian website
may have already done the job. The site, which was recently
shut down, provided links to 73,011 locations with unsecured
security cameras in 256 countries. In an unrelated incident,
a hacker in Cincinnati compromised a baby monitor and used
it to scream at a sleeping infant.
Or perhaps you have the latest smart locks, the kind that
let you use your smartphone at a distance to open the front
door for a guest. Perhaps you also have Web-connected lighting systems. Wouldn't a would-be burglar love to unlock the
doors, turn off the lights, and disable your home security?
Now consider your car. It has or soon will have the ability
to record and report diagnostic information, remotely start
and turn on the heat when signaled by your cellphone, and
use integrated GPS, map, weather, and traffic data to select
the best route. But these capabilities also mean that hackers can remotely flash your car's lights, enabling them to
identify it on your street, unlock the door, start the engine,
and drive it away. Hackers might even gain control of the
car while you're driving it, thanks to malware that infected
the car when it communicated with a computer back in
the repair shop. In February 2014, the U.S. Department of
Transportation began working on a regulatory proposal
52

mar 2015

north american

SPectrUm.ieee.orG

that would require all new vehicles to be equipped with
car-to-car and car-to-infrastructure communication capability, providing yet another path for reaching into automobiles remotely.
Your body itself may not be safe from hackers. Already
patients are being monitored and even treated with medical
devices like pacemakers and insulin pumps, ventilator systems and blood chemistry monitors. These products are connecting to the Internet because it's so much better to monitor
patients in their homes than in medical facilities. But if a personal health device connects to the Internet, it can be hacked.
In an episode of the TV show "Homeland," a murderer kills
remotely by accelerating a heart pacemaker-a trick that hasn't
been reported in real life but has been demonstrated in the lab.
In fact, doctors disabled the wireless capabilities in the pacemaker of former U.S. vice president Dick Cheney to protect him
from such malfeasance. If this kind of attack happened to an
implanted pacemaker, we might never know; it might be impossible to distinguish between a product malfunction and a cyberattack. Researchers have also demonstrated that insulin pumps,
used to help control diabetes, can be remotely instructed to
pump out all their insulin at once, killing or severely injuring
the user. The same applies to pain medication pumps.
More subtle hacks might be tried to avoid arousing suspicion. A criminal might tweak a monitoring system so it would
report that a dangerously sick patient was just fine.

iCons: J.D. KinG

almost daily. the smart locks and security systems in your home could be disabled by a would-be burglar. your car could be forced to unlock its
doors and start its engines; a thief would only have to get in and drive. implanted pacemakers and insulin pumps are also vulnerable to hacking.

http://SPectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum - North American - March 2015