Why the Internet of Things (IoT) could cause a power blackout
IoT devices can be exploited on a large scale for cyberattacks. Successful extortion attempts such as «fake sextortion,» wire transfer fraud using «Office 365» credentials, and the key topic «Managing Purchased Risks in Hardware and Software»: The 28th Semi-Annual Report of the Reporting and Analysis Center for Information Assurance (MELANI), published on April 30, 2019, addresses the most significant cyber incidents of the second half of 2018 both domestically and abroad.
The rapidly advancing digitalization can only be mastered with the appropriate hardware and software. The market is clearly dominated by US companies, with China in the fast lane and a few global players in the hardware and software sector, for example from Korea, Russia and Germany. The potential access to ICT manufacturers by the respective home countries leads to questions about how to deal with these risks. The 28th MELANI semi-annual report focuses on this issue and addresses other current topics such as those described below.
With the Internet of Things (IoT), all kinds of devices such as heating and air conditioning systems are connected to the internet for remote control. This is practical, but also harbors certain risks. According to a study published by Princeton University in 2018, it is entirely possible that malicious actors could hack inadequately protected IoT devices, combine them into a botnet and misuse them for cyber attacks, such as a power outage. The semi-annual report sheds light on the problem and contains recommendations.
Countless "fake sextortion" emails have been circulating since March 2018. In an email, the attackers claim that they have compromising images showing the recipient consuming pornographic websites. As "proof" of the authenticity of the claim, the email often mentions passwords or cell phone numbers from previous data leaks. The semi-annual report deals with this problem and shows the development of the various "fake sextortion" waves.
With over 100 million monthly users, Office 365 accounts have become a popular target for attackers. In the second half of 2018, "Office 365" access data obtained in this way was increasingly used for so-called transfer fraud. This is when fraudsters search for existing electronic invoices in compromised accounts, then copy them, add a different IBAN and send them again.
