Federal agency makes security recommendations for Internet of Things

According to estimates, around 6 billion devices were connected to the internet in 2016, writes Melani in the half-year report published on Thursday. In 2020, this figure is likely to be more than three times as many, namely around 20 billion. However: "Manufacturers and users often pay too little attention to security aspects."

Manipulation as a hazard

The authors of the report see the manipulation of such systems as a potential threat. Especially in the logistics sector, where devices connected to the internet are experiencing a boom, the damage caused by manipulation could be enormous. The report cites one example: "If a manipulated pharmaceutical logistics system delivers the urgently needed medication to the wrong place, this can very quickly become a matter of life and death." Such attacks could be used to extort money or cause uncertainty in society. According to experts quoted in the report, some operators "simply" do not use passwords or encryption for protection. Unprotected sensors communicating via the network are found in cars, earthquake sensors, ATMs, air conditioners, lights and medical devices, among other things.

Update and passwords important

Melani has published recommendations for a more secure Internet of Things: Before installing network-enabled objects, you should ask for software updates. Not only a PC or smartphone, but also a smart light switch needs a regular software update. Devices and objects that can be accessed with standard access data are also potentially dangerous. According to Melani, they can be found by anyone. Here too, protection mechanisms need to be considered - for example, whether the access data preset by the manufacturer can be adjusted.

Fraudulent schemes

Melani recommends using your own complex passwords as well as firewalls and separate network segments for Internet of Things devices. Unauthorized access to personal data from the internal network should not be possible via these devices. Devices that are not required should be disconnected from the network. There were also numerous attempts at fraud via the network in the second half of 2016. DDoS attacks and encryption Trojans, for example, are still being used to extort money. "CEO fraud" was also used in various cases: perpetrators use this scam to demand that employees make a payment to an account in the name of a company boss. In most cases, a very confidential, sensitive or urgent matter is put forward - and the money ends up with the fraudsters.

Allegedly a federal agency

Even the federal government was not spared: according to the report, financial departments of the federal administration also received payment instructions. In one case, perpetrators imitated the website of the Swiss Financial Market Supervisory Authority Finma in order to trigger a payment. In another case, perpetrators pretended to be representatives of a federal agency on the telephone. By pretending to be an official agency, more pressure can be exerted on victims to pay, writes Melani. Even the phone number on the victim's display has been faked. In 2016, Melani received reports of more than 4,500 phishing pages. Criminals are still trying to obtain credit card details or access data for internet services in this way.

Indirect target of cyber espionage

The Melani report also deals with cyber espionage. Attacks against the World Anti-Doping Agency and the International Court of Arbitration for Sport in Lausanne affected Switzerland indirectly. As Switzerland is home to many international organizations, the risk of being exposed to such operations is increased. Three servers at the University of Geneva were affected by a recent attack between 2001 and 2003, as Melani writes, citing the operator of Swiss university networks "Switch". Two of these servers have not been active since 2009. The third is said to have been inaccessible from the outside. (SDA)

Graphic: Pixabay