Home Networked Devices Suffer 10 Attacks Daily: IoT Security Needs Urgent Improvement

Recently, NETGEAR, a security solutions provider, and Bitdefender, a cybersecurity software supplier, jointly released a report on the security status of IoT (Internet of Things) devices. This report examined common vulnerabilities in IoT devices and proposed measures to mitigate such risks. Based on IoT data from 3.8 million households worldwide, the report disclosed new trends in IoT security threats. Given the rapid increase in global IoT connections, IoT security has become a core part of cybersecurity and data security. It requires attention and collaborative efforts across all levels, from top-level policy design to micro-technical advancements.

Severe Home IoT Security Situation

The report by NETGEAR and Bitdefender revealed data on IoT security. Analyzing the security threat data of 3.8 million household IoT devices using NETGEAR's security services, the study examined over 9.1 billion security events from approximately 50 million IoT devices to identify common vulnerabilities and attack scenarios.

The report highlighted that the security situation for home IoT devices is dire, with these devices constantly under threat:

• Each household IoT device experiences an average of 10 attacks every 24 hours, up from 8 attacks last year.
• Bitdefender's smart home security solutions block an average of 2.5 million threats daily, which is about 1,736 threats per minute.

According to market research, a typical American household now has an average of 21 connected devices, including not just phones and computers but also gaming consoles, smart TVs, smart speakers, baby monitors, cameras, and home appliances. While these devices enhance household convenience, they also pose significant security risks, as blocking 10 attacks daily is challenging.

One critical finding from the report is that nearly all attacks (up to 99.3%) on IoT devices exploit known vulnerabilities and exposed weaknesses, with only a small portion using weak passwords or plaintext authentication. This underscores the necessity for users to keep their devices updated with the latest patches and software.

The report identified specific devices highly susceptible to attacks in 2023, including smart TVs, smart plugs, digital video recorders (DVRs), and smart routers, accounting for 34%, 18%, 13%, and 14% of vulnerabilities, respectively. Smart TVs, due to their longer lifespan and lack of software support, are particularly prone to attacks. Although these statistics are mainly from overseas markets, domestic households with high penetration rates of smart TVs and routers should pay close attention to these threats.

Due to the diverse functions and hardware configurations of IoT devices, security threats and internet vulnerabilities vary significantly. The most common types of vulnerabilities found were buffer overflows and denial-of-service attacks, accounting for 28.25% and 27.2%, respectively, followed by code execution, privilege escalation, memory corruption, and information leakage.

The report also mentioned risks associated with mobile devices. Bitdefender's "2024 Consumer Cybersecurity Assessment Report" showed that 78.3% of respondents use mobile devices for sensitive transactions. However, 44.5% of respondents do not use any mobile security solutions, making them vulnerable to malware, phishing attempts, and data breaches.

Advancing IoT Security Regulations: Security Labeling as a Typical Approach

In response to the growing IoT security threats, besides pushing IoT security companies to develop and apply new technologies and solutions, many governments are enhancing top-level policy design and regulatory frameworks. These regulations aim to ensure IoT devices, networks, and data processing are protected from unauthorized access, manipulation, or attacks. Some countries have specific regulations for IoT devices or government guidelines, while others have general cybersecurity laws affecting IoT devices.

Most regulations share common themes, including enforcing minimum security measures, promoting best practices in design and development, and requiring regular updates and patches. Some also mandate compliance checks and penalties for non-compliance, creating a structured environment for safer IoT implementation.

In 2020, the United States enacted the IoT Cybersecurity Improvement Act, the first law specifically targeting IoT device security. This act defines IoT devices as having at least one sensor or actuator for interacting with the physical environment, at least one network interface, and the ability to operate autonomously, not as part of a larger system. Notably, the law excludes devices like smartphones and laptops.

A crucial component of this legislative effort is the guidelines developed by the National Institute of Standards and Technology (NIST), particularly the NIST SP 800-213 series. This series includes federal IoT device cybersecurity guidelines and a catalog of cybersecurity requirements for IoT devices, offering a detailed framework aligned with broader cybersecurity standards. These guidelines were refined through extensive public feedback and collaboration, emphasizing the commitment to developing practical and adaptable IoT security standards for various federal applications. The act prohibits federal agencies from procuring or using IoT devices that do not meet NIST standards.

In recent years, the U.S. has promoted the Cybersecurity Labeling Program for consumer IoT security certification, helping consumers identify IoT devices that meet strict security standards such as strong credentials, regular updates, and data protection. This market-driven approach allows consumers to "vote with their feet."

Canada has also enacted the Personal Information Protection and Electronic Documents Act, covering a wide range of activities beyond commercial transactions, including personal data in federally regulated sectors. In the IoT context, the act sets specific requirements to ensure organizations comply with accountability and consent principles, limiting the use, disclosure, and retention of personal information collected through IoT devices. These regulations mandate that IoT device manufacturers and operators implement stringent data protection measures, maintain transparency in their data practices, and allow individuals to access and control their personal information.

Europe has passed the Cyber Resilience Act (CRA) to protect all digital products in the EU from cyber threats, with IoT products being a significant part of this "digital products" category. For IoT devices, the CRA requires manufacturers to take strict compliance measures, including mandatory EU conformity marks indicating the products meet the new stringent cybersecurity standards outlined by the act. The CRA also covers importers and distributors, who are responsible for ensuring only compliant products enter the European market.

In March of this year, Japan's Ministry of Economy, Trade, and Industry released a draft for the "IoT Security Conformity Assessment Program," akin to Japan's version of the IoT security labeling program. This program helps relevant public organizations select and procure IoT products meeting certain security levels, using common standards for assessment and visualization. This facilitates the safe definition of IoT products for procurement and use, allowing industry organizations to specify necessary certifications and labels. Coordination with other countries' programs aims to reduce compliance assessment costs for IoT product suppliers during export and achieve mutual recognition.

In December last year, South Korea's Ministry of Science and ICT, the Korea Internet & Security Agency, and Singapore's Cyber Security Agency signed a cooperation agreement on mutual recognition of IoT security certification systems. These certification systems ensure IoT products can effectively address security challenges, protect consumer data, and enhance device integrity against potential cyber threats.

The rapid development of IoT brings security risks, posing more challenges to the industry. Countries prioritize addressing this issue, with security labeling becoming a typical approach. In this context, China needs to expedite the launch of its IoT security labeling program. Adopting this globally common approach protects consumer rights and boosts the competitiveness of Chinese IoT enterprises.