Do you feel differently about your smart fridge?
The high-tech home hub allows you to check what food you have in, suggest recipes, and manage the family calendar, should you be able to afford its not-insignificant price tag.
But this week’s cyberattack on Supervalu’s refrigeration systems might be forcing people to re-evaluate its position in their home.
Where could the next attack come from?
READ MORE
You might equally be eyeing your connected coffeemaker warily, worried about what it could be getting up to behind your back. You might consider unplugging the robot vacuum cleaner in case it goes rogue while you are out on the school run.
Jokes aside, the recent spate of attacks on seemingly harmless systems should give us pause for thought. The problem with many of these connected devices is that as soon as you hook anything up to the internet, it opens up a chink in your armour , no matter how hard we try to lock it down.
It is a trade-off that we might not be aware we are making at the time – but it is a common thread in the modern world. For the sake of convenience, we give up a little security. Even with the most diligent company in charge of maintaining the security of the appliances, there is always a risk that something will go wrong. And with the growth in artificial intelligence (AI), the chance of a previously undetected vulnerability rearing its head has suddenly been magnified.
You might wonder why hackers would want to attack a smart home device in the suburbs of Dublin. While we may not have thousands of euro of stock to destroy, or disposable income to pay out ransoms, we do have something that is valuable: our data. And that, as we know, is worth a lot of money in the right – or wrong – hands.
There is also the chance that our smart home devices, unpatched and open to exploitation, may be used as part of an attack on a high-value target.
In recent days, a joint operation between public and private partners in the tech industry took down a global botnet that had been hidden in set-top boxes across 200 countries. The botnet, which was placed on the devices before they were sold, surreptitiously used the set-top boxes and internet connections of those unlucky enough to have installed them in their homes.
This is not a new threat. Botnets have been carrying out large-scale attacks for years. One example: in 2016, the Mirai botnet took over up to 560,000 unsecured or weak cameras, printers, and DVR players and knocked out Twitter, Reddit, and Netflix, among others.
So what can we do to protect ourselves? Besides cutting off the connection, that is, although you could argue there is no compelling need to have an oven or coffee maker with an internet connection.
There is some help on the way from the bureaucrats, with various rules regarding security being implemented at an EU level, forcing manufacturers to adopt a secure-by-design approach. But we can’t rely on them to fully shield us from all the risks.
There are ways to protect ourselves: keeping up to date with software releases to patch up any security holes is a given;buying reputable brands rather than settling for cheap, unbranded technology from online marketplaces is another. Changing the default passwords on devices is another tip from security experts.
But we need to be aware of what could be coming down the line.
Anthropic recently warned of another threat: that AI models are becoming so smart and small in terms of storage requirements that they could copy themselves into places you might not suspect – such as your smart fridge.
That could create an army of smart botnets that could, in theory, be commanded to launch attacks without needing a data centre to run from. And, the experts argue, that would be one that is very difficult to battle, because there is no centralised point from where the attack has been launched.
Of course it is never as simple as it looks. The scenario proposed by Anthropic was a test rather than a real-world incident, and the end result – a model that replicates itself – is more of a ‘could’ than a ‘did’. The model didn’t have to break in as such, although we are often so lax about security on these connected devices that it wouldn’t have presented a huge barrier if that had been the case.
There are a few lessons to learn here.
Take the claims of AI companies about the power and potential of their technology with a grain of salt, for both good and bad.
But perhaps, to be safe, you might also consider limiting smart technology to the essentials. Sometimes the trade-off just isn’t worth it.
