The devices without data encryption in their connections are highly vulnerable to several types of man-in-the-middle (MitM) attacks, says the report
More than 90 per cent of data transactions that are performed by Internet of Things (IoT) devices in corporate networks were unencrypted, according to a latest report by network security firm Zscaler.
With regards to IoT devices, 41 per cent did not use Transport Layer Security (TLS) at all. On the other hand, 41 per cent used TLS just for a few connections and only 18 per cent used TLS for all the traffic, the report finds out.
The devices without data encryption in their connections are highly vulnerable to several types of man-in-the-middle (MitM) attacks. This means that a huge volume of such devices is prone to MitM attacks where hackers can intercept traffic and steal or manipulate the unencrypted data.
A hacker, after gaining access to the local network, could use the Address Resolution Protocol (ARP) tricking or could compromise the local router and then intercept IoT traffic to deliver malware or to steal the data and credentials sent in plain text, the report says.
The report, based on telemetry data gathered from the Zscaler’s cloud, looked into 56 million connections from IoT devices that are present on 1,051 enterprise networks.
Most common IoT devices
From the data, the company recognised 270 different IoT profiles spread across 153 IoT device manufacturers. The devices include smart printers, smart watches, smart TVs, digital home assistants, set-top boxes, IP phones, IP cameras, medical devices, media players, digital video recorders, networking devices, data collection terminals, smart glasses, digital signage media players, industry control devices, 3D printers and even smart cars.
Set-top boxes were the most common devices used for video decoding. These made up for more than 50 per cent of devices observed in the study. These were followed by smart TVs, wearables and printers. However, the maximum amount (80 per cent) of outbound data transactions were generated by data collection terminals.
While assessing IoT malware infections, the report observed that there are several devices with default or weak credentials or with known security flaws. This is because these IoT devices do not have automatic updates turned on and their users seldom check and deploy manual updates.