The Gift of Cyber Attack: What to Know Before Gifting Smart Devices
With the holiday season in full swing, the temptation to buy clever and convenient gadgets as gifts for our friends and family is always there. Everybody loves a smart gadget that does interesting things. However, few people stop to consider the possible security implications and potential issues before they grab a shiny new toy off the virtual shelf.
The researchers at the Tripwire Vulnerability and Exposure Research Team chose a smart item suitable for a holiday gift and put it to the test. The item chosen for the security test was a best-selling Amazon item listed on the platform's gift guide - a Wi-Fi microscope.
The microscope has Wi-Fi connectivity features that require a computer or a mobile device to store any high-resolution digital images the microscope's camera captures. The means of connection to various devices differ significantly for this particular microscope, the research team found out. The mobile app stores for Android and iOS devices have a dedicated app on them.
PC users need to download a third-party program that allows access to the camera using either a USB connection or IP. The most convenient and generally safest option was available for Mac computers - Mac users can simply connect the device using USB and use a native MacOS application.
There are also issues with the mobile app connection option, the team explains. When you connect to your microscope with a phone, even when using the official app provided for that purpose, the microscope itself still acts as a Wi-Fi access point that has no password protection in place. This means your phone, once connected to the microscope, is exposed to potential attacks through the unsecured access point.
Potential bad actors who are within proper range could also spoof the microscope and replace the phone's connection with one to a new malicious access point.
As an extreme case, the researchers listed the possibility of bad actors developing a specific exploit aimed at that specific microscope device that will allow them arbitrary code execution on a connected mobile device, effectively giving them full access to everything on the phone.
