Fridge among 1,00,000 devices hacked by cybercriminals

Washington: A fridge was among more than 1,00,000 devices hacked by cybercriminals to send out spam emails -- in what may be the first proven cyberattack on smart appliances, researchers say.

The global attack campaign involved more than 7,50,000 malicious email communications coming from more than 1,00,000 everyday consumer gadgets such as home-networking routers, connected multimedia centres, televisions and at least one refrigerator that had been compromised and used as a platform to launch attacks, researchers said.

Personal computers can be unknowingly compromised to form robot-like botnets that can be used to launch large-scale cyberattacks.

Scientists at California-based security group, Proofpoint, found that cybercriminals have begun to commandeer home routers, smart appliances and other components of the Internet of Things(IoT) and transform them into "thingbots" to carry out the same type of malicious activity.

The attack that Proofpoint observed and profiled occurred between December 23, 2013 and January 6, 2014, and featured waves of malicious email, typically sent in bursts of 100,000, three times per day, targeting Enterprises and individuals worldwide.

More than 25% of the volume was sent by things that were not conventional laptops, desktop computers or mobile devices; instead, the emails were sent by everyday consumer gadgets such as compromised home-networking routers, connected multimedia centres, televisions and at least one refrigerator.

No more than 10 emails were initiated from any single IP address, making the attack difficult to block based on location -- and in many cases, the devices had not been subject to a sophisticated compromise.

Instead, misconfiguration and the use of default passwords left the devices completely exposed on public networks, available for takeover and use.

"Botnets are already a major security concern and the emergence of thingbots may make the situation much worse," said David Knight, general manager of Proofpoint's Information Security division.

"Many of these devices are poorly protected at best and consumers have virtually no way to detect or fix infections when they do occur," David said.

The Internet of Things includes every device that is connected to the internet -- from home automation products including smart thermostats, security cameras, refrigerators, microwaves, home entertainment devices like TVs, gaming consoles to smart retail shelves that know when they need replenishing and industrial machinery.