Warning: Internet of Things Holds Hidden Dangers

By Rene Novoa, Senior Manager of eDiscovery and Digital Forensics

 

Law enforcement and civil litigators now have another source of evidence—searching for clues and ESI in the Internet of Things (IoT) universe where “always-on” smart devices may collect and store evidence of criminal behavior or civil liability.

Police are investigating an Arkansas murder where clues to the crime may have been stored on the victim’s Amazon Echo, a free-standing personal assistant device that responds to verbal commands for information.

The victim was found in a hot tub and police say that another smart device, a water meter, could also hold clues to what happened at the crime scene.

Staying One Step Ahead

DriveSavers is one step ahead of the IoT curve. Our engineering team has done extensive research on how smart devices collect and store data. More importantly, we are developing the best techniques for data recovery and forensic investigation of a wide range of IoT devices.

Based on cases such as the U.S. Supreme Court’s opinion in Riley v. California, information from smart devices is likely protected by the owner’s right to privacy. In this case, Amazon rejected police requests for data that may have been collected by the Amazon Echo:

Amazon will not release customer information without a properly served and valid warrant or subpoena. Amazon objects to over-broad or otherwise inappropriate demands as a matter of course.

The Echo, which you address as Alexa, doesn’t store each voice request permanently on the device itself, but it sends a copy of each inquiry to the user’s mobile phone or tablet, according to our research.

Just the Start

In addition to being a legitimate target for legal discovery, the IoT is an expanding frontier where your personal data may be inadequately protected and susceptible to theft.

Tech-savvy hackers now may be able to get to your bank account via your garage door opener, refrigerator or virtual helpers like the Amazon Echo and Google Assistant.

Hackers can take control of large networks of IoT devices and use them to make debilitating Distributed Denial of Service (DDoS) attacks on commercial websites.

Last fall, Twitter, Amazon, Tumblr, Reddit, Spotify and Netflix were among the websites that sustained DDoS attacks using commandeered smart devices—like DVRs, remote controlled cameras and even garage door openers—in an attempt to overload the sites with massive requests for information.

Personal Assistants, Personal Problems

Many smartphone users are already familiar with Apple’s Siri and Google’s Assistant, which, similar to Alexa on the Google Echo, are programs that respond with answers to verbal questions via smartphone. Data collected by these devices and others is not normally encrypted, making it a potential target for high-tech thieves.

Devices that are connected to the Internet can also lead hackers, law enforcement and civil litigators to other devices with even more sensitive, valuable and private information like bank accounts, credit cards and virtually anything else of value that’s in a digital format.

What You Can Do

Technology is an everyday part of life today and is necessary in school, career and at home. It’s important for you, your family and your employees to be familiar with how to use current devices as modes of communication.

Here are three ways to be safer when using electronic gadgets.

1. Understand Your Devices

You should know the answers to these questions:

• Does the device have a camera?
• Can it transmit or receive pictures?
• Does it have a phone book or contact list?
• Can it download apps? What do the apps have access to (photos, contacts, etc.)?
• Can you communicate with other people through the device?
• Does the device post to the web?
• Does the device have a dashboard? If so, is the dashboard part of the installed software or is it online?
• What kind of information can be shared with other people online?

2. Keep Up with Device Updates

Updates often include new security protocols and patches for security loopholes. Stay on top of these.

3. Add Wi-Fi Security

Make sure your home Wi-Fi is password protected so that outsiders cannot easily access it.

For more cybersecurity safety tips, check out 6 Ways to Protect Yourself from Hackers.