Use of exposed devices gives attackers the ability to listen in on private conversations and view potentially sensitive video feeds in real time
BOSTON – March 9, 2023 – Bitsight, a leader in detecting and managing cyber risk, today unveiled new research which found one in 12 Bitsight-tracked organizations with Internet-facing webcams or similar IoT devices are susceptible to video and/or audio compromise. These findings come shortly after the White House release of its National Cybersecurity Strategy, which aims to significantly improve the security of IoT devices.
Spanning 54 countries, exposed organizations include multiple Fortune 1000 organizations, and are concentrated in the education, technology, government and politics, and media and entertainment sectors. Of these sectors, education was found to be most at risk – nearly one in four Bitsight-tracked education organizations using Internet-facing webcams and/or similar devices are susceptible to spying.
By utilizing exposed devices, organizations put both cybersecurity and physical security at risk. If these devices are exploited, threat actors could eavesdrop on both private and professional conversations – allowing them to potentially exploit personal information and sensitive business information. Exposed webcams overlooking access-controlled doors and rooms could also provide bad actors with key information relating to physical security.
"This research shows that even everyday technologies, such as webcams, can leave organizations highly vulnerable if exposed," said Bitsight Chief Risk Officer Derek Vadala. "Understanding how these devices can increase an organization’s attack surface and taking the steps to deploy them in a manner that limits potential threats is critical."
For this study, Bitsight assembled a comprehensive dataset of IP addresses owned by organizations with at least one open audio/video service, mapping them to Bitsight’s inventory of organizations to determine rates of exposure. The exposed devices discovered by Bitsight were found to not be protected by a firewall or VPN, despite recommended best practices. Additionally, they were either misconfigured – possibly due to a user failing to set a password – or suffered from a software vulnerability.
Bitsight urges organizations to identify and assess the security of any video- and/or audio-enabled devices deployed internally and by third-party business partners, and engage in the following remediation efforts:
- If the devices are not behind a firewall or VPN, then prioritize doing so.
- If the devices lack authentication to access video and/or audio feeds, then prioritize setting up access control measures to protect them.
- If the devices suffer from a software vulnerability, the developer is the only route to remediation. In this case, Bitsight recommends halting use of the exposed device and changing brands if the vendor is not able or willing to remediate.
For more information, the full study can be viewed here.
About Bitsight
Bitsight creates trust in the digital economy and transforms how organizations manage cyber risk. The Bitsight Security Ratings Platform applies sophisticated algorithms, producing daily security ratings that range from 250 to 900, to help organizations manage their own security performance; mitigate third party risk; underwrite cyber insurance policies; conduct financial diligence; and assess aggregate risk. With the largest ecosystem of users and information, Bitsight is the Standard in Security Ratings. For more information, please visit www.bitsight.com, read our blog or follow @Bitsight on Twitter.