Last updated at Thu, 20 Jul 2017 16:14:29 GMT

By now, you've probably caught wind of Mark Stanislav's ten newly disclosed vulnerabilities last week, or seen our whitepaper on baby monitor security – if not, head on over to the IoTSec resources page.

You may also have noticed that Rapid7 isn't really a Consumer Reports-style testing house for consumer gear. We're much more of an enterprise security services and products company, so what's the deal with the baby monitors? Why spend time and effort on this?

The Decline of Human Dominance

Well, this whole “Internet of Things” is in the midst of really taking off, which I'm sure doesn't come as news. According to Gartner, we're on track to see 25 billion-with-a-B of these Things operating in just five years, or something around three to four Things for every human on Earth.

Pretty much every electronic appliance in your home is getting a network stack, an operating system kernel, and a cloud-backed service, and it's not like they have their own network full of routers and endpoints and frequencies to do all this on. They're using the home's WiFi network, hopping out to the Internet, and talking to you via your most convenient screen.

Pwned From Home

In the meantime, telecommuting increasingly blurs the lines between the “work” network and the “home” network. From my home WiFi, I check my work e-mail, hop on video conferences, commit code to GitHub (both public and private), and interact with Rapid7's assets directly or via a cloud service pretty much every day. I know I'm not alone on this. The imaginary line between the “internal” corporate network and the “external” network has been a convenient fiction for a while, and it's getting more and more porous as traversing that boundary makes more and more business sense. After all, I'm crazy productive when I'm not in the office, thanks largely to my trusty 2FA, SSO, and VPN.

So, we're looking at a situation where you have a network full of Things that haven't been IT-approved (as if that stopped anyone before) all chattering away, while we're trying to do sensitive stuff like access and write sensitive and proprietary company data, on the very same network.

Oh, and if the aftermarket testing we've seen (and performed) is to be believed, these devices haven't had a whole lot of security rigor applied.

Compromising a network starts with knocking over that low-hanging fruit, that one device that hasn't seen a patch in forever, that doesn't keep logs, that has a silly password on an administrator-level account – pretty much, a device that has all of the classic misfeatures common to video baby monitors and every other early market IoT device.

Let's Get Hacking

Independent research is critical in getting the point across that this IoT revolution is not just nifty and useful. It needs to be handled with care. Otherwise, the IoT space will represent a mountain of shells, pre-built vulnerable platforms, usable by bad guys to get footholds in every home and office network on Earth.

If you're responsible for IT security, maybe it's time to take a survey of your user base and see if you can get a feel for how many IoT devices are one hop away from your critical assets. Perhaps you can start an education program on password management that goes beyond the local Active Directory, and gets people to take all these passwords seriously. Heck, teach your users how to check and change defaults on their new gadgets, and how to document their changes for when things go south.

In the meantime, check out our webinar tomorrow for the technical details of Mark's research on video baby monitors, and join us over on Reddit and “Ask Me Anything” about IoT security and what we can do to get ahead of these problems.