At least 83 million Internet of Things (IoT) devices around the world could be at risk of hacking, potentially enabling threat actors to listen in on private conversations and watch live video streams from baby monitors and smart cameras.

That's according to new findings from Mandiant, a cyber security company and subsidiary of FireEye.

Mandiant security researchers Jake Valletta, Erik Barzdukas, and Dillon Franke discovered a vulnerability that affects IoT devices that use the Kalay network platform manufactured by Taiwanese IoT and M2M (machine-to-machine) solutions provider ThroughTek.

Tracked as CVE-2021-28372, the vulnerability affects a core component of the Kalay platform, allowing hackers to “listen to live audio, watch real-time video data, and compromise device credentials for further attacks based on exposed device functionality”, according to the researchers.

Although Mandiant was not able to pinpoint the affected devices, its researchers noted that ThroughTek has at least 83 million active devices as well as an estimated 1.1 billion monthly connections on its Kalay platform, with all of them potentially being exposed to hackers.

Mandiant disclosed the vulnerability to the US’ Cybersecurity and Infrastructure Security Agency (CISA), which has published an advisory report on the issue that recommends that users disconnect their ThroughTek devices from the internet, isolate them from the business networks, and to only connect to devices through virtual private networks (VPN).

A spokesperson for the UK’s National Cyber Security Centre (NCSC) told IT Pro that it is “aware of this vulnerability”, adding that ThroughTek “has released an update to fix the issue”.

“Simply using the platform does not automatically make you vulnerable to real-world impact, as additional information that is hard to guess is needed to exploit the vulnerability in an individual device successfully. To maximise protection, the NCSC recommends individuals keep their software up to date by installing the latest vendor updates as soon as practicable,” said the NCSC spokesperson.

The discovery of CVE-2021-28372 by Mandiant comes two months after Nozomi Networks researchers discovered a similar flaw affecting ThroughTek’s P2P SDK, which is used to provide remote access to audio or video streams over the internet.

The UK government is working on a new law that will force IoT device manufacturers to meet minimum security requirements and banning them from setting easy-to-hack passwords such as ‘admin’ or ‘password’. In April, it was announced that the legislation would also include smartphones.

Google has announced its first purpose-built chip designed to help companies run machine learning models across IoT networks and the edge.

The Edge tensor processing unit (TPU) is an ASIC chip designed to handle machine learning models at the edge, upgrading IoT sensors from data harvesters to devices that can make inferences based on what they collect.

The idea is that by allowing much of the data analysis to occur at the very edge of the network, it's far easier and quicker to train the machine learning algorithms sat in the cloud. For example, a CCTV camera fitted with an Edge TPU chip would not only capture video, but perform facial recognition on the feed before it arrives at the server.

What's more, given that the chips are only making inferences rather than training the models themselves, they operate at a fraction of the power of machine learning hardware. Google was keen to show off that you could fit four Edge TPUs on a single US penny (see main picture).

Supporting machine learning models running on Edge TPUs is Google's newly-announced Cloud IoT Edge. This software can also underpin ML algorithms powered by GPUs or GPU-based accelerators, and can run on devices powered by the venfor's IoT operating system Android Things as well as Linux.

The software connects to the Cloud IoT Core, a managed service Google announced last year that was set up to connect IoT devices directly to its cloud platform.

Google claims this will make it far easier for businesses to build use cases around machine learning - with a bulk of the data analysis being done at the edge, companies don't need to worry about maintaining reliable connections with the cloud, or worry about regulations that mean it's simpler for companies to comply by just storing data on-premise.

Cloud IoT Edge is capable of analysing images, videos, gestures, acoustics and motion locally on the device, the company claims.

The Edge TPU development kit will be available in October

"We are the only cloud vendor today to have combined our AI research, our software research, and our hardware research to build together a hardware that is truly optimised for the latest and greatest AI technology," said Antony Passemard, head of product management for Cloud IoT.

"This is a game changer for IoT. This is really bringing intelligence to the edge in a very efficient manner in terms of watts consumed or price point," he added.

In order to test the new hardware and software, Google will be releasing a development kit in October that includes a system on module (SOM), featuring a quad-core CPU, a crypto-chip for added security, and the Edge TPU built in.

This SOM can be placed on top of a base board that the company has also developed, which will add connectivity options like Wifi and USB-C, as well as local storage.

For early access to the kit ahead of the October release, developers can submit a request through this form.

Pictures courtesy of Google

HPE is set to spend $4 billion on edge computing over the next four years, underlining the company's strategic shift away from its traditional datacentre roots.

Speaking at the company's annual conference, HPE Discover, CEO Antonio Neri yesterday revealed that his company would invest heavily to support the collection, processing and analysis of data outside of datacentre or cloud environments. This investment will be focused on research and development in the pursuit of new products and services in areas including automation, AI, edge computing and security.

"The edge is where we interact with our customers. That's what the edge is all about," Neri told attendees. "Actually, the edge is anywhere technology gets put into action. And I believe the edge is the next big opportunity for all of us.

"This next revolution requires what we call an 'edge-to-cloud' architecture. A world with millions of clouds distributed everywhere - that's the future as we see it. And HPE is uniquely positioned to drive this next revolution."

This move is a direct response to the explosion in data that has occured over the last few years, Neri said, explaining that a large portion of data that is generated at the edge is still being lost or wasted because businesses do not have the capacity to process it, and that the forthcoming development of smart cities, driverless cars and other tech innovations will only increase the amount of data being generated.

"The reality is that two years from now, we are going to generate twice the amount of data we have generated in the entirety of human history," Neri said, "and that's an incredible opportunity. Data that actually has the potential value to drive insights and actions across our world. To change our lives and our businesses."

One example Neri cited was Tottenham Hotspur FC, which is using an 'edge-to-cloud solution' delivered by HPE's PointNext and Aruba divisions to deliver high-speed networking for fans, combined with personalised interactive experiences and new merchandising opportunities.

HPE isn't the only company that's putting significant store by edge computing, though; its main rival, Dell Technologies, is also investing in the area through subsidiary VMware. The company launched a suite of new IoT packages for edge compute use cases at this year's Mobile World Congress, powered by Dell's hyper-converged infrastructure.

"We believe the enterprise of the future will be edge-centric, cloud-enabled and data-driven," Neri finished. "Those that can act with the speed and agility on a continuous stream of insights and knowledge will win. That's why our strategy is to accelerate your enterprise from edge to cloud, helping connect all of your edges, all your clouds, everywhere."

The UK government today called for stronger security measures for internet-connected devices, urging manufacturers to build security into product designs.

The Department for Digital, Culture, Media & Sport (DCMS) is promoting a 13-point code of practice in its Secure by Design review, to encourage IoT vendors to make security part of the design process rather than bolting it on as an afterthought.

However, the report's guidelines are not compulsory, and the government said it plans to work with industry to embed cyber security practices into connected device design.

Minister for digital Margot James said: "We want everyone to benefit from the huge potential of internet-connected devices and it is important they are safe and have a positive impact on people's lives. We have worked alongside the industry to develop a tough new set of rules so strong security measures are built into everyday technology from the moment it is developed.

"This will help ensure that we have the right rules and frameworks in place to protect individuals and that the UK continues to be a world-leading, innovation-friendly digital economy."

The government estimates that each UK household has 10 internet-connected devices, a number that it predicts could increase to 15 by 2020, potentially posing serious data protection threats to UK citizens.

Ian Levy, technical director of the National Cyber Security Centre (NCSC), also highlighted a need for more clarity for consumers on the need to use secure IoT devices, and to remove the burden of installing complex security software from these end users.

"The NCSC is committed to ensuring the UK has the best security it can, and stop people being expected to make impossible safety judgements with no useful information," he said.

"We are pleased to have worked with DCMS on this vital review and hope its legacy will be a government 'kitemark' clearly explaining the security promises and effective lifespan of products."

"Shoppers should be given high quality information to make choices at the counter. We manage it with fat content of food and this is the start of doing the same for the cyber security of technology products."

Devices like smart wearables, webcams and even children's toys are at risk of hacking without proper security measures.

To prevent such incidents, the review's recommendations include ensuring that devices don't come with default passwords, which can be easily hacked, that vendors are able to regularly update products' software, and that they abide by a vulnerability disclosure policy and ensure their devices have built-in redundancy to prevent them from being overwhelmed by DDoS attacks.

The only binding requirement is to protect people's personal data, something that is a key element of the EU's incoming General Data Protection Regulation and the government's own Data Protection Bill.

As part of the review, the government explored current industry incentives and challenges to implementing cyber security in consumer IoT. The evidence suggested that the main obstacles centre around cost and the challenge of justifying investing time and money when a business's focus is to get its product to market as soon as possible.

Additionally, manufacturers are unlikely to face immediate economic costs borne by a DDoS attack conducted through their devices, and, therefore, would not face sufficient commercial incentives to invest in a secure-by-design approach.

The government said it will consider making the changes compulsory through law after reviewing IoT vendors' progress throughout 2018.

Picture: Shutterstock

Three men have admitted to being the authors of the devastating Mirai botnet, which was used to launch a DDoS attack that took large parts of the internet offline last year before being widely shared with cyber criminals.

Paras Jha, 21, of Fanwood, New Jersey; Josiah White, 20, of Washington, Pennsylvania; and Dalton Norman, 21, of Metairie, Louisiana, all pleaded guilty to operating Mirai last week, in a court case unsealed by the US Department of Justice yesterday.

The trio built the botnet over the summer and autumn of 2016, targeting IoT devices like routers and wireless cameras, and targeting device vulnerabilities that would let Mirai enslave connected gadgets.

Mirai was behind one of the most effective DDoS attacks ever, hammering DNS provider Dyn with access requests from tens of millions of different IP addresses to force it offline and thereby bring down Github, Reddit, Twitter, Spotify and other huge companies that rely on Dyn to route users to their sites.

The trio conducted multiple DDoS attacks using the Mirai software in 2016, but the FBI doesn't believe they were behind the Dyn attack - they ended their involvement with Mirai in the autumn, when Jha posted the source code on a criminal forum to let other hackers use it to launch their own attacks.

Under the pseudonym of Anna-senpai, Jha wrote on the forum: "When I first go in DDoS industry, I wasn't planning on staying in it long. I made my money, there're lots of eyes looking at IOT now, so it's time to GTFO."

This came shortly after an attack on KrebsOnSecurity, security journalist Brian Krebs' blog, that was so big his pro-bono DDoS protection provider Akamai dropped him as a customer due to the cost of protecting his site.

"After Kreb [sic] DDoS, ISPs been slowly shutting downs and cleaning up their act," Jha wrote on the criminal forum, warning that such a public attack had seen ISPs grow more wary. "Today, max pull is about 300k bots, and dropping."

That was still large enough to pull down Dyn, however. Open sourcing Mirai also led to 15,194 attacks, according to a paper assessing the impact of the botnet.

Jha and Norman also pleaded guilty to using their pool of more than 100,000 connected devices to launch a 'clickfraud' campaign between December 2016 and February this year, generating false advertising clicks online.

Mirai wasn't Jha's first involvement with cyber attacks however - he pleaded guilty yesterday to a series of attacks on Rutgers University between 2014 and 2016, shutting down the university's central authentication server that staff and students used to deliver assignments and assessments.

"The Mirai and Clickfraud botnet schemes are powerful reminders that as we continue on a path of a more interconnected world, we must guard against the threats posed by cybercriminals that can quickly weaponize technological developments to cause vast and varied types of harm," said the Justice Department's acting assistant attorney John Cronan.

The FBI's assistant director, Scott Smith, added: "These cases illustrate how the FBI works tirelessly against the actions of criminals who use malicious code to cause widespread damage and disruptions to the general population.

"The FBI is dedicated to working with its domestic and international partners to aggressively pursue these individuals and bring justice to the victims."

Jha, White and Norman are yet to be sentenced.

GPU company Nvidia has partnered with satnav specialist TomTom to create a cloud-to-car mapping system for driverless cars.

Announced by Nvidia CEO, Jen-Hsun Huang, at firm's GTC Europe conference in Amsertdam today, the deal will combine TomTom's HD map coverage, which already spans more than 120,000 km of highways and freeways, with Nvidia's Drive PX2 computing platform to accelerate support for real-time in-vehicle localisation and mapping for driving on the highway.

"Together we will create a cloud and car platform for the western market," said Huang. "TomTom has mapped a very large part of the world as you know, they are one of the world's greatest mapping companies, their services are used by almost everyone."

He explained that as TomTom maps the world the company is collecting video which is being processed internally and turned into a high definition map.

"That processing is enormous; it is the grand challenge of supercomputing, to literally record the world and turn it into an HD map," said Huang.

"It is a computational challenge of extraordinary conventions, recognising length, structures, objects, cars, and turn the whole thing into a 3D map and has to be accurate within a few centimetres."

He added: "All of that processing is done in their product, and we're teaming with them to accelllerate that processing so it can be superfast and we can continuously crunch that data in the future and turn it into 3D maps."

Together, the companies will develop a cloud-to-car platform comprising of HD map in the cloud, AI algorithms, localisation algorithms and an AI super computer for the car.

"This collaboration is an important step for TomTom," added TomTom's Willem Strijbosch, head of autonomous driving.

"Combining our highly accurate HD maps with NVIDIA's self-driving car platform will enable us to propose new features to automakers faster, and therefore to make autonomous driving a commercial reality sooner."

As part of the announcement, Nvidia said its DriveWorks software development kit now integrates support for TomTom's HD mapping environment, and the open solution is available for all automakers and tier 1 suppliers developing autonomous vehicles.

A third of businesses will regard machine-to-machine technology as an innovation project come 2016, according to Vodafone.

M2M will no longer be something assigned exclusively to the IT department, the Vodafone M2M Barometer 2015 report, published this week, predicted.

Machine-to-machine refers to the technology, networks and services that connect smart devices - from cars to household items - to the Internet of Things.

The report's findings claim 21 per cent of businesses currently say that M2M projects are innovation projects,' with this predicted to rise to a third over the next year.

This change can be attributed to M2M playing a greater role in determining a company's competitive advantage and customers' experience, moving beyond the IT department and increasingly being used for operations such as analytics and the integration of services with third parties.

Furthermore, IT leaders are more likely to see M2M technology as an IT project (56 per cent), with CEOs (33 per cent) and strategy (42 per cent) more likely to categorise it under innovation'. Those responsible for finance were most likely to call M2M a business development' function.

Erik Brenneis, Vodafone group director of M2M, said: "He who pays for M2M is changing. Traditionally, the CIO has been the guy who's been buying M2M because it's perceived to be a technology purchase. It's all about hardware and bits of wire.

"As it becomes much more operational, we're seeing other people take control of that buying decision. CIOs are still the execution arm, but the chief executive, strategy and marketing people are all getting involved."

Even among IT leaders, 33 per cent believe M2M is about "improving processes, not buying technology," with 30 per cent of CEOs siding with this view.

"Two or three years ago, there was really nothing of this," Brenneis added. "We hardly knew the CEOs back then, it's a huge change."

The shift is also apparent in the way these projects are funded, the report explains, with less than half (46 per cent) of M2M projects funded through the IT budget.

Instead, 42 per cent are funded by the departments who will be benefitting from the technology.

Brenneis added: "The Internet of Things is transforming more businesses faster than ever before. M2M technologies have as big an impact on how companies operate as the arrival of the desktop computer a generation ago, greatly enhancing productivity and competitiveness while opening up whole new fields of engineering innovation."

Other key findings of the study include increased investment from early adopters, with 81 per cent using M2M more than they did the previous year, and the rate of adoption for businesses using the technology to increase productivity up 23 per cent year on year.

"Companies are not just using M2M to optimise internal business processes like filling up a vending machine or saving fuel through fleet management, but they're also using it to offer new things to their customers and for advertisement. How people are using M2M and why has evolved tremendously," Brenneis said.

Inside the Enterprise: Predicting the future is always fraught with risk, and in a fast-moving industry such as technology, it approaches the foolhardy.

But looking back over 2013 does give us some clues as to the direction of technology in business, for 2014 and beyond.

In the headlines at least, this year was dominated by security and privacy on the one hand, and IT failure on the other.

On privacy, the revelations of NSA whistle blower Edward Snowdonshone a light on surveillance practices at that US security agency and beyond: the UK's GCHQ was implicated too in a story that ranged from the mass surveillance of internet traffic to the tapping of the German Chancellor's mobile phone.

Whilst governments rushed to justify their actions or to claim outrage the UK government faced its own travails. In November, the Public Accounts Committee predicted that the Department for Work and Pensions would face writing off up to 140 million. Some estimates say the figure could be even higher. The department had already admitted writing off 34 million back in September.

The Government, though, was not alone in suffering IT problems. RBS Group, owners of the NatWest and RBS banking brands, suffered a series of outages, including one on "Black Friday", one of the year's key shopping days. RBS' chief executive admitted that years of underinvestment in IT contributed to the problems.

RBS' problems highlight an issue that is affecting more and more businesses: the growing complexity of IT. Even with IT budgets starting to recover, companies are struggling to move money from operations to strategic investment. The ideal ratio of a 50:50 split between investment and maintenanceremains a long way off for many if not most firms.

Shifting that ratio will mean not just spending more, but looking again at how IT budgets are spent. Increasingly, that will mean automation.

Automation is already helping, in the form of intelligent network management and IT services management tools that can monitor the performance of applications, and the use of resources. Much of this is being driven by cloud computing suppliers, whose large networks and data centres are too big to be run by human technicians working on a "break-fix" basis.

Business-facing cloud services are employing automation, too, to allow non-technical staff to configure servers or indeed, a technician to manage a large number of cloud-based systems from a single PC or even a tablet. And IT vendors are starting to introduce pre-configured and pre-tested configurations of large systems, including software and hardware, which CIOs should be able to run with little in the way of set up.

But the two areas where automation looks set to be essential, in 2014 and beyond, are security and communications.

Mobile industry types have predicted the growth of machine to machine communications for years. And with Mobile World Congress just over a month away, vendors will be setting out their stores again.

This time, though, the growth in low-cost sensors, and more applications that make use of them, suggest that the Internet of Things could be much closer to reality.

Applications from smart buildings, to industrial plant and machinery, connected cars, and surveillance (the CCTV, not the Snowdon kind) rely on M2M. So to do supply chains and logistics. Smart systems are giving way to the idea of the smart, connected, or instrumented business.

Not only does this create vast amounts of data, it needs intelligent systems to make sense of it all, and turn the stream of event information into business decisions.

The other area where automation is not just useful, but essential, is security. The security predictions for 2014 are too numerous to list, but it is sufficient to say that hardly anyone predicts fewer threats.

In fact, the volume of threats and breaches is such that security teams are struggling to keep up. There is simply too much information for the human brain to process.

Automating security systems to improve monitoring and so detection of cyber attacks will be a key part of security spending in 2014 and a key area for IT investment.

It is one area where spending now will save money later.

Have a safe and prosperous 2014.

Stephen Pritchard is a contributing editor at IT Pro.

Business and tech decision makers need to keep tabs on 15 technology areas, including smart products, advanced collaboration and communication, advanced analytics and software defined infrastructure, that are expected to become more prominent between now and 2018.

So claims analyst firm Forrester Research, which has flagged the technologies as part of its Top Emerging Technologies to Watch report.

We went a level deeper in our research looking for future disruption

"Emerging digital technologies are a primary driver of business evolution and disruption. Firms are grappling with an accelerating pace of business change while also trying to make IT simpler and more cost effective. Amid these forces, savvy enterprise architects, IT strategists, and business technology leaders are constantly peering into the future to recognise the next big technology thing in time to make good investment decisions," Forrester claimed in a teaser for the report.

"This report identifies the top 15 emerging technologies you need to start watching now, as they will have big impacts by 2018."

Normally, the report only looks two years ahead and focuses primarily on what the company terms the big four' cloud, mobile, social and data.

Instead, this year's four groups are end user computing, sensors and remote computing, process data management, and infrastructure and application platforms.

Brian Hopkins, principal analyst serving enterprise architecture professionals at Forrester, explained in a blog post that the company made the decision due to the sheer pace of change.

"We went a level deeper in our research by examining how today's hot technology create platforms for future disruption.

"For example, you won't find mobile in our list; instead mobile is built into emerging technologies such as next-generation devices and UIs, advanced collaboration and communication, systems of engagement, and cloud application frameworks," Hopkins said.

Forrester's top 15

End user computing technologies

Next generation devices and UIs

Advanced collaboration and communication

Systems of engagement

Sensors and remote computing technologies

Smart products

In-location positioning

Machine-to-machine networks

Process data management technologies

Smart process application and semantics

Advanced analytics

Pervasive BI

Process and data cloud services

Infrastructure and application platforms

Big data platforms

Breakthrough storage and compute

Software-defined infrastructure

New identity and trust models

Vodafone has teamed up with Boston Scientific Corporation to enable doctors and nurses to access vital patient information remotely through the use of intelligent machine-to-machine (M2M) technology.

The new mobile technologies will empower both doctors and patients, enhancing quality of care while reducing costs and inefficiency.

By jointly developing new mobile health monitoring solutions, the patient and care-giving experiences can be significantly enhanced. Specifically, the partnership will create new technology that will provide doctors with real-time information about patients' cardiac health and vital signs remotely.

Vodaphone's M2M technology will enable patients to contact doctors and send them health information via mobile devices. Patients can receive their doctors' medical guidance without ever having to leave their home, freeing up vital hospital beds for others in need of healthcare services.

The new system is expected to significantly increase the speed at which doctors can respond to early warnings of deterioration in their patients' cardiac systems.

"With long patient lists and busy schedules, doctors are always looking for solutions that improve patient care while driving clinical efficiencies," said Michael Onuscheck, Boston Scientific's senior vice president and president of Europe, the Middle East and Africa (EMEA).

"Our collaboration with Vodafone allows us to use their mobile expertise and provide wireless remote patient monitoring services that appeal to both patients and healthcare providers."

Vodafone's M2M technology connects machines wirelessly via the web enabling them to deliver services and information without human intervention. Through the use of M2M technology, common devices become more intelligent and functional providing a better customer experience in a number of sectors, including healthcare.

"The mobile internet has already transformed how people work, share their lives with friends and family and learn about the world around them," said Nick Jeffrey, chief executive of Vodafone's global enterprise arm.

He added: "Wireless communications are now also set to change how we stay healthy and recover from illness. The new mobile technologies will empower both doctors and patients, enhancing quality of care while reducing costs and inefficiency."

As many as one billion mobile phone subscribers could actually be machines in 2015, according to industry predictions.

Machine to machine connections (M2M) are growing rapidly. And, whist 3G and soon 4G networks will carry the bulk of voice and data communications, especially from smartphones, the older GSM networks are expected to serve more and more M2M connections.

The estimate, from mobile network equipment vendor Nokia Siemens Networks, comes as 4G networks are being rolled out across Europe, Asia and the Americas. Moves such as the UK's digital TV switchover, set for completion in 2012, will free up radio capacity for high-speed mobile networks, including LTE and WiMax.

But the volumes of data created by machine to machine communications are relatively small, Nokia Siemens Networks suggested. A typical M2M connection can generate as little as 1MB of data a month, which is well within the capabilities of the older GSM networks. GSM, for its part, still offers wider network coverage than even 3G, and especially new 4G networks.

M2M technology is being used in a wide range of devices and applications, where equipment and machinery needs to communicate with a network or back office computer system. Examples include smart metering for power, vehicle monitoring for transport fleets, and health care equipment. It is even being used to monitor vending machines at sports venues.

But even though the volumes of data involved are not large, Nokia Siemens Networks expects the rapid growth of M2M will put some pressure on GSM networks. As a result, the company has developed new software that, it claims, will reduce the signaling load on networks by as much as 70 per cent.

Businesses using M2M include iMetrik, a Canadian start using the technology for vehicle tracking, and Yutong Bus, a Chinese manufacturer. Irish wind farm operator Servusnet is using M2M to improve the efficiency of wind turbine operations.

However, Juniper Research, the analyst firm, calculates that M2M still accounts for under 10 per cent of operator revenues.