With everything from door locks and home security cameras to wall clocks and microwaves being connected to the internet these days, cybercriminals are increasingly targeting smart devices, researchers at Kaspersky Lab warn.
As you can see in the chart above—which shows the number of malware samples for internet of things (IoT) devices Kaspersy Lab has collected since 2016—the security firm has discovered 121,588 samples attacking smart devices in the first half of 2018 alone. That's three times as many as it found in all of 2017, and it follows a tenfold increase in samples from 2016 to 2017.
"Smart devices are on the rise… yet manufacturers still don't prioritize security: there are no reminders to change the default password during initial setup or notifications about the release of new firmware versions, and the updating process itself can be complex for the average user," Kaspersky Lab's Mikhail Kuzin, Yaroslav Shmelev, Vladimir Kuskov wrote in a blog post last week. "This makes IoT devices a prime target for cybercriminals. Easier to infect than PCs, they often play an important role in the home infrastructure: some manage internet traffic, others shoot video footage, still others control domestic devices (for example, air conditioning)."
Most IoT malware is still meant to hook smart devices into a botnet that can be used to carry out distributed denial of service (DDoS) attacks. But the researchers say malware's targeting of smart devices is getting more sophisticated as well as prevalent.
"More and more exploits are being weaponized by cybercriminals, and infected devices are used to steal personal data and mine cryptocurrencies, on top of traditional DDoS attacks," they wrote.
To lessen the risk of infection, Kaspersky Lab says, users should not allow their smart devices to be accessed from an external network "unless absolutely necessary." The company also recommends periodically rebooting devices to remove malware that has been installed on them, regularly checking for and installing new firmware, and using complex passwords. Also be sure to change the factory password when you set up a new device and close or block unused ports, if that's an option.