The hacked toilet's lid could be opened and closed remotely, or its bidet function suddenly turned on, leading to "discomfort or distress to user." The unsecure refrigerator allows hackers into the same network as a person's computer, which they used to send spam. Even a poorly secured internet-connected HVAC system can lead to disaster—that was the portal through which hackers gained access to tons of customer data at Target.
These are the kinds of vulnerabilities opened up by the Internet of Things. There are currently more than 10 billion internet-connected devices, and that number will only rise as more connected appliances, fitness trackers, and other devices enter the market. And anything that is connected can also be hacked. During a two-week long stretch at the end of December and the beginning of January, hackers tapped into smart TVs, at least one refrigerator, and routers to send out spam. That two-week long attack is considered one of the first Internet of Things hacks, and it's a sign of things to come.
The smart home, for instance, now includes connected thermostats, lightbulbs, refrigerators, toasters, and even deadbolt locks. While it's exciting to be able to unlock your front door remotely to let a friend in, it's also dangerous: If the lock is connected to the same router your refrigerator uses, and if your refrigerator has lax security, hackers can enter through that weak point and get to everything else on the network—including the lock.
To find that lock, and anything else that's connected to the Internet, hackers need only head to Shodan, a search engine of sorts where one can find networked items—computers, phones, baby monitors, and anything else with an IP address. A search for "default password," for instance, pulls up a list of devices that use something like "admin" for the username and "password" for the password—devices that are the easiest to gain access to. While most people know to change the "change me" style of default password that comes with a new online account, they're probably less apt to remember that they need to do the same with their refrigerator or microwave.
It's not only the networks that are vulnerable—it's the things themselves. Hardware in many internet-connected items is versatile and can be coded to do all sorts of tasks. That versatility makes these things especially useful for hackers, who can then run whatever program they'd like. And after they've hacked in, it may be hard to tell until long after the damage is done. Lightbulbs, for instance, don't have interfaces, and the mobile apps used to control them are so limited in function to regular PCs that they wouldn't necessarily show signs of trouble (whereas a PC might) unless the hackers have hacked in just to remotely turn off the lights. What's more likely is they've hacked in to gain access to the network to which the lightbulbs are connected.
To make matters worse, once something is hacked, it's difficult for manufacturers to send out software patches, says Tao Zhang, an engineer for Cisco Corporate's Technology Group. That's because much of the firmware and software run by internet-connected things is out of date in the first place. "Therefore, hackers often need to do less to hack into things like smart TVs or internet-enabled refrigerators than our personal computers and smartphones," he says.
We're not doomed, but hacks will continues. And so will good old-fashioned errors, like Heartbleed, the mistake that exposed hundreds of sites' user data earlier this week. With both kinds of hacks, the key is vigilance: Be vigilant about making good passwords in the first place, and be vigilant about changing them every so often and especially after there's been a data breach (though with Heartbleed, it was best to wait a few days to make sure sites had time to patch the problem). It may feel silly giving your refrigerator a password more complicated than "password," but it's worth it.