{"id":37593,"date":"2019-02-20T08:26:21","date_gmt":"2019-02-20T07:26:21","guid":{"rendered":"http:\/\/modern-wilderness.flywheelsites.com\/?p=37593"},"modified":"2019-02-25T08:24:41","modified_gmt":"2019-02-25T07:24:41","slug":"smart-offices-be-aware-of-the-risks","status":"publish","type":"post","link":"https:\/\/officerepublic.news\/en\/2019\/02\/smart-offices-be-aware-of-the-risks\/","title":{"rendered":"Smart Offices: Be aware of the risks"},"content":{"rendered":"\n

More than 50 years ago, the\nCIA, in collaboration with a Dutch specialist in radio waves, tried to bug the\nRussian embassy using office furniture. This was in retaliation to the tapping\nof the US Embassy in Moscow. At that time, the technology used was\nrevolutionary. Nowadays, we allow our office furniture to be totally  connected to the internet. What are the risks\nof the ‘connected office<\/strong>‘?<\/p>\n\n\n\n

In 1952, the American Government discovered that their embassy in Moscow was being tapped using an unknown technique. The listening device was hidden in the eagle donated by Russia, which was hanging in the ambassador’s office. The CIA was not able to reproduce the technique itself, and turned instead to a small Dutch company on the North Sea coast that specialized in radio waves and technology. An intensive collaboration developed , which resulted among other things in the successful placement of test equipment in the leg of the Russian ambassador\u2019s new office desk  in The Hague. \u2018Operation Easy Chair<\/em>\u2019 was the start  of many later espionage techniques.<\/p>\n\n\n\n

Today,  it seems that no complicated operations need to be planned in order to gain access to company-sensitive information. Worldwide, offices are increasingly provided with ‘intelligent’ solutions and packed with sensors  connected to the internet. The NSA recently warned in an article<\/a> of the risks of the connected office.<\/p>\n\n\n\n

\"\"
(C) NSA<\/figcaption><\/figure>\n\n\n\n

The NSA report said: “Connected devices\nprovide more entry points for adversaries to attack and while we enjoy\npersonalized care from everyday items such as our office furniture, we might be\nunknowingly giving our adversaries more sensitive information than we intend.<\/em>\n“<\/p>\n\n\n\n

Hacking IoT devices a real threat<\/h3>\n\n\n\n

The NSA report comes in a time whenthe public\nhas hardly ever heard of hacking IoT, other than some large scale attacks, but\nwhere professionals are already seeing some developments which, 10 years\u2019\nago,  no-one ever imagined could happen.  Darktrace is one of the companies trying to\nprevent attacks on IoT-networks <\/p>\n\n\n\n

Nicole Eagan, CEO of Darktrace said about a\nyear ago \u201c”There are many internet-of-things devices, everything from\nthermostats, refrigeration systems, HVAC systems, to people who bring in their\nAlexa devices into the offices. There’s just a lot of IoT. It expands the\nattack surface, and most of this isn’t covered by traditional defences.<\/em>“<\/p>\n\n\n\n

She continued, citing an example of hacking\ncompanies in a way nobody thought of before: \u201cThey hacked a casino through\nits internet-connected thermometer in an aquarium in the lobby of the casino.\nThe hackers exploited a vulnerability in the thermostat to get a foothold in\nthe network. Once there, they managed to access the high-roller database of\ngamblers and then pulled it back across the network, out the thermostat, and up\nto the cloud.\u201d<\/em><\/p>\n\n\n\n

Hardware and software hacking<\/h3>\n\n\n\n

Today, everyone  is aware of phishing email and viruses posing a software-based threat. The possibility of using poorly developed hardware devices to get into a companies\u2019 networks is less known. It is even possible hackers use a backdoor in a sensor or other IoT device, that was built in by the manufacturer.<\/p>\n\n\n\n

A report issued by the USCC states in its summary \u201cChina\u2019s research into IoT security vulnerabilities and its growing civil-military cooperation raise concerns about gaining unauthorized access to IoT devices and sensitive data. In addition, China\u2019s authorized access to the IoT data of U.S. consumers will only grow as Chinese IoT companies leverage their advantages in production and cost to gain market share in the United States, based on the terms of use and sweeping Chinese Government data access powers<\/em>\u201d<\/p>\n\n\n\n

At the moment, almost everybody is aware of the tension between Canada, the USA and (parts of) Europe on the one hand and China on the other in the case of Huawei being blocked from 5G-network tenders in western countries.<\/p>\n\n\n\n

New solutions bring new entrance points<\/h3>\n\n\n\n

The development of the \u2018connected office\u2019\nwhether it is with lockers including an internet based management system, a\ndesk that has sensors for individual settings, or a meeting room with sensors\nfor occupation control, brings new hardware and software into your office that\ncould be used as entrance point for third parties you don\u2019t want in your\nsystems.<\/p>\n\n\n\n

David Jacoby<\/a>, Security Evangelist, European Research Center (Nordics) at Kaspersky Lab<\/a> adds \u201dAnything communicating with anything is a potential problem, it all depends on the implementation. Let\u2019s imagine you have an office chair, that doesn\u2019t do anything other than register things from the user, like weight, posture, time used on the chair etc. and then wirelessly communicates this with an PC or smartphone.<\/em><\/p>\n\n\n\n

Depending on how this device\ncommunicates with the PC or smartphone, different risks occur. If it\u2019s over\nWIFI, maybe the private keys are stored in the chair, and bad guys can extract\nthese keys via some vulnerability get access to the WIFI.<\/em><\/p>\n\n\n\n

Other risks could be that the\nimplementation in the chair and PC\/Mobile gets outdated and years later, a\nresearcher\/hacker finds a vulnerability in that implementation resulting in\nfurther attacks. Maybe you can use the chair to communicate with other devices\nwhich its not intended to do. If you can get 100 000 chairs to communicate with\nthe same machine, you have just created a DDoS attack\/botnet.\u201d<\/em><\/p>\n\n\n\n

David continues: \u201cIf its only sensors without control,\nyou have the same problems as the chairs. But if you also start adding\nadditional \u201clayers\u201d of functionality, such as controls, you might have many other\nscenarios. Let\u2019s say the attacker can force the fire extinguisher to go off, or\nchange the heating in the server rooms, the  threats grow with every layer you add<\/em> .\u201d<\/p>\n\n\n\n

Office furniture manufacturers recognize possible threat<\/h3>\n\n\n\n

Office Furniture manufacturers are in most cases aware of the threat of hacking the equipment they are selling. Steelcase <\/a>is the largest office furniture manufacturer in the world, and one of the trendsetters in the field of integration of IoT and furniture.  Stu Berman<\/a>, Information Security Architect at Steelcase agrees with the warning of the NSA : \u201cAny electronic device poses a potential threat to the network and other devices connected to it. The highest level of risk is putting a device on a sensitive network with no network controls between these cloud-connected devices and sensitive on-premises systems. There are various approaches to mitigate these risks through network isolation, through network behaviour anomaly monitoring, and network access and flow control tools.<\/em>\u201d<\/p>\n\n\n\n

Nick Butterfield<\/a> of Herman Miller<\/a> also acknowledges the possible threat: \u201cThis concern is something Herman Miller takes very seriously, and we always communicate information about this risk to our customers\u201d<\/em><\/p>\n\n\n\n

Gert-Jan de Kam<\/a> of the Dutch VDB Group<\/a>: \u201cAlmost all Smart Building solutions that we know use the Internet \/ ICT infrastructure of the user organization. Our solution \u201cIotspot\u201d is, as far as we know, the only solution that makes use of mobile internet connections and functions independently. This distinction is crucial because Smart Building solutions over the user’s infrastructure pose a much greater security risk<\/em>\u201d.<\/p>\n\n\n\n

‘Over 20.000 attacks on our IOT Cloud Platform’<\/h3>\n\n\n\n

Almost all approached manufacturers point out the differences between an IoT system that is integrated in the user’s network and a system that is separate from the user’s network. In the latter case, the risks are considerably lower than in the former. Nevertheless, Steelcase has experienced third parties attempting to gain access to Steelcase’s systems.<\/p>\n\n\n\n

Stu Berman of Steelcase : \u201cWhile we have not seen attacks that were able to penetrate the multiple levels of defense we have in place, we do monitor the attacks taking place. For instance in August 2018 we saw more than 20,000 attempts on our IOT cloud platform from around the world<\/a>. Many originated with an IP\u00a0address source in\u00a0China, followed by Germany and then US registered addresses. None of these attempts was successful.\u00a0\u201d<\/em><\/p>\n\n\n\n

Threats\nnot only online<\/h3>\n\n\n\n

Although one might think of an online hack in\nthe first place, the threat comes not only from hacking a WiFi network, or a\ncloud solution from one of the manufacturers. Ever thought of your locks?\nModern lockers in the workplace are often part of a lock management system, not\nonly managing the locks of lockers but also of the doors in the building your\noffice is located. Those locks are commonly operated with a card. The card\nsends a signal via NFC (Near Field Communication) and the lock identifies the\nowner of the card and grants access.<\/p>\n\n\n\n

Cards can be cloned using NFC technique. Cards can be cloned when they are in your wallet or bag by someone standing next to you in an elevator. Watch this movie with a proof of concept for security badges<\/p>\n\n\n\n

\n