Dangers Of The Internet Of Things In The Home - Phoebe

Internet of Things. So, Amazon Alexa, Google Home, you know, smart capital, smart lamps. In your home, how much would you take rate the risk of IoT in a probably fall into one of two camps? Either you avoid IoT like the plate or you sort of accepted the risk. How much do they care about your data? Probably got an Amazon Alexa that wakes you up with a smart lamp. the kettle comes on and then in the evening it turns the TV on. But regardless which camp you fall into, I think it's important to talk about the risks that IoT presents at home. Um, and I did my EPQ on the internet of things. So, it's still an interest that

that I still have to stay. And I won't even go into the whole other ballpark of now in smart cities, but I think it's really important regardless of what country into to consider the the the threats of having them in the home. hopefully and click on to the next slide. So, a little bit about me quickly. So, this is a picture of me at the National Cyber Awards in 2023. This is um this is my EU um which I wrote on um the IoT in the home and since then I've now done degree apprentichips. I'm in my third of four years um at PWC doing a degree apprentichip. So I'm working not actually in cyber security but in data

analytics with mergers and acquisitions but to dabble in cyber security and scratch their itch. I co-ounded cyber women at Birmingham. So I've been involved in the cyber women community. So that's given me the opportunity to speak at conferences like Bristol and B cyber and um besides Birmingham earlier this year those two talks more about the theme um and the the field of cyber security but today is my sort of deep debut talking about topic that I'm interested in. So a little bit more technical maybe for me so hopefully it's something I can interest you all as well and I just want to now talk about my VQ. So the title formally was what is the

most serious threat posed by it in the home and then when I did my research I found how how do I measure what a serious threat is? So I came up with a pretty little metric which I put in my report. So it was a 5,000 word essay and then a 10-minute presentation sort of like this one talking about my findings. So I thought a serious threat be quantified by how easy it is to do uh the impact of it how often it occurs and can even be stopped and then I found that everything I researched could be put into two categories. So either physical security so this would be malware DOS attacks key loggers

inference attacks and IoT facilitated domestic abuse and privacy. So this would be things like insecure manufacturer devices in particular medical devices like Fitbits and things like that. Um and insecure devices. So you can find them on show which if you don't know like an internet explorer browser for um internet connected devices. So pretty scary but you just see CCT footage if it's not secure default passwords a lack of privacy settings. And then overall I found that the the things that came out top that part of my metric were hardest to stop or easiest to use or had the most impact were insecure devices, careless manufacturing devices, a lack of privacy settings and out on top which shocked me

that it didn't seem that technical was IoT facilitated domestic use. Um, and that's because go back to my previous metric is because it's it just can't really stop because the authorized users are doing the abuse of the devices. So, they're already on the system as expected as planned and they're they're doing abuse. So, I found a definition cuz it's a bit how do you quantify what domestic abuse with IoT is? So according to California law review, this is when IoT devices are used by intimate partners or family members to control, manipulate, isolate the victim in a pattern of coercion and control. And I want to actually go into this a little bit because it's quite shocking

actually. It's more prevalent than we think. Um 15% of domestic violence cases that ever reported lead to action by the police. And then I found a statistic in Australia that 99% of support workers report working with techilitated domestic use cases and with 30 billion IoT devices expected by 2030 it shows that this is becoming the default attack vector for domestic use and it's only going to become more prevalent unless we do something about it. So Ring cameras I had no idea until I researched this that Amazon own Ring. So you think okay quite a reputable company they can't do anything wrong with their privacy and security wrong. So actually between 2017 and 2019 every single employee at Ring could

access any single customer's CCTV footage and door Ring doorbells expanded beyond the doorbell market as well. They started doing CCTV so in the home outside the home people could see inside people's houses. Do you think this is a massive problem? Anyone at Ring can see any room of any customer. And not only that, Ring did not encrypt any of their footage. So, and people could hack in and see this footage. So, people live stream inside people's houses. And these cameras have speakers. So, people were were shot out racial slurs and death threats to customers. Ring was then sued finally in 2023. So, 5 years later, $5.8 $8 billion million and 117,000 customers were affected by this. So quite

shocking. You think well if Ring can't even secure their privacy and security how can the cheapest one off when you search price low to high secure their security cameras. So it's just something to think about and then voyerisms on the rise as well. So this article is from this year and it's uh quite a shocking story. So, someone was struggling financially. So, she um she asked a family friend, her half sister's uncle, she moved in um cuz he had a spare room that she could stay in. She saw in the bathroom when she moved in something strange, but thought nothing of it. But eventually, she reported police and found out that it was a microphone and

camera. So, her half sister had been spying on her the whole time. Not only that, when the police looked into it more, found that he had been looking and spying on family members for over a decade. And it's not uncommon, it's been found in Airbnbs, rented accommodation, landlords through smoke alarms, mirrors, uh, air fresheners. Um, and they're very easy to get as well. You just search spy gadget, and they're seen as security gadgets, and they're very easy to get your hands on, and yet very difficult to stop. And now the scary bit. So again, the IOT facilitated message abuse. This came out on top in my research of APQ. Um, and found on the parliamentaries committee's

website. Um, a quite sad story. Um, and it was anonymized, but I'll call the victim her. So, she was being abused at home. So, she thought, "Okay, well, I'll put some smart cameras in a smart doorbell so I can record this abuse and and I can report my abuser." But her abuser hacked into her devices. He took control of Wi-Fi and told her that she was too stupid to understand the technology. And if any of you have IoT in your homes, then you set up smart devices through Wi-Fi. So he was able to bypass the two factor authentication that she sorted out on these devices and he had control of the IoT in the home.

This meant that he was able to now listen in on her conversations, watch her throughout the house. And the most shocking part of this was that he deleted any of the incriminating evidence of him abusing her. So she then wanted to report it or look back at the videos. He couldn't she couldn't find any videos of the abuse cuz he deleted it all. Um but she did reach out to Refuge um which is a charity and they helped her to discover the surveillance that he was doing on her and plan her escape. But when the police then got involved, they didn't acknowledge the tech abuse. They saw it as a homicide risk and even suggested to her that she

reinstalls the door camera to protect herself which is just shocking. That's the whole problem that she faced. He hacked and controlled all the smart cameras that she put in to protect herself. And I saw a really sad part at the end of um her her case which was that she still to this day feels like someone's watching her in her own home on secret canvas somewhere. So are there enough protections in this? The answer is no, but we may be getting there. So, the online safety act in 2023 was used as a bit of a catchall uh for for online safety that you know maybe everything's sort mentioned very much more about smart devices in the home. Then the criminal

justice bill of 2024 which I don't think is happening anymore that didn't cover enough about tech abuse either. So, it mentioned a bit about tech abuse in the home but only about deep. So nothing about the smart cameras and air fresheners. Nothing about voyerism and only now in the crime of policing bill 2025. Is there finally some movement? So it's going to be illegal to doesn't share any pictures of people doing internet acts or anything secret. But also to finally record it. So putting an air freshener which has a secret camera in and recording will finally be illegal which is is a good move. But we still got places to go. And um I also looked into

research from the gender and tech research lab at UCL and they found that we need to have a consistent definition of violence against women and girls and a consistent definition of what abuse is um to move forward and force against this. So now I want to ask you again how big do you think or how would you rate the risk of biot in the home? Uh because these case studies show it's not just hackers that are able to get in with you know uh this configured TS or UDP. It's ex partners that still know the the password or baby monitor or it's ex-housemates that still have your Wi-Fi password that can get in and they can

they can see into your footage. A camera can show so much about your life. So, I think it's really important when you're bringing in cameras into your home, IoT into your home, uh, how would you spot the signs of something's going wrong and what risk does it bring to you? Um, not all IT is bad. So, for example, the Polygaza Trust is something which you can install on your phone. So, this is uses IoT for good. So, if you're in an emergency situation, it uses sensors in your GPS and your phone to to report to your family members uh if you're in trouble. And then there's Refuge, which helped Hannah in that um case study. The

National Stalking Helpline, the Cyber Helpline, which you can volunteer at. They don't specifically do tech use, but is is a great way to help out if you have those cyber security skills. And that is actually all from me today. So um any questions let me know. I hope I've inspired you brought some awareness into this topic and love to chat about it or anything in general. Thank you.

>> You have any questions? >> Yes. Um, so my parents for some inexplicable reason decided to get a fridge that has like camera voice control. I think you can open it by using your voice as well. >> Okay. >> I will up for like buttons. So I'm not but >> are there ways to check it security or make sure it's not in like what advice would you give to just people who have this >> black mirror almost? Sure. Okay. So um I'd say if you're wanting to bring IoT into your home to look for certified reputable companies. So it's a bit like what I was saying. Don't just look for the cheapest one off Amazon. Maybe look for the one that have

that guarantee. look for ones where on the internet you can find their privacy settings and you can change your default path but it's not fixed set in stone. Um yeah so I I would have a look to see if the model online has privacy settings but if not I think you have firewalls on your home network which is quite easy to do some tutorials and create a separate subet as well so that your IoT are not connected to the rest of your home. Um I hope that helps. Yeah, >> great presentation thoughts on things that are internet connected are unnecessary. So things like washing machine that's connected to Wi-Fi just go downstairs. >> Yeah. Necessary.

>> Necessary. >> You know, because you have to have your washing out so it doesn't smell. So you put it in before you leave for the day and then on your way home work you go >> wash my kettle kettle >> when you are upstairs.

>> I understand the kettle. >> I've never I've never thought of the smart washing machine before. I see you have children for you. Nothing to do. Um, I think there's no point making intercon connected where it's not necessary. But I guess there's there's a good case for it if it saves time, but I'd maybe look for ones that maybe have the security controls in place or you there's manual where you can actually configure it so it's not collecting a single bit of data about um Yeah. >> Yeah. Um so as you were saying when the when the police investigated this this case they sort of overlooked didn't investigate the tech side in your research you've done

>> you is there sort of a shift towards the sort of like more like standard police officer getting a better understanding of this or they or are they not yet implementing any training for because you would you would think based on a case like that >> it would be quite important and it's sort basic common sense they should have they should have this knowledge in there, but have you noticed you've been looking at any movement towards that from the police society? >> I wouldn't necessarily say I've looked into how police have been trained specifically. I would say there's still a lot that needs to be done cuz I think these are quite recent cases where this

is going wrong. So, um I think policy is moving forwards and I don't honestly know how this is going on. Um but I'd say more still needs to be done. Um because it seems like it's still quite >> what on the medical side I got like case for example how would you look at something like that especially when you've got say doctors you expect security as well as the medical side. >> Okay. Um, I suppose this is something that I looked into a few years ago, so maybe I haven't looked into it as much more recently. Um, so in terms of making sure they're safe and they can't fail you. Um, that's a difficult one, I suppose.

>> I just had experience. >> So I had a internet connection. I no longer but I had a spinal stimulator. My original one uh was electronic so you just scanned it and then you turn it up. Um then I got a Johnny 5 upgrade and it came connected where I could connect it from my phone. Um and I hacked into it within 20 minutes with some help. With some help with some help. Um, we it took us 20 minutes and all all we could do was get my serial number where it was positioned and we could turn it up and down. Now, my advice wasn't life like it would just be like this, which is quite fun actually,

but however, there was absolutely no security given. There was no security responsibility. There was It wasn't even a conversation until I brought it up. Hospital said you straight to manufacturer. They accept no responsibility. It's all to do with the manufacturer and the manufacturer says, "Oh, it's all to do with hospital and the patient. >> There is no responsibility accepted when it comes to medical devices. >> How social care there is a pervasive supply chain problem. there more needs to that there needs to be more conversation happening around this ownership and because especially NDK the NHS um outsources quite a lot of services to um private companies to like private manufacturers that it seems to be

overlooked that there be risks introduced that just account you need to delegate some take ownership that >> there's your answer. >> And at that point, I'm sorry, I'm going to have to stop. I'm really sorry. Please do more conversations. Please come find me. But thank you very much.