ZIEN
As the Internet of Things (IoT) device boom continues to integrate network capabilities into various electronic products, including home appliances, there are growing calls for national-level security mandates. Experts warn that as IoT technology proliferates and the market expands, related criminal activities are also on the rise.
ZIEN, a company specializing in XIoT (eXtended IoT) convergence security, emphasized the need for national-level IoT security discussions during their participation in the IoT section of the recent 'DEF CON' conference, the company announced on the 23rd. ZIEN is known for developing 'Z-IoT', a solution that automatically checks and identifies vulnerabilities in software and firmware embedded in IoT devices, using their patented technology.
DEF CON, often referred to as the "Hacker Olympics" among white hat hackers, is the world's largest hacking and information security conference. At the event, ZIEN highlighted the necessity of firmware vulnerability checks in IoT devices, presenting on the topic of "Custom Protocol Analysis and Vulnerability Exploration in Dashcams".
The research team from ZIEN presented findings on "security vulnerabilities in publicly available firmware files in web and mobile environments" and "risks of hackers gaining administrative privileges". They emphasized that these vulnerabilities could seriously compromise the overall security of IoT devices. The company stressed that firmware vulnerability checks are essential during the development phase, as addressing such issues in IoT devices after deployment is particularly challenging.
A real-world example underscores these concerns. In December 2022, a security expert successfully attacked wall pad cameras in approximately 400,000 households. Between August and November 2021, he hacked into 638 apartment complexes, attempting to sell photos and videos of private interiors on overseas websites before being caught.
According to the "2023 Second Half Cybersecurity Incident Status" report by the Korea Internet & Security Agency (KISA), there were about 1,800 attempts of malware infections and DDoS attacks on IP camera DVR products. This data covers a four-month period from September to mid-December 2023 in South Korea alone. Globally, IoT device attacks reached 112.3 million cases in 2022.
Despite the increasing instances of IoT device hacking, including cases where private lives are exposed on the web, awareness of IoT device security remains low in South Korea.
In light of these concerns, ZIEN points out that while foreign governments are strengthening security regulations, South Korea should also implement minimum mandatory regulations to prevent potential loss of life due to IoT security vulnerabilities. The company emphasized the need for support and policy implementation regarding domestic security regulations.
Major countries such as the United States, United Kingdom, and the European Union have been strengthening IoT security through regulations, including mandating IoT device security measures since 2018. Notably, the U.S. and EU have stressed the need for government efforts to implement common IoT cybersecurity labeling. The UK, in April, mandated enhanced security for IoT devices through an amendment to the Product Security and Telecommunications Infrastructure (PSTI) Act.
Youngmin Cho, CEO of ZIEN, stated, "Major countries worldwide are assigning responsibility to manufacturers by mandating IoT device security. Considering the current rate of IoT device adoption, it's necessary to mandate IoT device security at the national level through policies and legislative amendments."
Meanwhile, ZIEN is set to unveil 'Z-GRC', an AI-based security certification automation platform, in October. The company is currently working on a project aimed at implementing a secure IoT ecosystem through automated preliminary risk checks. This includes differentiated IoT security certification checks for enterprises and devices, multi-faceted analysis and understanding of advanced security technologies, and compliance with domestic and international regulations.
Source : TECH M