Guess Who's Listening?

Billions of devices are now connected to the internet. Will hackers turn them against us?

- Adam Piore

In 2009, just as consumers had begun to buy wifi-enabled thermostats and front-door cams and other early devices that now make up the “Internet of Things,” computer scientist Ang Cui had gotten the idea to scan the Web for “trivially vulnerable” embedded devices.

By trivial, he meant those devices that still carried the usernames and passcodes programmed into them at the factory—obvious usernames like “name” and passcodes like “1234.” Many of these codes were published in manuals available freely on the internet and easily scanned automatically with computer programs, so there was no need even to guess.

When he did his scan, Cui found more than one million vulnerable, publicly accessible devices in 144 countries. From this sample, he estimated that about 13 percent of all devices connected to the internet were essentially unlocked doors, waiting for a hacker to walk through. Even more alarming, four months later 96 percent of those devices had the same security holes.

Cui’s warning was no less terrifying for its deadpan delivery: “Widely deployed and often misconfigured, embedded network devices constitute highly attractive targets for exploitation.”