# data[].attributes.headline
A Subtle intro to the Internet of Things

# data[].attributes.subject
A Subtle intro to the Internet of Things

# data[].attributes.attachment_link.readable_text
The Internet of Things (IoT) describes the network of physical objects-"things"-that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the internet. These devices range from ordinary household objects to sophisticated industrial tools. With more than 7 billion connected IoT devices today, experts are expecting this number to grow to 10 billion by 2020 and 22 billion by 2025. Oracle has a network of device partners.

Why is Internet of Things (IoT) so important?

Over the past few years, IoT has become one of the most important technologies of the 21st century. Now that we can connect everyday objects-kitchen appliances, cars, thermostats, baby monitors-to the internet via embedded devices, seamless communication is possible between people, processes, and things.

By means of low-cost computing, the cloud, big data, analytics, and mobile technologies, physical things can share and collect data with minimal human intervention. In this hyperconnected world, digital systems can record, monitor, and adjust each interaction between connected things. The physical world meets the digital world-and they cooperate.

What technologies have made IoT possible?

While the idea of IoT has been in existence for a long time, a collection of recent advances in a number of different technologies has made it practical.

Access to low-cost, low-power sensor technology. Affordable and reliable sensors are making IoT technology possible for more manufacturers.

Connectivity. A host of network protocols for the internet has made it easy to connect sensors to the cloud and to other "things" for efficient data transfer.

Cloud computing platforms. The increase in the availability of cloud platforms enables both businesses and consumers to access the infrastructure they need to scale up without actually having to manage it all.

Machine learning and analytics. With advances in machine learning and analytics, along with access to varied and vast amounts of data stored in the cloud, businesses can gather insights faster and more easily. The emergence of these allied technologies continues to push the boundaries of IoT and the data produced by IoT also feeds these technologies.

Conversational artificial intelligence (AI). Advances in neural networks have brought natural-language processing (NLP) to IoT devices (such as digital personal assistants Alexa, Cortana, and Siri) and made them appealing, affordable, and viable for home use.

What is industrial IoT?

Industrial IoT (IIoT) refers to the application of IoT technology in industrial settings, especially with respect to instrumentation and control of sensors and devices that engage cloud technologies. Refer to this Titan use case PDF for a good example of IIoT. Recently, industries have used machine-to-machine communication (M2M) to achieve wireless automation and control. But with the emergence of cloud and allied technologies (such as analytics and machine learning), industries can achieve a new automation layer and with it create new revenue and business models. IIoT is sometimes called the fourth wave of the industrial revolution, or Industry 4.0. The following are some common uses for IIoT:

Smart manufacturing

Connected assets and preventive and predictive maintenance

Smart power grids

Smart cities

Connected logistics

Smart digital supply chains

Unlock business value with IoT

As IoT becomes more widespread in the marketplace, companies are capitalizing on the tremendous business value it can offer. These benefits include:

Deriving data-driven insights from IoT data to help better manage the business

Increasing productivity and efficiency of business operations

Creating new business models and revenue streams

Easily and seamlessly connecting the physical business world to the digital world to drive quick time to value

What are IoT applications?

Business-ready, SaaS IoT Applications

IoT Intelligent Applications are prebuilt software-as-a-service (SaaS) applications that can analyze and present captured IoT sensor data to business users via dashboards. We have a full set of IoT Intelligent Applications.

IoT applications use machine learning algorithms to analyze massive amounts of connected sensor data in the cloud. Using real-time IoT dashboards and alerts, you gain visibility into key performance indicators, statistics for mean time between failures, and other information. Machine learning-based algorithms can identify equipment anomalies and send alerts to users and even trigger automated fixes or proactive counter measures.

With cloud-based IoT applications, business users can quickly enhance existing processes for supply chains, customer service, human resources, and financial services. There's no need to recreate entire business processes.

What are some ways IoT applications are deployed?

The ability of IoT to provide sensor information as well as enable device-to-device communication is driving a broad set of applications. The following are some of the most popular applications and what they do.

Create new efficiencies in manufacturing through machine monitoring and product-quality monitoring.

Machines can be continuously monitored and analyzed to make sure they are performing within required tolerances. Products can also be monitored in real time to identify and address quality defects.

Improve the tracking and "ring-fencing" of physical assets.

Tracking enables businesses to quickly determine asset location. Ring-fencing allows them to make sure that high-value assets are protected from theft and removal.

Use wearables to monitor human health analytics and environmental conditions.

IoT wearables enable people to better understand their own health and allow physicians to remotely monitor patients. This technology also enables companies to track the health and safety of their employees, which is especially useful for workers employed in hazardous conditions.

Drive efficiencies and new possibilities in existing processes.

One example of this is the use of IoT to increase efficiency and safety in connected logistics for fleet management. Companies can use IoT fleet monitoring to direct trucks, in real time, to improve efficiency.

Enable business process changes.

An example of this is the use of IoT devices for connected assets to monitor the health of remote machines and trigger service calls for preventive maintenance. The ability to remotely monitor machines is also enabling new product-as-a-service business models, where customers no longer need to buy a product but instead pay for its usage.

What industries can benefit from IoT?

Organizations best suited for IoT are those that would benefit from using sensor devices in their business processes.

Manufacturing

Manufacturers can gain a competitive advantage by using production-line monitoring to enable proactive maintenance on equipment when sensors detect an impending failure. Sensors can actually measure when production output is compromised. With the help of sensor alerts, manufacturers can quickly check equipment for accuracy or remove it from production until it is repaired. This allows companies to reduce operating costs, get better uptime, and improve asset performance management.

Automotive

The automotive industry stands to realize significant advantages from the use of IoT applications. In addition to the benefits of applying IoT to production lines, sensors can detect impending equipment failure in vehicles already on the road and can alert the driver with details and recommendations. Thanks to aggregated information gathered by IoT-based applications, automotive manufacturers and suppliers can learn more about how to keep cars running and car owners informed.

Transportation and Logistics

Transportation and logistical systems benefit from a variety of IoT applications. Fleets of cars, trucks, ships, and trains that carry inventory can be rerouted based on weather conditions, vehicle availability, or driver availability, thanks to IoT sensor data. The inventory itself could also be equipped with sensors for track-and-trace and temperature-control monitoring. The food and beverage, flower, and pharmaceutical industries often carry temperature-sensitive inventory that would benefit greatly from IoT monitoring applications that send alerts when temperatures rise or fall to a level that threatens the product.

Retail

IoT applications allow retail companies to manage inventory, improve customer experience, optimize supply chain, and reduce operational costs. For example, smart shelves fitted with weight sensors can collect RFID-based information and send the data to the IoT platform to automatically monitor inventory and trigger alerts if items are running low. Beacons can push targeted offers and promotions to customers to provide an engaging experience.

Public Sector

The benefits of IoT in the public sector and other service-related environments are similarly wide-ranging. For example, government-owned utilities can use IoT-based applications to notify their users of mass outages and even of smaller interruptions of water, power, or sewer services. IoT applications can collect data concerning the scope of an outage and deploy resources to help utilities recover from outages with greater speed.

Healthcare

IoT asset monitoring provides multiple benefits to the healthcare industry. Doctors, nurses, and orderlies often need to know the exact location of patient-assistance assets such as wheelchairs. When a hospital's wheelchairs are equipped with IoT sensors, they can be tracked from the IoT asset-monitoring application so that anyone looking for one can quickly find the nearest available wheelchair. Many hospital assets can be tracked this way to ensure proper usage as well as financial accounting for the physical assets in each department.

General Safety Across All Industries

In addition to tracking physical assets, IoT can be used to improve worker safety. Employees in hazardous environments such as mines, oil and gas fields, and chemical and power plants, for example, need to know about the occurrence of a hazardous event that might affect them. When they are connected to IoT sensor-based applications, they can be notified of accidents or rescued from them as swiftly as possible. IoT applications are also used for wearables that can monitor human health and environmental conditions. Not only do these types of applications help people better understand their own health, they also permit physicians to monitor patients remotely.

How is IoT changing the world? Take a look at connected cars.

IoT is reinventing the automobile by enabling connected cars. With IoT, car owners can operate their cars remotely-by, for example, preheating the car before the driver gets in it or by remotely summoning a car by phone. Given IoT's ability to enable device-to-device communication, cars will even be able to book their own service appointments when warranted.

The connected car allows car manufacturers or dealers to turn the car ownership model on its head. Previously, manufacturers have had an arms-length relationship with individual buyers (or none at all). Essentially, the manufacturer's relationship with the car ended once it was sent to the dealer. With connected cars, automobile makers or dealers can have a continuous relationship with their customers. Instead of selling cars, they can charge drivers usage fees, offering a "transportation-as-a-service" using autonomous cars. IoT allows manufacturers to upgrade their cars continuously with new software, a sea-change difference from the traditional model of car ownership in which vehicles immediately depreciate in performance and value.

Make the best business decisions with Oracle IoT

With Oracle Intelligent Applications, you can extend your supply chain, ERP, HR, and customer experience (CX) applications to the digital world. Leverage intelligent, predictive algorithms and digital twins to improve operational efficiency, boost worker productivity, enhance CX, and create new business models and opportunities.

# data[].attributes.attachment_link.description
Physical objects are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems, ranging from ordinary household objects to sophisticated industrial tools.

# data[].attributes.body
IoT security refers to the methods of protection used to secure internet-connected or network-based devices. The term IoT is incredibly broad, and with the technology continuing to evolve, the term has only become broader. From watches to thermostats to video game consoles, nearly every technological device has the ability to interact with the internet, or other devices, in some capacity.

# data[].attributes.body
IoT cybersecurity is the practice of protecting IoT devices and ecosystems from cyber threats. To counter these threats, there are tools that protect networks from data breaches, while identifying and monitoring risks that aim to reduce vulnerabilities.

# data[].attributes.attachment_link.readable_text
It's safe to say we love our smart devices. Over 24 billion active internet of things (IoT) and operational technology (OT) devices exist today, with billions more projected to exist by 2030. As individuals, we love how they make our lives more convenient and fun. We can get information in real-time, and stay in touch with each other. They're essential. Companies love smart IoT devices because they make it possible to stay connected to consumers and gather information.

Manufacturers, utility companies and supply chain organizations (such as automobile manufacturers, power companies and shipping companies) also love their IoT. This form of IoT, though, is referred to as operational technology (OT).

A term associated with OT is industrial control system (ICS). Industrial control systems include devices and networking capability that allows robots, wind turbines and container ships to operate efficiently. If an IoT device is used to control a physical system, such as an element in the power grid or a device on the factory floor, it is said to be an OT device.

The problem is, cybercriminals love IoT and OT devices, too. Maybe even more than we do. The major issue with IoT and ICS devices is that they make it possible for an individual or company to conduct new and different cyberattacks. Hackers will find malicious ways to interfere with the operations of a company, city or even country.

Cybersecurity professionals often refer to this fact by saying that IoT increases the attack surface that hackers can exploit. Security professionals know this and are the ones who help manage the resulting security risks.

The IoT/ICS Device

IoT and ICS devices are considered end points. In other words, they are devices at the end of a communications chain that starts with a person or robotics device, and ends in cloud platforms and data centers. IoT and ICS devices don't just appear out of thin air. They are designed, developed and managed, just like any other computer. Figure 1 provides an overview of the elements inside of a typical IoT device.

As shown in the graphic above, any IoT device has each of these elements inside:

Firmware: Read-only memory embedded in the device that provides low-level control of the hardware. It can be updated, but usually not programmed. Communicates between each of the elements in the device as well as other networked devices.

Protective services: A portion of the device's firmware or operating system that provides security functionality, including the ability to isolate processes so that they can't be used to defeat security, and encryption.

Motion sensors: The combined hardware and software used to track how the device is moved. Can include detection of simple movement (e.g., moving the device back and forth, or up and down), or satellite connectivity (e.g., Global Positioning System or GLONASS).

Microcontroller: The processor used to run the software and provide the "brains" of the unit.

Connectivity stack: Responsible for providing network connectivity. Networking capabilities can include Bluetooth, mobile (e.g., 3G, 4G, 5G), Zigbee, LoRA, SigFox or WiFi.

Authentication services: When included, provides the ability for the IoT device to verify and validate users, network traffic or processes.

Power management: If the device requires significant use of power, functionality that manages power usage, as well as the charging of the device.

Battery/power: The physical capability to store power, as well as receive power from a remote source.

Memory: The working "muscle" of the IoT device, in that it provides the ability to store working data, machine code and information that is then addressed by the processor.

Storage: Provides the ability to capture and keep data for relatively long periods of time. Such information can include storing the location(s) the IoT device wearer/operator took the device, information about other devices that have connected with it and information entered by the user. Such information can be added actively (e.g., by the user programming the IoT/OT device on purpose), or passively (e.g., the device capturing the motions and actions of the wearer/user).

It doesn't matter if that device is a webcam, the smartwatch or the Raspberry pi device your local water utility company developed to control devices for your community water supply, the elements remain the same.

The IoT Ecosystem

Someone needs to develop and maintain each of these elements in order for an IoT/ICS device to work properly and securely. In other words, developers and organizations need to make sure that they create quality hardware and software to run IoT/OT devices. Software and hardware developers work together closely - or sometimes, not so closely, as you'll see - to make sure that IoT and other computing devices work well with each other.

In fact, there's an entire IoT ecosystem that exists to create IoT solutions and manage devices. This ecosystem is composed of the elements found in Table 1.

Network connectivity

Service providers, local LANS and mobile networks (including 4G and 5G), are responsible for transporting data and keeping us connected.

Table 1: The IoT Ecosystem
What Are the Common Threats?

Many times, mistakes or omissions occur as developers create the IoT/ICS hardware and software. No one is perfect.

However, these mistakes can result in the following flaws:

Inadequate default settings: IoT devices that contain default settings may include default passwords and other settings that cannot be changed.

Non-existent upgrade paths: Sometimes, it is impossible to update the firmware or other information itself, making the device permanently toxic to healthy IoT networks.

The use of inappropriate technology: Many times, organizations will place powerful software onto an IoT device, even though such computing power is not necessary. For example, IoT manufacturers have placed complete Linux operating system on an IoT device, when only a portion was necessary. As a result, once the IoT device was compromised, it became a powerful weapon in the hands of an attacker.

IoT security is one of the major cybersecurity challenges today. Several challenges exist. IoT and OT devices can also provide a rich breeding ground for attackers who want to conduct Distributed Denial of Service (DDoS) attacks, such as through botnets.

A botnet is a large collection of devices that has fallen under the control of a centralized attacker, or group of attackers. A botnet can include tens of thousands, or even millions of devices. Attackers can use these botnets to wage DDoS attacks or introduce malware to new victims. Many of the security breaches that find their way into the news are the results of botnets.

IoT devices can also be used to introduce new forms of malware, which attackers then use to compromise more organizations. Service providers of all types, from cellular network providers to cloud providers and finance companies, continue to be concerned about these security risks.

Types of Cybersecurity Threats

IoT devices that are not properly developed or secured can result in the conditions found in Table 2.
Table 2: Types of Cybersecurity Threats
Notable IoT Attacks

As the number and intensity of IoT attacks increases, several notable attacks have been made public. Here are a few examples in Table 3.

Mirai botnet (Dyn attack)

In 2018, the Mirai botnet created such a large volume of garbage traffic (just over 1 Tbps) that much of the internet was inaccessible in various countries.

Table 3: Notable IT Attacks
The Future of IoT Cybersecurity

Enhance monitoring of devices: The use of an intrusion detection systems (IDS), as well as a security information and event management (SIEM) system can help - so can the practice of information sharing. Using cybersecurity threat intelligence (CTI), it is possible to profile attackers and more intelligently position security controls for IoT and ICS devices.

Add security features: Features such as functionality that encrypts all stored and transmitted data can help. Enhanced authentication schemes can also help control connections. Additionally, workers can learn how to better partition and segment IoT traffic so that it can be easily controlled and managed. This way, they can respond better to security breaches.

Follow IoT and ICS standards: The National Institute of Standards and Technology (NIST) has published many cybersecurity standards, including the Recommendations for IoT Device Manufacturers. It has also provided a helpful page that outlines theirCybersecurity for IoT Program.

Additional technological and personnel solutions do exist. Here are a few ways IT professionals can improve their security posture when it comes to IoT devices.
Interested in learning more about what it means to become a cybersecurity professional? The CompTIA Cybersecurity Career Pathway can help you identify the essential skills to manage and secure IoT and ICS/OT devices. Read more about Cybersecurity.
IoT and ICS/OT devices will be in our lives for the foreseeable future. It is up to cybersecurity professionals to make sure that these devices will continue to help us conduct business and enjoy life, rather than be a problem.

# data[].attributes.attachment_link.description
It's safe to say we love our smart devices. Over 24 billion active internet of things (IoT) and operational technology (OT) devices exist today, with billions more projected to exist by 2030. As individuals, we love how they make our lives more convenient and fun.

# data[].attributes.body
To increase the security of linked devices and the environments in which they are used, NIST's Cybersecurity for IoT initiative has developed and connected standards, guidelines, and related technologies. This initiative seeks to empower advancement on a global scale by collaborating with partners from across government, business, universal bodies, and academia. According to NIST, there are a number of possible approaches to IoT conformity assessments, including
(a) creating different assessments based on device type and function,
(b) letting industry lead the way in developing requirements and assessment approaches,
(c) designing assessments to allow for the flexibility required to meet market demand, and
(d) utilizing various conformity assessment strategies based on the risk associated with device type or environment.

To safeguard the privacy of persons, the security of data and the security of devices are NIST's three main objectives for IoT risk management. NIST is a commonly used framework for risk management and is ideal for preparing for catastrophe and recovery in areas where IoT technology is present.

# data[].attributes.headline
A Comprehensive Guide to establish IOT security.

# data[].attributes.subject
A Comprehensive Guide to establish IOT security.

# data[].attributes.body
By exploiting a firmware update vulnerability, they hijacked the vehicle over the Sprint cellular network and discovered they could make it speed up, slow down, and even veer off the road. Its proof of concept for the emerging Internet of Things (IoT) hacks: While companies often ignore the security of peripheral devices or networks, the consequences can be disastrous.”

# data[].attributes.attachment_link.readable_text
I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold.

Though I hadn't touched the dashboard, the vents in the Jeep Cherokee started blasting cold air at the maximum setting, chilling the sweat on my back through the in-seat climate control system. Next the radio switched to the local hip hop station and began blaring Skee-lo at full volume. I spun the control knob left and hit the power button, to no avail. Then the windshield wipers turned on, and wiper fluid blurred the glass.

As I tried to cope with all this, a picture of the two hackers performing these stunts appeared on the car's digital display: Charlie Miller and Chris Valasek, wearing their trademark track suits. A nice touch, I thought.

The Jeep's strange behavior wasn't entirely unexpected. I'd come to St. Louis to be Miller and Valasek's digital crash-test dummy, a willing subject on whom they could test the car-hacking research they'd been doing over the past year. The result of their work was a hacking technique---what the security industry calls a zero-day exploit---that can target Jeep Cherokees and give the attacker wireless control, via the Internet, to any of thousands of vehicles. Their code is an automaker's nightmare: software that lets hackers send commands through the Jeep's entertainment system to its dashboard functions, steering, brakes, and transmission, all from a laptop that may be across the country.

To better simulate the experience of driving a vehicle while it's being hijacked by an invisible, virtual force, Miller and Valasek refused to tell me ahead of time what kinds of attacks they planned to launch from Miller's laptop in his house 10 miles west. Instead, they merely assured me that they wouldn't do anything life-threatening. Then they told me to drive the Jeep onto the highway. "Remember, Andy," Miller had said through my iPhone's speaker just before I pulled onto the Interstate 64 on-ramp, "no matter what happens, don't panic." ¹

As the two hackers remotely toyed with the air-conditioning, radio, and windshield wipers, I mentally congratulated myself on my courage under pressure. That's when they cut the transmission.

Immediately my accelerator stopped working. As I frantically pressed the pedal and watched the RPMs climb, the Jeep lost half its speed, then slowed to a crawl. This occurred just as I reached a long overpass, with no shoulder to offer an escape. The experiment had ceased to be fun.

At that point, the interstate began to slope upward, so the Jeep lost more momentum and barely crept forward. Cars lined up behind my bumper before passing me, honking. I could see an 18-wheeler approaching in my rearview mirror. I hoped its driver saw me, too, and could tell I was paralyzed on the highway.

"You're doomed!" Valasek shouted, but I couldn't make out his heckling over the blast of the radio, now pumping Kanye West. The semi loomed in the mirror, bearing down on my immobilized Jeep.

I followed Miller's advice: I didn't panic. I did, however, drop any semblance of bravery, grab my iPhone with a clammy fist, and beg the hackers to make it stop.

This wasn't the first time Miller and Valasek had put me behind the wheel of a compromised car. In the summer of 2013, I drove a Ford Escape and a Toyota Prius around a South Bend, Indiana, parking lot while they sat in the backseat with their laptops, cackling as they disabled my brakes, honked the horn, jerked the seat belt, and commandeered the steering wheel. "When you lose faith that a car will do what you tell it to do," Miller observed at the time, "it really changes your whole view of how the thing works." Back then, however, their hacks had a comforting limitation: The attacker's PC had been wired into the vehicles' onboard diagnostic port, a feature that normally gives repair technicians access to information about the car's electronically controlled systems.

A mere two years later, that carjacking has gone wireless. Miller and Valasek plan to publish a portion of their exploit on the Internet, timed to a talk they're giving at the Black Hat security conference in Las Vegas next month. It's the latest in a series of revelations from the two hackers that have spooked the automotive industry and even helped to inspire legislation; WIRED has learned that senators Ed Markey and Richard Blumenthal plan to introduce an automotive security bill today to set new digital security standards for cars and trucks, first sparked when Markey took note of Miller and Valasek's work in 2013.

As an auto-hacking antidote, the bill couldn't be timelier. The attack tools Miller and Valasek developed can remotely trigger more than the dashboard and transmission tricks they used against me on the highway. They demonstrated as much on the same day as my traumatic experience on I-64; After narrowly averting death by semi-trailer, I managed to roll the lame Jeep down an exit ramp, re-engaged the transmission by turning the ignition off and on, and found an empty lot where I could safely continue the experiment.

Miller and Valasek's full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep's brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say they're working on perfecting their steering control---for now they can only hijack the wheel when the Jeep is in reverse. Their hack enables surveillance too: They can track a targeted Jeep's GPS coordinates, measure its speed, and even drop pins on a map to trace its route.

All of this is possible only because Chrysler, like practically all carmakers, is doing its best to turn the modern automobile into a smartphone. Uconnect, an Internet-connected computer feature in hundreds of thousands of Fiat Chrysler cars, SUVs, and trucks, controls the vehicle's entertainment and navigation, enables phone calls, and even offers a Wi-Fi hot spot. And thanks to one vulnerable element, which Miller and Valasek won't identify until their Black Hat talk, Uconnect's cellular connection also lets anyone who knows the car's IP address gain access from anywhere in the country. "From an attacker's perspective, it's a super nice vulnerability," Miller says.

From that entry point, Miller and Valasek's attack pivots to an adjacent chip in the car's head unit---the hardware for its entertainment system---silently rewriting the chip's firmware to plant their code. That rewritten firmware is capable of sending commands through the car's internal computer network, known as a CAN bus, to its physical components like the engine and wheels. Miller and Valasek say the attack on the entertainment system seems to work on any Chrysler vehicle with Uconnect from late 2013, all of 2014, and early 2015. They've only tested their full set of physical hacks, including ones targeting transmission and braking systems, on a Jeep Cherokee, though they believe that most of their attacks could be tweaked to work on any Chrysler vehicle with the vulnerable Uconnect head unit. They have yet to try remotely hacking into other makes and models of cars.

After the researchers reveal the details of their work in Vegas, only two things will prevent their tool from enabling a wave of attacks on Jeeps around the world. First, they plan to leave out the part of the attack that rewrites the chip's firmware; hackers following in their footsteps will have to reverse-engineer that element, a process that took Miller and Valasek months. But the code they publish will enable many of the dashboard hijinks they demonstrated on me as well as GPS tracking.

Second, Miller and Valasek have been sharing their research with Chrysler for nearly nine months, enabling the company to quietly release a patch ahead of the Black Hat conference. On July 16, owners of vehicles with the Uconnect feature were notified of the patch in a post on Chrysler's website that didn't offer any details or acknowledge Miller and Valasek's research. "[Fiat Chrysler Automobiles] has a program in place to continuously test vehicles systems to identify vulnerabilities and develop solutions," reads a statement a Chrysler spokesperson sent to WIRED. "FCA is committed to providing customers with the latest software updates to secure vehicles against any potential vulnerability."

Unfortunately, Chrysler's patch must be manually implemented via a USB stick or by a dealership mechanic. ( Download the update here.) That means many---if not most---of the vulnerable Jeeps will likely stay vulnerable.

Chrysler stated in a response to questions from WIRED that it "appreciates" Miller and Valasek's work. But the company also seemed leery of their decision to publish part of their exploit. "Under no circumstances does FCA condone or believe it's appropriate to disclose 'how-to information' that would potentially encourage, or help enable hackers to gain unauthorized and unlawful access to vehicle systems," the company's statement reads. "We appreciate the contributions of cybersecurity advocates to augment the industry's understanding of potential vulnerabilities. However, we caution advocates that in the pursuit of improved public safety they not, in fact, compromise public safety."

The two researchers say that even if their code makes it easier for malicious hackers to attack unpatched Jeeps, the release is nonetheless warranted because it allows their work to be proven through peer review. It also sends a message: Automakers need to be held accountable for their vehicles' digital security. "If consumers don't realize this is an issue, they should, and they should start complaining to carmakers," Miller says. "This might be the kind of software bug most likely to kill someone."

In fact, Miller and Valasek aren't the first to hack a car over the Internet. In 2011 a team of researchers from the University of Washington and the University of California at San Diego showed that they could wirelessly disable the locks and brakes on a sedan. But those academics took a more discreet approach, keeping the identity of the hacked car secret and sharing the details of the exploit only with carmakers.

Miller and Valasek represent the second act in a good-cop/bad-cop routine. Carmakers who failed to heed polite warnings in 2011 now face the possibility of a public dump of their vehicles' security flaws. The result could be product recalls or even civil suits, says UCSD computer science professor Stefan Savage, who worked on the 2011 study. "Imagine going up against a class-action lawyer after Anonymous decides it would be fun to brick all the Jeep Cherokees in California," Savage says. ²

For the auto industry and its watchdogs, in other words, Miller and Valasek's release may be the last warning before they see a full-blown zero-day attack. "The regulators and the industry can no longer count on the idea that exploit code won't be in the wild," Savage says. "They've been thinking it wasn't an imminent danger you needed to deal with. That implicit assumption is now dead."

471,000 Hackable Automobiles

Sitting on a leather couch in Miller's living room as a summer storm thunders outside, the two researchers scan the Internet for victims.

Uconnect computers are linked to the Internet by Sprint's cellular network, and only other Sprint devices can talk to them. So Miller has a cheap Kyocera Android phone connected to his battered MacBook. He's using the burner phone as a Wi-Fi hot spot, scouring for targets using its thin 3G bandwidth.

A set of GPS coordinates, along with a vehicle identification number, make, model, and IP address, appears on the laptop screen. It's a Dodge Ram. Miller plugs its GPS coordinates into Google Maps to reveal that it's cruising down a highway in Texarkana, Texas. He keeps scanning, and the next vehicle to appear on his screen is a Jeep Cherokee driving around a highway cloverleaf between San Diego and Anaheim, California. Then he locates a Dodge Durango, moving along a rural road somewhere in the Upper Peninsula of Michigan. When I ask him to keep scanning, he hesitates. Seeing the actual, mapped locations of these unwitting strangers' vehicles---and knowing that each one is vulnerable to their remote attack---unsettles him.

When Miller and Valasek first found the Uconnect flaw, they thought it might only enable attacks over a direct Wi-Fi link, confining its range to a few dozen yards. When they discovered the Uconnect's cellular vulnerability earlier this summer, they still thought it might work only on vehicles on the same cell tower as their scanning phone, restricting the range of the attack to a few dozen miles. But they quickly found even that wasn't the limit. "When I saw we could do it anywhere, over the Internet, I freaked out," Valasek says. "I was frightened. It was like, holy fuck, that's a vehicle on a highway in the middle of the country. Car hacking got real, right then."

That moment was the culmination of almost three years of work. In the fall of 2012, Miller, a security researcher for Twitter and a former NSA hacker, and Valasek, the director of vehicle security research at the consultancy IOActive, were inspired by the UCSD and University of Washington study to apply for a car-hacking research grant from Darpa. With the resulting $80,000, they bought a Toyota Prius and a Ford Escape. They spent the next year tearing the vehicles apart digitally and physically, mapping out their electronic control units, or ECUs---the computers that run practically every component of a modern car---and learning to speak the CAN network protocol that controls them.

When they demonstrated a wired-in attack on those vehicles at the DefCon hacker conference in 2013, though, Toyota, Ford, and others in the automotive industry downplayed the significance of their work, pointing out that the hack had required physical access to the vehicles. Toyota, in particular, argued that its systems were "robust and secure" against wireless attacks. "We didn't have the impact with the manufacturers that we wanted," Miller says. To get their attention, they'd need to find a way to hack a vehicle remotely.

So the next year, they signed up for mechanic's accounts on the websites of every major automaker and downloaded dozens of vehicles' technical manuals and wiring diagrams. Using those specs, they rated 24 cars, SUVs, and trucks on three factors they thought might determine their vulnerability to hackers: How many and what types of radios connected the vehicle's systems to the Internet; whether the Internet-connected computers were properly isolated from critical driving systems, and whether those critical systems had "cyberphysical" components---whether digital commands could trigger physical actions like turning the wheel or activating brakes.

Based on that study, they rated Jeep Cherokee the most hackable model. Cadillac's Escalade and Infiniti's Q50 didn't fare much better; Miller and Valasek ranked them second- and third-most vulnerable. When WIRED told Infiniti that at least one of Miller and Valasek's warnings had been borne out, the company responded in a statement that its engineers "look forward to the findings of this [new] study" and will "continue to integrate security features into our vehicles to protect against cyberattacks." Cadillac emphasized in a written statement that the company has released a new Escalade since Miller and Valasek's last study, but that cybersecurity is "an emerging area in which we are devoting more resources and tools," including the recent hire of a chief product cybersecurity officer.

After Miller and Valasek decided to focus on the Jeep Cherokee in 2014, it took them another year of hunting for hackable bugs and reverse-engineering to prove their educated guess. It wasn't until June that Valasek issued a command from his laptop in Pittsburgh and turned on the windshield wipers of the Jeep in Miller's St. Louis driveway.

Since then, Miller has scanned Sprint's network multiple times for vulnerable vehicles and recorded their vehicle identification numbers. Plugging that data into an algorithm sometimes used for tagging and tracking wild animals to estimate their population size, he estimated that there are as many as 471,000 vehicles with vulnerable Uconnect systems on the road.

Pinpointing a vehicle belonging to a specific person isn't easy. Miller and Valasek's scans reveal random VINs, IP addresses, and GPS coordinates. Finding a particular victim's vehicle out of thousands is unlikely through the slow and random probing of one Sprint-enabled phone. But enough phones scanning together, Miller says, could allow an individual to be found and targeted. Worse, he suggests, a skilled hacker could take over a group of Uconnect head units and use them to perform more scans---as with any collection of hijacked computers---worming from one dashboard to the next over Sprint's network. The result would be a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.

"For all the critics in 2013 who said our work didn't count because we were plugged into the dashboard," Valasek says, "well, now what?"

Congress Takes on Car Hacking

Now the auto industry needs to do the unglamorous, ongoing work of actually protecting cars from hackers. And Washington may be about to force the issue.

Later today, senators Markey and Blumenthal intend to reveal new legislation designed to tighten cars' protections against hackers. The bill (which a Markey spokesperson insists wasn't timed to this story) will call on the National Highway Traffic Safety Administration and the Federal Trade Commission to set new security standards and create a privacy and security rating system for consumers. "Controlled demonstrations show how frightening it would be to have a hacker take over controls of a car," Markey wrote in a statement to WIRED. "Drivers shouldn't have to choose between being connected and being protected...We need clear rules of the road that protect cars from hackers and American families from data trackers."

Markey has keenly followed Miller and Valasek's research for years. Citing their 2013 Darpa-funded research and hacking demo, he sent a letter to 20 automakers, asking them to answer a series of questions about their security practices. The answers, released in February, show what Markey describes as "a clear lack of appropriate security measures to protect drivers against hackers who may be able to take control of a vehicle." Of the 16 automakers who responded, all confirmed that virtually every vehicle they sell has some sort of wireless connection, including Bluetooth, Wi-Fi, cellular service, and radios. (Markey didn't reveal the automakers' individual responses.) Only seven of the companies said they hired independent security firms to test their vehicles' digital security. Only two said their vehicles had monitoring systems that checked their CAN networks for malicious digital commands.

UCSD's Savage says the lesson of Miller and Valasek's research isn't that Jeeps or any other vehicle are particularly vulnerable, but that practically any modern vehicle could be vulnerable. "I don't think there are qualitative differences in security between vehicles today," he says. "The Europeans are a little bit ahead. The Japanese are a little bit behind. But broadly writ, this is something everyone's still getting their hands around."

Aside from wireless hacks used by thieves to open car doors, only one malicious car-hacking attack has been documented: In 2010 a disgruntled employee in Austin, Texas, used a remote shutdown system meant for enforcing timely car payments to brick more than 100 vehicles. But the opportunities for real-world car hacking have only grown, as automakers add wireless connections to vehicles' internal networks. Uconnect is just one of a dozen telematics systems, including GM Onstar, Lexus Enform, Toyota Safety Connect, Hyundai Bluelink, and Infiniti Connection.

In fact, automakers are thinking about their digital security more than ever before, says Josh Corman, the cofounder of I Am the Cavalry, a security industry organization devoted to protecting future Internet-of-things targets like automobiles and medical devices. Thanks to Markey's letter, and another set of questions sent to automakers by the House Energy and Commerce Committee in May, Corman says, Detroit has known for months that car security regulations are coming.

But Corman cautions that the same automakers have been more focused on competing with each other to install new Internet-connected cellular services for entertainment, navigation, and safety. (Payments for those services also provide a nice monthly revenue stream.) The result is that the companies have an incentive to add Internet-enabled features---but not to secure them from digital attacks. "They're getting worse faster than they're getting better," he says. "If it takes a year to introduce a new hackable feature, then it takes them four to five years to protect it."

Corman's group has been visiting auto industry events to push five recommendations: safer design to reduce attack points, third-party testing, internal monitoring systems, segmented architecture to limit the damage from any successful penetration, and the same Internet-enabled security software updates that PCs now receive. The last of those in particular is already catching on; Ford announced a switch to over-the-air updates in March, and BMW used wireless updates to patch a hackable security flaw in door locks in January.

Corman says carmakers need to befriend hackers who expose flaws, rather than fear or antagonize them---just as companies like Microsoft have evolved from threatening hackers with lawsuits to inviting them to security conferences and paying them "bug bounties" for disclosing security vulnerabilities. For tech companies, Corman says, "that enlightenment took 15 to 20 years." The auto industry can't afford to take that long. "Given that my car can hurt me and my family," he says, "I want to see that enlightenment happen in three to five years, especially since the consequences for failure are flesh and blood."

As I drove the Jeep back toward Miller's house from downtown St. Louis, however, the notion of car hacking hardly seemed like a threat that will wait three to five years to emerge. In fact, it seemed more like a matter of seconds; I felt the vehicle's vulnerability, the nagging possibility that Miller and Valasek could cut the puppet's strings again at any time.

The hackers holding the scissors agree. "We shut down your engine---a big rig was honking up on you because of something we did on our couch," Miller says, as if I needed the reminder. "This is what everyone who thinks about car security has worried about for years. This is a reality."

Update 3:30 7/24/2015: Chrysler has issued a recall for 1.4 million vehicles as a result of Miller and Valasek's research. The company has also blocked their wireless attack on Sprint's network to protect vehicles with the vulnerable software.

¹ Correction 10:45 7/21/2015: An earlier version of the story stated that the hacking demonstration took place on Interstate 40, when in fact it was Route 40, which coincides in St. Louis with Interstate 64.

² Correction 1:00pm 7/27/2015: An earlier version of this story referenced a Range Rover recall due to a hackable software bug that could unlock the vehicles' doors. While the software bug did lead to doors unlocking, it wasn't publicly determined to exploitable by hackers.

# data[].attributes.attachment_link.title
Hackers Remotely Kill a Jeep on the Highway-With Me in It

# data[].attributes.attachment_link.description
I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold.

# data[].attributes.headline
Ethical hacker shoes how easy it is to Hack IOT Modules 

# data[].attributes.subject
Ethical hacker shoes how easy it is to Hack IOT Modules 

# data[].attributes.attachment_link.title
Ethical hacker shows us how easily smart devices can be hacked and give access to your personal info

# data[].attributes.attachment_link.title
Hacker Accessed ‘Ring’ Camera Inside Little Girl’s Room, Her Family Says | TODAY

# data[].attributes.headline
Hackers gaining access to Home Security and Threaten Owners

# data[].attributes.subject
Hackers gaining access to Home Security and Threaten Owners

# data[].attributes.attachment_link.title
Hackers tap into home security cameras and livestream to hundreds | ABC News

# data[].attributes.headline
Owlet WiFi Baby Heart Monitor Vulnerabilities

# data[].attributes.subject
Owlet WiFi Baby Heart Monitor Vulnerabilities

# data[].attributes.body
This most recent incident is just another illustration of how gadgets with the greatest of intentions, such as those that notify parents when their infants develop cardiac problems, may become hazardous if abused by a malicious party.

Sadly, this is the case more frequently than not when embedded computing is included in so-called smart gadgets. Unfortunately, these are stories that we will continue to hear if manufacturers and developers don't take this into account and take further precautions to safeguard devices at the hardware layer.

# data[].attributes.attachment_link.readable_text
Not long ago, top computer security researcher Jonathan Zdziarski was blessed with a new baby and did what a lot of parents do - spent money on gizmos to keep an eye on it.

One of the devices was an Owlet - a sensor that babies wear in a sock that monitors their heartbeat and relays that data wirelessly to a nearby hub. This internet-connected home unit can then ping out an alert to the parent's smartphones if anything is amiss.

Zdziarski told The Reg that his suspicions about the device were first raised when he looked at the end-user license agreement, which has a big section indemnifying the company from litigation if the device malfunctions and the wearer dies. But he found even more worrying details when he started examining the device's code.

The Owlet base station encrypts data sent to and received from the manufacturer's servers, which contact parents' phones if needed. But the ad-hoc Wi-Fi network linking the base station to the sensor device is completely unencrypted and doesn't require any authentication to access.

If you're within range, you can snoop on the base station's wireless network, and meddle with it. That's right, the base station creates its own unlocked Wi-Fi network that the sensor (and anyone else) can join.

A single unauthenticated command over HTTP can make the Owlet base station leave your home Wi-Fi network and join one of your choosing; you can also take control of the system and monitor a stranger's baby and prevent alerts from being sent out.

It's just another drop in an ocean of insecure gadgets and gizmos we're all drowning in. It's further evidence we're in an epidemic of slap-dash security in embedded engineering.

Getting your neighbor's @owletbabycare baby vital signs monitor to quit their network and join yours in one easy command, with no password... pic.twitter.com/MV1DEzX0b6
- Jonathan Zdziarski (@JZdziarski) October 12, 2016

"This would be simple to do by someone scanning port 80 [on the Wi-Fi network], which the base station is locked into using," he said. "The whole interface is non-authenticated, so if you go into the IP address for the base station you can delete specific Wi-Fi networks, disconnect the Wi-Fi altogether, and ultimately break the alerts."

He also found some serious design flaws. If the monitoring sock falls off the baby's foot an alert goes off that something is wrong. After the worried parent rushes in and just puts the sock back on, the device doesn't reset itself. It remains dormant unless the parent reenables it, he said.

Zdziarski also said that, based on a quick examination of the code, there didn't appear to be a software update mechanism in place to fix these issues. Owlet has since told The Reg that there is an update mechanism that the company uses regularly.

"The safety, security and privacy of our customers are of the utmost importance to us. We are aware of the report on Twitter, and our data team is working closely with this individual to better understand his concerns and ensure we continue to provide value to parents," an Owlet spokeswoman told us.

"At this time, what we can share is that we are connecting our data team with Mr Zdziarski so they can work closely with him to understand his concerns and what he's identified." ®

# data[].attributes.attachment_link.title
Wi-Fi baby heart monitor may have the worst IoT security of 2016

# data[].attributes.attachment_link.description
Not long ago, top computer security researcher Jonathan Zdziarski was blessed with a new baby and did what a lot of parents do - spent money on gizmos to keep an eye on it. One of the devices was an Owlet - a sensor that babies wear in a sock that monitors their heartbeat and relays that data wirelessly to a nearby hub.

# data[].attributes.body
This IoT botnet was made possible by malware called Mirai. Once infected with Mirai, computers continually search the internet for vulnerable IoT devices and then use known default usernames and passwords to log in, infecting them with malware. These devices were things like digital cameras and DVR players.

Lessons it taught

“Devices that cannot have their software, passwords, or firmware updated should never be implemented.

Changing the default username and password should be mandatory for the installation of any device on the Internet.

Passwords for IoT devices should be unique per device, especially when they are connected to the Internet.

Always patch IoT devices with the latest software and firmware updates to mitigate vulnerabilities.”

# data[].attributes.attachment_link.readable_text
The cyber-attack that brought down much of America's internet last week was caused by a new weapon called the Mirai botnet and was likely the largest of its kind in history, experts said.

The victim was the servers of Dyn, a company that controls much of the internet's domain name system (DNS) infrastructure. It was hit on 21 October and remained under sustained assault for most of the day, bringing down sites including Twitter, the Guardian, Netflix, Reddit, CNN and many others in Europe and the US.

The cause of the outage was a distributed denial of service (DDoS) attack, in which a network of computers infected with special malware, known as a "botnet", are coordinated into bombarding a server with traffic until it collapses under the strain.

What makes it interesting is that the attack was orchestrated using a weapon called the Mirai botnet. According to a blogpost by Dyn published on Wednesday, Mirai was the "primary source of malicious attack traffic".

Unlike other botnets, which are typically made up of computers, the Mirai botnet is largely made up of so-called " internet of things " (IoT) devices such as digital cameras and DVR players.

Because it has so many internet-connected devices to choose from, attacks from Mirai are much larger than what most DDoS attacks could previously achieve. Dyn estimated that the attack had involved "100,000 malicious endpoints", and the company, which is still investigating the attack, said there had been reports of an extraordinary attack strength of 1.2Tbps.

To put that into perspective, if those reports are true, that would make the 21 October attack roughly twice as powerful as any similar attack on record.

David Fidler, adjunct senior fellow for cybersecurity at the Council on Foreign Relations, said he couldn't recall a DDoS attack even half as big as the one that hit Dyn.

Mirai was also used in an attack on the information security blog Krebs on Security, run by the former Washington Post journalist Brian Krebs, in September. That one topped out at 665 Gbps.

"We have a serious problem with the cyber insecurity of IoT devices and no real strategy to combat it," Fidler said. "The IoT insecurity problem was exploited on this significant scale by a non-state group, according to initial reports from government agencies and other experts about who or what was responsible.

"Imagine what a well-resourced state actor could do with insecure IOT devices," he added.

According to Joe Weiss, the managing partner at the cybersecurity firm Applied Control Solutions and the author of Protecting Industrial Control Systems from Electronic Threats, it is hard to know what Mirai could become. "A lot of these cyber-attacks start out as one particular type of attack and then they morph into something new or different," he said. "A lot of this is modular software.

"I can't speak for anyone else," Weiss continued. "[But] I don't know that we really understand what the endgame is."

# data[].attributes.attachment_link.title
DDoS attack that disrupted internet was largest of its kind in history, experts say

# data[].attributes.attachment_link.description
The cyber-attack that brought down much of America's internet last week was caused by a new weapon called the Mirai botnet and was likely the largest of its kind in history, experts said. The victim was the servers of Dyn, a company that controls much of the internet's domain name system (DNS) infrastructure.

# data[].attributes.body
Western Digital, a major maker of storage devices, entirely deleted its My Book Live devices. This was caused by two flaws, the first of which made it susceptible to penetration, and the second of which was a serious security flaw that let hackers remotely do a factory reset without a password.

The My Book Live attack is significant not only because hackers were able to wipe petabytes of user data from each device, but also because it was a Western Digital developer that had actively removed code that required a valid user password before allowing a factory reset to be activated.

# data[].attributes.attachment_link.readable_text
UPDATE 6/30: Western Digital has now shared details(Opens in a new window) of multiple vulnerabilities that allowed My Book Live devices to be wiped and is offering affected customers support starting next month.

The two vulnerabilities identified are known as CVE-2018-18472(Opens in a new window) (a Remote Command Execution bug) and CVE-2021-35941(Opens in a new window) (an unauthenticated factory reset vulnerability). 18472 can be triggered by anyone who knows the IP address of the affected device, where as 35921 was introduced to My Book Live in April 2011 "as part of a refactor of authentication logic in the device firmware."

As Western Digital explains, "Our investigation shows that in some cases, the same attacker exploited both vulnerabilities on the device, as evidenced by the source IP. The first vulnerability was exploited to install a malicious binary on the device, and the second vulnerability was later exploited to reset the device. On some devices, the attackers installed a trojan with a file named .nttpd,1-ppc-be-t1-z, which is a Linux ELF binary compiled for the PowerPC architecture used by the My Book Live and Live Duo."

There's no evidence Western Digital cloud services, firmware update servers, or customer credentials were compromised. However, if you have lost data as a result of these vulnerabilities and attacks, you can expect data recovery services to be provided by Western Digital beginning in July. My Book Live device owners will also be offered a trade-in program to upgrade to a My Cloud device, which still benefit from active support. Details of both the data recovery service and trade-in programs will be released separately in the near future.

Original Story 6/25:
If you own one of Western Digital's My Book Live network attached storage drive, it's important that you unplug it immediately to avoid all the data potentially being wiped.

As Ars Technica reports(Opens in a new window) , a growing number of users are discovering that their My Book Live data has been wiped without warning(Opens in a new window) . Western Digital believes malicious software is causing the drive wipes and has issued the following advisory(Opens in a new window) on its community website:

"Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers' data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available."

Although Western Digital stopped selling the My Book Live devices in 2015, they proved popular due to their inclusion of an Ethernet port allowing files to be accessed from anywhere. Now it seems that feature has come back to haunt the company, but it's unclear if the malicious software is targeted at Western Digital or individual owners at the moment.

If you own a My Book Live, after you've disconnected it from the internet consider backing up either using a cloud backup service to secure your data or by seeing this as the perfect excuse to invest in a new NAS or an external hard drive.

# data[].attributes.attachment_link.title
Western Digital Explains How Attackers Wiped My Book Live Devices

# data[].attributes.attachment_link.description
UPDATE 6/30: Western Digital has now shared details(Opens in a new window) of multiple vulnerabilities that allowed My Book Live devices to be wiped and is offering affected customers support starting next month. The two vulnerabilities identified are known as CVE-2018-18472(Opens in a new window) (a Remote Command Execution bug) and CVE-2021-35941(Opens in a new window) (an unauthenticated factory reset vulnerability).

# data[].attributes.body
Thousands of security cameras created and maintained by Verkada, a Silicon Valley-based firm that offers security as a service, were successfully accessed and controlled by a gang of hackers.

Once they breached the Verkada database, they moved laterally across the network and gained control over a super-admin account. From there, they were able to hijack control of the cameras to launch future attacks and access video footage stored on the cloud of Verkada’s more than 24,000 client list.

# data[].attributes.attachment_link.title
Hackers Breach Thousands of Security Cameras, Exposing Tesla, Jails, Hospitals

# data[].attributes.attachment_link.description
A group of hackers say they breached a massive trove of security-camera data collected by Silicon Valley startup Verkada Inc., gaining access to live feeds of 150,000 surveillance cameras inside hospitals, companies, police departments, prisons and schools.

# data[].attributes.headline
A holistic Risk Analysis of IOT Devices 

# data[].attributes.subject
A holistic Risk Analysis of IOT Devices 

# data[].attributes.body
Kamalanathan et al.

Types of IoT risks

Ethical IoT risk:  This refers to the unforeseen adverse effects of unethical actions using IoT devices.

Security and privacy IoT risk: This refers to the exploitation of vulnerabilities in the system to gain access to assets with the intent to cause harm.

Technical IoT risk: This is due to hardware or software failure because of poor design, evaluation, etc.

# data[].attributes.attachment_caption
Someone hacked printers worldwide, urging people to subscribe to PewDiePie.

# data[].attributes.headline
PewDiePie ( A Famous Youtuber ) fans hack printers which suggests to Subscribe

# data[].attributes.subject
PewDiePie ( A Famous Youtuber ) fans hack printers which suggests to Subscribe

# data[].attributes.body
In 2018, there was an ongoing battle between PewDiePie ( the creator ) and T-Series ( an organization) race toward the 100 Million Subscribers milestone. It was all the internet had to offer in that year. The creator's fans were fanatic and were searching for myriad options to promote the channels. Amidst all that, this incident emerged, where some unknown fans Hacked Multiple printers to print a statement suggesting to subscribe to the creator.

Printers are really weak points in the network. They are sort of like IOT modules but with limited functionality. All it takes to hack is a utility called PRET, which is an open-source toolkit.

# data[].attributes.attachment_link.readable_text
The fight over who gets to have the most-subscribed channel on YouTube spilled into the real world months ago when Felix "PewDiePie" Kjellberg fans started campaigning to raise awareness of the Swedish star. The grassroots effort has, for the most part, been in good fun - but recently, people on social media have reported being hacked by someone who is urging them to subscribe to PewDiePie.

Kjellberg has maintained his status as the top channel on YouTube for years now, but recently, his claim to the throne has been increasingly threatened by T-Series, a channel owned by an Indian music production company. T-Series' growth rate in 2018 has been explosive: it currently has over 72 million subscribers, placing it behind Kjellberg by around 150,000 fans. Judging by T-Series' subscriber trajectory, many onlookers estimate that the channel will eventually outgrow PewDiePie, but Kjellberg and his fans are putting up a fight.

Kjellberg's recent uploads often feature segments where he asks fans to convince people to subscribe to him. As a result, PewDiePie fans have done everything from placing posters to playing Kjellberg's diss track against T-Series at the club. One YouTuber launched a citywide advertising campaign where they bought every single billboard, radio spot, and local TV spot available in support of PewDiePie's channel. Together, fans have ensured that Kjellberg remains narrowly ahead of T-Series for longer than anyone expected.

Over the last couple of days, Twitter users have been posting screenshots of unsolicited printouts from internet-connected printers that say that PewDiePie needs their help. "PewDiePie, the currently most subscribed to channel on YouTube, is at stake of losing his position as the number one position by an Indian company called T-Series that simply uploads videos of Bollywood trailers and campaigns," the sheet says. The printout tells people to subscribe to Kjellberg and to "tell everyone you know" about the YouTube race. At the end, there's an ASCII figure of a "brofist," a gesture that Kjellberg is known for. The screenshots have no specific origin; users from Canada to the UK have purportedly received it.

A hacker on Twitter has claimed responsibility for the printouts, stating that the stunt is apparently their way of raising awareness of printer security.

According to @TheHackerGiraffe's tweets, they took advantage of an open network port available on hundreds of thousands of printers worldwide. This is a known vulnerability that allows printers to receive data. To do it, the hacker claims that they used a tool called PRET that, according to its GitHub page, allows attackers to "captur[e] or manipulat[e] print jobs, accessing the printer's file system and memory or even causing physical damage to the device."

"Your printer is exposed," TheHackerGiraffe told a user on Twitter. "I'm trying to warn you to close it, how else am I gonna get your attention?"

"I didn't think this would work when I did it," TheHackerGiraffe said on Twitter. The Verge has reached out to the hacker asking for proof tying them to the exploit, and we will update this post once we hear back.

Update November 30th 1:10 PM: TheHackerGiraffe told The Verge that he got the idea for the hack while browsing Shodan.io, a repository for internet-connected devices. Here, they claim that they found 800,000 available printers, and decided to attack 50,000 of them.

"People underestimate how easy a malicious hacker could have used a vulnerability like this to cause major havoc," TheHackerGiraffe said. "Hackers could have stolen files, installed malware, caused physical damage to the printers and even use the printer as a foothold into the inner network.

"The most horrifying part is: I never considered hacking printers before, the whole learning, downloading and scripting process took no more than 30 minutes."

# data[].attributes.attachment_link.title
Someone hacked printers worldwide, urging people to subscribe to PewDiePie

# data[].attributes.attachment_link.description
The fight over who gets to have the most-subscribed channel on YouTube spilled into the real world months ago when Felix "PewDiePie" Kjellberg fans started campaigning to raise awareness of the Swedish star. The grassroots effort has, for the most part, been in good fun - but recently, people on social media have reported being hacked by someone who is urging them to subscribe to PewDiePie.