‘Some of the attackers seem to have access to high levels of funding, innovative tactics, and military-grade malware’
With cyber-attacks against internet of things (IoT) deployments in India up by 22% in the last quarter, experts are pointing the finger, in part, at politically-motivated hackers.
A new report (PDF) from telecom analytics firm Subex states that, for the second quarter running, India is the most-attacked country in the IoT space.
Among the main targets was technology and systems associated with ‘smart cities’, financial services, and transportation. Mumbai, New Delhi, and Bengaluru attracted the most attacks, Subex said.
There was a total of 33,450 ‘high grade’ cyber-attacks and 500 ‘critical’ IoT attacks “of very high sophistication and persistence”, while nearly 7,900 malware variants were detected.
The State of IoT Security in India – Q2 2019 (Image credit: Subex)
‘Hackers want to get into systems early’
According to Kiran Zachariah, Subex’s vice president for IoT business, and Prayukth KV, head of IoT marketing, the level of attacks being experienced by India is out of proportion with the current size of IoT deployment in the south Asian nation.
“The reasons could be many. It could be because of the diversity of IoT deployments in terms of devices, connectivity flavors, and maturity of these deployments from a utility and security perspective,” they tell The Daily Swig.
“It could also be because India is expected to be among countries with the maximum number of connected endpoints in the future, so hackers want to get into the systems early.”
And there’s a third reason too: “Last but not least,” they say, “there could be a geopolitical angle at play as well, as some of the attackers seem to have access to high levels of funding, innovative tactics, and military-grade malware.”
RELATED Smart cities dumb down privacy concerns
The team behind this latest research detected what they call “hyper reconnaissance” activity impacting the Indian IoT security landscape for two days around the middle of every month.
“We have seen increased reconnaissance activity in the US as well. But then those recon missions stay at that level,” they say. “But in India, we have seen these activities scaling up to full-fledged attacks whenever there is a geopolitical event in India’s neighborhood.”
IoT attack surface
Bharat Mistry, principal security strategist at Trend Micro, points out that India’s strong economy has led to an internet boom that has expanded the attack surface; meanwhile, the country has become part of the supply chain for many industries, allowing cybercriminals to use it as an attack vector for other organizations.
And, he tells The Daily Swig, “The ongoing political tension between India and its neighbors such as Pakistan means that cyber espionage can be seen as a key issue, especially in cases where a competitive edge is required.”
Unfortunately, says Bharat, India currently has very limited regulation when it comes to IoT device manufacturing.
“The only exceptions are the regulations in place for operators of critical national infrastructure such as power, water, and banking,” he says.
“There is no government body like the UK’s National Cyber Security Centre (NCSC) in India to mandate cyber regulations or provide any guidance or education around cyber security.”
This may need to change, with the IoT sector booming in the country.
According to a report (PDF) from EY and the Associated Chambers of Commerce and Industry of India late last year, there could be two billion IoT connections in the country by 2022.
RELATED Indian gov’t breaks ground on dedicated cybersecurity center
