Japan’s IoT Security Stress Test

Government to Beef Up Cybersecurity for 2020 Olympics


Last week, Japan approved a project that will see the government try to hack into Internet of things (IoT) devices to survey the number of gadgets at risk of a cyberattack. Authorities are aiming to strengthen cybersecurity as the country prepares to host major global events, namely the Rugby World Cup in 2019 and the Olympic Games in Tokyo in 2020.

IoT vulnerabilities are caused by many factors, but the main one is user oversight. For example, many users never change the initial settings in IoT devices after buying and installing them, leave their devices unchecked and unsupervised, and often don’t update firmware frequently enough — if ever.

As IT infrastructure has become a backbone for major sports venues, cybersecurity has taken a central role at large events, in services ranging from broadcasting to ticketing. At the Pyeongchang Winter Olympic Games in 2018 in South Korea, for instance, Internet and Wi-Fi systems went down just before the opening ceremony started. South Korean officials acknowledged they had fallen victim to a cyberattack before the games even began.

Japan’s security survey will be carried out by employees of the National Institute of Information and Communications Technology, supervised by staffers from the Ministry of Internal Affairs and Communications. The institute will test default passwords and use other tactics to attempt hacks of randomly-selected IoT devices, and compile a list of vulnerable devices. It will then share the information with Internet service providers, advising them to alert users about vulnerabilities and ask them to better secure their devices. The government agency claims that more than 54 percent of cyberattacks it detected in 2018 involved IoT devices.

IoT devices are regularly targeted by hackers as weak links of an IT infrastructure. They’re often used to stage distributed denial-of-service attacks. A high-profile incident made headlines earlier in 2019, when a hacker gained access to Nest security cameras and urged owners to subscribe to PewDiePie’s channel on YouTube.

Although many people in the West would be hesitant to let the government access their devices, they do willingly allow non-governmental companies like Facebook and Google to use their data. Cultural conditions are different in Japan and the announcement of the IoT survey is a reminder that citizens everywhere are trading privacy and other aspects of their security for the convenience that IoT devices offer. But the risks with IoT are potentially larger: hackers can use an IoT device as a gateway into the whole network, the attack can remain undetected for a long time, and it can threaten the physical security and safety of users as well as their cybersecurity.