From https://theconversation.com/fax-machines-and-coffee-pots-the-surprising-ways-you-could-be-hacked-101937:
Hopefully you protect your computers from cyber attacks. You might have anti-virus software on your phone, tablet, laptop or desktop. You might avoid using them to visit suspicious websites and carefully protect your various login details. But it’s no longer just what we typically think of as computers that are connected to the internet and so at risk of cyber attacks. And if multiple devices are connected to the same network in your home or office, then if a hacker breaks into one machine they could gain access to all of them. Security researchers recently claimed to have hacked into a computer network by sending a malicious fax. And there are many other seemingly unlikely ways a hacker can get access to your system. You might have a well-protected front door to the internet, but could someone get in by means of the recently installed cat flap in the conservatory? Some devices we recognise as being related to our computers, but we don’t necessarily think of them as being connected to the internet. Nowadays, printers often have their own internet connection to allow them to talk to other devices in your home or office, often wirelessly. This connection provides the first step for hackers to remotely access your network. Then they just need to get around any security controls and they can hack into not just the printer but the other devices connected to it. Printer vulnerabilities have been well documented, with one hacker claiming to have broken into 150,000 printers in order to raise awareness of their insecurity. Similarly, many baby monitors and security cameras now connect to the internet to allow people to access them from outside the home. New York’s Department of Consumer Affairs issued a public warning about baby monitor security following a number of widely reported incidents of strangers’ voices being heard over them. The creation of the so-called Internet of Things means it’s not just computer accessories that are now connected but also devices, appliances and objects that we traditionally don’t see as having anything to do with this kind of technology. And it seems that almost as soon as any device is connected to the internet, it gets hacked. Recent examples include cars, toys, thermostats, medical implants and even coffee machines. A hacker who succeeds in communicating with one of these device can then conduct any number of possible attacks. They could disrupt communications, which would be irritating in the case of a coffee machine, but potentially life threatening in the case of a medical implant. They could also access data sent to the device, again probably uninteresting in the case of a toy, but potentially a security risk if someone can find out where your car is likely to be left unattended or when your home is empty (and your heating is off). Intriguingly, even some devices that are not directly plugged into the internet can be hacked. As mentioned, it was recently reported that fax machines could be hacked by sending carefully crafted image files to them containing malicious code. When this image was converted into data for transmission within the internal computer network, the code hidden within this data was able to run and inflict its damage. This method of intrusion, which any device with an external connection to the outside world is potentially vulnerable to, enables hackers to insert malicious software such as a virus into the computer networks connected to the device. This code might not just be used to attack the infiltrated network, but could also connect the devices on it to a wider distributed network of hijacked machines. The hackers could then use this collective computing power to steal passwords, search for bankcard details, bombard websites with requests for data in order to disrupt their service, or attack yet more computers. Of course, just because something can be hacked does not mean that it will be. An expert user can use network security technologies such as firewalls and strong authentication methods to reduce the risks of outsiders attacking internet-connected devices. But most users are not experts and every device we connect creates a new opportunity for anyone trying to break into our computer systems. As a society, we have to ask ourselves two big questions. First, what technology will it really benefit us to connect to the internet? A heart monitor that can be tracked by your doctor? Probably. A doll that can have sophisticated conversations but also records everything your child says? Less so. Second, for those technologies we do want connected, how do we get device manufacturers to take their cyber security seriously? Most new internet-connected products lack the security of more traditional computers such as laptops and phones. The answer probably relies on market pressure, which always takes time to exert its influence. We can do our own part by asking questions about security before purchasing new devices but, ultimately, it’s suppliers who have to make their devices secure. That said, just because your kettle can connect to the internet, does not mean that you have to let it do so. I fear, however, that we are going to be reading about insecure fridges and hackable toasters for a considerable time to come.

From https://theconversation.com/cia-hacking-qanda-can-your-tv-spy-on-you-and-is-your-phone-listening-in-74337:
WikiLeaks has released thousands of documents that appear to show how the US Central Intelligence Agency (CIA) is able to spy on smartphones, computers and other internet-connected devices. They apparently have the ability to break into any Android and iPhone smartphone, as well as devices running Windows, Mac OS or Linux operating systems. Though the leak doesn’t tell us how widely these techniques are used, it does highlight just how vulnerable the technology on which we increasingly rely is to security breaches. The leaked documents suggest the CIA has a catalogue of “zero-day” vulnerabilities. A software vulnerability is typically a flaw in a program that a hacker can use to undermine the security of a system and break in to control it or steal its data. Usually, vulnerabilities are reported to vendors so they can produce a software patch that will fix the flaw and to eliminate or reduce the chances of a successful attack. Those flaws that the software manufacturer doesn’t know about are called zero-day vulnerabilities (referring to the number of days the manufacturer has known about the problem). By exploiting these zero-day vulnerabilities, the CIA could theoretically undermine the controls of computer operating systems and smartphones. This would allow it to bypass, for example, the security of many messaging apps that are considered secure, such as WhatsApp, Telegram or Signal. It doesn’t show that these apps have had their strong encryption methods broken – instead the messages can be read directly from the operating system before being encrypted. The leaked documents also detail a highly technical catalogue of hacking tools, such as instructions for compromising Skype, Wi-Fi networks, PDF documents and commercial anti-virus programs. There are also instructions on how to steal passwords, such as those inputted into internet browsers. For example, a technique called “QuarkMatter” can insert stealthy spying software on an Apple computer by hiding it in the EFI system partition, the part of the hard drive where the startup files are kept. The documents also report that the CIA might be able to listen to conversations heard by the microphones in smart TVs even when the TVs appear to be switched off. But that doesn’t mean the CIA can exploit anyone’s smart TV. The program, called “Weeping Angel”, was designed specifically for the Samsung F8000 TV. And it is entirely possible that the CIA created this technique (and others like it) just to target specific individuals. It also seems that the program can only be loaded onto a television via a software update from a USB device. So someone would have to enter your house and access your TV to be able to hack it. But we should also note that other “Internet of Things” connected devices could be used for similar purposes, such as the Amazon Echo home assistant. The CIA has, it is claimed, even explored ways of remotely controlling and hacking into cars in order to crash them, creating a “nearly undetectable assassination”. Many commenters have noted that some of the vulnerabilities that are shown in the catalogue are old and some of them have already been patched up. For example, the Samsung TV hack is not possible anymore in recent devices with updated firmware. But that doesn’t mean that the CIA (or any other intelligence agency) hasn’t updated its arsenal to exploit newer vulnerabilities. The document suggests the CIA is willing to exploit public technology for spying and put it at further risk of hacking. If manufacturers don’t know about vulnerabilities then they can’t fix them and so they are also available for malicious hackers or other governments to exploit as well. The US government has established the Vulnerabilities Equities Process (VEP) as a way of helping its agencies deciding whether or not to disclose or not a vulnerability. If the CIA is stockpiling a catalogue of vulnerabilities it discovers, as other agencies have previously denied doing, then it may be ignoring this protocol. There are exceptions, such as if the exploit has “a clear national security or law enforcement need”. But as we don’t know how the vulnerabilities have been exploited, it isn’t clear if they fall into this category. It’s also not clear what other hacking activities the CIA may be undertaking. The leak includes 8,761 documents and files, many of which haven’t yet been analysed, and there are likely more documents to come. Some documents have been redacted by WikiLeaks editors to avoid disclosing the actual programming code for the attacks, to make it difficult to copy them. Finally, it appears that the entire archive of disclosed CIA toolkit consists of several hundred million lines of code (by comparison, Windows 7 is composed of 25m lines of code). So it might take some time to fully understand the extent of their hacking capabilities.