Device Types and the IoT Surface

A computing device is any machine that runs a program: it reads input, carries out instructions held in its memory, and produces output that it keeps or passes on. A phone fits that description, and so do a laptop and the machine that answers a bank's website. So does the chip inside a door lock that reads a key card. Security work starts by knowing which of these an organization has, because each kind is attacked in its own ways and protected with different tools.

A downtown hotel with 220 guest rooms is replacing its network equipment, and the IT manager, Grace Liang, starts with a list of everything that will be connected to the new network.

Sort the seven rows into four groups by what each device is built for, then check your groups against the definitions below.

Row A is the server. Its job is answering other computers: when a clerk opens a booking, the front-desk computer asks the server for it, and the server sends it back. Rows B and C are built for one person at a time. The front-desk computers have a full keyboard and screen and run the same programs any office computer runs. The tablets do much less, but they fit in a cart and run all shift on a battery.

The front-desk computers are personal computers even though clerks on different shifts share them; no two clerks use one at once.

Rows D through G are the fourth group. A door lock has a small circuit board inside it. Its program does one thing: it reads the card, compares the room number and dates written on it with what it was told, and drives the motor that pulls back the bolt. It can't browse the web or open a document, and it has no screen anyone signs in to. The televisions, cameras, and washers are the same kind of thing: a machine first, with a small computer built in to run it.

Now total the last column by group. How many of the hotel's networked devices are embedded computers?

The embedded computers number 482 of the 499 devices on the list, about 97 percent. The other 17 are the server, the front-desk computers, and the tablets. None of those 482 is a computer that anyone at the hotel sits down to work at; each one runs a machine.

Embedded computers rarely work alone. MGM Resorts, which runs some of the largest hotels and casinos in Las Vegas, found attackers inside its network in September 2023 and shut down some of its own systems to contain them. For days guests reported digital room keys that didn't work, and slot machines, ATMs, and card terminals on its casino floors were out of service. Each slot machine has an embedded computer of its own, and the casino's management systems oversee all of them. With those systems down, most slot machines in MGM's Strip casinos were offline, and a player who found one that worked waited for an attendant to pay out the credit by hand. A group called Scattered Spider later said it was behind the attack, and the hackers' account, passed on by a malware-research group, was that it had taken one phone call to MGM's IT help desk, using details about an employee found on LinkedIn. MGM never said how. The company later put the cost at about 100 million dollars of earnings for the quarter, nearly all of it in September.

The hotel's list has the same shape. The front-desk computers write key cards from bookings on the reservations server, so with row A down, nobody arriving could get a working card, though each lock would still read the cards already made.

Verkada, a California company, sells security cameras to businesses, schools, hospitals, and jails. Its cameras send their video to Verkada's servers, and customers watch it through a web page. The company's support staff could open any customer's cameras from that same system, so that they could help fix a problem.

According to the Federal Trade Commission, on March 8, 2021, an intruder used a weakness in Verkada's customer support server to take over a support account with Super Admin rights. That account could reach more than 150,000 live customer cameras. Through them the intruder watched patients in psychiatric hospitals and women's health clinics, young children playing in a room, and people in jail cells, and sent commands to some of the cameras themselves. Thousands of cameras were opened, some for as long as 90 minutes, and gigabytes of data left with the intruder, including customers' Wi-Fi passwords. Verkada didn't know until a news outlet contacted it for comment: a group of hackers had described the break-in to Bloomberg News.

Which kinds of computer inside Verkada's system did the intruder pass through to reach a jail cell? Name each one.

The path ran through two kinds, servers and embedded computers. It started at Verkada's support server, which no customer had ever seen, went on through the servers that held the video and controlled the cameras, and ended at the cameras, which the intruder could send commands to and not only watch.

Tillie Kottmann, a 21-year-old in Lucerne, Switzerland, who described the break-in to reporters, was already under U.S. investigation for other break-ins. On March 12, four days after the break-in, Swiss police acting for the U.S. Justice Department searched Kottmann's home and took their computers, and on March 18 a federal grand jury in Seattle indicted Kottmann for break-ins at other companies going back to 2019. In August 2024 Verkada settled with the Federal Trade Commission, which had charged that it failed to require strong passwords, encrypt customer data, or lock down its network. The order requires a security program checked by outside auditors, and a 2.95 million dollar penalty for unwanted marketing emails, a separate charge.

Row F works the way Verkada's cameras did: 36 embedded computers in the hotel's ceilings, sending video to servers the hotel doesn't own. The IT manager adds a column to the list, headed "Who else can reach it." For the door locks, the answer is the front desk and the lock maker's service technician. For the cameras, it may be everyone at the camera company with a support account, as it was at Verkada, and anyone who takes one over. Liang asks the camera company how many of its staff that is. The answer is a line from its contract: support access is limited to authorized personnel.