From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Welcome to the World of Tomorrow today! Or, at the very least, welcome to CES 2024 coverage. IT Brew traveled to Las Vegas to explore the cool, the weird, the wild, and the not-yet-ready-for-primetime technology companies are unveiling.

Flying drones delivering packages, a satellite beaming signals, an airplane, abstract graph, and retail shirt rack

CES 2024

Eoin Higgins

itbrew.com

IoT accessibility is growing in importance to the tech industry.

To accessible media and technology consultant Larry Goldberg, it’s been interesting to watch as IoT devices become increasingly important to a market that’s traditionally been underserved.

“I have been in this field for a while, and it’s absolutely true over the past five years—even before the pandemic—the awareness was growing that there’s a real market here of people with disabilities,” Goldberg told IT Brew. “You see the big 10 companies—almost the entire Fortune 500—realizing they need to make their technology more accessible and that there’s a market they need to serve.”

That market extends beyond just “people with mobility impairments” and includes older adults, Goldberg said. Speaking to IT Brew from Sarasota, Florida—where he noted there were a lot of “old folks” around—Goldberg said that IoT companies should be aware of the rich potential of that market.

“It’s something the AARP has been looking at for years,” Goldberg said.

At CES, Kenneth Kohlmann, VP of lawn care company Yarbo, told IT Brew that his company is appealing to the accessibility market by giving consumers with disabilities “back some of their independence.”

“We even go to customers’ houses—we had a couple of disabled customers that couldn’t set up Yarbo themselves,” Kohlmann said. “So, as a courtesy, we flew out there and set it up.”

Users who experience accessibility challenges may need that help. User interfaces on IoT devices often are difficult to operate for everyone. Goldberg said that one of the first things companies targeting the disability community should consider is “making sure it’s fully operable by someone who can’t see, someone who has limited mobility. And that it shouldn’t be too complicated.”

“I think the internet of things in general has always been a real, shining opportunity for people with disabilities,” Goldberg said.

Abstract image of the wheelchair symbol for disability, created out of lines and dots, indicating a digital nature; black and blue background

Accessible IoT products open door to disability market

“You see the big 10 companies—almost the entire Fortune 500—realizing they need to make their technology more accessible and that there’s a market they need to serve,” an expert tells IT Brew.

Automated devices are popping up all over, inside and outside the home—and the connectivity they require for updates, instructions, and programming could open the door for threat actors.

At tech showcase CES in January, autonomous internet-of-things (IOT) startups were on the floor showing off their products.

Ensuring IoT devices are safe and secure is important to users, Rapid7 Principal Security Researcher Deral Heiland told IT Brew, because if it can be hacked, it will be. Consumers are becoming more security aware and are going to be looking out to ensure the companies whose products they buy have their interests in mind.

“We need the vendors to step up and start thinking about, ‘Hey, I’m starting to see more awareness in our consumers from security, privacy, how my data is being handled,’” Heiland said. “I think it’s to their advantage that they make a statement on that and make that data available.”

One of the main threats from hackers attacking connected IoT devices is that they could be used to access vulnerable home networks. Heiland told IT Brew that while it’s a danger, it’s one that carries a risk-reward calculation for the average attacker that doesn’t necessarily line up.

“If there’s a vulnerability that would allow that level of attack on a device, then yeah, somebody could do that,” Heiland said. “Now, what would they gain? Often there’s not always a big gain for breaking into individual homeowner’s systems; you’re gonna, at best, get data about them, you’re gonna get maybe bank information about them. And that’s a lot of work.”

Pool cleaning robotics company Aiper’s machines operate autonomously, using network connectivity and an app for scheduled programming. The app-controlled pool cleaners are serialized to specific accounts, Aiper Director of Sales James Loria told IT Brew, meaning that the security will be similar to that of an iPhone.

“If someone were to steal it, they can’t do anything with it,” Loria said.

Lawn care company Yarbo’s machines connect with home networks via wi-fi, 4G, or LoRa, Yarbo VP Kenneth Kohlmann told IT Brew, and uses a roughly 100-strong IT team with members based in New York, Chicago, and Shenzhen that remotely patches vulnerabilities.

The company pentests its products to detect any areas of concern, and has a token generation 

 system in place to ensure security. Yarbo also relies on a virtual layer that acts as a secondary buffer, meaning if hackers access the machines, they’re still faced with another overlay to break through.

“It uses an SSL certificate, and then we have a token system,” Kohlmann said. “So, basically, every time we request something from our server, we have to supply a token that’s only good for an hour. After that hour, we have to reauthenticate every time.”

Web of connections overlaid over home appliances

Smart devices rely on connectivity to operate—here’s how they stay secure

“If someone were to steal it, they can’t do anything with it,” one expert assures IT Brew about his company’s products.

Love is in the air…and so are cyber scams.

Singles looking for companionship are always ripe targets for scams and hacks, and Valentine’s Day is no exception.

The holiday provides scammers and threat actors with opportunities to prey on the lovelorn through a variety of attack tactics—some of which are utilizing new technologies like AI and deepfakes.

David Divitt calls the attacks “romance scams.” Divitt, the senior director of fraud protection and experience at global identity verification firm Veriff, told IT Brew a romance scam is usually a process the attacker has put a lot of work into—and Valentine’s Day can offer a good opportunity to pull the trigger on extortion or theft.

“They could anchor around Valentine’s Day as, ‘I really want to come and see you, so can you send me money for tickets?” or, ‘I think it’s time we finally meet, so send me some pictures so I know what you look like,’” Divitt said. “And that kind of thing could be used as an anchor to convince the victim, unfortunately, to complete this scam.”

Hackers can use the information they obtain for myriad purposes, including manipulating the results of identity verification (IDV) sessions to impersonate victims.

“We are seeing the fraudsters trick the victim into doing an IDV session without them realizing,” Divitt said. “The fraudster might be trying to open up a crypto account in order to move some stolen crypto or take a stolen credit card and buy crypto with it. In order to do that, they need an identity.”

Threat actors are using more sophisticated methods to target their romance scam victims, deploying deepfakes and AI to supplement their existing tactics. Divitt warned that this technology has “massively pushed the boundary in terms of how easy it is to convince the victim.”

“Assuming they’re using the technology that’s at the leading edge of the deep fakes, it can look very, very realistic,” Divitt said. “They’re moving their head, they’re moving their mouth, talking...it’s really difficult to know that that’s not the real person that you think you’re talking to.”

While deep fakes aren’t 100% effective yet, the technology is moving quickly. Identity security firm SailPoint CISO Rex Booth 

 at CES in January that his company tested out the tech with employees, sending them instructions from CEO Mark McClain that were built by AI from public recordings of the executive.

Booth said that the results were “more effective from an offensive perspective than a typical phishing email”—and that’s for employees of a company focused on security. When live interactions can match that level of sophistication, he added, then the technology could present major threats to consumers. IT Brew asked if the tech has evolved to the point that an AI-generated deepfake could take content written in one language, translate it, and have a believable video speak to a target all in real time.

“Right now, the answer is no,” Booth said. “Is the answer yes in 12 months? It’s closer to yes.”

Divitt advised that users should take precautions when it comes to talking to people online you haven’t met. If you’re on screen, have them get up and move around. Deep fake technology hasn’t progressed to the point that it can mimic those kinds of movements. And if you’re asked for sensitive documents or money, proceed with caution.

“Trust your gut,” Divitt said, “and don’t be embarrassed to ask a few questions.”

Valentine’s Day brings out the AI and deep fake scammers

“They’re moving their head, moving their mouth, talking—and you could be having a video chat with somebody,” one expert tells IT Brew.

It’s been almost a month since CES drew more than 135,000 people 

 for the world’s biggest consumer tech trade show, and host Consumer Technology Association (CTA) is already planning next year’s event.

Preparation includes ensuring the digital security of attendees and vendors. There hasn’t been a hack on the CES show, CES VP and Show Director John Kelley told us, save an attack on the website “several years ago.” But networks have crashed and the show has experienced outages.

“We haven’t really experienced anything large scale, where we’ve had some sort of cyberattack,” Kelley said.

A recent spate of attacks on Las Vegas casinos and resorts like MGM and Caesars adds complexity to the security picture. As IT Brew reported, the MGM hack in September cost the resort company 

. Caesars reportedly paid “tens of millions of dollars” 

CES operates more than 2.5 million net square feet across more than 10 venues. The show uses different networks than the casinos do where possible, helping to ensure some separation between the event and affected properties, and checked in with the resorts on their level of protection. CTA and the venues have contingency plans for how to maintain continuity of service when there’s a network disruption.

“We started those conversations, last summer going into the fall, with each of the venues to ensure what security protocols they had in place—if there were any gaps, did we need to fill any gaps?” Kelley said.

That often involves talking with security and IT professionals in the venues.

“There is a community of IT professionals—CIOs, CTOs—who work for the properties; they share and exchange information on a pretty frequent basis,” Kelley said. “So if, for instance, something’s happening over at property X, then they share it with their counterparts over at property Y to say, ‘Hey, look, we’ve noticed some weird traffic on the network or this has happened here; make sure your house is in order.’”

How CES keeps attendees and vendors safe

 “There is a community of IT professionals—CIOs, CTOs—who work for the properties; they share and exchange information on a pretty frequent basis,” CES exec says. 

Connected devices are spreading throughout the bathroom, and this increasingly wide stance has increased the need for cybersecurity precautions to get ahead.

Bemis Manufacturing’s Bio Bidet debuted a new Bluetooth-controlled toilet seat fixture that’s controlled from your phone at this year’s CES. The Bemis Living app, which controls the device, eliminates the need for yet another piece of hardware sprinkled in among your toiletries.

“The purpose of the app is to replace the need for the remote,” Bio Bidet Digital Marketing Coordinator Anna Xiong told IT Brew. “Most people bring their phone to the bathroom; it’s one less thing you have to hold in your hand.”

Given the nature of the app and the sensitivity of where and how it’s used, there are some protections built in, including skin detection to avoid the spray going off unexpectedly.

Bio Bidet isn’t the first company to look at cybersecurity concerns for the toilet. At last year’s CES, IT Brew talked with French company Withings about their urinalysis device and how it tracked health data and 

. And this year, Kohler debuted a $10,500 

But with a product as potentially physically sensitive as an app-controlled bidet, there are some security concerns—notably that someone in the home could prank the person on the toilet.

Bio Bidet has a proximity sensor that the company’s marketing director, James Amburgey, told IT Brew is meant to add another layer of protection.

“There is a proximity sensor, and we’ve been really conscious of the radius in which it operates to help mitigate some of that,” Amburgey said.

The bidet seat is also end-to-end encrypted, Amburgey said. And users can utilize the app to control air, seat temperature, and intensity. Plus, Xiong told us, “if you have a cleansing style that you like, then you can save it” for future use.

As products like Bio Bidet try to differentiate themselves and make a splash, protecting data is something all new companies will need to get behind.

App-controlled bidet comes with security concerns, solutions

“There is a proximity sensor,” a company representative assures IT Brew. 

Silicon Labs CEO Matt Johnson sees the IoT industry tracking upward, he told us at 

. Johnson, who’s led the wireless connectivity company for two of his six years there, said that return on investment for device developers is looking good—and a lot of that has to do with consumer gadgets.

“Home has always been big in the IoT,” Johnson said. “But now it’s pervasive and almost everything is connected wirelessly.”

As IoT tech becomes easy to access and use, it’s become increasingly accessible. With that level of access has come an increased need for security.

Other companies are taking similar actions and turning to third party security experts for help. Owlet, maker of a “dream sock” that monitors your baby’s health, runs its products through a full gamut of tests for security before they go to market, company CTO Burc Sahinoglu told us on the show floor.

“We work with security providers like Bishop Fox, in the Bay Area; we ask them to do full penetration testing, hardware testing, device testing,” Sahinoglu said.

 for vulnerability reporting, something Rapid7 Principal Security Researcher of IoT Deral Heiland believes is a good indicator that the company whose product you’re using is serious about security.

“If a company does not have a method for actually receiving reports around security issues on their product, you want to step away,” Heiland told us.

Managing consumer security needs and regulatory frameworks puts a lot of pressure on the private sector, Silicon Labs’s Johnson said. Balancing security and compliance means having IT teams and dedicated SEC ops teams is “the new normal.”

“It’s frustrating, but you just gotta adapt to it because it’s not going to go away,” Johnson said. “It’s just going to continue to get more advanced—and worse.”

People at the 2024 CES event in Las Vegas.

As connected devices become the norm, an increase in security needs

“It’s just going to continue to get more advanced—and worse,” Silicon Labs CEO Matt Johnson tells us.

Your devices are all talking to each other on your network—and opening up a new front in the hacking wars.

IoT was a major part of this year’s CES. The show highlighted products across the home, from app-controllable bidets to AI-powered baby monitors. The sector is growing, Rapid7 Principal Security Researcher of IoT Deral Heiland told us, and so is the threat surface.

“If there’s a vulnerability that would allow that level of attack on a device, then yeah, somebody could do that,” Heiland said.

Heiland, talking with IT Brew at CES, took care to note that the return on investment for an attack on an individual’s home usually doesn’t make a hack worth the effort—though that calculation may be changing in the era of remote work. Covid led to an increase in people working partly or fully from home, a “potential attack vector.”

“Instantly, these home networks are an extension of your corporate networks,” Heiland told us.

With more connected devices comes a larger network of threats to manage, Silicon Labs CEO Matt Johnson told IT Brew. Speaking just off the show floor, Johnson said IoT tech has reached the level of technological sophistication and low cost where “it’s pervasive and almost everything is connected wirelessly.” With that explosion in innovation have come concerns over security, naturally, because if “we can’t trust the devices, we won’t use them.”

Legacy devices are the biggest problem, Johnson told us. Home networks may contain any number of older devices which are still connected to your router, and many, if not all, will have out of date or weak security. Consumers should keep that in mind, and take basic precautions.

“I know this sounds ridiculous, but just, super simple test,” Johnson said. “You go to your home network, and do a scan of your network and look at all the devices and IP addresses out there. Do you know what everything is on your network?”

You should also keep tabs on who’s providing the products you use, Heiland said. A good way to separate the good from the bad is to see which manufacturers and vendors foreground security on their company websites. Keep an eye out for reporting capabilities.

“They should be able to communicate those key areas out there—privacy and security on their technology—and have ways of communicating,” Heiland said. “If a company does not have a method for actually receiving reports around security issues on their product, you want to step away.”

An close-up of a computer screen showing a cursor and the symbols for lock and home.