WASHINGTON _Your office may seem clean. But it's probably not. Invisible network pollution contaminates the space, and it may open a door to intruders.
The pollution comes from the growing list of internet-connected devices: cellphones, security cameras, thermostats, door locks, printers, speakerphones, even coffeemakers. Not all of them have up-to-date security patches or strong password protection. All of them are potential targets for hackers.
In a report titled to be released Monday, a Boston-based company says the connected devices that surround us at home and work concern technology security experts, who see the rise of a menacing new force.
"Our devices live in an open and free world. They connect to anything. They connect to good things and bad things. They don't know the difference," said Paul Paget, chief executive of Pwnie Express.
The problem, Paget said, is that much of the internet-connected world is contaminated with malicious code, or malware, "and your devices swim in that pollution."
Increasingly, employees carry their own devices to work, perhaps unwittingly bringing infections and malware into contact with office networks, or bring devices with weak defenses that can be hijacked forcibly recruited into a robotic network, or botnet, for attacks elsewhere.
The first major alarm about botnets arose on Oct. 21 when hackers used malware, which security professionals called Mirai, to harness an army of connected devices, mainly security cameras, to overwhelm a New Hampshire firm, Dyn, that is a backbone of the internet. The took down internet access in some metropolitan areas of the East Coast.
Suddenly, the risk of connected devices became a hot topic. Even the most mundane home or office device could seem dangerous.
"We now work in offices where the conference room whiteboards are smart, security cameras are wireless and speakerphones are Bluetooth. Even the coffeemakers are connected and can potentially open a back door to a rogue actor," says the report, titled "Internet of Evil Things."
To gauge a sense of shifts in the mood of information security experts, Pwnie Express surveyed 868 of them in 80 countries over three weeks ended Jan. 5.
Ninety percent said they were concerned about vulnerabilities in the connected world, the survey found, and 44 percent said they now worried more about random connected devices than traditional network security.
Two-thirds of the respondents said they didn't know how many connected devices employees brought into their workplaces. The same number said they either hadn't checked or didn't know how to check devices for the Mirai malware.
"They are highly concerned about it, and they don't know what to do," Paget said. "If they don't know what to do, then the fear starts to creep in."
Once focused only on the safety of equipment and computers they directly controlled, 60 percent of network security professionals now realize they have to worry about any connected devices brought into their workplaces, the survey found.
Yet only 8 percent said they could continuously monitor and detect such devices.
"That means less than 1 in 10 IT security departments could detect Mirai on a webcam, a printer or a device brought from home into an office," the report says.
Paget said company security professionals would increasingly have to monitor all connected devices in range of their networks, including the odd visitor with a Bluetooth-connected phone or even the wireless drone that flew overhead.
"Privacy laws come into play," Paget said, adding that security professionals will have to monitor the activity of such devices, "not touch the data, not inspect it, not drop agents onto machines, but understand what the behavior is."
