McAfee highlights growing threat to IP-enabled devices

Medical equipment, industrial control systems and cars are increasingly at risk of attack in a world in which "everything we touch is IP-enabled", McAfee chief technology officer George Kurtz has warned.

Kurtz said at the firm's Focus customer event in London on Wednesday that the "massive explosion in non-PC devices connecting to the internet" has provided cyber criminals with a whole new set of technologies to attack.

Some 70 million pieces of malware are currently represented in McAfee's signature database, the equivalent of the total number discovered in the past 20 years combined, he said.

In addition, McAfee processes 100,000 new pieces of malicious code every day, 60 per cent of which is unique, while two million infected web sites are detected every month.

These threats are not confined to traditional devices, however, and Kurtz urged manufacturers of life-saving medical equipment to think more about security when engineering products.

He explained how a McAfee team of researchers had managed to hack an IP-enabled insulin pump with ease, for example.

"We were able to quadruple the dose remotely and without authentication," he said. "It really wasn't that hard, and some of the mistakes manufacturers are making are pretty basic."

Likewise, some cars today contain over 10 million lines of code and receive over-the-air updates, making them open to being hacked.

As the ground-breaking Stuxnet worm showed, industrial control systems such as the Scada technology manufactured by Siemens have also been singled out as new targets by malicious actors.

"I think Stuxnet is just the tip of the iceberg," Kurtz said. "It's a prototype, a model of what's already out there. We're already seeing the son of Stuxnet now with Duqu."

Kurtz also used his keynote to highlight the dangers facing smartphone users, arguing that several factors have come together to make platforms, in particular Android, more vulnerable than traditional computing systems.

"We've got an immature platform with not even basic security built in. You can't even get encryption on Android," he said.

"Then you get two or three releases a year, making it difficult for IT. It's a recipe for disaster."