'Smart' fridge among over 100,000 devices hacked to send out spam

A fridge was among more than 100,000 devices hacked by cyber criminals to send out spam emails - in what may be the first proven cyberattack on household "smart" appliances, researchers say.

The global attack campaign involved more than 750,000 malicious email communications coming from more than 100,000 everyday consumer gadgets such as home-networking routers, connected multi-media centres, televisions and at least one refrigerator that had been compromised and used as a platform to launch attacks, researchers said.

Personal computers can be unknowingly compromised to form robot-like "botnets" that can be used to launch large-scale cyberattacks.

Scientists at California-based security group, Proofpoint, found that cyber criminals have begun to commandeer home routers, smart appliances and other components of the Internet of Things(IoT) and transform them into "thingbots" to carry out the same type of malicious activity.

The attack that Proofpoint observed and profiled occurred between December 23, 2013 and January 6, 2014, and featured waves of malicious email, typically sent in bursts of 100,000, three times per day, targeting Enterprises and individuals worldwide.

More than 25 percent of the volume was sent by things that were not conventional laptops, desktop computers or mobile devices; instead, the emails were sent by everyday consumer gadgets such as compromised home-networking routers, connected multi-media centres, televisions and at least one refrigerator.

No more than 10 emails were initiated from any single IP address, making the attack difficult to block based on location - and in many cases, the devices had not been subject to a sophisticated compromise.

Instead, misconfiguration and the use of default passwords left the devices completely exposed on public networks, available for takeover and use.

"Bot-nets are already a major security concern and the emergence of thingbots may make the situation much worse," said David Knight, General Manager of Proofpoint's Information Security division.

"Many of these devices are poorly protected at best and consumers have virtually no way to detect or fix infections when they do occur," Knight said.

The 'Internet of Things' includes every device that is connected to the internet - from home automation products including smart thermostats, security cameras, refrigerators, microwaves, home entertainment devices like TVs, gaming consoles to smart retail shelves that know when they need replenishing and industrial machinery.