The data leak of Orvibo puts the spotlight on IoT

The researchers of the VPN testing, as well as review service, have recently discovered that it is a publicly accessible database that belongs to Orvibo. Moreover, Orvibo is a Chinese firm that runs a platform to manage the appliances such as smart home across the world, in the US and the United Kingdom.

SmartMate, the database of Orvibo has been found without any password protection. And it also contains over 2 Billion logs which belong to two million smart home devices around the world. The IoT devices also collect massive volumes of data when they are put into operation.

As far as the security implications of IoT is concerned, they are humongous. These logs also record several details/credentials such as passwords, usernames. On the other hand, they are only protected by utilizing MD5 algorithm, yet they are implemented without the protection of salt. 

When the database is operational, it tends to collect significant amounts of data - Moreover, the data increase with every tick of the clock. Furthermore, the customers are also exposed to the risk that malicious actors might access their account.

In spite of the numerous attempts for contacting the Chinese firm since the 16th of June 2019, researchers said that they are yet to receive the desired response. On the other hand, the data is still left exposed. If a breach is as significant as this, then the researchers noted that there were significant implications as much of the data are left exposed. There is also a possibility that the customers' account might be hacked in the future.

These accounts are also subjected to receive reset code, and this might be dangerous as the hacker will be able to lock out users for a very long time. The hackers can also change the passwords along with the email address; nevertheless, the actions are irreversible.

**This post was published on https://www.computerweekly.com