Erik M. Kellerᴺᶠᵀ

A casino installed a smart fish tank in the lobby. Beautiful thing. Automated feeding. Temperature control. Remote monitoring. Connected to the internet. Obviously. Hackers found it. Exploited it. Downloaded the high-roller database. 10 gigabytes. Sent it to Finland. Using audio and video protocols so it looked like normal streaming traffic. The fish tank sat in the lobby maintaining water chemistry while stealing credit card numbers. The casino isolated the fish tank on its own VPN. Separate network. Segregated. Off limits to everything. Hackers didn't care. Broke through the isolation anyway. Once inside the fish tank's system. They pivoted to the main network. Quietly pulled data. Methodically. 10 gigabytes over time so nobody noticed. Nobody monitors fish tank outbound traffic. Why would they. It's a fish tank. When Darktrace finally investigated they saw it immediately. The fish tank sending massive amounts of data to an external IP. Using protocols designed for audio. Not data. Clear exfiltration. The only device in the entire casino that ever communicated with that Finland server. A fish tank. Not a computer. Not compromised credentials. Not a malware-laden email. A networked aquarium. The lesson everyone learned: IoT devices are security theater. You can secure them. Lock them down. Isolate them. They're still connected to something. Still vulnerable to something. And something will find them. Even if that something is just checking if a fish tank is running the default password.