Slashdot Mirror

← Back to Stories (view on slashdot.org)

Securing Networks In the Internet of Things Era

Posted by timothy on from the glad-that-someone-finally-invented-things dept.

An anonymous reader writes "Gartner reckons that the number of connected devices will hit 26 billion by 2020, almost 30 times the number of devices connected to the IoT in 2009. This estimate doesn't even include connected PCs, tablets and smartphones. The IoT will represent the biggest change to our relationship with the Internet since its inception. Many IoT devices themselves suffer from security limitations as a result of their minimal computing capabilities. For instance, the majority don't support sufficiently robust mechanisms for authentication, leaving network admins with only weak alternatives or sometimes no alternatives at all. As a result, it can be difficult for organizations to provide secure network access for certain IoT devices."

106 comments

  1. Slashdot went dead ? by Anonymous Coward · · Score: 0

    Slashdot didn't pay their server bill ?

    1. Re:Slashdot went dead ? by Anonymous Coward · · Score: 0

      Not dead enough! Oh why does it have to be back up? Stay dead!!

    2. Re: Slashdot went dead ? by Anonymous Coward · · Score: 0

      Slashdot went beta. That might as well be a death sentence.

  2. One time pad by Anonymous Coward · · Score: 1

    Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years. Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.

    1. Re:One time pad by Anonymous Coward · · Score: 0

      Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years. Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.

      The same thing has held true for our disposable consumer society for a very long time. You usually replace your computing devices every few years too.

    2. Re: One time pad by Anonymous Coward · · Score: 0

      Recycling makes me feel good!

    3. Re:One time pad by Anonymous Coward · · Score: 0

      Yeah, except the servers then need to store several billion one time pads.

    4. Re:One time pad by Zero__Kelvin · · Score: 2

      "Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years."

      Assuming you will ever read this after posting as an AC, how do you propose the distribution of these One Time Pads will occur? How will each device determine which One Time Pads have been used and which haven't? What happens when you want to check your refridgerator contents from an internet cafe? Even if you can distribute a new OTP set efficiently and securely, how will that be synchronized? How, for example, will the other ten devices in your home know that one of them has a different OTP set installed without using the network? How will you keep people from performing denial of service attacks by invalidating your current OTP set? What happens if the device you use to manage OTP sets fails? How far into this post did you have to read before you realized that your idea is an EPIC FAIL, and you really hadn't given any actual thought to the problem?

      "Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.""

      What do you mistakenly think this has to do with OTPs?

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    5. Re:One time pad by Anonymous Coward · · Score: 0

      For personal use sneaker net works just fine. That's why I mentioned microSD cards. None of the problems that you mentioned present much of a challenge for personal use. These days most people carry smart phones capable of holding huge libraries of OTPs and exchanging them face-to-face.

      There is a large industry of talking heads and idiots that insist on complex insecure encryption approaches to justify their existence. You seem to have bought into their garbage. It is usually only necessary to risk using these algorithms between people who do not meet in meat space (e-commerce is the most common use where the key distribution problem is real). E-commerce is a large and important problem but it is not the same problem as personal communication with your friends, family and "things."

      The point about banks is that they already deliver a physical card to you every few years. The economics of non-volatile memory makes it inexcusable that personal financial transactions are not properly secured with OTPs. Unfortunately they don't seem to have the correct economic incentive.

      While, I'm on my soapbox OTP is also the reason that we know that the NSA mass surveillance can never be an effective tool against terrorist communications. It really IS all about the metadata, finding the connections between people and organizations -- perhaps years before any criminal activity is contemplated.

      Finally, to answer your question: yes I have thought about this a lot. I design secure communication devices for a living. They are used by the US government/military and undergo lengthy certification. I'm not just talking out my ass.

    6. Re:One time pad by Zero__Kelvin · · Score: 1

      "For personal use sneaker net works just fine. "

      Yes, I'll just sneakernet my OTPs to every light fixture, toaster, refrigerator and whatever else, fire up the UI, plug in the MicroSD card to the MicroSD Card Reader ... oh wait! Did I just suggest that all my light fixtures will have a UI and MicroSD card?

      I didn't read the rest of your post. You have a history of lack of forethought and I have no doubt it would be far too easy to blow holes in every other thing you wrote.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    7. Re:One time pad by Darinbob · · Score: 1

      Some devices use those, or smartcards. However some devices don't; they're too small, or are owned by utilities who don't want someone else messing with them, etc. A MicroSD is not necessarily secure either, how do you know if one has been removed and replaced with a fake? On-board flash with write protected blocks is a lot safer, though at some point someone highly determined will break in (desolder things, etc).

  3. When was gartner... by Anonymous Coward · · Score: 2, Insightful

    When was gartner right about anything ?

    1. Re:When was gartner... by Cornwallis · · Score: 2

      Many many years ago Gartner said it cost some ridiculous amount of $$$ to support a workplace desktop. A little over a decade ago they said it would cost $3K/yr to support a handheld. I've never paid attention to anything they've had to say since.

    2. Re:When was gartner... by tepples · · Score: 1

      A little over a decade ago they said it would cost $3K/yr to support a handheld.

      How much did cellular voice and data cost back then?

    3. Re:When was gartner... by Anonymous Coward · · Score: 0

      I remember that one. According to Gartner's calculations, my workplace's desktop support costs exceeded my total IT budget by a factor of 2 or 3. They're right about a lot of things, but it's important to remember that they and the other big consulting/think tank firms will NEVER tell you do keep on doing what you're doing because you already know how to do that and are good at it. Instead, they want you thinking you need to be doing things you're not good at and therefore need their help with. Hence: the Internet of Things as the buzzword of the year.

      Luckily this one is easy to manage by yourself since it largely consists of putting things on the Internet that have no business being there in the first place other than making some marketer happy. Properly firewalling these things off with rules denying inbound OR outbound access or never connecting them in the first place is the correct and only suitable response. So is not buying them in the first place and, if possible, avoiding dealing with companies stupid enough to make them. For example, I don't need my f*cking thermostat connected to the Internet, and if I do for some reason desire that, I don't need a managed privacy invading cloud app to get me hooked up to it. If you require such a setup to connect to your own stuff, you don't know what you're doing and shouldn't have one anyway.

      As long as I'm on that rant: Attention everybody who has some kind of managed security system with cameras inside your house: If you can connect to your camera over the Internet, so can the alarm company and anybody who bribes/bullies/legally compels them to.

  4. will NOT have learned from Target by dltaylor · · Score: 4, Insightful

    Most of the management types I've met have just enough functioning brain cells to kiss ass and repeat whatever mantra they learned in MBA school or during the most recent management retreat.

    Target was breached because HVAC maintenance had access to the same network as the POS terminals, which is inexcusable stupidity. Unfortunately, this is exactly what will happen with the IoT devices. Putting them on an entirely separate network (own APs for wireless, blinkenlights, ...) will cost something, and, since the CIOs don't spend hard time in a closed prison for exposing their systems, or the personal data of employees or customers, they simply will not authorize the expenditure.

    1. Re:will NOT have learned from Target by Anonymous Coward · · Score: 5, Insightful

      Exactly. I have yet to see a compelling argument or application for this "Internet of Things." I mean, it's a really catchy buzzword. I know my toaster is bored most of the day, having only 5 minutes' work to do each morning, and I can see where it might enjoy surfing the web during downtime. Maybe I'm just not very creative, that I fail to imagine the wondrous potential embodied in uploading my toast-cooking routine and consumption to the cloud. WTF do people want this?

      Until someone can explain the actual benefit to me, I'm going to see "Internet of Things" as a way to turn every object in my house into an advertisement and a potential hole in my already fragile network security.

    2. Re:will NOT have learned from Target by Anonymous Coward · · Score: 2, Informative

      The entire premise of the article as given by the headline "Securing Networks in the Internet of Things Era" is bogus. The hard shell soft core (aka boundary security) strategy isn't applicable to the internet of things, because the things are necessarily going to be on a "network" that an attacker can access: It's all wireless. If you can't get to them through the gateway, you can always talk to them directly over the air. You can't protect the things by protecting the network. (With more and more ways for hostile systems to access "internal" networks directly, network border security is increasingly becoming a useless strategy in general computing as well. Reflection attacks, where compromised internal hosts are used as stepping stones to get to the entire network, have been eating away at border gateway security for a long time anyway.)

    3. Re:will NOT have learned from Target by Anonymous Coward · · Score: 3, Interesting

      Exactly. I have yet to see a compelling argument or application for this "Internet of Things." I mean, it's a really catchy buzzword. I know my toaster is bored most of the day, having only 5 minutes' work to do each morning, and I can see where it might enjoy surfing the web during downtime. Maybe I'm just not very creative, that I fail to imagine the wondrous potential embodied in uploading my toast-cooking routine and consumption to the cloud. WTF do people want this?

      Until someone can explain the actual benefit to me, I'm going to see "Internet of Things" as a way to turn every object in my house into an advertisement and a potential hole in my already fragile network security.

      You want an explanation?

      Outside of IT, name 10 people you know who that have ever used the words "potential hole" and "fragile network security" when discussing their home wifi concerns.

      As far as your quest for a compelling argument, the audience hardly compels me with their brilliance. Consumers are for the most part children regardless of age, proven by the billions generated on some of the silliest shit in existence. Children want toys, not rules, hence the IOT we have today.

    4. Re:will NOT have learned from Target by alen · · Score: 1

      but imagine if you can put bread in your toaster and start it up on your phone in the shower so it will be perfectly toasted when you get out of the shower

    5. Re:will NOT have learned from Target by Zero__Kelvin · · Score: 1

      So maybe nobody mentioned this, but you do know that most homes, and even most companies, don't have CIOs, right?

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    6. Re:will NOT have learned from Target by Zero__Kelvin · · Score: 1

      If you can't get to them through the gateway, you can always talk to them directly over the air.

      Somebody should invent WPA2!

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    7. Re:will NOT have learned from Target by Opportunist · · Score: 1

      How did we ever exist without...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    8. Re:will NOT have learned from Target by Opportunist · · Score: 2

      And that's what's wrong with our world. The most important positions remain unfilled, I'm almost certain that I'm the only household around this area that has a CISO.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    9. Re:will NOT have learned from Target by dltaylor · · Score: 1

      Actually, they do, but the person in that position doesn't even know what it means, much less how to deal with it.

      Picture an internet where home users must havea license to access the iy, or hire a "chaffeur" to manage their systems and there are penalties for failing to secure them. Many fewer bot farms, I suspect.

    10. Re:will NOT have learned from Target by Zero__Kelvin · · Score: 1

      "Actually, they do, but the person in that position doesn't even know what it means, much less how to deal with it."

      Yes, and every computer owner is a software engineer; most of them simply don't know the first thing about software engineering*!

      * Substitute Slashdot member for computer owner to make the above statement true :-)

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    11. Re:will NOT have learned from Target by CaptainDork · · Score: 2

      This is wrong-think.

      People who support the, "users are stupid," mentality are asshats.

      Design shit that works the way it is supposed to. Expecting consumer paranoia is evidence of crappy system design.

      The first thing I test for when hiring is a flawed outlook like yours and when I do, the interview is over.

      --
      It little behooves the best of us to comment on the rest of us.
    12. Re:will NOT have learned from Target by NotSanguine · · Score: 1

      ...(With more and more ways for hostile systems to access "internal" networks directly, network border security is increasingly becoming a useless strategy in general computing as well. Reflection attacks, where compromised internal hosts are used as stepping stones to get to the entire network, have been eating away at border gateway security for a long time anyway.)

      Not useless, just not enough. cf. Defense in-depth.

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    13. Re:will NOT have learned from Target by Zero__Kelvin · · Score: 2

      "but imagine if you can put bread in your toaster and start it up on your phone in the shower so it will be perfectly toasted when you get out of the shower"

      This is Slashdot. Who the hell only eats bread once a week?

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    14. Re:will NOT have learned from Target by Darinbob · · Score: 1

      We already have an "internet of things", for many years now. Computers are things. Mobile phones are things. The difference is now smaller things are networked (not necessarily on the "internet" though), and things not typically networked. Ie, smart meters, remote monitoring devices and sensors, televisions. There are the things that are only extremely loosely considered to be networked, attachment via bluetooth.

      Many of those internet of things devices won't ever be addressable by the general public, and there won't be any "cloud". This stuff is not just about phones or social media. And many of the devices have quality security designed with a paranoia mindset rather than devices with an attitude to sell advertising.

    15. Re:will NOT have learned from Target by Darinbob · · Score: 1

      We already have better security than WPA2, which existed before WPA2 was invented.

      Wired networks are not necessarily more secure than wireless networks. The only thing wired networks provides is a minor physical hurdle. We have plenty of rs232 cables connecting vital infrastructure which is vastly less secure than many wireless devices.

    16. Re:will NOT have learned from Target by Zero__Kelvin · · Score: 1

      Is there some reason for your rambling? The OP said that anything wireless can be accessed by anyone in range. I pointed out how stupid that was. I never said there is no better security than WPA2 or that wired is automagically more secure than wireless. These are all fantasies you seem to have had spontaneously.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    17. Re:will NOT have learned from Target by Anonymous Coward · · Score: 0

      but omg social!! I have comcast social media service!!

    18. Re:will NOT have learned from Target by epyT-R · · Score: 1

      Yeah, but only because the net will then be so expensive and legally risky to use that people just won't use it very much.

    19. Re:will NOT have learned from Target by Anonymous Coward · · Score: 0

      How stupid that was? Anything wireless CAN be accessed by anyone in range. The only way to prevent shenanigans is to secure the device, i.e. make it refuse data from anyone who isn't authorized to talk to it. That is DEVICE SECURITY, not network security. What you fail to realize is that a secure wireless network is an abstraction. The "secure" part is only as secure as each individual device's implementation. The network can do jack shit to prevent an attacker from talking to a device.

    20. Re:will NOT have learned from Target by Zero__Kelvin · · Score: 1
      You're right. I should have mentioned that wireless security stopspeople from accessing the device, and makes it untrue to say that anyone withing range can access it. Oh wait ...

      " That is DEVICE SECURITY, not network security."

      All I can say is Holy Shit! I mean seriously. Holy Fscking Shit. The fact that you think device security isn't a subset of network security just boggles the mind.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    21. Re:will NOT have learned from Target by Anonymous Coward · · Score: 0

      And this is the exact problem.

      In the not-virtual-world nobody would say "just make it work how it is supposed to, regardless how stupid the user is"

      This is the exact reason why you have to get a driving license and cannot just get a car!

      "Why is is dangereous to point a loaded gun in my face and pull the trigger" - "Aehm, but..." - "Cut down your techno-gibberish and make it work!"

  5. That's ridiculous. Smaller is easier to secure. by Anonymous Coward · · Score: 1

    The most secure computing device in general use is also the smallest: The (mini-, micro-, nano-) SIM card in your GSM phone does crypto that's good enough for payment processing. NFC cards are the same technology, just wireless. These cards run on microwatts. If the internet of things is insecure than it's due to laziness and cheapness, not because there's a technological problem. Minimal computing capabilities my ass.

    1. Re:That's ridiculous. Smaller is easier to secure. by Anonymous Coward · · Score: 0

      Yeah well, I'm just not going to plug these "things" in.

      Now that's truly secure.

  6. Securing the Internet of Things is easy by Rosco+P.+Coltrane · · Score: 2

    The Internet of Things is a buzzword. Buzzwords don't need securing. Problem solved.

    --
    "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
    1. Re:Securing the Internet of Things is easy by Ol+Olsoc · · Score: 1

      The Internet of Things is a buzzword. Buzzwords don't need securing. Problem solved.

      Speaking of Buzzwords, just imagine a Sybian on the internet.

      --
      The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
    2. Re:Securing the Internet of Things is easy by Livius · · Score: 1

      It's not easy, since "Securing Networks In the Internet of Things Era" means exactly the same thing as "Securing Networks".

    3. Re:Securing the Internet of Things is easy by fisted · · Score: 1

      Honestly, there are enough sybians on the internet already...

      --
      CLI paste? paste.pr0.tips!
    4. Re:Securing the Internet of Things is easy by Ol+Olsoc · · Score: 1

      Honestly, there are enough sybians on the internet already...

      Yeah, but think about the business model.

      People could pay to give Felicity a good time, just use their credit card to keep them good vibes coming.

      Felicity too.

      --
      The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
    5. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 2

      It's actually not a buzzword, any more than the term network was a buzzword in the 1970s. Cloud is a buzzword. Web 2.0 is a buzzword. Paradigm can be a buzzword when used incorrectly. The IoT is a term that describes something that is not only implementable, but currently being implemented. It describes something that actually exists. There is no cloud. There is no seperate Web called Web 2.0. There is an Internet, and it does have things attached to it.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    6. Re:Securing the Internet of Things is easy by Anonymous Coward · · Score: 1

      It is a buzzword. The "Internet of Things" is just "The Internet". There is zero difference between the two beyond superficialities.

    7. Re:Securing the Internet of Things is easy by Opportunist · · Score: 3, Insightful

      Sorry, but "Internet of Things", the term at least, has become a buzzword. As you correctly identified, it's bullshit bingo material considering that pretty much anything connected to the internet almost invariably has to be a thing (apologies to all the cyborgs out there). The "buzzwordism" (I really hope that doesn't become a buzzword now...) lies in the term meaning something along the line of "appliances connected to the internet that were not supposed to be connected when they were originally created". Routers, switches, hubs, bridges... they are by definition supposed to be connected to some sort of network. They have no use outside of one. Computers, gaming consoles and maybe even TVs kinda "belong" on a network, because even though they have a use without, it kinda makes sense to connect them.

      It's different for what the appliance industry termed "white goods". Washing machines, dryers, fridges, stoves... they came into existence long, long before anything remotely resembling a computer or internet, and people don't immediately consider them something they would possibly connect to a network. Those are the "things" the "internet of things" talks about.

      And this is basically also the reason why "internet of things" belongs to the buzzwords. Or, maybe rather, buzzterms. It's a made up term that qualifies a certain group of items that makes no sense whatsoever outside the world of marketing.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    8. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 0

      No. It is not. You could argue with DARPA if you want, but the Internet was always intended to connect computers. While it is true that coke machines have been connected to the network by MIT as a novelty (for example), saying that the idea of connecting completely different systems to the internet for the purpose of doing something other than computing is just "the internet" is patently absurd.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    9. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1

      "bullshit bingo material considering that pretty much anything connected to the internet almost invariably has to be a thing"

      Well I've never played Bullshit Bingo, but the term refers to all that which is not for the purposes of computing. One could also argue that when someone is using the internet they are a person connected to the internet, and that when a location that did not have internet acces, that place now has internet acccess, and thus that place is now connect to the intenet. See also: I was going to go to that cafe, but they don't have internet :-("

      " Routers, switches, hubs, bridges... they are by definition supposed to be connected to some sort of network."

      Your mistake seems to be in thinking that the IoT refers to these devices. It doesn't.

      "Those are the "things" the "internet of things" talks about."

      Hey. You figured it out, if a little too late. All you have to figure out now is that you just pointed out why IoT is absolutely not a buzzword, but rather describes something new that actually exists, and continues to evolve.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    10. Re:Securing the Internet of Things is easy by tepples · · Score: 1

      Before or after Elop?

    11. Re:Securing the Internet of Things is easy by Anonymous Coward · · Score: 0

      No. It is not.

      So how do "things" make the Internet something other than interconnected networks?

      You could argue with DARPA if you want, but the Internet was always intended to connect computers.

      And these "things" run computers in them.

      While it is true that coke machines have been connected to the network by MIT as a novelty (for example), saying that the idea of connecting completely different systems to the internet for the purpose of doing something other than computing is just "the internet" is patently absurd.

      In what way beyond superficialities is it different? You've merely asserted it is different.

    12. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1

      "And these "things" run computers in them."

      That sentence doesn't even parse, but no. On a completely unrelated note, please look up the definition of computing*. The intelligent members of the universe thank you.

      * I'll even give you a hint. Cars aren't computers!

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    13. Re:Securing the Internet of Things is easy by Anonymous Coward · · Score: 0

      "...but the Internet was always intended to connect computers"

      What the fuck do you think the IoT is FFS? Your toaster doesn't get just a network card bolted on to the side. It comes with a small purpose built computer to run the interface.

      That is what is wrong with /. nowadays. You are all over this fucking thread with your bullshit and you know nothing at all about the basic tech involved.

    14. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 0

      " It comes with a small purpose built computer to run the interface."

      And the purpose of that small computer is not to ... wait for it ... act as a general purpose computer!

      "That is what is wrong with /. nowadays. You are all over this fucking thread with your bullshit and you know nothing at all about the basic tech involved."

      Actually there are at least two things wrong with Slashdot today:

      1) It has been flooded with peope who are too stupid to create a Slashdot account and don't understand that the purpose of AC is supposed to be to post when there is a reason why you would want to remain anonymous (e.g. you work at a company and want to provide inside info)

      2) Those same idiots don't know the difference between an embedded system and a general purpose computer.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    15. Re:Securing the Internet of Things is easy by NotSanguine · · Score: 1

      "And these "things" run computers in them."

      That sentence doesn't even parse, but no. On a completely unrelated note, please look up the definition of computing*. The intelligent members of the universe thank you. * I'll even give you a hint. Cars aren't computers!

      That's true. But How many computers are embedded in cars?.

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    16. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1

      That was the point actually*, but thanks for playing!

      *Putting a computer in something doesn't make the thing a computer

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    17. Re:Securing the Internet of Things is easy by NotSanguine · · Score: 1

      2) Those same idiots don't know the difference between an embedded system and a general purpose computer.

      Ooh! Ooh! Mr. Kotter! Mr. Kotter! I know the difference! But I'm not sure why that matters. Ask yourself this question (since you clearly haven't done so yet): What is the purpose of connecting anything to a network? To communicate with other devices. Whether those devices are toasters, routers, switches, fondue machines, laptops, automatic tie racks or smart phones is irrelevant. The raison d'etre for network connectivity is the same.

      Here's a good question for you. Is a smartphone an embedded device or a general purpose computer? A better question: Does it really matter?

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    18. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 0

      "What is the purpose of connecting anything to a network? To communicate with other devices."

      I'm learning something new from a guy with a ridiculously high SlashID now! Up until now I thought that the purpose of the internet was to allow people to communicate! Now I know it is was devices the whole time! RFC822 was just a ruse! That Tim Berners Lee guy? Just trying to throw us off the scent with has damn human readable content ruse! The ability to share documents? Again, it is about the devices sharing, not people! Network printers? Again, nobody was ever supposed to read the shit after it was printed!

      Yes kid, you are clueless.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    19. Re:Securing the Internet of Things is easy by NotSanguine · · Score: 1

      That was the point actually*, but thanks for playing! *Putting a computer in something doesn't make the thing a computer

      That is true. However, just because you embed a computer in something that's not a computer doesn't magically make that embedded computer something else. It's still a computer. And that computer will, assuming it has power applied and some code to execute, compute. I guess I'm not really clear on your point. Please elucidate. Thanks!

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    20. Re:Securing the Internet of Things is easy by NotSanguine · · Score: 1

      "What is the purpose of connecting anything to a network? To communicate with other devices."

      I'm learning something new from a guy with a ridiculously high SlashID now! Up until now I thought that the purpose of the internet was to allow people to communicate! Now I know it is was devices the whole time! RFC822 was just a ruse! That Tim Berners Lee guy? Just trying to throw us off the scent with has damn human readable content ruse! The ability to share documents? Again, it is about the devices sharing, not people! Network printers? Again, nobody was ever supposed to read the shit after it was printed! Yes kid, you are clueless.

      Again, I'm not clear on your point. I did get the ad-hominems (thanks for those, by the way -- that was very sweet!). And your attempt to ridicule me for my /. ID was especially humorous. What is more, at 47 years old, it is kind of nice to be called 'kid'.

      While having (with appropriate security controls) control systems and other devices connected to a network (note, I did not say "the Internet" although in appropriate circumstances that can be useful too) can be extremely useful, I'm no fan of connecting every damn fool thing to the Internet. There's no reason why I need to monitor my microwave oven (someone might be making popcorn -- that must be stopped!) or make sure that the bleach levels in my washing machine are optimal while I'm at the movies.

      Beyond that, go ahead and read the IP, UDP and TCP protocol specifications. I have -- and first did so nearly a decade *before* Berners-Lee, et. al. published the the HTTP protocol specification. The whole point of the TCP/IP suite, as well as the DARPA/NSFNet/Internet was to interconnect devices to facilitate communications. Having read and understood those documents over the last 20+ years, I can say with some confidence that they do not require that connected devices be "general purpose" or "human focused." New applications which take advantage of these protocols are developed all the time.

      SMTP and HTTP are applications that ride on top of the TCP/IP suite. They are applications which were developed to enhance the capabilities of interconnected networks. Others, such as the RPC spec are designed specifically for device to device communications.

      Leaving aside your sarcasm, ill humor and general negativity, I still don't understand what point you're trying to make. Other than attacking me what, if anything, are you trying to add to this conversation? That's not a veiled slur, I really would like to understand. Please elucidate. Pretty please!

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    21. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1

      " The whole point of the TCP/IP suite, as well as the DARPA/NSFNet/Internet was to interconnect devices to facilitate communication of people. -implied content added

      That's the part you don't quite seem to get. The difference between people and things seems to elude you.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    22. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1

      " I guess I'm not really clear on your point."

      That's OK. We'll just add it to the very long list of things you are not clear on.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    23. Re:Securing the Internet of Things is easy by NotSanguine · · Score: 1

      " The whole point of the TCP/IP suite, as well as the DARPA/NSFNet/Internet was to interconnect devices to facilitate communication of people. -implied content added

      That's the part you don't quite seem to get. The difference between people and things seems to elude you.

      I see. So your premise is that there is no *valid* purpose for computer networks other than to connect people to other people? Okay then. So, you've never heard of Networked Control Systems or automated data transfers or machine generated/updated databases or a myriad of other applications where people are completely irrelevant to the equation.

      I'm guessing you're not quite that stupid, so I'm going to assume you're trolling and ignore you. Ciao! Have a great day!

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    24. Re:Securing the Internet of Things is easy by NotSanguine · · Score: 1

      " I guess I'm not really clear on your point."

      That's OK. We'll just add it to the very long list of things you are not clear on.

      Please. Publish that list. Do you really get off on this whole trolling business? My feathers aren't ruffled, I'm not annoyed or upset. More than anything, I'm just amused at the mixture of insults, poorly delineated thoughts and general silliness on your part.

      In any case, why don't you go upstairs and raid mom's fridge while I discuss this stuff with the grownups. There's a good boy.

      --
      No, no, you're not thinking; you're just being logical. --Niels Bohr
    25. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1
      Great. Now show me where I said that networks have never connected things before prior to 2014*, then show me in the DARPA proposal where it talks about creating a network of things, or an IETF ratified RFC that specifies the protocols and implementation details that would be used to do it.

      "I'm guessing you're not quite that stupid"

      Great. Now if you could just figure out that you are quite stupid, we'll have made some headway.

      *Oh wait, that's right. I explicitly pointed out that they have, and used the MIT Soda Machine as an example!

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    26. Re:Securing the Internet of Things is easy by Opportunist · · Score: 1

      There are exactly three possibilities:

      1) You skimmed my post and replied to it bit by bit and your client does not allow editing.
      2) You did not want to understand what I wrote.
      3) I was not clear enough.

      In case it was 3 (in case it's one of the other 2, there is little I can do to improve understanding): The "internet of things" is a buzzword, by the very definition thereof (though one might argue that it's a compound buzzword since it's actually comprised of three words). It is "a word or phrase used to impress or that is fashionable". And it pretty much is that. It fits right in with the rest of the buzzword gallery. Just like every "good" buzzword, it uses simple, known terms to describe something that is supposedly new and exciting. The problem is, what it describes is not new or exciting. It's old technology used in a different way. Not unlike "cloud". A more serious and honest description would be that now appliances that weren't connected to the internet will now be connected. But that ain't edgy or catchy. So it's "the internet of things".

      "The internet of things", that sounds like the fridge is gonna have a chat with the stove to discuss what's going to be for dinner. And while there is a remote possibility that something like this might happen one day, that anthropomorphism of appliances is anything but warranted. Moreover, "the internet of things" sounds as if there would be a network where only these things talked with each other and nobody could interfere, completely ignoring that these "things" will be just as vulnerable to an attack as anything else connected to the internet.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    27. Re:Securing the Internet of Things is easy by Zero__Kelvin · · Score: 1

      "The "internet of things" is a buzzword, by the very definition thereof (though one might argue that it's a compound buzzword since it's actually comprised of three words). It is "a word or phrase used to impress or that is fashionable"

      No. You don't seem to know what the internet is, or how it works. There is an actual IETF and actual RFCs which describe actual protocols and standards. There are no IETF ratified RFCs for "the cloud" or "web 2.0", but there is / will be for IoT.

      ""The internet of things", that sounds like the fridge is gonna have a chat with the stove to discuss what's going to be for dinner."

      Very good. You are finally starting to understand the IoT. I skimmed your post, which is what I always do when someone has established that they are much more interested in proving how their cluelessness is spot on than learning what they frig it is they are talking about. Again, learn wht the IETF is and what an RFC is, and don't bother to post back. I accept your apology.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  7. Seperate VLAN. by Karmashock · · Score: 3, Interesting

    You can buy a router for 200 bucks that can do port by port VLAN or create different Wifi SSIDs that link to different VLANs.

    Put all your internet of things stuff on VLAN 2, then setup firewall rules that allow the hub for the internet of things devices to either communicate directly with a control system on VLAN1 or just go out to the internet. If VLAN 2 is compromised... it will not compromise VLAN 1.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    1. Re:Seperate VLAN. by dotwhynot · · Score: 3, Interesting

      You can buy a router for 200 bucks that can do port by port VLAN or create different Wifi SSIDs that link to different VLANs.

      Put all your internet of things stuff on VLAN 2, then setup firewall rules that allow the hub for the internet of things devices to either communicate directly with a control system on VLAN1 or just go out to the internet. If VLAN 2 is compromised... it will not compromise VLAN 1.

      What happens when your 200 bucks router is compromised?

    2. Re:Seperate VLAN. by Karmashock · · Score: 3, Interesting

      Same thing that happens when your router is compromised today. Its a zero sum game. At least the router has a chance of repelling an intrusion because it has some security features built into it. The IoTs stuff is naked.

      My worry with IoTs stuff is that an outside intruder will gain control over them through the internet. I'm less worried about a war driver tapping in from the street. The router idea should provide my computers protection from the shotty security of the IoTs.

      Ideally the IoTs stuff should not link to some centralized cloud server but rather host itself locally. If it does that, then I can set the incoming port numbers to something random and at that point its pretty unlikely anything is going to touch my system.

      Logging into my local hub of IoTs stuff should work something like this:

      https://myhomeiprandomportnumb...

      At that point while a breach is possible its just very unlikely.

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    3. Re:Seperate VLAN. by Opportunist · · Score: 2

      Routers are (hopefully...) a bit more advanced in their security makeup, considering that they are routinely used by people who don't think TCP is the three letter acronym for the Chinese secret service, not to mention that there has been a bit of time now to find bugs in router hard- and software and iron them out.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Seperate VLAN. by Anonymous Coward · · Score: 0

      Routers are (hopefully...) a bit more advanced in their security makeup, considering that they are routinely used by people who don't think TCP is the three letter acronym for the Chinese secret service, not to mention that there has been a bit of time now to find bugs in router hard- and software and iron them out.

      Routers are routinely compromised in large numbers today.

    5. Re:Seperate VLAN. by Anonymous Coward · · Score: 0

      personally I think that a wireless mesh network would work better for the types of things that people here are discussing. your toaster and your iphone both have enough power (both computing and electrically) to support fairly strong encryption a tiny chip in your jeans that lets you know when some one else has the same ones on when you pass them on the street by pushing a notification to your iphone/ smart watch, not so much. Thats where security holes are going to happen, granted in this example it wouldn't be severe but thats the idea.

    6. Re:Seperate VLAN. by Opportunist · · Score: 1

      Mostly due to people treating them like a box that is just supposed to be running, not caring about its security.

      Now ponder what's going to happen with appliances where their networks security issues will be exactly no criterion when it comes to picking them out, compared to security possibly playing at least a little one with routers where even home users at least somehow consider their role as networked devices. That's not really the case with e.g. a fridge.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  8. So ... by cascadingstylesheet · · Score: 1

    ... we need to have an insecure buzzword, to "change our relationship" with the Internet? Why?

    1. Re:So ... by Anonymous Coward · · Score: 2, Insightful

      You need to for the following reason.

      A billion people who are clueless will buy IoT refrigerators, TVs, toasters, lamps, thermostats, washing machines, dishwashers, and so on.

      Companies will cater to this market, and moreover will stop making non-IoT enabled devices.

      "No problem", you think, "I just won't put them on the network". But to get around this and ensure you can be data-mined, the devices will be designed not to operate without connecting to their "home base" advertising company.

      So the answer is: you need to "change your relationship with the internet" because you'll want to keep turning on your lamps, setting your thermostat, washing your clothes, refrigerating your food, etc.

      You might think, "OK, I just won't buy any new devices". That works for a while. But eventually devices break, people need new ones, and we'll be locked into the world of IoT.

      You might think, "don't buy those devices and they'll stop making them". But it won't work, because a billion other people will buy them, and a handful of people who refuse don't matter on this scale.

      That's why.

      HTH.

    2. Re:So ... by Opportunist · · Score: 1

      Do you write dystopian stories in your pastime? If not, you should.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re: So ... by Anonymous Coward · · Score: 0

      If you wrote an accurate description of reality in this day and age and showed that to somebody 20 years ago, it would be described as dystopian.

      We are now living in a dystopian era.

  9. Avoid IoT at all costs by sinij · · Score: 2

    There is very little upside to having various infrastructure devices and appliances networked. Downside are too numerous to list here, and securing them is overly expensive.

    Solution? Air gap it!

    1. Re:Avoid IoT at all costs by Anonymous Coward · · Score: 2, Informative

      Then you won't be feeding the ad and data mining engines. Devices will be designed not to work if they can't send your data back to their home base.

      Think I'm kidding?

      That's just the beginning. Wait and watch. You'll see. There's nothing you can do to prevent it, because people who don't think about things will ensure this model succeeds in the marketplace.

    2. Re:Avoid IoT at all costs by Opportunist · · Score: 1

      Just trust the free market.

      Or, put another way, rest assured the first thing I do when I find shit like that in my fridge is to create a server that tells my fridge everything is all right and plays a Tom and Jerry cartoon (sans PC-censoring) instead of an ad on the built in screen.

      I'll hand you the source when it's done. Just in case you prefer another cartoon

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:Avoid IoT at all costs by flyingfsck · · Score: 1

      Yup - an ethernet port is handy to configure something, but there is little need to hook every thingummababber to a network switch.

      --
      Excuse me, but please get off my Pennisetum Clandestinum, eh!
    4. Re:Avoid IoT at all costs by rthille · · Score: 1

      The trouble is, you might first have to conduct a side-channel attack on the crypto chip in your fridge to get its key so you can properly encrypt the messages to say "everything is all right".

      --
      Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
    5. Re:Avoid IoT at all costs by Anonymous Coward · · Score: 0

      Yes. And the number of people who will be able to do that is vanishingly small.

    6. Re: Avoid IoT at all costs by Anonymous Coward · · Score: 0

      Air gap it? How is that going to stop it communicating over wireless?

    7. Re:Avoid IoT at all costs by Darinbob · · Score: 1

      The advantages can be enormous though. Consider smart meters. Utilities didn't even know when there was a power outage with old analog meters, until enough customers called in no trucks would roll. That's because if they respond to the first call it's almost always a blown fuse in a home. Similarly utilities did not know even the most basic facts about their infrastructure, like whether a neighborhood is being delivered the right voltage balanced across the phases, unless they sent an employee out to check. Having sensors on the distribution and transmission grids allows monitoring what is happening. It can alert to problems or emergencies quickly, such as gas leaks. It even works in winter when the regular meter readers don't bother showing up for 3 months and just estimate your bill.

      Consider street lights and traffic lights. It would be a good idea to know soon when elements have burned out. We have cameras that detect traffic better than the eye-in-the-sky helicopter.

      Yes it would be a great jobs program to get rid of all networks, but the municipalities, utilities, and government agencies are going to cut corners and not send someone to monitor every few hours.

    8. Re:Avoid IoT at all costs by Opportunist · · Score: 1

      Here my faith is on the internet where it's sufficient if one person can do it and creates a crib sheet for everyone else.

      Outlawing this only means it will be moved to a server in a country named something like Generistan.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    9. Re:Avoid IoT at all costs by rthille · · Score: 1

      If you need the key embedded in the chip in your fridge, and the engineers weren't complete idiots and they aren't all the same, then downloading a script may not be enough, you may have to hook up a sensitive a/d converter and run 1000s of probes to determine the key. The potential pool of people who would do such a thing to avoid ads on their fridge is much smaller than those who would simply cover the screen with their kid's art.

      --
      Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
  10. No Default Route by Anonymous Coward · · Score: 1

    Most things like printers do not need to talk to the entire Internet. They just need to talk to the local network. So remove their default route. Without a route to the Internet, discover/communication/mischief becomes much more difficult. Its not perfect, but its an easy policy to remember. If it doesn't need to send packets out, then don't tell it how to get there..

    1. Re:No Default Route by flyingfsck · · Score: 2

      Yup - only enable services that are actually needed. That reduces the attack surface. A printer doesn't need a default route, a DNS server address, a FTP/Telnet server and many other things that HP and others enable by default in their printers.

      --
      Excuse me, but please get off my Pennisetum Clandestinum, eh!
    2. Re:No Default Route by tepples · · Score: 1

      Most things like printers do not need to talk to the entire Internet.

      Even with things like Apple AirPrint and Google Cloud Print? Or printing postage?

    3. Re:No Default Route by Anonymous Coward · · Score: 0

      Are you taking your medication? If not please go take it now.

      He said "most things like printers", not "all printers everywhere in every situation".

      Now why don't you try being part of the actual conversation for once instead of being an immature dink that attacks whatever part of a comment that you happen to fix upon.

    4. Re:No Default Route by tepples · · Score: 1

      My fault. I parsed "like" to mean "such as". I could do without the abusive language though.

  11. What's a thing? by tepples · · Score: 1

    connecting completely different systems to the internet for the purpose of doing something other than computing

    Define a "thing" and distinguish it from "computing" to help some of us understand. Is a printer a "thing"?

    1. Re:What's a thing? by Zero__Kelvin · · Score: 1

      Most of us have graduated from elementary school, and understand that "Internet of a bunch of things that aren't related to computing" is excessivey and unecessarily verbose. Clearly, you are a unique individual. It turns out that isn't always a good thing, BTW.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    2. Re:What's a thing? by tepples · · Score: 1

      Let me rephrase: What makes a thing "related to computing"?

    3. Re:What's a thing? by Zero__Kelvin · · Score: 1

      Let me rephrase: Attend an elementary school. They teach that now!

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    4. Re:What's a thing? by Anonymous Coward · · Score: 0

      Most of us have graduated from elementary school, and understand that "Internet of a bunch of things that aren't related to computing" is excessivey and unecessarily verbose.

      Yeah, that's why those of us with working brains realize that it's just called "The Internet".

  12. Lose Internet and your food spoils by tepples · · Score: 1

    Companies [...] will stop making non-IoT enabled devices. [...] the devices will be designed not to operate without connecting to their "home base" advertising company.

    Then there's an opportunity for a competitor to say in an ad "Do you want your food to spoil just because your Internet went out? You don't have to worry about that with a QSI refrigerator."

  13. You are probably correct... by bagofbeans · · Score: 1

    ..but in 30 years. Meanwhile, the toaster manufacturer needs Granny to be able to but and use it without explicitly pluuging in a network or configuring anything.

    So IOT devices will have to have wifi sneak capabilities, always trying to establish a wifi connection. They can continually try to crack encrypted wifis.

    It will be an interesting household with a few dozen nodes continually spamming the aether trying for connection.

  14. If it's got a std. BSD IP stack? This helps by Anonymous Coward · · Score: 0

    My FREE program for hosts file construction adds security, speed, reliability, + anonymity & does more, more efficiently by FAR vs. addons + fixes DNS' security issues:

    APK Hosts File Engine 9.0++ 32/64-bit:

    http://start64.com/index.php?o...

    Summary:

    ---

    A.) Hosts do more than:

    1.) AdBlock ("souled-out" 2 Google/Crippled by default)
    2.) Ghostery (Advertiser owned) - "Fox guards henhouse"
    3.) Request Policy -> http://yro.slashdot.org/commen...

    B.) Hosts add reliability vs. downed/redirected dns (& overcome redirects on sites, /. beta as an example).

    C.) Hosts secure vs. malicious domains too -> http://tech.slashdot.org/comme... w/ less added "moving parts" complexity/room 4 breakdown,

    D.) Hosts files yield more:

    1.) Speed (adblock & hardcodes fav sites - faster than remote dns)
    2.) Security (vs. malicious domains serving malcontent + block spam/phish & trackers)
    3.) Reliability (vs. downed or Kaminsky redirect vulnerable dns, 99% = unpatched vs. it & worst @ isp level + weak vs Fastflux + dynamic dns botnets)
    4.) Anonymity (vs. dns request logs + dnsbl's).

    ---

    * Hosts do more w/ less (1 file) @ faster levels (ring 0) vs redundant inefficient addons (slowing slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ os, & 1st net resolver queried w\ 45++ yrs.of optimization).

    * Addons = more complex + slow browsers in message passing (use a few concurrently & see) & are nullified by native browser methods - It's how Clarityray is destroying Adblock.

    * Addons slowup slower usermode browsers layering on more - & bloat RAM consumption too + hugely excessive cpu use (4++gb extra in FireFox https://blog.mozilla.org/nneth...)

    Work w/ a native kernelmode part - hosts files (An integrated part of the ip stack)

    APK

    P.S.=> "The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"

    ...apk

  15. total security for the IoT... by swschrad · · Score: 2

    don't plug toasters, TVs, fridges, etc into the Internet. the geniuses behind them don't even finish the software they're loaded with at the factory.

    --
    if this is supposed to be a new economy, how come they still want my old fashioned money?
  16. Retro-Security by Anonymous Coward · · Score: 0

    My security is retro.

    Let feds try and decode a PGP encrypted TRS-80 cassette tape.

    It takes my TRS-80 4D a little time to do the work but I'm fairly safe in knowing that file on the cassette is secure.

  17. Heh by Anonymous Coward · · Score: 0

    First rule of IoT networks: Most things will newer need network for anything...

    When the current IoT hype passes we are left with network that's not much changed and some badly engineered appliances that really don't need any networking capabilities..