Slashdot Mirror

← Back to Stories (view on slashdot.org)

Research Finds Shoddy Security On Connected Home Gateways

Posted by timothy on from the junction-box-is-open dept.

chicksdaddy writes Connected home products are the new rage. But how do you connect your Nest thermostat, your DropCam surveillance device and your Chamberlin MyQ 'smart' garage door opener? An IoT hub, of course. But not so fast: a report from the firm Veracode may make you think twice about deploying one of these IoT gateways in your home. As The Security Ledger reports, Veracode researchers found significant security vulnerabilities in each of six IoT gateways they tested, suggesting that manufacturers are giving short shrift to security considerations during design and testing. The flaws discovered ranged from weak authentication schemes (pretty common) to improper validation of TLS and SSL certificates, to gateways that shipped with exposed debugging interfaces that would allow an attacker on the same wireless network as the device to upload and run malicious code. Many of the worst lapses seem to be evidence of insecure design and lax testing of devices before they were released to the public, Brandon Creighton, Veracode's research architect, told The Security Ledger. This isn't the first report to raise alarms about IoT hubs. In October, the firm Xipiter published a blog post describing research into a similar hub by the firm VeraLite. Xipiter discovered that, among other things, the VeraLite device shipped with embedded SSH private keys stored in immutable areas of the firmware used on all devices.

88 comments

  1. No kidding ... by gstoddart · · Score: 5, Insightful

    suggesting that manufacturers are giving short shrift to security considerations during design and testing

    Well, that gets a big frickin' DUH.

    Until companies bear legal liability for writing shitty security code, this is exactly what will happen.

    The Internet of Stuff is lots of hype, and little security.

    The overwhelming majority of consumer products which want to connect to the internet have absolutely crap security, because companies want to get products out the door and don't care if they have lousy security.

    The solution is to treat the Internet of Stuff as exactly what it is ... a marketing term, driving products geared towards analytics and ad revenue, implemented by companies who don't give a crap about your security.

    Just don't buy it if you want security.

    I am completely un-surprised by this. In fact, I expected it.

    --
    Lost at C:>. Found at C.
    1. Re:No kidding ... by Anonymous Coward · · Score: 1

      It just reminds me of the people who have bought certain cheap networked cameras for watching babies or light surveillance work.

      While there are security features, they all shipped with a default password and with guest access as "on" by default.

      There was a site (maybe still is), where you could connect to people's cameras with your browser and stare over their shoulder into their office, or watch their kids play.

      Creepy as fuck, and a lesson about what manufacturers of small electronic items think of security.

      Sure, you can turn off those features, but they should have been off by default to start with. Don't think for a second that such a thing wouldn't happen to IoT devices.

       

    2. Re:No kidding ... by grimmjeeper · · Score: 1

      Trouble is, all of the gadget geeks that willingly fork over huge sums of money to have all this home automation stuff have no idea how vulnerable they are. Sadly, it's going to take someone using the gaping security holes to break into the house and do physical harm to one or more of the people in the house before anyone starts to pay attention.

    3. Re:No kidding ... by jbmartin6 · · Score: 2

      A better way to say this might be: the effort the manufacturer puts into security will be equal to the perceived risk. Since my garage door is already easy to open with a crowbar, the manufacturer might perceive that the risk of some wireless vulnerability is no worse than the risk I am already accepting by having a garage door in the first place. The same with vulnerabilities in my thermostat. What is the risk of someone hacking it and goofing with my temperature settings? They might feel this is not a real threat since there is no money involved for the theoretical attacker. And of course, as you point out, the risk to the manufacturer of lawsuits, etc. enters into the picture. As it stands now, they might plan to go into court and argue that since it was already easy to open the standard garage door there is no reason to make the wireless opener any more secure than that.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    4. Re:No kidding ... by Anonymous Coward · · Score: 1

      ^: This.
      Consumers aren't willing to pay for security. Companies will compromise on security/profit at every corner that isn't regulated (and on those that are :/). As the saying goes: Cheap, Good, Fast. Pick two.

    5. Re:No kidding ... by gstoddart · · Score: 3, Insightful

      And your thermostat? Your TV? Your TV? Your fridge?

      Sorry, but I've pretty much decided that the overwhelming majority of things (like anything which isn't a computer) have no damned need to be connected to the internet.

      They don't have cables plugged into them, they don't know the wifi passwords, and they never will.

      I have zero interest in an internet connected toaster or thermostat, so I'm simply not buying the damned things.

      A couple we know was telling us about these awesome new locks they got they can unlock their house with an app on their phone. I just bit my tongue until they asked a very specific question which made me respond "if you can open it from your phone who else can?"

      Essentially you have put the security of your home in the hands of a 3rd party. You might choose to trust that, but I don't.

      This was after I told her about the creepy "Hello Barbie" which wants to upload the conversations little girls have with their dolls to the internet so it can talk back to them.

      They'd immediately recognized they didn't want their grandchildren with one of those, but for some reason the lock thing didn't occur to them.

      Pretty much I just assume the people who write the "security" for consumer products are incompetent, lazy, or indifferent -- the net result is pretty much the same. You should simply expect the security is non-existent.

      --
      Lost at C:>. Found at C.
    6. Re:No kidding ... by Anonymous Coward · · Score: 0

      Unfortunately security ('Secure') is hard to get right, costs a lot and is a moving target. What you're asking for will likely never happen. If the government stepped in regulation would end up being something like - '[x] Manufacturer took reasonable steps to secure device' and you would end up in court arguing the definition of reasonable. They would no doubt come up with some phoney certificate 'Certified to Government Best Security Practices 2015' for the manufacturer to stamp on the packaging and the consumer would feel all warm and fuzzy.

    7. Re:No kidding ... by Mr+D+from+63 · · Score: 1

      You should simply expect the security is non-existent.

      That depends on where you draw the boundaries. People have locks on their houses but hide a key in the yard. You can say that is no security, but it is really reduced security.

      Just because there may be easier circumvention methods doesn't mean there is no security. And until there are actual attackers and not just potential attack paths, minimal security might be enough, or at least statistically better than someone breaking in the back door with a 4x4 (an actual experience of mine). When folks start hearing stories of houses being accessed via these means, they will raise their bars.

    8. Re:No kidding ... by jbmartin6 · · Score: 2

      "if you can open it from your phone who else can?"

      And who else can walk up and simply kick the door in? Is the risk of a break-in significantly changed by using the phone app? Why wouldn't anyone who wanted in simply kick in the door or just break a window? Some guy in a different country has no interest in unlocking my front door. My point is, does an app like that REALLY change your risk at all given how easy it already is to get in? Now if you are running a gold repository or something the equation is different, but for the typical wooden house owner I don't see it is any different.

      But I generally agree with you, I don't want Internet connected appliances of any sort. Even my 'smart' TV is disconnected.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    9. Re: No kidding ... by Anonymous Coward · · Score: 0

      That sounds good until a vast majority of sheeple accept the IoT (or accept it through complacency). Then we will have "Internet required" for basic settings on a fridge, toaster, or thermostat.

    10. Re:No kidding ... by internerdj · · Score: 1

      My regular locks can be bypassed by any idiot with a brick. If you've got enough intelligence to bypass a connected lock, then you've got enough intelligence to get into my house past my normal locks and probably just as quietly.

    11. Re:No kidding ... by gstoddart · · Score: 2, Insightful

      Well, I'll tell you what ... you buy any fucking piece of technology you like.

      Me? I think the trend to have this Internet of Stuff is mostly garbage products by people who think the world operates on a smart phone ... and that the 'security' on those products is incompetently written by people who don't care.

      I think until we get smart and apply data protection and security laws which says corporations have a legal responsibility to both protect your data and your security ... you should assume both your privacy and your security are in the hands of some asshole in marketing, and that the asshole in marketing doesn't give a crap about anything but his bonus.

      Because, that's pretty much what it is.

      --
      Lost at C:>. Found at C.
    12. Re:No kidding ... by Mr+D+from+63 · · Score: 3, Interesting

      I love my net connected thermostats. When I take vacation, I can turn the heat or AC down to save energy, then can connect on my way home and have the house at a comfortable temperature when I arrive. I have them programmed to lower the heat/AC during the work or school day, but can make a change on the fly if someone is home for the day. I can adjust the temperatures without getting out of bed if I have my tablet nearby. Programming for daily/weekly settings & seasonal modes via a web interface is much better than button pushing.

      I find it very useful and convenient. I know it has very limited security, but I also know the probability of that being exploited is extremely low as are the severity of the consequences. And I can check as often as I like and know if the settings were changed.

      I can't think of any reason to connect an appliance or lighting that would be nearly as useful or worth the cost.

    13. Re:No kidding ... by phantomfive · · Score: 1

      A better way to say this might be: the effort the manufacturer puts into security will be equal to the perceived risk.

      That might be a reasonable approach at some level, but I think the fundamental issue is deeper (and it is a serious issue for the IoT going forward):

      The problem is there aren't enough high-quality developers who understand security. To get security right, you can't just write code until it works. You can't copy code from SO and if it passes your test case, release. To write secure software, you have to think of everything that can go wrong (or at least try, it's sad how many programmers don't even try. This is what divides code-monkeys from software engineers IMO).

      Bruce Schneier says to write secure software you have to be devious, think like an attacker. That's a lot of work, and a lot of programmers don't know how to do it. They figure you can write in C#, Java, or Python, and your code is automatically secure. There programmers who know how to do this, but not enough.

      Since there are not enough programmers, the CEOs will find less competent programmers to do it, and it will be insecure. They have a choice between an insecure product and no product.

      --
      "First they came for the slanderers and i said nothing."
    14. Re:No kidding ... by Mr+D+from+63 · · Score: 0

      Fine, and you can continue to live with your fears and general hatred for anything corporate, while others enjoy little conveniences at very little real risk.

    15. Re:No kidding ... by gstoddart · · Score: 2

      Really, the availability of programmers isn't the main problem.

      Corporations bear no liability for writing crap security, which means they have no penalty for doing so. They might try a small amount of security to look good, but at the end of the day they simply don't need to care.

      So the security of these things is as inherently insecure as anything is which is doing on a "meh, whatever" level of effort.

      Marketing wants the product out the door, management wants to do it as cheaply as possible, and sales is already trying to figure out who all they're going to sell your data to.

      As long as they have no penalty, you should assume they're too lazy or incompetent to have any real security in place.

      I just simply don't buy devices which want to connect to the internet. Because I simply don't trust them.

      --
      Lost at C:>. Found at C.
    16. Re:No kidding ... by phantomfive · · Score: 1

      Seriously? Are you actually saying that because someone can break your door with a brick, then it's ok to not have secure internet connected things?

      Also, it's not about intelligence......script kiddies don't need to be intelligent, especially now that every exploit gets posted into metasploit.

      --
      "First they came for the slanderers and i said nothing."
    17. Re:No kidding ... by turbidostato · · Score: 1

      "A better way to say this might be: the effort the manufacturer puts into security will be equal to the perceived risk. Since my garage door is already easy to open with a crowbar, the manufacturer might perceive that the risk of some wireless vulnerability is no worse than the risk I am already accepting"

      Half true.

      The effort a manufacturer puts into security will be equal to the percieved risk... to them, not to you.

      People buy because of features, not because security and there's basically no liability for the vendor in case of (even hugh) security problems.

      So, imagine for a minute you are a vendor: each day it passes without puting your product in the market means expenses you have to affront without sales to compensate for them and risk of a competitor to reach the market before you do.

      Naturally you focus in the feature set and launch as soon as it looks like more or less being there, everything else be damned. After all, the worst that can come from a security problem with my gadget will be bad PR *IF AND ONLY IF* my gadget successes in the market, while the risk of reaching the market too late or at too a high cost, is bankrupcy, so let's focus on reaching the market first, which is already difficult enough.

    18. Re:No kidding ... by fuzzyfuzzyfungus · · Score: 1

      The trouble, of course, is that once you connect something to the internet(especially if every single unit phones home to one half-assed 'cloud management' server that can get cracked and compromise everyone without all the tedious IP-guessing), you make attacks in bulk, without regard for geography, trivial.

      Weak security on things that you need to be quite nearby to exploit certainly isn't good(and can make things like car theft or burglary easier); but they inherently limit the number of people you need to worry about. Once the internet enters the picture, anyone on earth with vague technical knowledge and income high enough to not be living in a box can potentially be messing with you, for fun or profit, or both.

    19. Re:No kidding ... by phantomfive · · Score: 1

      Really, the availability of programmers isn't the main problem. Corporations bear no liability for writing crap security, which means they have no penalty for doing so. They might try a small amount of security to look good, but at the end of the day they simply don't need to care.

      I disagree. Because even if corporations did bear liability, they would merely increase prices to cover the problem (that is what banks do.....if accounts get hacked or something, and they can't blame it on someone else, it's just the cost of doing business).

      Fundamentally, it doesn't matter how much you punish corporations, if there aren't programmers who know how to write secure software, they won't have secure software.

      --
      "First they came for the slanderers and i said nothing."
    20. Re:No kidding ... by Anonymous Coward · · Score: 2, Insightful

      My point is, does an app like that REALLY change your risk at all given how easy it already is to get in?

      Yes, it really makes it easier.

      If for nothing else than for not needing to make any harsh sounds and/or strange movements when breaking in. And for being able to do that thru the front door instead of having to find the physical weakest spot of the house. Might even make it look as if a housekey is used to enter. That means the breaking-and-entering might take place in broad daylight, with neighbours looking on and suspecting nothing.

      Also, there is something else you're probably forgetting: That burglar will now being able to "google" all vunerable houses from his comfy chair. Than he just needs to let his computer monitor a few of the IoT devices in those houses for a few days, and he'll even know when the occupants are most likely to be away from home.

    21. Re:No kidding ... by gstoddart · · Score: 2

      They'll do a hell of a lot more if the corporation can face punishment than if all they have to do is say "aww, shucks, we're not actually sorry".

      Because without penalties, you can pretty much guarantee they will do the barest minimum they can justify ... and that will range between "nothing at all" and "not very much".

      --
      Lost at C:>. Found at C.
    22. Re:No kidding ... by internerdj · · Score: 1

      Manufacturers should be investing in security, but me avoiding IoT devices that I find useful over security issues is pretty pointless.

    23. Re:No kidding ... by Noah+Haders · · Score: 2

      this is why I'm looking forward to the homekit framework. It handles security and connection of the multiple devices in the home, reducing the danger from any individual device that may be insecure. as long as a device is designed to be homekit compatible, then much of the risk will be gone. compare this to something like android in the home (or even worse, android in the car), where everything is open to haxors and other bad actors. imagine if android had access to your CAN bus in the car? those are some scary thoughts.

    24. Re:No kidding ... by JoeZeppy · · Score: 2
      This.

      Your ex-wife gets a restraining order and has the locks changed because shes tired of you beating her up. If you try to get in with a brick, she'll have time to call 911, or the neighbors will, but if you can slip in late at night when no one is looking, well, Bobs your uncle, eh mate?

    25. Re:No kidding ... by phantomfive · · Score: 1

      If you want to make laws that "software needs to be secure," I'm in favor, it will only increase my salary.

      But as mentioned earlier, in industries where there already are such laws, it's just the cost of doing business. Medical systems are some of the scariest insecure systems you'll find, as another example.

      --
      "First they came for the slanderers and i said nothing."
    26. Re:No kidding ... by phantomfive · · Score: 1

      Fascinating. Do you also not care if your computer is secure?

      --
      "First they came for the slanderers and i said nothing."
    27. Re:No kidding ... by Anonymous Coward · · Score: 0

      You receive remuneration from Nest or one of their competitors.

      Someone needed to point that out for the benefit of the other comment readers.

    28. Re:No kidding ... by YrWrstNtmr · · Score: 1

      A couple we know was telling us about these awesome new locks they got they can unlock their house with an app on their phone. I just bit my tongue until they asked a very specific question which made me respond "if you can open it from your phone who else can?"

      Exactly
      I recently bought a keypad deadbolt for my new front door. Specifically one without any wifi or smartphone connection crap. You actually have to touch it to open. Coworker of mine was extolling the virtues of the one he was going to buy, with smartphone, zWave, all that crap.
      I don't want the door to unlock simply because I am standing near it with the phone in my pocket.

    29. Re:No kidding ... by jeffmflanagan · · Score: 1

      That depends on if you have to give the devices Internet access, because someone can potentially take over your whole network via a non-secure IOT device. This stuff needs to stay inside your firewall with no outside connection until manufacturers take security seriously. I don't care if someone messes with my light bulbs, I do care if they wipe my servers via an IOT exploit.

    30. Re:No kidding ... by internerdj · · Score: 1

      Do I care if my valuables that can only be accessed virtually are protected by virtual security? Yes. Do I care that my valuables that can only be accessed physically have a virtual security flaw that is not any bigger than the security flaws with my existing traditional physical security? Not one bit.

    31. Re: No kidding ... by Anonymous Coward · · Score: 0

      Exactly. Also, this is modern capitalism at its finest. Rush an inferior product to market and hope you get rich before somebody tries to hold you accountable.

      Oh, and complain publicly and loudly about unspecified "regulations" and "job killing" and stuff when somebody finally tries to make you deliver a properly designed product.

    32. Re:No kidding ... by 0123456 · · Score: 1

      And who else can walk up and simply kick the door in? Is the risk of a break-in significantly changed by using the phone app? Why wouldn't anyone who wanted in simply kick in the door or just break a window?

      Let's see.

      1. Joe Burglar walks up to your front door, unlocks it, walks in. Neighbours assume he's just a friend as he walks out again with a bag full of your stuff and locks the door behind him.
      2. Joe Burglar walks up to your front door, kicks it in. Neighbours call 911.

      See the tiny little difference?

      I honestly can't understand why anyone would even think this 'Internet Of Things' crap is a good idea unless they make money from selling it.

    33. Re:No kidding ... by Anonymous Coward · · Score: 0

      And who else can walk up and simply kick the door in?

      Nobody, unless your door is made of cardboard.

    34. Re:No kidding ... by sjames · · Score: 1

      The key in the yard is probably safer. I can scan their house from miles away and nobody will know. Skulking around someone's front yard may bring hard questions.

    35. Re:No kidding ... by Anonymous Coward · · Score: 0

      Are you really hyping up product security for a product that doesn't exist? Do you consider yourself a fanboy?

    36. Re:No kidding ... by Rakarra · · Score: 1

      Manufacturers should be investing in security

      But they won't, until consumers choose a security-first mindset, which they won't.

      but me avoiding IoT devices that I find useful over security issues is pretty pointless

      Thanks for contributing to a less secure world! Yes, that's snarky, but the IoT so far has shown little upside in favor of creating yet more attack vectors. I like opening my fridge knowing that there's NO possibility that some worm found it's way in and raised the temperature, and now the food is spoiled. I don't need an internet-connected coffee pot, or oven, or any of things. Better yet, my regular devices don't slowly use energy all the time -- we should be looking for ways to reduce energy, not create more standby power draws so that advertisers can find out more about our personal lives.

    37. Re:No kidding ... by sjames · · Score: 1

      Given a few tries and a good bit of determination, my door could be kicked in. It would be much easier to break the window. However, both of those are noisy and look like someone is doing something wrong. Pressing a couple keys on a phone and then going right in looks like nothing out of the ordinary.

    38. Re:No kidding ... by Anonymous Coward · · Score: 0

      My regular locks can be bypassed by any idiot with a brick. If you've got enough intelligence to bypass a connected lock, then you've got enough intelligence to get into my house past my normal locks and probably just as quietly.

      Odds are good that your banking security can be bypassed with a brick applied to your ankles a few times too. Why not just go ahead and post it here, since any idiot with a brick could get it out of you anyway?

    39. Re:No kidding ... by sjames · · Score: 1

      There are programmers who know how to write secure software, they just aren't found in the bargain basement.

    40. Re:No kidding ... by hitmark · · Score: 1

      http://www.shodanhq.com/ ?

      --
      comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
    41. Re:No kidding ... by Waffle+Iron · · Score: 1

      When folks start hearing stories of houses being accessed via these means, they will raise their bars.

      Waiting to hear "stories" would be of no use if, for example, attackers choose to wait until a nationwide cold-snap and then simultaneously brick one million thermostats.

    42. Re:No kidding ... by tburkhol · · Score: 1

      My regular locks can be bypassed by any idiot with a brick. If you've got enough intelligence to bypass a connected lock, then you've got enough intelligence to get into my house past my normal locks and probably just as quietly.

      Breaking an insecure internet lock is not like throwing a brick through the window. A thief who knows how to break the internet lock can sit quietly at home and search the net for easy locks, rather like going up to your door and trying the handle, except he can do thousands of doors from his bedroom. Or drive down the street looking for the right broadcast./response. To someone who knows how to break the security, broken security is more like a bright neon "Rob Me" sign than a fragile glass window. You think it's secure because you don't know how to read the sign.

    43. Re:No kidding ... by Anonymous Coward · · Score: 0

      LOL a "secure" Apple product. Sure I believe that it is sooooo much more secure than android. Most android infections come from people installing software they shouldn't, but you can't call any product secure unless you can train the user to be more secure, or take away those options from them. Users are the security flaw, not the software.

    44. Re:No kidding ... by Anonymous Coward · · Score: 0

      I really hope you're not in technology. You're absolutely wrong in so many ways. The moment a vulnerability is located script kiddies go to town, SWATting is a thing because of a technology flaw. People are willing to bring potential physical harm to others for enjoyment, and you think it's about hating "corporate" things. It's about hating that consumers are viewed as too stupid to value security, that really isn't that difficult. You can do that same thing that these devices do on your own with far greater security for little cost, so it's the fact that we know security isn't that expensive, yet these companies specifically choose to put consumers at risk out of laziness. The worst part is that these people don't even need to come into your home to ruin your life, they *can* cause literal death (i.e. turning off the heat, turning up the heat, causing the garage door to close on someone when they aren't expecting it) from the comfort of their computer chair. If this isn't worth security, then I don't know what is.

    45. Re:No kidding ... by phantomfive · · Score: 1

      Yes, I agree. I would also believe that you are one of those programmers who knows how to write secure software.

      However, my point is, there aren't enough quality programmers like you for all the projects that people want to build. There are more projects that need securing than people who are capable of securing them.

      --
      "First they came for the slanderers and i said nothing."
    46. Re:No kidding ... by Mr+D+from+63 · · Score: 1

      There is a small possibility it would go down that way, but much more likely we'd see various other attacks beforehand.

      And if that is the worst case, then its really not that bad. Having a heating system break down during a cold snap is nothing new, and the fix for a bricked thermostat is quick and easy compared to a mechanical problem.

    47. Re:No kidding ... by FictionPimp · · Score: 1

      Joe Burglar walks up to the front door with a bump key. Spends 15 seconds opening it, and walks out with a bag of your stuff and locks the door behind him. Maybe we just shouldn't have doors at all!

    48. Re:No kidding ... by Anonymous Coward · · Score: 0

      You do realize modern door locks are seriously insecure right?

    49. Re:No kidding ... by cusco · · Score: 1

      What percentage of the population will be competent to take the thermostat off the wall and cross the wires? My wife would be afraid that she would be electrocuted, even if I were on the phone reassuring her that she wouldn't. A lot of people don't even have a screwdriver in the house. Really sad, but true.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    50. Re:No kidding ... by cusco · · Score: 2

      If someone is standing outside my door kicking it in there's a good chance one of the neighbors will call the cops, and if they see a broken window it's the same story. If someone walks up to the door and just walks in the neighbors will assume that they belong there. Some guy in a different country might be very interested in unlocking doors for his cousin/friend/business partner, or opening the garage door so that the moving van can back right in, especially if they have verified on your cameras that you're not home, your guard dog is a chihuahua, and the thermostat is set low enough that it's certain you won't be home for a number of hours.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    51. Re:No kidding ... by cusco · · Score: 2

      Kiddie porn sites have been found on Internet-connected multi-function printers, and at least one has been used as an entrance into a corporate network. An HVAC system was the point of entry for the Target attack. IoT junk will be used, probably sooner rather than later.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    52. Re:No kidding ... by cusco · · Score: 1

      Much of (if not most of) the medical equipment was never intended to be put on the larger corporate network. For example MRI devices were supposed to write to a DVD and be sneaker-netted to wherever the images were to be analyzed because transferring that much data over a 10 megabit network was unreasonable. Gigabit networks changed the scenery, and manufacturers just slapped a network interface on them and foisted the security issue on hospital IT staff.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    53. Re:No kidding ... by Mr+D+from+63 · · Score: 1

      I was just saying its a simple fix compared to a mechanical breakdown. A repair guy can do it in a few minutes if that is what it takes. If it is mechanical, it could take days for a part, or be very expensive.

      The point is that, given it being a low probability thing to start with, and coupled with the limited severity of the risk, its certainly an acceptable risk.

    54. Re:No kidding ... by phantomfive · · Score: 1

      That's true too, but I've worked on medical devices, and I know that's not the only problem.

      --
      "First they came for the slanderers and i said nothing."
    55. Re:No kidding ... by Anonymous Coward · · Score: 0

      FictionPimp walks into a slashdot article about security, does not recognize the difference in scope of security risk when talking about a smart phone unlocking a door via the internet vs. a bump key. But because I want to feed the troll some knowledge I'll bite,

      Number one, using the internet means that the person unlocking the door does not need to be physically at the door to open it. As such a disposable middleman can be used to commit whatever crime (outside of and including tresspass) ensues. This makes it harder for authorites to stop the group as some of the criminals involved are never seen by security cameras, neighbors, or the homeowners. There are no fingerprints, loose hairs, skin cells, or other physical evidience to implicate them. There are no witnesses.

      Number two, due to number one, your neighbors may not recognize the break in, as people tend to view the act of breaking in to require force. Using a button on a smartphone is effortless.

      Number three, it need not be a smartphone, it could be ANY internet connected device ANYWHERE in the world. Just because the manufacurer requires the use of an app on a smartphone (or worse a web interface!) does not mean that is the ONLY thing that can be used. Most hackers won't be using the manufacturer's approved software anyway, they will use their own self-made hacking software or software made by other hackers. (Unless the manufacturer's software is REALLY broken and a hacker can leverage a bug in it to gain access faster.)

      Number four, It takes time for society to catch up with new technology and the new methods to commit age old crimes they enable. I.e. The police may assume that because a smartphone was used to open the door, then you must have permitted the criminal onto your property. (Because that new fangled computer technobable will prevent that type of thing as it's "perfectly secure.") Or that your insurance company will make the same assumption and not want to pay out on your policy. Once again will your neighbors recognize the attempt?

      Number five, use of the internet to open the door is very silent. As such you may not be woken up due to the break in if you are sleeping, if it's a criminal who cleans up loose ends on a job, you may wind up dead if you don't have an early enough warning. (That's true day or night.)

      These are only some possible risks. There are more, but the real issue is not the use of a phone, the real issue is the use of the internet. Use of the internet to enable convenience to a system that's purpose is the exact opposite of convenience. It's purpose is security, and when you open up your security system to the world, you take on a lot more risk than just what is locally perceivable. Just ask the victims who appear almost WEEKLY as an article on /. They have huge amounts of resources, and they still get hacked.

      The only thing that protects you at this point is the fact IoT Home Automation systems are not widespread yet, and criminals have not yet fully begun to exploit them. But just like any other computer system in existance, given enough time, given enough of a payoff, or widespread use of the system, and they will start to hack it, they will start looking for exploits, and they will start using them. Linux was crowned by some as the "unhackable" system. Macs were before Linux, and there will be someone who will crown the next "unhackable" system in the future. They will all be hacked once the conditions are right. Your Home Automation system will eventually end up on the list. (It's a security system for a building for consumers, of course it will get hacked at some point once the number of users passes the threshold.) The question is, is the risk acceptable? And what can be done to reduce that risk? THAT is the point of the article. And the reason why the subject should not be scoffed at.

  2. This is not news by Avidiax · · Score: 3, Insightful

    Anyone that understands the economics of software/embedded device development understands that it's a market for lemons with respect to security (https://en.wikipedia.org/wiki/The_Market_for_Lemons).

    The customer can't easily distinguish between a secure and insecure product, so even if they cared, they'd have no way to provide an economic force to cause developers to prioritize security.

    1. Re:This is not news by Mr+D+from+63 · · Score: 1

      The customer can't easily distinguish between a secure and insecure product, so even if they cared, they'd have no way to provide an economic force to cause developers to prioritize security.

      And maybe they just don't care, and won't until there are actual reported cases of intrusion or whatever. Then more consumers will either become educated, get expert advice, or demand some type of warranty. That is how the market works.

  3. wardriving v2 might be more interesting by Trepidity · · Score: 1

    Instead of just fucking around on someone's wifi, the 21st-century's wardriving kids will be heating your house to 90 F, freezing your vegetables, and ruining your coffee!

    --
    10 PRINT CHR$(205.5+RND(1)); : GOTO 10
  4. OSS solution by ArhcAngel · · Score: 1

    I've been looking at OpenHAB. It is pretty comprehensive and compatible with many current IoT protocols. Being OSS it's open to peer/security revue. I am hoping it or something like it will gain mass scale adoption.

    --
    "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    1. Re:OSS solution by grimmjeeper · · Score: 1

      Open source gaining widespread adoption over commercial packages? You can hope in one hand and crap in the other. Guess which one will get filled up first.

    2. Re:OSS solution by ArhcAngel · · Score: 1

      The thing is this works with the most popular commercial packages, is cross platform (It''s JAVA based), and has clients for almost any use case. It's a pretty good glue for incompatible systems.

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    3. Re:OSS solution by grimmjeeper · · Score: 1

      I'm not sure the language it's written in makes any difference. But being standards based hasn't helped any other OSS project thus far. Why do you think this one will be any different? I know you want it to succeed. But why will it?

    4. Re:OSS solution by UnderCoverPenguin · · Score: 1

      and compatible with many current IoT protocols

      How many of these protocols support adequate security?

      Unfortunately, simply not supporting unsecure devices is likely to severely limit the market for a "secure IoT Hub". Manufacturers know this, so are very likely to to make "communicate with any device" the default setting..

      --
      Don't try to out wierd me, three-eyes. I get stranger things than you, free with my breakfast cereal. --Zaphod Beeblebr
    5. Re:OSS solution by Anonymous Coward · · Score: 0

      its also bloated garbageware that can barely run on a pi. 1000mhz and 512mb ram isn't enough to issue a command over i2c? lol wut

  5. Sigh by ledow · · Score: 3, Interesting

    Every single time something wants to cross the boundary between "sheltered device" and "available to the Internet", you have to see what it's doing or you'll run into this.

    This is the whole problem with things like UPnP, default "ALLOW ALL OUT" rules, etc. Devices want to talk out, and they'll punch holes to do it, and you don't have to be a genius here - connect their capabilities to find out what COULD happen.

    The Chromecast dongle has your wifi password in it. It has access to your network. It has access to your Google account. It has access to the HDMI port of your TV (which may include Ethernet?). Three of those are DANGEROUS (the fourth probably isn't but a lot of people have said similar things and been wrong).

    Now consider that it doesn't even need to be be Google that's malicious / incompetent to be a problem. Oh, look, all Chrome browsers on your local net can discover Chromecasts. And send data. Data encoded in complicated codecs which I've often seen in Changelogs because they allow overflows. Oh, look, third-party apps in Chrome are allowed to jump onto the Chromecast too.

    Join the dots. Unless you have security against those steps in the chain, there's nothing stopping the mere presence of a Chromecast dongle on your network being a vulnerability. They cost £30 so I doubt they could have a massively-overarching security audit that covers them for years in the future.

    Now apply that to your Nest equipment. To the apps on your phone (that game can read from SD card, allow in-app purchases, send text messages to your friends, whatever.... join the dots on ALL that it can do and see what could potentially happen!). To the junk that you plug into the network or wireless. It's a nightmare. And as soon as you break the line and let those things talk out (or be port-forwarded to) you have an Internet-facing vulnerability that amplifies everything a thousand-fold.

    This isn't shocking, unless you've been blind to the potential for the fifty years.

  6. This is not new. by lq_x_pl · · Score: 1

    In order to be consumer-friendly, they cannot be complex devices. Good security w/out complexity would lock most users out of their stuff. Good security w/out locking users out of their stuff requires complexity.

    --
    An internal system operation returned the error "The operation completed successfully.".
  7. Bigger problem - Re:No kidding ... by UnderCoverPenguin · · Score: 2

    The biggest problem I have seen with these connected devices is that many of them need to "call the mothership". While that does make it easier for the device vendors to support their products, it also means that could be used to determine when you are least likely to be home is being sent over the Internet.

    I have 3, separate, wired networks in my house. One is for the home automation system, and has NO connection to the Internet.

    The system does have IR receivers, so could be vulnerable to a phone or tablet app that sends IR signals using something like an IRED, so the IR receivers accept a very limited set of commands. BUT, the IR communications are one-way: Simple commands in, nothing out.

    --
    Don't try to out wierd me, three-eyes. I get stranger things than you, free with my breakfast cereal. --Zaphod Beeblebr
    1. Re:Bigger problem - Re:No kidding ... by Obfuscant · · Score: 1

      The biggest problem I have seen with these connected devices is that many of them need to "call the mothership". While that does make it easier for the device vendors to support their products,

      I've given up trying to find a router that doesn't have hardwired network connections to mama. The last router I bought makes repeated connections to an NTP server run by the company that makes it, to the point that there is no manual way to set the date and time and no way to change the configuration for NTP.

      I wanted to use this device behind a slow network connection where I already have a stratum 2 server of my own. The only way to do this was to hard-configure the first DNS nameserver to the nameserver on my network and put in entries for each of the 10 hardwired NTP servers. I asked customer support what all the names were, and they told me they were not permitted to tell me. That's ok, tcpdump and dig eventually got the information.

      Netgear WNR2000v5.

      And after a bit I found that it was also pinging an update server.

      That's not the worst offender. I have some internet-controllable power switches that send data packets off to some Chinese server for some reason that is completely undocumented. Customer service for that company claims it is to implement a dynamic DNS service.

  8. The underlying problem is... by YuppieScum · · Score: 1

    Simplicity.
    Interoperability.
    Security.

    Pick two.

    Companies want to turn a profit - security makes things complicated for typical end users, which translates into profit-sapping support calls and product returns.

    Why does anyone find this attitude surprising?

    --
    This sig left unintentionally blank.
  9. Home Automation can be secure by Anonymous Coward · · Score: 0

    Yes, you can do it securely... I personally use a Crestron system behind a Cisco router and remotely connect through SSL VPN. I can control the whole house on my iPhone from anywhere in the world securely.

    1. Re:Home Automation can be secure by YrWrstNtmr · · Score: 2

      I personally use a Crestron system behind a Cisco router and remotely connect through SSL VPN.

      To 99% of the population, that is complete gibberish.

    2. Re:Home Automation can be secure by phantomfive · · Score: 1

      That's kind of assuming your Cisco router and your iPhone are secure............which have been proven to not be valid assumptions.

      --
      "First they came for the slanderers and i said nothing."
  10. ADNA - another dumb, new acronym by Insightfill · · Score: 1

    Would it have been too hard to have explained "IoT" in TFS? I spent a long time trying to parse it until I hit on "Internet of Things". Really? What we used to call a bridge or router, is now a "IoT" hub or gateway (maybe both? TFS is vague). IoT is NOT widespread enough to be dropped like this.

    Come on, guys. At least make TFS standalone.

    1. Re:ADNA - another dumb, new acronym by TheGratefulNet · · Score: 1

      actually, IoT -is- a thing and has been for a while, now.

      one vendor has more levels, one of which is EioT (enterprise iot). enterprise, meaning wired cat5/6 cable with PoE and once you have network and power, you can put sensors all over the place, easily, with existing cables already in your building. at least, that's their push for -e- iot.

      iot is a new buzzword, its true. but its also implying 'cloud stuff' when it comes to consumers. that's the part I object the most to. the iot stuff I work on (my own projects) does not require or even use any cloud shit. all things are local on your network with things you setup and trust. if/when you want to gateway to some other public network, you then need permit/denies at very granual levels. if you are not prepared to do that, you have no business putting shit on the public internet.

      --

      --
      "It is now safe to switch off your computer."
    2. Re:ADNA - another dumb, new acronym by Anonymous Coward · · Score: 0

      At least make TFS standalone.

      Team Foundation Server is standalone. It hasn't been bundled with Visual Studio since the 2010 version.

      Or maybe you could just use a little context and fucking Google it. Because I figured out that you didn't mean Team Foundation Server in about 0.00001 seconds, and I doubt you're incapable of doing the same for "IoT", which is a term that has been plastered all over various bullshit tech sites for the last couple of years. And if that still doesn't work for you, JFGI.

    3. Re:ADNA - another dumb, new acronym by cusco · · Score: 1

      So you're saying there needs to be an Identification level of Internet of Things, an ID-IoT.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
    4. Re:ADNA - another dumb, new acronym by Anonymous Coward · · Score: 0

      Would it have been too hard to have explained "IoT" in TFS?

      Would it be too hard to explain what TFS means ? Something like "The Fine Story" perhaps ? Anything else ? Not even a quick google sheds light on it.

      In other words: In the very sentense you're complaining about others doing something you're guilty of doing it yourself ... :-\

    5. Re: ADNA - another dumb, new acronym by Anonymous Coward · · Score: 0

      wtf is tfs?

  11. The base stations shouldn't be secure by boondaburrah · · Score: 1

    Unless we're talking about base stations that connect to some online cloud service so you can control it from work, I want less security, not more. Really, the job of security should be left up to the router/gateway between my network and the internet. If the attacker's on my local wifi, I'm already hosed anyway.

    More importantly, leaving these devices open is good for extensibility. If the devices become secure, they become locked down. As it is, if my smartbrand a doorbell goes off I can have it tell my smartbrand b lights to turn on, etc. Security will solve a problem of a hacker getting in, but you can bet we won't get the keys for our own legitimate use.

    Secure your network, and let the devices do what they do best. Also don't connect them to the internet because damn, that sounds like a mess waiting to happen, security or not.

    1. Re:The base stations shouldn't be secure by Anonymous Coward · · Score: 0

      It's not really the IoT (Internet of Things) if you don't connect them to the internet...the whole point is remote access...

  12. So? by T.E.D. · · Score: 1

    What does that really hurt? I suppose if a neighbor mooches off my wifi, that hurts my ISP, but not really me.

    If it becomes a problem, at best I might wanna put up a wifi password to keep my neighbors off, but I don't really understand why my wifi (not the computers on it but the wifi itself) needs to have industrial-strength security.

  13. Call me ignorant.... by Shadowmist · · Score: 1

    But isn't this mostly alleviated if you secure your home WiFi network?

    1. Re:Call me ignorant.... by ledow · · Score: 1

      Visit a web page.

      That pages loads iframes etc. from the local network.

      Say, the router configuration page. Let's say certain models of router fail to adequately validate credentials before they apply setting changes you request, etc. and that you can request those settings change via HTTP POST/GET methods.

      Yes, some of this SHOULD generate security warnings. But it doesn't always. And that's the problem.

      People have had their home routers "hacked" by visiting a webpage which changed their home router DNS settings to a malicious provider. The attackers don't need to do anything on your home network, as such, because you do it for them. XSS vulnerabilities like this have existed for years and no browser has entirely eradicated them.

      What makes you think that other devices aren't just as insecure? It takes one default-open hole, one well-known credential, one hidden admin interface on your local network for something as simple as a web page load to cause havoc.

      And the point of lots of these devices is to be bale to talk in/out of your network with ease. They only need to send a single UPnP request to pop a port-forward to themselves and you'd barely be able to tell (one of the reasons many people disable UPnP, but I've been on dozens of home networks that have it on by default). And once they are exposed to the world, they become a front-line device on your network.

      Consider your home NAS, which might well have port-forwards for it's home-cloud features? Or things like ChromeCast that allow 3rd party browser extensions to stream video (encoded in normal formats and subject to the normal overflows) direct to the ChromeCast over your network. Once you start getting into more and more obscure, never-touched, never-monitored devices, your attack surface is growing all the time.

  14. Can't fix stupid by Anonymous Coward · · Score: 0

    Let's be clear, companies try and make these products to be setup by dummies. Its why for years we had WiFi routers coming out of boxes with no security enabled. Its why we had PnP so as to help the dummies communicate and setup their stuff in home correctly without spending 10 hours on a help line.
    The other aspect with remote controlled devices such as adjusting your thermostat from your smartphone, or locking your doors, or turning on your lights. Is that this ads another layer of complexity to the home network because it takes control outside of the home. Is this really needed? Or have we managed to become too dependent on technology that we can't remember to leave a light on or adjust a t-stat or we can't remember to lock our doors? Sometimes, you look at technology and need to ask is this really beneficial? and to whom is it beneficial? I think too many times we assume too much about our technology being secure.

  15. Not so simple to say "reject all connectivity" by kencurry · · Score: 1

    Because you are trying to balance reasonable security with some ability to manage all the stuff in your house, including locking doors and closing garages that your kids leave open. If you think of absolute security as a currency, you spend some of it to get the convenience of remote lock/unlock.

    --
    sigs are for losers (except to point out that sigs are for losers)