Slashdot Mirror
Beware the Ticking Internet of Things Security Time Bomb
alphadogg writes: A panel of security experts, including from IBM, LogMeIn and formerly RSA, warn that IoT security is a growing threat because device makers haven't baked in security. IT security staffs are already inundated with safeguarding internal infrastructure and cloud-based resources, so guarding against a slew of new threats is likely to be overwhelming. LogMeIn's Paddy Srinivasan says most Internet-of-things OEMs "barely even have IT staff," so they aren't capable of developing rigorous security even if they wanted to. IBM’s Andy Thurai says most companies are rushing technology to market to try to monetize you as much as possible, and they aren't even willing to give you a cut for the data you supply. Regulations may help, but probably not enough and definitely not soon.
With Samsung recording data on the Smart TV's, it's not too far-fetched that the IoT will in large part be a system of tracking end users to inundate them with more targeted Ads.
IBM’s Andy Thurai says most companies are rushing technology to market to try to monetize you as much as possible, and they aren't even willing to give you a cut for the data you supply.
When was this ever not the case?
Never mind the IOT security problems, we have security problems with our Things of the Internet. Networking equipment being compromised to distro malware... which should be scarier due to their, you know, traffic-handling capabilities.
http://pastebin.com/TL916tkA
http://pastebin.com/x1YqVv5T
http://pastebin.com/weeAZTQB
http://pastebin.com/wnQ3HKZ6
*some* of these people *claim* it isn't a default-password issue.
Companies, rushing to get things out to market, not bothering to do enough testing, nevermind rigorously ensuring that they've secured their products?
Inconceivable!
Next you'll probably try and tell me that they'll threaten to sue security researchers that expose the inevitable flaws rather than simply fixing them.
Connectivity seems to be this decade's fin tail and chrome craziness.
Doesn't matter, most WiFi IOT devices will never get packets out of the house. Home WiFi routers rarely handle more than 32 devices.
IOT will require all the home WiFi routers to be replaced to allow enough connected devices.
Let alone the radio interference it will create.
I run DHCP, only allowing MAC addresses I want to get a routable address. And just in case, I also run a firewall where I can see what devices are connecting to the outside world.
The day my toaster tells me it NEEDS an internet connection to make toast is the day make toast over a campfire.
How come Slashdot never gets Slashdotted?
from back in the day when cars talked to you: "your door is ajar". fail. a local woman wrecked her new car when she heard "spirits" talking to her.
If the NSA where not a reason enough to shutdown the IoT, the idea of hardware makers writting many embeded OS in every device sends a cold down my spine.
Hardware makers just don't care about software and they do shitty stuff. Having many of these devices around like that will literally means having software connected to a network that have not updated and is running a outdated and bugged version of a OS. It seems a recipe to disaster.
Periodically some "things" on the IoT get revealed as publicly accessible. Cameras and conference room equipment particularly have caused problems in the past.
In homes, it may be some lolz to mess with lights of a stranger. It may be costly to the homeowner when someone modifies the HVAC settings to crank the programmable thermostat during the day. A skript kiddie could cause a neighborhood to all lose their AC compressors, and then we're talking tens of thousands, perhaps hundreds of thousands in some areas.
Controlling your television may not seem very creepy, but could be used as presence detection to see how long it takes for someone to turn it off or turn down the loud volume. Cameras on TVs are a great combination if thieves can guess your neighborhood, then identify your house, then identify you are not home.
Similarly with garage doors. That industry has come a long way, in the 70s and 80s you could get a universal garage door remote that would work on many homes in a neighborhood, some thieves would clean out the garages and close the door when done. New IoT garage remote controllers lack the basic protections implemented decades ago.
And most obviously, security cameras in and around a home are increasingly common as an IoT item. Do you REALLY want those images out there?
Many ISPs make it rather easy to iterate through neighborhoods as they provide convenient DNS access like c-111-222-333-444.town.state.comcast.net. A quick scan of a town to find all the customers with open security cameras, a bit of time to identify the homes in that neighborhood that look interesting on camera and have a few open IoT devices... and you've got a loot schedule. Most of the scans could be easily automated, only requiring some human criminals to look at them once they've found a neighborhood with enough interesting devices exposed.
//TODO: Think of witty sig statement
I remember new year's eve Y2K, and everyone expecting blackouts, etc.. and me driving around with an X10 wireless remote,
sending random commands to sequential channels. People's lights went on and off, burglar alarms (dis)armed themselves,
garage doors opened, sprinklers sprinkled water onto the cold pavement (with great ice potential). People panicked. X10 had no notion of authentication. Probably still hasn't.
Now, I had to drive around, because I was using a commercial-grade transmitter, my range and impact were limited.
Now, Imagine that kind of attitude, but with everything just a few network hops away, no range limits, and with the Invisible Hand clearly not having spanked the market into having a clue.
Image a person less mature than me and that same kind of attitude, today. Or several thousands of them. Spread over the globe.
I can image the havoc, I'm having trouble imagining the useful applications.. A matter of age? I'm not near to connecting stuff I don't have to.
Imagine what would happen if the Silons attacked, also.
While I'm not a fan of government regulations, they do play an important role in society. For example, car safety is as a result of government regulation. Unfortunately, many non-IoT devices don't get firmware updates. To make matters worse, the devices that manufacturers want to make IoT are often household durable goods (e.g. appliances, thermostats, etc.), that don't get replaced every year.
Personally, I feel that IoT durable good devices devices should get security fixes for 20 years--via regulation. Unwilling to do that? Then don't go IoT...
Windows 3.1x calc: 3.11 - 3.10 = 0.00
There is a reason people are starting to call it the "Malware of Things" and that is we have already been down this road before and it turned out badly. This time down the new road there are plenty of bad guy type hackers licking their chops at a whole new playground of stuff to break into for nefarious gains.
The Ticking Time Bomb of Car Fob Security is already upon us and I suspect that this will explode long before the IoT bomb even has a chance to finish winding up...
It is really that simple. That means don't buy Dropcam or a Nest or any of the other "easy to use" everything is stored "in the cloud" IOT devices that are out there and are the most heavily promoted.
There are nwtwork security cameras you can secure easily and control the recordings of. There are also "home automation" devices that only talk to each other within a defined area using reasonable encryption. You just have to be very careful and research what you are buying.
I note that in my last visit to BestBuy every IOT and home automation device promoted was more useful to the company who manufactured it that was collecting all the customers data than to the customer.
You can program your home router to block all outgoing traffic except from devices you select and you will find that many IOT devices will no longer work if you block their ability to "phone home."
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
IoUT -- Internet of Unsafe Things
By putting insecure devices on the Internet, manufacturers are shifting the costs of internet security to the end users and their internet service providers.
It's about time we had a court case where a manufacturer was sued in court for being woefully negligent in the security features of their product and for companies like "Underwriters Laboratories" to start testing and certifying Internet-connected devices about whether they can be safely connected to the Internet out of the box (or not).
The primary issue as I see it with IoT is the lack of a good security model that ordinary people can reference. You wouldn't stick an unmanaged Windows desktop out on the internet, expose a service and expect it not to be vulnerable. Why would we treat an inexpensive gadget any different? Security happens in layers, so if the device is going to be out on the internet then it needs a firewall protecting it, it needs some intelligent filtering so private data doesn't leak out (even to the device vendor) and malicious exploit attempts don't get in, it needs to know how to allow only your devices like your phone inbound and not just anyone on the internet. It needs a serious password and it needs encryption where appropriate. I'm not sure what products exist at a reasonable cost in the market today that are up to the task. The products at a reasonable cost that don't take high level network expertise may not exist at this point. Another concern that will come out of the lack of a good security model is that many services may not go from your phone or laptop to the device directly, they may place the service provider in between, in which case it becomes very hard to allow only authorized users to attempt to connect and to treat the provider or vendor as an untrusted entity. In short, allowing the IoT device itself to be solely responsible for it's own security is a flawed model that will be certain to fail time and time again.
So, starting 12 years ago, ZigBee had a security working group to specifically address these very things. It was, of course, a pain in the neck in many ways. But it was intended to provide a good secure platform for developers and vendors.
On the other hand, TinyOS, starting in 2000 had very little in the way of security and has also not been adopted by much more than academics and experimentalists, or those who have other means of handling or avoiding the security issues.
These are always considerations and trades that must be handled.
Good luck firewalling every wall outlet when all your stuff is designed to phone home via IPv6 over AC.
And like smart TV's now, future devices won't fully work if firewalled. Because reasons, that's why.
Hi
We're working on a project (in public) to try to help secure out-of-the-box links from low-power cheap sensor nodes to the concentrator (or equivalent) in IoT networks.
Eg see:
http://www.earth.org.uk/note-o...
and
http://lists.opentrv.org.uk/pi...
to pick a couple of related items.
Anyone who'd like to help us get this right with solutions open source, please do contact us eg via @OpenTRV on Twitter or email.
Rgds
Damon
http://m.earth.org.uk/
not buying that crap. except my alarm system.
wait a minute...
if this is supposed to be a new economy, how come they still want my old fashioned money?
No message needed.
You get hacked via a company's product, company pays 3x damages. Doesn't matter if the company makes a web browser or a thermostat. Never happen, but it would solve the problem. Would also kill IoT in it's tracks.
And what exactly is IBM going to do to help?
They're just pissed they're missing out. That's what happens when you lay off all your good employees. You're the last one to dinner.
There no market in cryptolocker snatching and encrypting you fridge contents.
IoT is just convergence of already existing proprietary control systems with NO SECURITY to IP enabled systems that have little or add on security.
It's still totally 100% dependent on the Systems Integrator to asses the risks and install the systems securely, to a level that suits the end customer.
More than likely the swipe card you used to get into the office this morning sent the card ID in clear text as 1 & 0 on two 12V wires that pulsed low to send the 26bit sequential card ID. No Crypto, if your really lucky the card reader has a tamper switch to detect removal and access to the two wires.
Always the same story. They are just making the same mistakes again that have been made before with workstations, servers and mobile devices. But this time they really could have known better, so this can only be a combination of greed and stupidity.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
IoT idiocy. In the race to the connected home they forgot who should have the right to connect.
Russians now control your fridge.
Good day sir.
It's a good point that as IoT devices proliferate there are security implications because your house will have dozens or even hundreds of devices all talking TCP/IP using whatever random protocols and implementations each device's manufacturer came up with.
That being said, I think it's unrealistic to imagine that each little company should hire their own security experts to make their own rock-solid stack, because many of these devices are home-made, or made by little startups, etc. And even if every manufacture aggressively tracked technology, users won't upgrade their firmware constantly.
Instead, I'd suggest that a better option would be to standardize the basic communications and develop a FOSS hardened communications stack for IoT devices, and push IoT producers to adopt it, so that everyone at least builds on a secure platform. There are many communications stacks for IoT, but the problem (IMO) is that they're generally proprietary by companies trying to "win" in a battle between IoT stacks, and because there are so many code bases, and they are proprietary, they can't be trusted, and even if they are trusted, they can't be used by all developers because they're tied to proprietary platforms.
So what we need is an IoT stack, secure and efficient enough to run on tiny processors (Arduino...) ideally grounded in an open standards group such as the IETF. And with a marketing program to drive all IoT platforms to adopt it. Of course, there can be multiple competing implementations as there are with all network stacks. That's valuable from a security perspective, because it prevents everyone from running one code base and thus having the same security vulnerabilities. And, of course, competition makes everything better, as they compete to be more efficient, secure, etc. As long as they are interoperable, and based on a fundamentally secure design.
Of course, this won't fix all problems - you can certainly build an insecure app on top of an secure protocol - but at least it'll eliminate a bunch of "basic" problems, like identity and securing streams, etc.
Enable 3D printed prosthetics!
is at it again, preventing us from keeping our data safe. Incredible.
What happened to them? I haven't seen or heard them for a while. I just see GoPro and others these days.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Reboot the refrigerator, the toilet is overflowing!