Slashdot Mirror
Beware the Ticking Internet of Things Security Time Bomb
alphadogg writes: A panel of security experts, including from IBM, LogMeIn and formerly RSA, warn that IoT security is a growing threat because device makers haven't baked in security. IT security staffs are already inundated with safeguarding internal infrastructure and cloud-based resources, so guarding against a slew of new threats is likely to be overwhelming. LogMeIn's Paddy Srinivasan says most Internet-of-things OEMs "barely even have IT staff," so they aren't capable of developing rigorous security even if they wanted to. IBM’s Andy Thurai says most companies are rushing technology to market to try to monetize you as much as possible, and they aren't even willing to give you a cut for the data you supply. Regulations may help, but probably not enough and definitely not soon.
With Samsung recording data on the Smart TV's, it's not too far-fetched that the IoT will in large part be a system of tracking end users to inundate them with more targeted Ads.
Companies, rushing to get things out to market, not bothering to do enough testing, nevermind rigorously ensuring that they've secured their products?
Inconceivable!
Next you'll probably try and tell me that they'll threaten to sue security researchers that expose the inevitable flaws rather than simply fixing them.
Connectivity seems to be this decade's fin tail and chrome craziness.
I run DHCP, only allowing MAC addresses I want to get a routable address. And just in case, I also run a firewall where I can see what devices are connecting to the outside world.
The day my toaster tells me it NEEDS an internet connection to make toast is the day make toast over a campfire.
How come Slashdot never gets Slashdotted?
from back in the day when cars talked to you: "your door is ajar". fail. a local woman wrecked her new car when she heard "spirits" talking to her.
The difference is the number and sneakiness of systems thus compromised.
Back in the day, when an 8086 was real money and whatnot, you could be fairly sure that only the identifiable computer on your desk was sophisticated enough to be disobeying you; because you couldn't afford enough transistors, even if the market could supply them, for anything else to be.
Now, thanks to Progress, basically anything from 99 cents on up is probably turing complete, phoning home to the mothership, and host to a mixture of 'consumer analytics platforms' and egregious security flaws.
Periodically some "things" on the IoT get revealed as publicly accessible. Cameras and conference room equipment particularly have caused problems in the past.
In homes, it may be some lolz to mess with lights of a stranger. It may be costly to the homeowner when someone modifies the HVAC settings to crank the programmable thermostat during the day. A skript kiddie could cause a neighborhood to all lose their AC compressors, and then we're talking tens of thousands, perhaps hundreds of thousands in some areas.
Controlling your television may not seem very creepy, but could be used as presence detection to see how long it takes for someone to turn it off or turn down the loud volume. Cameras on TVs are a great combination if thieves can guess your neighborhood, then identify your house, then identify you are not home.
Similarly with garage doors. That industry has come a long way, in the 70s and 80s you could get a universal garage door remote that would work on many homes in a neighborhood, some thieves would clean out the garages and close the door when done. New IoT garage remote controllers lack the basic protections implemented decades ago.
And most obviously, security cameras in and around a home are increasingly common as an IoT item. Do you REALLY want those images out there?
Many ISPs make it rather easy to iterate through neighborhoods as they provide convenient DNS access like c-111-222-333-444.town.state.comcast.net. A quick scan of a town to find all the customers with open security cameras, a bit of time to identify the homes in that neighborhood that look interesting on camera and have a few open IoT devices... and you've got a loot schedule. Most of the scans could be easily automated, only requiring some human criminals to look at them once they've found a neighborhood with enough interesting devices exposed.
//TODO: Think of witty sig statement
I remember new year's eve Y2K, and everyone expecting blackouts, etc.. and me driving around with an X10 wireless remote,
sending random commands to sequential channels. People's lights went on and off, burglar alarms (dis)armed themselves,
garage doors opened, sprinklers sprinkled water onto the cold pavement (with great ice potential). People panicked. X10 had no notion of authentication. Probably still hasn't.
Now, I had to drive around, because I was using a commercial-grade transmitter, my range and impact were limited.
Now, Imagine that kind of attitude, but with everything just a few network hops away, no range limits, and with the Invisible Hand clearly not having spanked the market into having a clue.
Image a person less mature than me and that same kind of attitude, today. Or several thousands of them. Spread over the globe.
I can image the havoc, I'm having trouble imagining the useful applications.. A matter of age? I'm not near to connecting stuff I don't have to.
Imagine what would happen if the Silons attacked, also.
While I'm not a fan of government regulations, they do play an important role in society. For example, car safety is as a result of government regulation. Unfortunately, many non-IoT devices don't get firmware updates. To make matters worse, the devices that manufacturers want to make IoT are often household durable goods (e.g. appliances, thermostats, etc.), that don't get replaced every year.
Personally, I feel that IoT durable good devices devices should get security fixes for 20 years--via regulation. Unwilling to do that? Then don't go IoT...
Windows 3.1x calc: 3.11 - 3.10 = 0.00
The Ticking Time Bomb of Car Fob Security is already upon us and I suspect that this will explode long before the IoT bomb even has a chance to finish winding up...
It is really that simple. That means don't buy Dropcam or a Nest or any of the other "easy to use" everything is stored "in the cloud" IOT devices that are out there and are the most heavily promoted.
There are nwtwork security cameras you can secure easily and control the recordings of. There are also "home automation" devices that only talk to each other within a defined area using reasonable encryption. You just have to be very careful and research what you are buying.
I note that in my last visit to BestBuy every IOT and home automation device promoted was more useful to the company who manufactured it that was collecting all the customers data than to the customer.
You can program your home router to block all outgoing traffic except from devices you select and you will find that many IOT devices will no longer work if you block their ability to "phone home."
Facebook is billions of individual "Skinner Boxes." And if you use it you are the pigeon!
The primary issue as I see it with IoT is the lack of a good security model that ordinary people can reference. You wouldn't stick an unmanaged Windows desktop out on the internet, expose a service and expect it not to be vulnerable. Why would we treat an inexpensive gadget any different? Security happens in layers, so if the device is going to be out on the internet then it needs a firewall protecting it, it needs some intelligent filtering so private data doesn't leak out (even to the device vendor) and malicious exploit attempts don't get in, it needs to know how to allow only your devices like your phone inbound and not just anyone on the internet. It needs a serious password and it needs encryption where appropriate. I'm not sure what products exist at a reasonable cost in the market today that are up to the task. The products at a reasonable cost that don't take high level network expertise may not exist at this point. Another concern that will come out of the lack of a good security model is that many services may not go from your phone or laptop to the device directly, they may place the service provider in between, in which case it becomes very hard to allow only authorized users to attempt to connect and to treat the provider or vendor as an untrusted entity. In short, allowing the IoT device itself to be solely responsible for it's own security is a flawed model that will be certain to fail time and time again.
So, starting 12 years ago, ZigBee had a security working group to specifically address these very things. It was, of course, a pain in the neck in many ways. But it was intended to provide a good secure platform for developers and vendors.
On the other hand, TinyOS, starting in 2000 had very little in the way of security and has also not been adopted by much more than academics and experimentalists, or those who have other means of handling or avoiding the security issues.
These are always considerations and trades that must be handled.
Hi
We're working on a project (in public) to try to help secure out-of-the-box links from low-power cheap sensor nodes to the concentrator (or equivalent) in IoT networks.
Eg see:
http://www.earth.org.uk/note-o...
and
http://lists.opentrv.org.uk/pi...
to pick a couple of related items.
Anyone who'd like to help us get this right with solutions open source, please do contact us eg via @OpenTRV on Twitter or email.
Rgds
Damon
http://m.earth.org.uk/
not buying that crap. except my alarm system.
wait a minute...
if this is supposed to be a new economy, how come they still want my old fashioned money?
When an 8086 was real money, an 8048 was only a few bucks, so things haven't changed as dramatically as you make it seem.
No message needed.
You get hacked via a company's product, company pays 3x damages. Doesn't matter if the company makes a web browser or a thermostat. Never happen, but it would solve the problem. Would also kill IoT in it's tracks.
today chips with 8048 cores are fractions of a penny in large quantity, so yes they have changed pretty dramatically
And what exactly is IBM going to do to help?
They're just pissed they're missing out. That's what happens when you lay off all your good employees. You're the last one to dinner.
Always the same story. They are just making the same mistakes again that have been made before with workstations, servers and mobile devices. But this time they really could have known better, so this can only be a combination of greed and stupidity.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It's a good point that as IoT devices proliferate there are security implications because your house will have dozens or even hundreds of devices all talking TCP/IP using whatever random protocols and implementations each device's manufacturer came up with.
That being said, I think it's unrealistic to imagine that each little company should hire their own security experts to make their own rock-solid stack, because many of these devices are home-made, or made by little startups, etc. And even if every manufacture aggressively tracked technology, users won't upgrade their firmware constantly.
Instead, I'd suggest that a better option would be to standardize the basic communications and develop a FOSS hardened communications stack for IoT devices, and push IoT producers to adopt it, so that everyone at least builds on a secure platform. There are many communications stacks for IoT, but the problem (IMO) is that they're generally proprietary by companies trying to "win" in a battle between IoT stacks, and because there are so many code bases, and they are proprietary, they can't be trusted, and even if they are trusted, they can't be used by all developers because they're tied to proprietary platforms.
So what we need is an IoT stack, secure and efficient enough to run on tiny processors (Arduino...) ideally grounded in an open standards group such as the IETF. And with a marketing program to drive all IoT platforms to adopt it. Of course, there can be multiple competing implementations as there are with all network stacks. That's valuable from a security perspective, because it prevents everyone from running one code base and thus having the same security vulnerabilities. And, of course, competition makes everything better, as they compete to be more efficient, secure, etc. As long as they are interoperable, and based on a fundamentally secure design.
Of course, this won't fix all problems - you can certainly build an insecure app on top of an secure protocol - but at least it'll eliminate a bunch of "basic" problems, like identity and securing streams, etc.
Enable 3D printed prosthetics!
What happened to them? I haven't seen or heard them for a while. I just see GoPro and others these days.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).