Slashdot Mirror
Stanford Starts the 'Secure Internet of Things Project'
An anonymous reader writes: The internet-of-things is here to stay. Lots of people now have smart lights, smart thermostats, smart appliances, smart fire detectors, and other internet-connect gadgets installed in their houses. The security of those devices has been an obvious and predictable problem since day one. Manufacturers can't be bothered to provide updates to $500 smartphones more than a couple years after they're released; how long do you think they'll be worried about security updates for a $50 thermostat? Security researchers have been vocal about this, and they've found lots of vulnerabilities and exploits before hackers have had a chance to. But the manufacturers have responded in the wrong way.
Instead of developing a more robust approach to device security, they've simply thrown encryption at everything. This makes it temporarily harder for malicious hackers to have their way with the devices, but also shuts out consumers and white-hat researchers from knowing what the devices are doing. Stanford, Berkeley, and the University of Michigan have now started the Secure Internet of Things Project, which aims to promote security and transparency for IoT devices. They hope to unite regulators, researchers, and manufacturers to ensure nascent internet-connected tech is developed in a way that respects customer privacy and choice.
Instead of developing a more robust approach to device security, they've simply thrown encryption at everything. This makes it temporarily harder for malicious hackers to have their way with the devices, but also shuts out consumers and white-hat researchers from knowing what the devices are doing. Stanford, Berkeley, and the University of Michigan have now started the Secure Internet of Things Project, which aims to promote security and transparency for IoT devices. They hope to unite regulators, researchers, and manufacturers to ensure nascent internet-connected tech is developed in a way that respects customer privacy and choice.
It is nice to have Stanford to pitch in to help my startup.
I prefer a Dumb Home. Our home is built of stone. It has no brains. It is solid state. It stores incoming solar and wood fired heat and then releases it slowly. It never freezes despite our very cold northern mountain winters. It's too much thermal mass to freeze. Dumb wins. The doors are manual. The windows are manual. The security system is operated by a pack of local wolves - they eat predators. We have no thieves.
Companies that make these devices are driven by business interests, not technology concerns. Which is what their shareholders expect and require. So the question isn't "Can someone hack this?" the question is "Given 0.001% of these get hacked, and our recourse is to return the $50 in a refund which is our highest liability exposure due to terms & conditions, that equates to five cents cost per unit. So if we are selling 10 million of these per year, we should not spend more than $500,000 on security engineering. That pays the full run rate for two full-time engineers. Hire them and see what they can do". We sometimes forget the economics side of things in technology arguments...
Just because I can hook a shark from a boat, I do no offer to wrestle it in the water.
TFA was "meh" at best, but why not design a secure architecture where the $50 device communicates to some type of secure hub (or hubs if one wants redundancy), and the hub is what communicates on the Internet. This way, only one device has to be hardened against attack via the Net. Yes, it doesn't stop attacks done at the LAN level... but any security is better than none, and it would help lock out all intruders except those close by in physical proximity.
This can be done a number of ways, by the central hub being a Wi-Fi AP, or just part of a BT PAN pairing.
To boot, if devices need to communicate with a remote site, there are many ways to communicate via secured link.
A hub topology is the proper way to do IoT. Letting every device go out via 3G or whatnot is only asking for compromise.
Realistically, if the device is "smart", it should just get passed up. If we don't pass up on these devices, we will be seeing fridges demands one sit through a 30 second ad before it unlocks the door, or the oven to allowing Slurm brand turkeys to be baked in it.
How to secure 'Internet of Things' things: Firewall them oRf from having access to the Internet.
Everyone I've seen selling IoT things have been selling "non-Internet connected network of things that we call IoT because that sounds cooler". The IoT is when the devices are connected to the Internet. Not when they are connected to a proprietary private network owned, controlled and managed by a single company, and "Internet" access is through a paywalled proxy. My home power meter is "IoT" and there is no way to access it from the Internet, directly or indirectly. Though the reports the power company pulls through their closed and private network are shared time-delayed in emails and paper reports sent out.
/56 for your personal items), and you can reach your own stuff from anywhere. When the "lock your door remotely" is app-based and locked into your Samsung phone, and Samsung home server, and lock from a short approved list that pays Samsung (sorry, the last IoT home demo I saw was one of Samsungs), that's not IoT, that's a Samsung home automation solution.
Similar are the mobile-phone network IoT car-based devices, a number of which will "IoT" when back at base, through secure WiFi to a private server, with no data in the loop *ever* traveling over the Internet (unless the customer buying the solution goes out of their way to send things over a WAN, that's still not Internet connectivity, just using the Internet for a private WAN).
The level of control around IoT at the moment prevents any IoT from working over the Internet. The IoT is when every device in your house is connected (probably IPv6, with a
Learn to love Alaska
You can't secure IoT, there is not enough value in each individual device to implement robust security. To make things worse - consumers don't understand security and don't put any pressure on demand side. The only way I can see the whole mess could be secured is with establishing secure perimeters and access control border devices.
For example, your house has ACME smart thermostat, ACME smart fridge, and ACME remote baby monitor device all connected to the Internet. Since ACME is competing/pressured based on price-point to keep their ShopMart contracts going, they have not spent any time securing their devices. It is 2025 and they are still stuck using badly-broken TLS 1.4! Fortunately for the consumer, home routers market stepped up and developed sophisticated access controls, reputation services, pattern-based communication analysis, and anomaly detection techniques. This way when a script kiddie attempts to exploit your thermostat, the router detects attempt and blocks the access to the IoT device.
We all have certain expectancies from products. Like owning what we paid for, and having the reasonable assumption that a random fishing hacker can't hack your gas oven and blow up your house. This all comes down to educated programmers. A programmer who isn't abiding by the ever evolving security standards and practices will leave your product looking like swiss cheese. Real life example being, an educated programmer will avoid SSLv3 in the first place even though it's the latest standard, and uneducated programmer will just go, version 3 is bigger than version 2, so it must be better. I personally prefer the not-so-smart toaster at my house, because one I don't have the time to reverse engineer yet another code base to analyze vulnerabilities, and the other reason being, it makes toast, I'm okay with sacrificing the ability to request a toast via my smart phone.
I'll be interested in the Internet of Things as soon as I can get an IPv6 address for my balls.
You are welcome on my lawn.
This actually sounds like a good thing--namely a Secure Internet of Things. But I think that might be a large undertaking. Perhaps they should start smaller with an Internet of Secure Things.
The internet-of-things is here to stay.
To the contrary, in my experience most things that have a catchy name before they are implemented go nowhere. Multicasting, Named Data Networking, Internet of Things, OLP, Web Ontology, Neural Networks, etc. The project is more focused in sounding trending than in finding reasons why things want to access the internet (presumably so that your toaster can watch youtube videos while you are away?)
Successful projects usually start from the other end. People first create a small iteration of the thing that proves the concept, it starts to catch up (fancy name might be created here but this is entirely optional) and one day you turn around and its taken over the world.
...from my experience with embedded engineers, the past cluster-f*cks implemented by that category of engineer (think SCADA), and the more-of-the-same coming down the pike (think "we'll just invent our own security rather than using proven solutions"), it's doomed from the start. These are guys that optimize down to the last 1/8 of a bit of RAM, the last 10Hz of processing speed, the last milliwatt of power. Given that mindset, they don't have a clue that security is a top line concern for anything that communicates with the outside world. The necessary solutions are just way outside their sense of scale.
There is also this intrinsic mistrust of anybody else's code, which is polar opposite to the instincts required to do proper security. Of course, if you see the crap code they get force-fed from the chip vendors, and anything else that has to run in 16K of code space, it's not hard to see where the bunker mentality comes from.
But I've peeked into that world, and I don't see it changing. That's going to be a Very Bad Thing(tm).
I'll call it the Secure Homegrown Internet of Things! What do you all think?
I had a friend back in Junior high who used to do just that - it's not uncommon. So is Mom and Comcast now disseminating kiddie pr0n?
Fun History fact. Winston Churchill used to run around the house naked.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
The safest strategy for connecting everything in your home to the internet is....don't.
Why the fuck do you need to connect your front door lock, your coffeemaker, and your refrigerator to the internet?
Forget to lock your door? GO BACK AND LOCK IT. People have been doing it for 1000 years and the world continues to spin.
Don't want to get up in the morning to turn on your coffeemaker? Either a) get up and stop being a pussy or b) get one of the umpteen programmable ones, or c) just plug your damn coffeemaker into a christmas-light timer set to power up before you wake up.
Want your refrigerator to tell you when you're almost out of milk or better still, to automagically order restocks of food? LOOK INSIDE IT. Decide what you need to buy. THEN GO TO THE STORE. You'll meet actual humans there, and interact with them. I suspect there's more actual human value to that than to the supposed minutes you'll save (so you can what, play more video games? Do some more work emails?) not doing those things.
-Styopa
The debate that keeps raging is an all-or-nothing debate. To be completely wide open and give the entire Internet your fridge or live in a stone home without even a PC?
Why not just leave things interconnected within the home without any way (physical or remote) to access out from the outside? Or if a user wants updates, include an Ethernet cable that can be easily unplugged when not updating and plugged in when updating.
This is security + convenience at its best. :-)
With this design the only way that the system can be cracked is if someone was in the home, I which case the homeowner would have a lot more to worry about than a cyber cracker.
This is simple, people. Stupid simple.
Internet connected toasters was supposed to be a joke highlighting the futility of perusing technological solutions to problems that don't exist.
Now we have assistant professors at Stanford acting like politicians who quote the Onion to defend their policy positions.
Stanford are fools for even suggesting that IoT can be secured. Moreover i think it is highly immoral for a university to propose such a profoundly stupid thing.
I bet you tho they get a heap of funding for this.
It's not smart to have SMART devices that are under the control of other people or companies or government.
Unless you have 100% control over them 100% of the time, then you should unplug them and throw them away.
Secure Internet of Things is going to be like Safe Drunk Driving.