Slashdot Mirror
IoT Security Is So Bad, There's a Search Engine For Sleeping Kids (arstechnica.com)
An anonymous reader writes: Shodan, a search engine for the Internet of Things (IoT), recently launched a new section that lets users easily browse vulnerable webcams. The feed includes images of marijuana plantations, back rooms of banks, children, kitchens, living rooms, garages, front gardens, back gardens, ski slopes, swimming pools, colleges and schools, laboratories, and cash register cameras in retail stores. While IoT manufacturers are to blame, this also highlights the creepy stuff you can do with Shodan these days. At the start of January, Check Point recommended companies to block Shodan's crawlers. The infosec community came to defend Shodan, and even its founder said that Shodan is uselessly branded as a tool of evil, saying that attackers have their own scanning tools.
Security is hard and companies have to make their video surveillance products easy enough for a socker mom to install. Frankly I'm not surprised. Nor do I have a solution. As someone who has to provide tech support to family and friends I realize how hard it is to "just make it work" for those who couldn't care less about the technical details.
-- Thou hast strayed far from the path of the Avatar.
According to TFA, which of course no one has bothered to read:
Shodan crawls the Internet at random looking for IP addresses with open ports. If an open port lacks authentication and streams a video feed, the script takes a snap and moves on. The cameras are vulnerable because they use the Real Time Streaming Protocol (RTSP, port 554) to share video but have no password authentication in place. The image feed is available to paid Shodan members at images.shodan.io. Free Shodan accounts can also search using the filter "port:554 has_screenshot:true."
The infosec community came to defend Shodan, and even its founder said that Shodan is uselessly branded as a tool of evil, saying that attackers have their own scanning tools.
It won't matter to the families of the children you have exposed that other scanning tools are available. Yours is public and visible --- and it has a deliberately provocative name. You can't search Google for Shodan and miss the connection.
Calm yourself and then understand one thing: there is no breaking in going on, here. These cameras are broadcasting this shit directly to all comers, wide open to the world. No one is "tak[ing] a hammer and break[ing] into someone's home," they're standing on the sidewalk looking into the front windows where the home builder didn't bother to install any blinds.
If I were to create a device that can be hacked by someone else, then my customers and I are to blame for the act of someone hacking it?
If you make a house that opens the door and throws the owner's jewelry at the person who rang the bell, damn straight you are at fault for making the stupid thing in the first place, and the owner for not locking the door when he goes out.
Nobody is "hacking". The act of a port screen is more like door knock or doorbell ring than walking through a parking lot trying every door handle for one that's unlocked.
Learn to love Alaska
If a company sold locks that couldn't be locked or were too trivially pickable, and advertised them as locks, you can guarantee there would be (and historically has been) more or less equivalent blowback.
Electronic locks used on hotels? Or the programmable key locks that a lot of people use on their house? You can still bust them open with $50 of off the shelf hardware. That's been going on for 4 or 5 years now, and the amount of blowback has been minimal.
Om, nomnomnom...
I'm not sure if everyone already knew this but Shodan *started* as an non-secured webcam search engine back in 2009.
Kriston
An AC wrote:
There was no breaking in.
If you provide data to the public Internet without any form of restriction, you can't then validly complain when the Internet public sees that data. You offered it publicly, and the public took you up on your offer.
This isn't anything like breaking and entering, nor even like someone walking through a door which you left wide open. It's much more intentional on your part than that:-- you offered data to the public by creating an unrestricted access port on the Internet, your offer was accepted when someone opened that port, and then you deliberately sent your data out to that recipient. It was your choice, before and after you made the offer to the public. Nobody can force you to send your data if you don't want to. Your system wasn't hacked to change its code to something that you did not intend.
The closest analogy I can make is to imagine yourself standing on the sidewalk in the high street, an open sweet jar in one hand, and the other hand outstretched offering sweets to passers by. The highstreet is the public Internet, and your invitingly outstretched hand is the open port. If someone takes hold of the sweet, you can still prevent it from being taken by holding tightly onto the wrapper (an access restriction, perhaps you want to check that recipients are smiling first).
But if you first offer a sweet and then release it, you don't get to complain --- it was your visible intention to hand out sweets to passers by, and nobody can read your mind, only your actions. If you don't understand this then perhaps you don't grasp how Internet protocols work, and you would be best advised to stay well clear of the Internet.
You may wish that Internet protocols worked some other way, perhaps using ESP, but they don't. They work as they were defined.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
...front gardens, back gardens...
Aha! But not side gardens! Those have better privacy...
...they they don't need to worry about the surveillance.
And the parents who put these protections in place, that's just like our big brother the NSA and GCHQ putting protections in place for us. No encryption necessary. Hope no bad guys get a hold of this.
But if you're doing nothing wrong... ...you have no reason to worry.
E
A service like shodan only increases public awareness, anyone who actually has malicious intent will have their own method of discovering insecure devices and no intention of publicising their activity. Publicity does not benefit those with malicious intent, as the publicity will cause at least some people to improve the configuration of their devices.
If you keep this information out of the public eye, it gets forgotten and overlooked and then the number of vulnerable devices only increases to the benefit of the actually malicious people who want to take advantage of them.
And yes often the device manufacturer is at fault, some devices cannot be reasonably secured and for others the manufacturer provides weak defaults and doesnt do enough to force users to change them.
Some devices these days come with a random password printed on the device, that's perfectly reasonable and prevents casual attackers using blank or default passwords.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
IoT: Internet of Trouble
Lets see....cheaply-made products produced and sold with barely a nod to security, installed by users who are likely to be as clueless as they could possibly be, all connected to a worldwide network easily accessible by lots and lots and lots and lots of malicious people with too much time on their hands.
What could possibly go wrong??
Trust me, you ain't seen nothin' yet. I'd wager that 98% of all of these consumer-grade gadgets are going to be easily hackable in their default configuration. It's only a matter of time- eventually one of them will cause a serious injury or death, or at the very least some kind of significant property damage.
You want your refrigerator to be internet enabled? Great! But should it also have the unfettered ability to turn the temperature down and spoil all the food?
You want door locks you can control from the other side of the world? Great! But should any Joe Blow with a free hacking kit be able to unlock your doors at will?
You want to be able to remotely turn on your stove and start heating some water? Great! But should it blindly start "heating" a cardboard box left sitting on the burner because some dickhead in Moldavia can bypass your login?
You want an internet-enabled thermostat? Great! But should some malicious asshole be able to turn off your heat in the dead of winter when you're on vacation, freezing your house and causing your water pipes to burst?
Don't get me wrong- I think the overall idea of IoT is fascinating and holds great promise, but mark my words... like anything else it's gonna be abused too. Unfortunately I think it's going to take some major-league lawsuits before manufacturers start taking the security aspect of it seriously.
Just cruising through this digital world at 33 1/3 rpm...