Slashdot Mirror
The Internet of Things Is a Surveillance Nightmare (dailydot.com)
An anonymous reader writes from a DailyDot's Kernel Mag article: Welcome to the Internet of Things, what Schneier calls "the World Size Web," already growing around you as we speak, which creates such a complete picture of our lives that Dr. Richard Tynan of Privacy International calls them "doppelgangers" -- mirror images of ourselves built on constantly updated data. These doppelgangers live in the cloud, where they can easily be interrogated by intelligence agencies. Nicholas Weaver, a security researcher at University of California, Berkeley, points out that "Under the FISA Amendments Act 702 (aka PRISM), the NSA can directly ask Google for any data collected on a valid foreign intelligence target through Google's Nest service, including a Nest Cam." And that's just one, legal way of questioning your digital doppelgangers; we've all heard enough stories about hacked cloud storage to be wary of trusting our entire lives to it. [...] But with the IoT, the potential goes beyond simple espionage, into outright sabotage. Imagine an enemy that can remotely disable the brakes in your car, or (even more subtly) give you food poisoning by hacking your fridge. That's a new kind of power. "The surveillance, the interference, the manipulation the full life cycle is the ultimate nightmare," says Tynan. [...] That makes the IoT vulnerable -- our society vulnerable -- to any criminal with a weekend to spend learning how to hack. "When we talk about vulnerabilities in computers... people are using a lot of rhetoric in the abstract," says Privacy International's Tynan. "What we really mean is, vulnerable to somebody. That somebody you're vulnerable to is the real question." The state of security around IoT, the chip or sensor-equipped devices connected to each other over the Internet, is deeply concerning. Just in the past few months, we have seen several instances of these devices getting hacked. We have also seen things such as Shodan, a search engine for the Internet of Things that can allow someone to browse vulnerable webcams. Many people continue to overlook the significance and potential consequences of their "smart" devices getting compromised. Someone recently asked, "So what if my coffee maker gets hacked? What are criminals going to do? Burn my coffee?" They can do a lot more than burn your coffee. You see these devices are connected to your Wi-Fi network, which gives them the ability to interact with other gadgets connected to the same network. When attackers manage to access one of these devices, it's only a matter of time before they own your entire network.
The convenience is worth the risk. The dumb-ass majority has spoken.
If you don't want to get hacked, don't get things connected to the internet. If you want to know your milk is about to expire in your fridge, or turn your dryer on to fluff your clothes from your phone, then know the risks. If you don't care about those conveniences, don't pay for them and don't get a connected device. I can guarantee that you can still buy a fridge, dryer, coffee maker, and thermostat that aren't connected to the internet, and will still be able to for quite some time. Right now, the benefit is minor (or questionable) and the cost is more than marginal for connected devices.
Just remember, they can't hack you if you aren't connected.
This is going to be fun I hear.
Captain Obvious strikes again!
We suffer more in our imagination than in reality. - Seneca
is every Three Letter Agency's wet dream.
Maybe not. Yes, the ability to spy on people might be useful for them, however, they're frequently charged with the protection of US citizens as well.
If IoT is vulnerable, it is not just vulnerable to the NSA or FBI, it is vulnerable to Russia, Iran, North Korea, China, and anyone else who wants to try a hand at it. That's not a situation that would have everyone at the FBI (for instance) uncorking a bottle of champagne.
Someone recently asked, "So what if my coffee maker gets hacked? What are criminals going to do? Burn my coffee?" They can do a lot more than burn your coffee.
Depending on how well the safeguards are on your coffee machine, the criminals could try to keep the water heating elements running after all the water has been transferred to the pot. Aside from the energy bill, this could have other interesting side effects ranging from a destroyed coffee machine to a burning coffee machine that could set your home on fire. Yes, yes, this is probably a wee bit too close to scare-mongering, but it does underline the need for safety by design.
The truth may be out there, but lies are inside your head
I think the whole IoT marketing movement is about rebranding existing technologies. Remotely accessible cameras and wearable technology have been around for a very long time practically unchanged, but now they're suddenly categorized under an ambiguous umbrella term. Most of the IoT tech have been security nightmares since day 1 so we shouldn't suddenly worry about them now, we should have worried about them for over a decade. Googling for weakly protected webcams, for example, has been around since the early 2000's and it's been a "new phenomenon" every five years or so.
If there are devices in my home or car that I find intrusive, they can't be secured properly or they somehow threaten my privacy, I'll get rid of them. This of course becomes a bit problematic once we start running out of alternative manufacturers, but I don't think that'll be a problem for a long time to come. Our cars will most likely be the first that we have least choices with as laws have started to mandate certain wireless technologies to be implemented in them.
The very least steps everyone should take to secure networked devices of any kind is to set up a proper firewall at home and whitelist addresses they can connect to. Or even bar them behind a VPN. Wouldn't be something every average Jane and Joe can do, but that's another story.
-SR
Software in medical devices was considered inconsequential for a couple of decades, and then the Therac device came out and killed several patients.
At the time, the FDA took a close look at software and decided that we need regulations to keep the software more safe.
I look at the programming in cars right now and note that we haven't had our "Therac" moment. Car manufacturers keep closed source and there's no regulations about how the code should be designed for safety. (Safety for the car, yes. Safety for the software, none.)
It'll probably take a couple of hackers making cars floor the accelerator randomly in a city for government to wake up and impose common-sense regulation.
We'll get it straightened out once a couple of people get killed.
I read "Surveillance Nightmare" and though -- well that's good, I don't want things to be easy for surveillance. Boy was I wrong when I realized they meant it's a nightmare *because* of all the surveillance it makes possible!
I don't want my fridge or my car hooked to the web at all, totally unnecessary. shit headed kid engineers and marketers are causing huge problems
The problem is that they often see US citizens as criminals. You know, before all that stupid trial stuff.
And if your point was valid, they wouldn't be fighting Apple in federal court for security, or been fighting them on it for several years now.
http://www.bloomberg.com/news/...
There are two types of people in the world: Those who crave closure
Short of completely abandoning modern society and living off the grid there is no way to maintain what was previously known as privacy. The cost to secure IoT devices and retroactively secure the internet age is so massively prohibitive it beyond the wildest of dreams for any realist. The best that can be hoped for is that some new concept of privacy is developed culturally. One where while we could access each-others most private lives we all collectively understand and respect that everyone will have some secret to dig up and choose to "let sleeping dogs lie".
Yet when I really think about it, I find that I have no good reasons to keep my computers connected to the internet. I went to BSG style networking at home. One network for local machines, going through a router that applies firewall riles in between, then another computer connected to the edge router, yet that computer isn't quite connected to the internet. I then run a virtual machine with an immutable hard disk and browser and make PPPoE connection from that VM to the router to gain internet routing. For every web page there is a separate instance of the VM (my underpowered server can run about 8 of these in parallel) and after I'm done with the page, the machine is shut down and new one created. I'm looking for more ways to automate it, and bring almost seamless experience, between the host and guest, but still the main idea is separation. I would rather return to usenet and irc, and other services from the 90s as the internet for me is medium for communication, not a medium for consumption. Why waste my time alone in my house facebooking on netflixing when I can go out to a bar or a cinema with a date?
when these sorts of things become mandatory.
We all see that eventually self driving cars will become mandatory and driving a car will become unthinkable. It is only a matter of time.
Eventually, these IoT surveillance and control devices will become mandatory.
Right now we aren't forced to buy internet connected appliances.
Right now we aren't forced to buy internet connected cars.
Right now we aren't forced to buy internet connected clothes, toiletries, etc.
How long will that last?
Once the First World fully embraces the IoT, not for any reason other than because "its cool", eventually it will become mainstream and commodified, just like having internet connectivity to your phone, computer and television is now.
Will the government mandate IoT?
Will we still be able to just buy an appliance that doesn't need weekly firmware updates and be constantly under threat from Romanian hackers?
We play the game with the bravery of being out of range
Appsolutely!
We play the game with the bravery of being out of range
that billions of small, stupid devices hooked to the net with no local defenses from hackers and governments might be a GOOD thing...NOT!
There have been reports of things like SmartTVs automatically connecting to ANY open WiFi(xFinity, etc). They are trying to create mesh networks that don't care whether you give them your networks pw or not.
We play the game with the bravery of being out of range
My point is valid because Apple is being fought to give the FBI a specific right to break encryption.
This is not the same thing as most IoT devices being insecure.
The FBI will be pleased with a capacity that they will have, but no one else will. That's fine to them.
What they will not be happy with is the ability for just anyone to break into US homes with a vulnerability that is not limited to themselves.
It is important to understand the distinctions, and also to understand that, as hard for it may be to believe that the FBI or NSA does anything but spy on its own citizens, it actually has another, actual stated job of protecting the US and its citizens.
Perhaps not every person in those organizations takes that task seriously, but there are many, if not most, who do. In fact, if these agencies have an original sin, it is that they think they have to own everything in order to protect us from ourselves. The idea that they are purely out for themselves as sort of a shadow state is a conspiracy theorist wank job.
Understand that I do realize that there are serious dangers from agencies that are trying to protect ourselves from ourselves by being able to spy on us, but you will fail to understand why these agencies have the power that they do unless you understand that they are not mustache twirling villains either.
You would be surprised at how inexpensive 3G cards and antennas are. I wouldn't be surprised to find more devices just using that for a constant, unstoppable Internet connection if they can't find a link out.
Or, they can do what modern consoles do. No Internet connection, no worky. You agreed to this, and that all info the device finds, can be given or sold freely by the device maker, in the EULA, when you opened the box.
If IoT is controlled by phones, and the FBI/NSA/KGB/CHINA have access to our phones because of the stupidity of the FBI, whats the difference?
With the power they want, they are CERTAINLY becoming much worse than mustache twirling villains.
There are two types of people in the world: Those who crave closure
automatically connecting to ANY open WiFi
That could be a problem if they are particularly 'smart'. But I've found that giving them an AP ID/password to a WiFi router that isn't actually plugged into any broadband usually shuts them up. And the advantage of living on a pretty large estate is that the next nearest node is well out of range of WiFi technology.
Have gnu, will travel.
It won't become an issue until some fifteen year old hacks into some Senators $IOT and releases some scandalous information on the Web.
You can bet your ass that security for IOT will become priority numero uno afterwards.
I daresay your response seems a little anti-regulation-ish.
The fault analysis didn't include the software, and indicates that the machine passed FDA muster without even considering the safety aspects of the software. It only states that the company did some testing.
Indeed, it would appear that the FDA accepted the "software is inconsequential" argument at the time of review.
Here's is a quote from the analysis:
In March 1983, AECL performed a safety analysis on the Therac-25. This analysis was in the form of a fault tree and apparently excluded the software. According to the final report, the analysis made several assumptions:
(1) Programming errors have been reduced by extensive testing on a hardware simulator and under field conditions on teletherapy units. Any residual software errors are not included in the analysis.
(2) Program software does not degrade due to wear, fatigue, or reproduction process.
(3) Computer execution errors are caused by faulty hardware components and by "soft" (random) errors induced by alpha particles and electromagnetic noise.
The fault tree resulting from this analysis does appear to include computer failure, although apparently, judging from these assumptions, it considers only hardware failures. For example, in one OR gate leading to the event of getting the wrong energy, a box contains "Computer selects wrong energy" and a probability of 10^11 is assigned to this event. For "Computer selects wrong mode," a probability of 4 x 10^9 is given. The report provides no justification of either number.
Well what the hell did you all expect when you decided to put every detail of your entire sordid lives on the Internet?
"They are trying to create mesh networks."
That's not a mesh network. A mesh network would be if the TV, lacking an internet connection, instead connected to your neighbour's TVs, and via them to the next TV along, until it finds the poor sod who did connect their TV to the internet and can pass the messages finally back to the server.
"You could never give someone food poisoning by hacking their fridge."
In fact, you can.
Remember Alexander Litvinenko? It would have been tad more easy to kill him and avoid the diplomatic repercussion if you learn from his fridge that he buys, say, strawberries and cream from the same provider twice a month.
Comment removed based on user account deletion
They have obviously never had botulism. I won't get into details - I've shared them before. Botulism is not your normal tummy ache. Botulism is what kills you because of the force of you trying to expel all fluids from any hole in your body. Your heart ruptures, or a vein in your head or neck will burst like a bubble. Botulism is still very deadly today. It sucks.
"So long and thanks for all the fish."
Anyone who ever helped their grandma or mother with their laptop could see this disaster coming from the invention of the term "IoT". IPv4 security + millions of people just plug and playing internet facing equipment = L. O. L. levels of an ugly mix of executive stupidity, investor greed, and public ignorance.
My wife just called, and told me we're out of milk. Why do I need a smart fridge? Not only that, but I don't want to program a menu into it so that it will tell me what I need to buy for next weeks meals. That's what the wife is for.
The things I need they don't make, like a smart tackle box to tell me if I have enough lures and leaders for the weekend trip to the fishing hole, or the smart gun safe to tell me if I have enough turkey shells for Turkey Season, deer loads for Dear Season, etc. Those are things I don't trust my wife to get right.
Of course, this being Slashdot, many of the nerds never got far enough away from the computer to get a girlfriend, much less land her (i.e., get her to marry you). For those, who cares, your life is too boring anyway, no-one wants to spy on you, but lots of companies want to sell you crap to fill up your lonely hours. Maybe one of those lifelike companion robots...
Me, I'm going home to a good home cooked meal and and an enjoyable nighttime activity most slashdotters just dream about!
HexaByte - he's a square and a half!
My mother taught me how to program.
There are problems with IoT security but none of them come from having XX chromosomes: if anything it's the driven XY engineers that say "we'll do security on the next release" that are the issue.
Rgds
Damon
http://m.earth.org.uk/
CIA chief: we’ll spy on you through your dishwasher (03.15.12)
:)
"“Items of interest will be located, identified, monitored, and remotely controlled through technologies such as radio-frequency identification, sensor networks, tiny embedded servers, and energy harvesters — all connected to the next-generation internet using abundant, low-cost, and high-power computing,”"
Stay with ethernet and a computer thats web facing
Domestic spying is now "Benign Information Gathering"
"They have obviously never had botulism."
There's no food that I can think of that can both induce botulism and requires a fridge, so I don't see what's your point.
What if the mustache twirling villains have bought their way into the FBI? It's happened before which is why the IRS had to go after Capone.
The point there appeared to be "sending a message" by using an incredibly rare and easily identified poison that only comes from one place. The diplomatic repercussions were expected and really didn't change anything to Russia's detriment. Everyone knew Putin was getting people killed they just didn't have a demonstration of his reach.
However your point still stands if the killer wants it to look like an accident.
"The point there appeared to be "sending a message" by using an incredibly rare and easily identified poison that only comes from one place."
Nevertheless there was the tactical point about how to do it. The way they did it left traces that were usable both by the press and the other side's intelligence. Imagine for a moment they were able to give him the Plutonium (or Thorium, or whatever it was) without the need to expose both the agent or the infection path. Everybody (in the knowledge) still would have known who was the hand after the issue, but still they'd have no card to play against him. Think, say, about Stuxnet: everybody "knew" who did it but, without traces, everybody was hesitant to act.
And, of course, as you say, it's another vector for the "make it look like an accident" case.
MAC access control and bespoke firewall rules solve most problems, the moment a device trips an alarm by going outside of it's allowed access you have your system drop the MAC off the allowed list and alert the owner that the device has a problem.
The question of if you can buy an affordable consumer level WiFi router that can do this is a completely separate matter, and the rule changes that make open router firmware development harder doesn't help either.
With the Polonium poisoning it was as obvious as a thief deliberately leaving a calling card in a novel. It's a byproduct of reactors that are only found in Russia and would produce very bright spots on any x-ray of the victim.
So while I get your point about subtlety what happened to Litvinenko was the exact opposite and says a lot about how Russia is run at the moment. "In New Tsarsist Russia Putin says fuck you" is the meme of the moment.
You do have a good point about harm due to deliberately making IoT devices fail. It could be very hard to pin down especially since forging logs is likely to be part of the operation. I'm old enough to sniff stuff before consuming due to habit before "use by" dates, but others are not and some spoilage is not going to be detected that easily. Non-fatal food poisoning could be used to get the target out of their secure location and to a place where they can be targeted by another means. Personally I think the most likely source of mischief is messing with the firmware of IoT devices with large batteries to overcharge and deliberately cause fires like some of the recent "hoverboard" accidents.
That is correct but you don't see what the point is. The point is referencing this statement from the GGP above, which had tricked down through:
Also, most food-borne illnesses are nothing other than a nuisance, good for a day or two home from work, and are no real threat to anyone without a compromised immune system.
There are a number of other food-borne illnesses that can and will kill you but I'm only familiar with botulism. It was also me agreeing with you - I'm not sure why you'd react as if I was attacking something you'd said. But, so be it...
As for some things that *might* end up in the refrigerator there's some of this list care of the CDC:
some examples are chopped garlic in oil, canned cheese sauce, chile peppers, tomatoes, carrot juice, and baked potatoes wrapped in foil.
But no, my post was an addendum to your post, not an argument against it. I guess, given that this is Slashdot, it's not unusual to assume that a response is an attempt to argue.
"So long and thanks for all the fish."