Slashdot Mirror
Bruce Schneier: We Need To Save the Internet From the Internet of Things (vice.com)
Bruce Schneier, writing for Motherboard:What was new about the Krebs attack was both the massive scale and the particular devices the attackers recruited. Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things. Much has been written about how the IoT is wildly insecure. In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.
Bruce just confirmed we are in the Matrix.
is when the manufacturers of the devices get hit with DDoS attacks and it disrupts their business. Otherwise, as TFA points out, they had no reason to bear the costs of fixing the problem since it doesn't impact them. Until there is a significant cost associated with making an insecure device they will remain insecure. That's also one of the problems with the internet, there is no way to block access from insecure devices when they become part of a BotNet. If their was, and manufacturers suddenly got lots of warranty calls when it stopped working they might actual care about security.
I'm a consultant - I convert gibberish into cash-flow.
B...b...but government always BAD!
Moron libertarians roar approval
Post with absolutely no insight gets modded up to +5, insightful
Smug libertarians strut around triumphantly. They have won the argument in their own minds yet again.
So the government will pass a law and all IoT will be secure... that would be the US gouv I assume? All companies in the world will be complying to the new law? I would not count that for sure.
are these system not designed with a basic level of security which would prevent most of this abuse?
All of the information is widely available from SANS and the open source communities who develop the platforms which most of these are based on.
At least there is until the vendor builds in default passwords or makes horrible cost-reduction decisions that invalidate the entire security scheme.
..is when the manufacturers get hit financially for the problems they cause. A few lawsuits against manufacturers of these shoddy devices will change the market quickly.
Really? The same one who let 30m clearance files on people get stolen by the Chinese because they didn't even leverage basic encryption? The congress which thinks the internet is just tubes? The FBI that thinks math is stupid and you can limit encryption?
Yes, brilliant, you fucking idiot.
then the government could fix it all for us.
How do they envisage government involvement solving this? It sounds like an administrative globally dispersed mess that governments would really struggle to have an impact on. Surely the simplest solution is for ISPs that don't deal with DDoS nodes to be blacklisted or otherwise punished by other firms? Currently ISPs do nothing about nodes in their network because there's a risk to degrading a customers service until they sort out an exploited IoT device or some such; they need a consequence for not doing something, but surely government (outside of asking firms to act) isn't the right party for this?
All IOT products need to be labeled as such. Then I can avoid them...
Can we have a botnet that scans the internet for insecure devices and changes their password?
Hold corporations, their executives, boards of directors, and stockholders, directly responsible, both criminally and financially, for the consequences of their mistakes.
Your cars blow up if hit from the rear? Welcome to prison, Mr. CEO, BoD, and major stockholders.
Your devices are insecure? They can be exploited by world and dog? Same thing.
or just turn of upnp on your firewall?
IoT to the cloud is a problem security wise. The bigger issue IoT devices should not be throw away stuff. That means designing them to function as part of a home for 20+ years, the smarts need to be a IoT controller not some cloud service that might still be around.
No sir I dont like it.
But markets solve ALL problems!
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If these devices are so trivially insecure and easy to get into, maybe the best way to deal with them currently is to use the same exploits used by blackhats to knock them offline.
Tech-clueless buyers will naturally gravitate to Internet-enabled toasters and refrigerators that cost twice as much money but can't be pwned with minimal effort by fourth-graders; and the problem will solve itself -- right after donkeys fly.
from the article: "but the only way for you to update the firmware in your home router is to throw it away and buy a new one."
Really? Seriously? Just what is this dingbat purchasing?
I have not owned a home router in the last 22 years that I did not update the firmware on.
Seriously, we built cameras that watched coffee pots, and coke machines, and watched the crystallography doors to see if people went to lunch so we could get console zero and run stuff.
It's just you n00bZ that think it's all you unwashed masses that we built it for.
That said, just because you can do something, doesn't mean you should.
My fridge should stop pinging the toaster, it's just rude.
-- Tigger warning: This post may contain tiggers! --
The market is the only thing that could save us. Government is bad! BAD, I tell you! Trust the invisible hand to squash those problems! The market will sort it out!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No, we need to save the Internet from the Internet Of insecure Things. Manufacturers of crap like this should be fined until they take security seriously.
Organization? You must be joking..
If hardware/software vendors were liable just like real engineering firms that build bridges or make cars or airplanes are, the crap would stop.
Of course, all the "programmers" who think coding is an "art" would be out of work....
There would be a government mandated certification that wouldn't actually ensure things are more secure.
It would be an expensive and slow process so start-ups and small scale companies can't compete with the big corporations.
The Official Site of 1337 Pwnage
No, we need to save the Internet from the Internet Of insecure Things. Manufacturers of crap like this should be fined until they take security seriously.
I see comments flipping out already about "how can government fix things?". Well, thru stuff like fines. I've heard the FCC is investigating IoT type vendors. If the FCC can fine companies, or even ban them from selling products in the US until they meet a minimum standard, that will have a huge effect on these companies' behavior.
So far, they make cheap crappy things with crappy firmware, and users/customers aren't tech savvy enough to know how to pick a device with better security features. In fact, there's no way for even a professional to tell from the box or specs. So the company has made their money from you before you know its bad. We need regulations and perhaps some gov/non-profit testing labs for these devices. Between regulations/fines, and some rating system to allow users to make best decisions, we can change how the market behaves.
Why is the immediate 'knee-jerk reaction' the need for government to step in. Here's a legitimate 'market dynamic' that can be used to 'fix the issue' using only the market.
1) People impacted by a DDOS identify the devices used in the attack.
2) Sue the owner of the device based on the premise that they are the owners of that device.
3) The owner of said device can then either try to sue the manufacturer or fix their device.
The expectation is that over time the public at large would 'wake up' and extract guarantees from IoT manufacturers with respect to the security of their devices rather than just ignore that altogether when they buy their fancy new Amazon Echo or whatever other 'toy' they want to buy today without any care in the world of whether or not the device is 'crappy'. At this point the only thing the general public cares about is the features of a product without any regard to its 'safety'. It would be like buying a car because its faster or more comfortable or whatever while ignoring its made of flimsy aluminum or might blow up in an accident.
That is not to say I'm totally stupid here. You could for instance have a properly constituted entity define a 'contract' with respect to security that a device must have, you could then use the 'power of government' to extract promises from companies that they'll meet these contractual requirements, and then otherwise advertise in regards to the importance of these guarantees so that consumers would have 'requisite knowledge' in selecting those IoT devices. The 'power of government' here is only the 'threat of regulation' not actual regulation.
Let's take ISO270001 for instance. That's not a 'government regulation', but you can obtain certification for it that is 'generally recognized in the community'. You could have such certifications for IoT devices themselves, where for instance is someone like 'consumer electronics' rating the security of any IoT devices and making a big deal about it. Seriously, this seems like a great opportunity for someone to make money based on their knowledge and building a name representing 'faithful authority' that companies making Iot devices would want to get their 'approval' (certification) for their devices. You could I guess call this a 'market failure', I'd call it a 'market opportunity'.
...a national government can fix this, and I believe in appropriate laws and regulations. Unless we wall off the internet into national subnets, and I sure don't want that. I can imagine an international organization in which states become members by agreeing to track and prosecute DDOSers and manufacturers of insecure devices and disallow nonmember states from connecting. Works for a year or two until scope creep turns the organization into a surveillance and enforcement nightmare.
Think about this: soon almost everyone will own an IoT refrigerator. Refrigerators are large purchases, so you probably won't pay cash, and you'll probably also register the product with the manufacturer. If you didn't register the product, then the fridge company may still be able to find out your real identity from the seller.
Now for the devious part: Your fridge will phone home to the manufacturer every day. If the fridge company knows your real name, they can provide a real-name database keyed on IP address.
The more IoT things you purchase, the greater chance the advertisers will be able to figure out who you are, because chances are pretty good that you'll reveal yourself by registering one or paying for one with a credit card. And not even IPv6 will save you from that, because all of your devices will be on the same 64-bit subnet.
Just pass a law that allows anybody to brick or take offline any insecure IoT device found on the internet. Problem solved.
Script kiddies can then have fun bricking insecure devices found on the internet, and users will be force to care about the security of the IoT devices that they run. And if users care more, then device manufactures will respond.
Many of these 'IoT' devices are literally solutions in search of a problem, being pushed by overeager marketers looking for a new way to get your hard-earned dollars. Honestly, ask yourself how many of these things do you really need? Some of the are useful, granted, but most of them are just toys that you can get along just fine without, and remove a layer of complication from your life in the process.
New devices utilizing the best communication infrastructure ever created will make lives better.
You failed policymaking 101, now live with the consequences.
Modifying software/firmware on computers and devices that you don't own or have been explicitly granted access to is criminal hacking, and a federal felony. Your suggestion might work, but I suspect that the definition of 'white hat' doesn't include incurring hundreds of thousands counts of a felony activity.
Perhaps the word you were looking for is 'Vigilante'?
HA! I just wasted some of your bandwidth with a frivolous sig!
That's not a "market failure", it's a government failure: the way liability is handled for software and security, companies get away with selling insecure crap without anybody being able to sue them for damages.
"...it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own."
Are you kidding me? I work for a company that is betting it's future on IoT in the manufacturing and heavy equipment area. I promise you, it's the evil 'ole "market" that is causing us to focus a HUGE portion of our resources on security. How do you figure it isn't in every IoT makers best interest to deliver secure products? They may be failing right now but those that do it right will win in the market. This isn't 2002 when security was an afterthought. Even tech novices are aware of security issues these days and demand it from the companies that supply them.
Show me one time where the government has gotten something like this right! They can't even handle their own security and you want them crafting regulation to manage the security of everyone else? The mind boggles.
the free market can fix all things, regulation is bad and hampers the self correcting free market.
I used to have a ton of respect for Bruce. But then I read this nugget in the article:
"But the only way for you to update the firmware in your home router is to throw it away and buy a new one."
Seriously? I've been applying router vendor firmware updates since the wireless-G days.
Egregious mistake, or FUD on his part? I'm not sure which is worse.
Surely most IoT devices need very little bandwidth to call home. Let's limit that to the minimum and call it standards based. For example, if an IoT device truly only needs say 5k of bandwidth here and there, then limit it to that. Better yet, work to limit the bandwidth all IoT devices need. Real security is even better, but we all know that takes a back seat.
Brought to you by Carl's Junior.
There is (conceivably) a remedy available under Copyright Law. Many of these "Internet of Things" devices (in particular, network cameras) run (at least some) libraries that were licensed under the GNU LGPL. One of the conditions of the LGPL is that users be able to - at will - replace the device's LGPL'd libraries with their own version (with the same API). If these devices do not have such an 'upgrade' mechanism available (and I suspect that few, if any, do), then they could find themselves legally liable.
If the device manufacturers feel that they're at risk here, then this may motivate them to make their products more easily updatable in the future.
I feel like in a way we need more open source firmware options. Sure most of these run Linux, but it's the configuration and front end custom software that's the problem. If there were a good standard open source distribution for different devices that was secure by default maybe this would be better.
IOT devices will always have serious security vulnerabilities. The cost of a vulnerability is on the customer, not the manufacturer. The manufacturers don't care if their device becomes part of a DDOS attack or spyware/malware server.
Just about everyone with a high speed network connection has a firewall of some sort.
The solution is for the FCC to require all Cable, DSL or Fiber modems to distinguish between a PC running a maintainable OS vs. an IOT device running an embedded OS with no option for maintenance. The router would then block all connections between the IOT device and the outside internet. Thus an IOT device cannot be hacked from the internet and cannot be part of a DDOS attack. If the IOT device needs to communicate with the outside internet, a PC with a maintainable OS must act as a network proxy.
Use one the Option field in the TCP/IP connection header to indicate a IOT device vs. a computer that can be maintained. IOT devices MUST use an Option field with a Kind value of 4 [non-routable] and a length of 1 byte if the manufacturer does not provide regular updates to the firmware for at least 7 years after the date of manufacture.
On its surface, the IoT sounds like a neat idea.
Unfortunately, in implementation, it's a raging clusterfuck.
Basically, just because you can connect ANYTHING to a network doesn't mean you SHOULD.
Chas - The one, the only.
THANK GOD!!!
The government proposes to add a backdoor to all encryption systems, and Schneier, an encryption expert, immediately goes to bat, contributing to and promoting large amounts of nuanced study on the matter to explain why such a proposal will fail. Then, on this networking issue, Schneier provides a completely unbacked claim that the Government is somehow going to magically fix something. I guess because Schneier is a "good guy" I should just assume that his completely unsubstantiated, critical-thinking-free solution is the one that we should support.
There is nothing the U.S. Government can do about hacked IoT devices in other countries. How about that one, Schneier? Are you even going to admit to the fundamental core of the World Wide Web is a substantial part of the problem, and cannot be addressed by U.S. government legislation?
Schneier's claim is barely three weeks from the date of the event, and Schneier is boldly proclaiming the market has failed. Puh-lease. There are very few, if any, events of this magnitude that any "solution", private or public, can take care of, or even propose to take care of, in such a short time.
Brian Krebs has clearly been the victim of some malicious actor, and as such must have methods for being made whole. These options do not even seem to merit any evaluation by Schneier.
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things.
Is this a substantiated statement? I know Krebs said it was likely, but has there been a analysis to establish it for sure? Seems like it wouldn't be that hard to trace ip addresses back to IoT devices and nmap them for identifying indicators.
Because online security is an aftermarket issue; for both the vendor and the buyer. Because insecure IoT devices are profitable, they will continue being insecure. Capitalism is inefficient, even in a free market, because buyers aren't rational or properly informed. The solution is government-enforced standards on the IoT device and the network gateway, or creating demand (See marketing campaign: See shoe event horizon) for an aftermarket home-network security device.
Standards, for both hardware and software, are very useful things. We get all the interchangability and interoperability they provide with a sprinkling of the usual benefits of mass production.
There's one problem, however, and it's a doozy: Human beings are not perfect and benevolent.
As a result, there are people with malicious intent always looking to exploit stuff, and on the other side there are imperfect people trying to construct perfect defenses. By definition, this construction of perfect defenses is impossible. It is therefore the case that standards actually serve the malicious. Any webcam or other standard gadget which complies with standards can be probed and detected in standard ways. When detected, these "standard" devices can be identified and then exploited based on the knowledge that they are identical to many others which have been found to be exploitable. Botnets are only possible because of standards and standardized hardware and standardized software.
As with other instances where the ROI for implementing good computer security is not there, with potentially disastrous societal consequences...
Make manufacturers liable for damages if their devices are compromised for malicious purposes (DDOS, PII extraction, etc.). Make anyone collecting PII or selling a network-connected device have insurance to cover liability for losses due to security. Bam, problem solved: the insurance market will create the implied ROI (vis-a-vis reduced insurance costs), and businesses will either modify their products or behavior accordingly. The solution also side-steps most of the traditional and vexing issues with government oversight (eg: since there's no government-specified "security standard" or anything, there's no potential to make a gigantic mess of that).
It seems so obvious, but I suppose that's why it's seemingly entirely inscrutable to the people in government...
If he is so smart, why is he writing letters to the editor instead of working toward a solution?
"can't get fixed" is technically incorrect, considering that a good swath of these iot devices can take firmware updates. For some of these device (like select IP video cameras) patched-to-date, open-source software exists.
"won't get fixed" by a public further numbed to tech work by an onslaught of overly simplistic, non-rooted devices (in the majority of cases where an upgrade path exists).
What's the solution? Please don't say metered Internet connections!
Legislating against proprietary firmware locking is probably the best possible first step...
The internet will never be secure while it is based on insecure hardware and protocols.
Go well
Give me a break. This problem is caused by government in the first place protecting losers like this from their rightful retribution at the hands of a vengeful market. Any attempt to correct the problem will run into its biggest obstacle, government regulation. Just another slashdotfalsememe.
The internets needs to get real. BCP 38 everywhere.
http://bcp38.info/
Let's just start with the common sense approach as outlined in bcp 38.
Once spoofing is largely eliminated, then let's go after stupid vendors. Tracking owned devices will become way simpler once spoofing is done for.
"What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own."
but but but... that would be SOCIALISM. *shudder*
I don't quite understand the issue at hand.
Most IoT devices are primarily clients and not servers, i.e. the device establishes a connection to the internet and not the other way 'round. If they do act as servers, they are usually meant to act as such in the context of one's local network. Or can you provide me any good reason why I should have my DVR be accessible over the internet? Even the CCTV will usually connect to a surveillance NAS or similar locally and the NAS itself could then be accessed from the internet, though that still seems to be an exception to the rule. So it seems to me that all you need to do is make sure your local network is safe from external attacks, in most cases a NAT router will (still) do.
IMO asking the IoT device makers to implement a separate firewall is the same like asking every software manufacturer to do it, too. If I create a software package, I should be able to rely that the operating system or a special purpose software is already taking care of security and that I don't have to duplicate the effort. With the IoT device it's the same, why go the effort of separately securing hundreds of devices when the problem could be solved with one good firewall?
If you really want to centralize control, start with internet providers. Make them ship hardened routers to their customers and offer better support. I guess this will solve most of the issues.
And before engaging governments in controlling the production quality of IoT devices globally, I'd much prefer if they would start to cooperate against cyber crime. I find it simply dumbfounding how much money laundering is done through Asia with complete paper trails available and still nothing is being done about it. Stop the money, and you stop the crime, including those pesky DDoS attacks. Unfortunately, I believe we're still years if not decades away from a solution.