Slashdot Mirror
Bruce Schneier: We Need To Save the Internet From the Internet of Things (vice.com)
Bruce Schneier, writing for Motherboard:What was new about the Krebs attack was both the massive scale and the particular devices the attackers recruited. Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things. Much has been written about how the IoT is wildly insecure. In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.
Bruce just confirmed we are in the Matrix.
is when the manufacturers of the devices get hit with DDoS attacks and it disrupts their business. Otherwise, as TFA points out, they had no reason to bear the costs of fixing the problem since it doesn't impact them. Until there is a significant cost associated with making an insecure device they will remain insecure. That's also one of the problems with the internet, there is no way to block access from insecure devices when they become part of a BotNet. If their was, and manufacturers suddenly got lots of warranty calls when it stopped working they might actual care about security.
I'm a consultant - I convert gibberish into cash-flow.
So the government will pass a law and all IoT will be secure... that would be the US gouv I assume? All companies in the world will be complying to the new law? I would not count that for sure.
right... because the government had nothing to do with the creation of the Internet and has certainly never ran secure nodes with large numbers of devices attached to them...
All IOT products need to be labeled as such. Then I can avoid them...
Can we have a botnet that scans the internet for insecure devices and changes their password?
Not directly, as you point out, but if they passed a law stating that the IoT makers were liable for misuse and made it easy to pin them on these things they'd be sure to secure them.
or just turn of upnp on your firewall?
IoT to the cloud is a problem security wise. The bigger issue IoT devices should not be throw away stuff. That means designing them to function as part of a home for 20+ years, the smarts need to be a IoT controller not some cloud service that might still be around.
No sir I dont like it.
What makes anyone think the government would want to do that? They'd much rather it be wide open so they can get into systems. The last thing they want is to push down hardened security.
But markets solve ALL problems!
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If these devices are so trivially insecure and easy to get into, maybe the best way to deal with them currently is to use the same exploits used by blackhats to knock them offline.
Tech-clueless buyers will naturally gravitate to Internet-enabled toasters and refrigerators that cost twice as much money but can't be pwned with minimal effort by fourth-graders; and the problem will solve itself -- right after donkeys fly.
Seriously, we built cameras that watched coffee pots, and coke machines, and watched the crystallography doors to see if people went to lunch so we could get console zero and run stuff.
It's just you n00bZ that think it's all you unwashed masses that we built it for.
That said, just because you can do something, doesn't mean you should.
My fridge should stop pinging the toaster, it's just rude.
-- Tigger warning: This post may contain tiggers! --
The market is the only thing that could save us. Government is bad! BAD, I tell you! Trust the invisible hand to squash those problems! The market will sort it out!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No, we need to save the Internet from the Internet Of insecure Things. Manufacturers of crap like this should be fined until they take security seriously.
Organization? You must be joking..
There would be a government mandated certification that wouldn't actually ensure things are more secure.
It would be an expensive and slow process so start-ups and small scale companies can't compete with the big corporations.
The Official Site of 1337 Pwnage
No, we need to save the Internet from the Internet Of insecure Things. Manufacturers of crap like this should be fined until they take security seriously.
I see comments flipping out already about "how can government fix things?". Well, thru stuff like fines. I've heard the FCC is investigating IoT type vendors. If the FCC can fine companies, or even ban them from selling products in the US until they meet a minimum standard, that will have a huge effect on these companies' behavior.
So far, they make cheap crappy things with crappy firmware, and users/customers aren't tech savvy enough to know how to pick a device with better security features. In fact, there's no way for even a professional to tell from the box or specs. So the company has made their money from you before you know its bad. We need regulations and perhaps some gov/non-profit testing labs for these devices. Between regulations/fines, and some rating system to allow users to make best decisions, we can change how the market behaves.
...a national government can fix this, and I believe in appropriate laws and regulations. Unless we wall off the internet into national subnets, and I sure don't want that. I can imagine an international organization in which states become members by agreeing to track and prosecute DDOSers and manufacturers of insecure devices and disallow nonmember states from connecting. Works for a year or two until scope creep turns the organization into a surveillance and enforcement nightmare.
Just pass a law that allows anybody to brick or take offline any insecure IoT device found on the internet. Problem solved.
Script kiddies can then have fun bricking insecure devices found on the internet, and users will be force to care about the security of the IoT devices that they run. And if users care more, then device manufactures will respond.
Here's the issue
1) Good luck doing this. It currently is tricky as is.
2) Here's the REALLY fun one. You identify the entity with the device, they live in another country. You now lack any legal power to influence them whatsoever, unless you have the money to file an international complaint/lawsuit, assuming it is even possible.
2a) Assume you suit goes through, it gets promptly ignored. Random hacked Chinese/Russian/Australian/German is not going to care what some person in another country thinks.
Many of these 'IoT' devices are literally solutions in search of a problem, being pushed by overeager marketers looking for a new way to get your hard-earned dollars. Honestly, ask yourself how many of these things do you really need? Some of the are useful, granted, but most of them are just toys that you can get along just fine without, and remove a layer of complication from your life in the process.
That's a pathetically weak argument there, certainly not strong enough to lord it over your opponent as a "shithead." Moreover, what the fuck is up with your prose?
Assertion: "The government can indeed help with certain problems, but not this one."
Support 1: They, whoever 'they' are, are unable to understand the problem. That's awfully vague and unsubstantiated.
Support 2: 'They lack the ability to create any useful solution." umm, that's just a rewording of your assertion.
Conclusion: "solutions will have to come from another source" more hand-waviness, based on an assertion that you didn't prove.
You're exactly the kind of shithead that attempts to ape rational argumentation based on what you think it sounds like. You have no ability to generate it or express it in legitimate prose.
Modifying software/firmware on computers and devices that you don't own or have been explicitly granted access to is criminal hacking, and a federal felony. Your suggestion might work, but I suspect that the definition of 'white hat' doesn't include incurring hundreds of thousands counts of a felony activity.
Perhaps the word you were looking for is 'Vigilante'?
HA! I just wasted some of your bandwidth with a frivolous sig!
Someone else suggested a UL-like certification for household IoT. I really like that solution. It's not hard for the average person to understand that this seal means a stranger can't watch you through your webcam, can't unlock your doors, etc. I think people would care, if it were as simple as looking for 1 logo, no geek needed.
Socialism: a lie told by totalitarians and believed by fools.
That's not a "market failure", it's a government failure: the way liability is handled for software and security, companies get away with selling insecure crap without anybody being able to sue them for damages.
"...it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own."
Are you kidding me? I work for a company that is betting it's future on IoT in the manufacturing and heavy equipment area. I promise you, it's the evil 'ole "market" that is causing us to focus a HUGE portion of our resources on security. How do you figure it isn't in every IoT makers best interest to deliver secure products? They may be failing right now but those that do it right will win in the market. This isn't 2002 when security was an afterthought. Even tech novices are aware of security issues these days and demand it from the companies that supply them.
Show me one time where the government has gotten something like this right! They can't even handle their own security and you want them crafting regulation to manage the security of everyone else? The mind boggles.
the free market can fix all things, regulation is bad and hampers the self correcting free market.
Surely most IoT devices need very little bandwidth to call home. Let's limit that to the minimum and call it standards based. For example, if an IoT device truly only needs say 5k of bandwidth here and there, then limit it to that. Better yet, work to limit the bandwidth all IoT devices need. Real security is even better, but we all know that takes a back seat.
Brought to you by Carl's Junior.
I feel like in a way we need more open source firmware options. Sure most of these run Linux, but it's the configuration and front end custom software that's the problem. If there were a good standard open source distribution for different devices that was secure by default maybe this would be better.
On its surface, the IoT sounds like a neat idea.
Unfortunately, in implementation, it's a raging clusterfuck.
Basically, just because you can connect ANYTHING to a network doesn't mean you SHOULD.
Chas - The one, the only.
THANK GOD!!!
The government proposes to add a backdoor to all encryption systems, and Schneier, an encryption expert, immediately goes to bat, contributing to and promoting large amounts of nuanced study on the matter to explain why such a proposal will fail. Then, on this networking issue, Schneier provides a completely unbacked claim that the Government is somehow going to magically fix something. I guess because Schneier is a "good guy" I should just assume that his completely unsubstantiated, critical-thinking-free solution is the one that we should support.
There is nothing the U.S. Government can do about hacked IoT devices in other countries. How about that one, Schneier? Are you even going to admit to the fundamental core of the World Wide Web is a substantial part of the problem, and cannot be addressed by U.S. government legislation?
Schneier's claim is barely three weeks from the date of the event, and Schneier is boldly proclaiming the market has failed. Puh-lease. There are very few, if any, events of this magnitude that any "solution", private or public, can take care of, or even propose to take care of, in such a short time.
Brian Krebs has clearly been the victim of some malicious actor, and as such must have methods for being made whole. These options do not even seem to merit any evaluation by Schneier.
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
As with other instances where the ROI for implementing good computer security is not there, with potentially disastrous societal consequences...
Make manufacturers liable for damages if their devices are compromised for malicious purposes (DDOS, PII extraction, etc.). Make anyone collecting PII or selling a network-connected device have insurance to cover liability for losses due to security. Bam, problem solved: the insurance market will create the implied ROI (vis-a-vis reduced insurance costs), and businesses will either modify their products or behavior accordingly. The solution also side-steps most of the traditional and vexing issues with government oversight (eg: since there's no government-specified "security standard" or anything, there's no potential to make a gigantic mess of that).
It seems so obvious, but I suppose that's why it's seemingly entirely inscrutable to the people in government...
If he is so smart, why is he writing letters to the editor instead of working toward a solution?
OVH said it
And notably, the UL is a non-governmental organization.
The internet will never be secure while it is based on insecure hardware and protocols.
Go well
While I agree with your sarcasm, I will say that there are a LOT of people actively involved in keeping those systems secure non-stop.
"A 'person' is smart. 'People' are dumb, panicky animals and you know that."