Slashdot Mirror
College Network Attacked With Its Own Insecure IoT Devices (zdnet.com)
An anonymous reader writes:An attacker compromised over 5,000 IoT devices on a campus network -- including vending machines and light sensors -- and then used them to attack that same network. "In this instance, all of the DNS requests were attempting to look up seafood restaurants," reports ZDNet, though the attack was eventually blocked by cybersecurity professionals. Verizon's managing principal of investigative response blames the problem on devices configured using default credentials -- and says it's only gong to get worse. "There's going to be so many of these things used by people with very limited understanding of what they are... There's going to be endless amounts of technology out there that people are going to easily be able to get access to."
The article suggests "ensuring that IoT devices are on a completely different network to the rest of the IT estate." But it ends by warning that "until IoT manufacturers bother to properly secure their devices -- and the organizations which deploy them learn to properly manage them -- DDoS attacks by IoT botnets are going to remain a huge threat."
The article suggests "ensuring that IoT devices are on a completely different network to the rest of the IT estate." But it ends by warning that "until IoT manufacturers bother to properly secure their devices -- and the organizations which deploy them learn to properly manage them -- DDoS attacks by IoT botnets are going to remain a huge threat."
Watch Dogs IRL, here we come!
Write them per device based on the device serial number, which is affixed to the back of the device.
This will defeat 'default password' attack botnets, provide just enough security to keep a device sort-of secure even under active incompetence, AND provide easy default password recovery given physical access to the device (which already negates software security to begin with.)
A number of devices I've had over the years already do this. While many devices do not due to cheap quality control, anything that is getting put on a college campus should be at least a single step up from that, and device metadata can be input into the flash during quality assurance testing as part of the flashing/testing procedure.
...until IoT manufacturers bother to properly secure their devices...
This is actually a planned event, set for the 5th of never.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
it's the Gong Show!
seriously going to get software updates for my iot fridge when i can't get it for a couple of years old phone..... doubtful
Never happen. People want to be able to use the things from their existing equipment.
Camera -> Mobile
Sensors -> Desktop
Use Monitoring -> Accounting Cloud
Good luck making a security case, unless they have already been burned and burned hard.
so we shouldn't discuss this.
"You failed to confirm you are a human. Please start from the beginning and try again. If you are a human, we apologize for the inconvenience." which proves /. is censoring replies.
Not sure how they plan to achieve that, given that even in IT that does not happen...
This needs to cost money *to the manufacturers* to start seeing something happening.
That's the problem. This is a classic market failure. The cost of insecure IoT devices is an externality. The manufacturer already sold their device, so it doesn't affect them. The owner of the individual device often (though perhaps not in this case?) still has a working device as far as they can tell, so it doesn't really affect them, either. The fix for the device is to buy a new one, so it's actually a net win for the manufacturer at this point.
Unfortunately, those in the US have been conditioned to believe that government is worse than any other problem, so you won't see anything done about IoT security until something even more significant than Dyn or something targeted directly at government happens.
Only apps can app apps, and the Appernet of Apps has the appiest apps!
Apps!
Invest in poor security and you will get poor results.
Anons need not reply. Questions end with a question mark.
You would be right if this only affected individual consumers, but as this story illustrates it affects large organizations. Those organizations are large enough to make the manufacturer pay for their loss, maybe not this time but in the long run. If it was not the case here (and it likely was not), this university (and other large organizations) will put clauses in their contracts when they buy such devices making the manufacturer liable for such losses. Once manufacturers fix it for their big customers, they will fix it for the average consumer as well because it will be cheaper to get it right for everyone than to only get it right for some.
The truth is that all men having power ought to be mistrusted. James Madison
Who the hell would put an IoT device in the same VLAN with other network equipment? "Professionals" who cause these massive security issues and effectively shoot themselves in the foot deserve every second of pain and hardship they run into.
I doubt vending machines are bought directly by the college. More likely their food service contractor (such as ARA) owns the machines, and is allowed to connect them to the campus network. So that would be a bit more indirect in that organizations which contract with food service vendors would have to stipulate in their contract that the vendor ensure "safe" connections, with a penalty for failure to do so one would hope, then that vendor has to implement that in their machine purchase contracts, AND for whomever installs and maintains the machines, whether their own employees getting vendor training, or the vendors' own support people. Lots of finger-pointing and lawyer career opportunities...
RO
IF this were real we would have a named attached to it. But since it NEVER happened you can't refute it as it never happened.
don't forget the 3rd party payment vendor that just runes there own device that is plugged in to the DBA bus.
Due to changes by the powers to be, my coworkers and I have ot narrow down the scope of the raw Nessus scan data to find our work assignments. Pull the spreadsheet, search for laptops and workstations in OU path, and work on the narrowed dataset (~400K items). One of the more interesting things to find in the raw data are garage openers on the network. Not sure how to remediate those yet. Won't be long before refrigerators, microwave ovens and HDTVs are on the network. Hopefully those will be on a separate VLAN than the general VLAN.
Dumb people being hit by their own stupidity is great, let's hope it stays that way and doesn't hit unsuspecting victims that actually DID try to secure their systems and get hit by the fallout.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No. Do not create a circumstance where a password is default at all in any circumstance. Simply have the device boot up and demand a password to be set as a minimum configuration.
The counter to this is that it makes set up too hard. The counter to that is that they have to configure their wireless password anyway, so it's not like we are demanding a integral reduction without using a calculator or a scratch pad.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
The article mentions a university network, not a college network. Universities are typically made up of several colleges, like the college of pharmacy or college of business.
This article contains a story about an unspecified university, a story that was basically summarized from Verizon's Data Breach Digest 2017. Actually, the 2017 digest isn't out yet and this story is from a "sneak peak".
looks like now the spell check has been hijacked and is searching for seafood restaurants.
The only way of fixing this is to make the high street retailer liable for the damage (including clean up costs) for IoT device failures like this. The liability should be statutory, ie the householder/college/... would not have to show negligence, just that a device installed as per reasonable instructions had this failure. These devices should also have support (eg easy to apply software updates), this support should be for the reasonable expected lifetime of the device; which for something like a light sensor would be 20-40 years, not the paltry year or two that you get with most e-bling these days.
Making the manufacturer liable would not work, many of them are in other countries (eg China) and it would be too difficult for Joe Sixpack/Aunt Tilley to make a complaint - ie sue them. The retailer is in your country, a statutory liability would ensure that their buying departments do appropriate checks and arrange suitable long term support; then arrange insurance in case the manufacturer goes out of business or fails to deliver.
"Oh No!" I hear cries "this will make my IoT toys more expensive!". Please consider the cost of not doing this, not just immediate damage but the cost of employing a builder to replace the light-sensor/e-switch/central-heating/...
To customers, to the consumers, I mean. It seems to me there's only drawbacks and absolutely nothing in it for us.
Most IoT devices are running Linux. As such, the passwords are set to a default. For example: User = pi, Password = raspberry.
Most installers, plug a device in, and forget about it. They fail to set the password, and the machine functions with a default password.
Two things need to change to solve this problem. Manufacturers need to force installers to change the password, and installers need training.
If the vending machines are owned by an outside company, they should be on their own VLAN that can only access the Internet and the other machines.
The truth is that all men having power ought to be mistrusted. James Madison
College decided to provide free seafood on weekends to avoid getting attacked again.
Next Semester, another 5000 IoT devices were compromised looking up Steak Houses...
It's the dolphins making their plans to leave.