Slashdot Mirror
Japanese Government Plans To Hack Into Citizens' IoT Devices (zdnet.com)
An anonymous reader writes: The Japanese government approved a law amendment on Friday that will allow government workers to hack into people's Internet of Things devices as part of an unprecedented survey of insecure IoT devices. The survey will be carried out by employees of the National Institute of Information and Communications Technology (NICT) under the supervision of the Ministry of Internal Affairs and Communications.
NICT employees will be allowed to use default passwords and password dictionaries to attempt to log into Japanese consumers' IoT devices. The plan is to compile a list of insecure devices that use default and easy-to-guess passwords and pass it on to authorities and the relevant internet service providers, so they can take measures to alert consumers and secure the devices. The survey is scheduled to kick off next month, when authorities plan to test the password security of over 200 million IoT devices, beginning with routers and web cameras. Devices in people's homes and on enterprise networks will be tested alike
NICT employees will be allowed to use default passwords and password dictionaries to attempt to log into Japanese consumers' IoT devices. The plan is to compile a list of insecure devices that use default and easy-to-guess passwords and pass it on to authorities and the relevant internet service providers, so they can take measures to alert consumers and secure the devices. The survey is scheduled to kick off next month, when authorities plan to test the password security of over 200 million IoT devices, beginning with routers and web cameras. Devices in people's homes and on enterprise networks will be tested alike
manufacturers probably will have to whitelist them too
I was wondering when the low lying fruit would be harvested. But why stop at surveying weak links in the net chain? Hack them right to dev/null, get them the fuck off the internet. That would be a solid security endeavor.
I do really not understand why such insane ideas get traction at all. Buy one of each of these and hack them in a lab, sure. But hack devices deployed out there by a large and diverse group of people? Pure insanity.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This does not involve any "hacking" into anything. It simply unauthorized access by attempting default passwords, not hacking. Please fix the title. Thanks.
This needs to be done to protect the dumbasses from themselves. Once they start to get educated about security then their digital footprint becomes a little safer but wy stop there, go to the manufactures of these devices and threaten traded sanctions if the manufactures do not do a better job at securing these things.
"But hack devices deployed out there by a large and diverse group of people? Pure insanity." - Hacking devices with little-to-no security to inoculate them from botnets is pure insanity? Pray tell what do you find sane about the internet?
Is it not pure insanity to put null-security hardcoded credential IP devices on the internet GENERALLY? Why would preparing to mitigate their ongoing chronic and future abuse be the insanity here?
I would like the NSA to partner with corporations to secure these devices. It would be great if they started educating the public about exploits and helping manufacturers to close holes. Even foreign manufacturers. It is in the best interest of national security for the US not to have another major internet outage caused by insecure IoT devices.
We also need oversight in this area. Capitalism only works if the consumers know what they are buying. But people don't know. Similar to how we don't sell food without an ingredients list, we shouldn't sell network devices without an open ports list, and a list of hard-coded credentials, etc. Just the mere act of requiring a label will curb idiotic practices. It forces manufacturers to think about it, and it induces liability if they fail to do so.
This is a good thing, *if* their gov't then increases their citizens awareness on device security
(And device manufacturers PULL THEIR F*CKING FINGER OUT with regards to proper device security).
Any manufacturer that doesn't implement decent security and secure by DEFAULT configurations should get a weekly fine, per product.
Just as someone providing the key to their house or car doesn't make it stealing if either is opened, logging into something isn't hacking!
Or to put it another way, when I log into my email, I'm not hacking into my email.
Either that, or if we're going to use "hack" for standard logging in, then we need a word for when you use subversive means to get around not having a password to achieve access that was meant to be prohibited.
This does not involve any "hacking" into anything. It simply unauthorized access by attempting default passwords, not hacking. Please fix the title. Thanks.
Exactly how does the fact that the password is easy to guess change the activity that is being performed in any way? It's hacking. The fact that it is hacking a second grader could do doesn't change that fact.
(and please spare us the standard geek indignation about the word hacking not meaning whatever positive thing you want it to mean)
... with warrant to go look through people's baby monitor cameras.
What could possibly go wrong?
Check your premises.
We've been talking about insecure default passwords on consumer devices for at least the better pat of two decades, there is no longer any excuses.
Manufacturers should be held criminally liable for producing insecure devices in the first place.
These IoT devices should require a secure non-default password be set as part of the setup process and not function until this step is done.
The "securing" is left to the owners (who usually cannot do it) and these will be notified months later, if at all.
That would be an idiotic idea. The proper way to handle this is to threaten device makers with gigantic penalties if their products are found to be insecure by default (measured against current good practice for duty of care) and/or not maintained/updated on a reasonable schedule to remain secure. There are FAR too many technologically impaired end users to expect them to adjust the default settings to be something reasonably secure or to update the devices regularly. If this makes the devices cost more then so be it.
It's probably ok in some cases to let advanced users tweak security settings but doing so should require special action on their part and probably a liability waiver (safe harbor) to the manufacturer of the device.
It's a commonsense approach to a serious problem. Hell, America could use citizen sleuths and crowdsource the effort.
Then, each sorry device could be reported to the owner aggregated and vendor's reps could be yelped.
I think it's a great idea.
It little behooves the best of us to comment on the rest of us.
And Shinzo Abe falls on the authoritarian side.
I think in the case of the culturally Japanese establishment, this will be an overall good thing. The majority of Japanese value personal privacy and culturally have it installed not to trouble others. Given that these devices can already be accessed by anyone who finds them online, having the government perform the due diligence some of these owners were unable or unwilling to grasp seems like an excellent way to plug the problems until the next hardware upgrade treadmill, and maybe even educate enough of the populace on the dangers of it to help educate the rest so it doesn't happen again.
Since a lot of people here do not get it, I will post it again:
1. The devices vulnerable to this will already be part of a bot-net and the vulnerability will have been closed by the bot-net. Hence they will not even find most problematic devices.
2. They plan to let the ISPs and users fix this. This will accomplish absolutely nothing.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I don’t know how successful that operation can be at getting consumers to fix their own setup (still, it’s worth trying), but it may well succeed in publicly shaming manufacturers of shoddy insecure designs (including lame default settings) and pressuring them to make better products. Even if consumers turn out to be too passive (or have too little knowledge) to fix the configuration of their own equipment, at least Japanese public opinion is sure to react to public announcements that XYZ product has caused this many millions of consumers to needlessly be exposed to hackers. So I see it as a smart move, and I applaud the fact that it was initiated through legislation.
And hackers! And hacks! And more hacking! And more buzzwords! IoT! Cyber! State actors! APT and all that! Whee!
If this story is true, then (regardless of its actual usefulness for the purpose) it would be a new, unique kind of event. So far, whenever we heard state agencies tampering with IT, it was for the worst of intentions, insecuring devices by planting back-doors into them.
I'm afraid that even if the Japanese approach was actually true to its intentions, the next state announcing something like this will only do so as a cover-up for the next round of surveillance intrusion.
Arguably leaving the device open through default passwords could be considered to be granting authorisation.
How is it different from somebody putting art in a public places likes parks or open a street stall.