Internet of Crappy Things
blog.kaspersky.com
Internet of Crappy Things
1–10 of 95 posts
Re: Internet of Crappy Things
#2I wonder if this might be the push that functional programming + formal verification needs to hit the mainstream.
Compare Erlang, for example, which must have seemed needlessly complex and theoretical outside of modern super-horizontal-scale computing.
I understand that NASA, the #1 in "if this code breaks we all lose our jobs" driven development, are big into formal methods. I think applying that same rigor to smart microwaves wouldn't be such a bad thing.
Re: Internet of Crappy Things
#3I'd rather not have everything I own connected to the internet. My appliances do everything I want them to do already.
It's not just about hacking, either. It would be pretty easy to chart someone's routine if you knew every time he used something electronic.
Re: Internet of Crappy Things
#4I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate.
Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the certifications should check that:
* The device always uses some form of encrypted communications if at all possible based on what it's communicating with
* If the device implements some form of remote control, that remote control includes both sufficiently secure authentication and authorisation mechanisms to ensure that at least it will take some effort to break into
* The device does not leak personal data to unauthorised or unauthenticated requesters, and provides a clear list of what data will be willingly communicated to whom (software should do that too...)
And so on...
The certification process could/should be implemented by high-reputation security companies like Kasperski or Matasano...
Until/unless some barrier to entry is erected, I think it's inevitable that everything that can be connected will be, and that this will mostly be insecure. In the meantime, I guess the solution is to only buy potentially connected devices from premium technology companies (e.g. Apple, Microsoft, Google, Tesla, Nest, etc) - but then, of course, those companies don't sell everything (e.g. no microwaves, car washes, etc) so that would limit the range of things you can safely purchase, for now...
On that note, given how corrupt and broken the US system is, perhaps this needs to start in Europe, where there is already a general mindset of consumer and personal data protection...
Re: Internet of Crappy Things
#5I wonder if this might be the push that functional programming + formal verification needs to hit the mainstream. Compare Erlang, for example, which must have seemed needlessly complex and theoretical outside of modern super-horizontal-scale computing. I understand that NASA, the #1 in "if this code breaks we all lose our jobs" driven development, are big into formal methods. I think applying that same rigor to smart…
What I see is Ada picking up steam after being people getting fed up with C like exploits every day.
http://www.his-2014.co.uk/programme.html
Or C being so limited, that it just looks like Ada with C syntax.
http://www.misra-c.com/Activities/MISRAC/tabid/160/Default.a...
Re: Internet of Crappy Things
#6We're currently working on a consumer device that could well be classified in the IoT category.
We're pushing hard to put in multiple good layers of security, even though the hackable potential of the device is low. The amount of personal or otherwise exploitable information is also low. But that is no excuse to leak anything, or to allow the device to be taken over by attackers.
The path isn't easy... the library support on many of these embedded platforms is poor. But it must be done.
Re: Internet of Crappy Things
#7There are two things that can break IoT, security and fracturing. But security is a necessary condition for IoT to succeed.
I know Apple has surprised many of the companies that want to work with HomeKit with its security requirements. I heard from one company that, for example, was upset that locks cannot be remotely activated. The last thing anyone needs is their house getting hacked and robbed as well.
Re: Internet of Crappy Things
#8I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…
A few massive home hacks and I agree that the gov't will step-in. Personally, I'd rather have the FCC than the NSA regulate wireless security.
Re: Internet of Crappy Things
#9I'd rather not have everything I own connected to the internet. My appliances do everything I want them to do already. It's not just about hacking, either. It would be pretty easy to chart someone's routine if you knew every time he used something electronic.
Not only would I prefer not to have everything connected to the internet, I believe it's imperative.
In my first IT class at high school, my teacher told me something which has stuck with me as a golden rule of computer security:
If you want to make a computer 100% secure, you should unplug all the cables, drop it in a vat of cement and then drop the entire block into the Mariana trench.
He's right, but that's some next level security. However, a more usable tenant of security is that devices should be smart enough to do their job, and no smarter. Connecting your fire alarms to the internet will, at some point, result in someone setting all your alarms off at 2am just to fuck with you.
The flip side is that if you're at home, you'll hear the alarm before you hear your phone, and if you're not at home then as long as it calls the fire brigade ASAP what different does it make if you get an alert on your phone?
Why bother connecting it to the internet at all?
Re: Internet of Crappy Things
#10IoT devices should not be connected directly to the Internet. I don't want my "smart" lightbulbs to be turned on or off through the Internet. I also don't want them to become yet another way for the NSA to spy on us.
All things that are connected to the Internet can be hacked, let alone things that come with poor security and from manufacturers that never intend to update them either. In fact, the plaftform makers for IoT (or governments if you will) should require manufacturers to update the security vulnerabilities for 80 percent of users until the end of life. For example, if 80 percent of customers keep the smart lightbulb for 5 years, then that's how long they should be updated.
So far Google and ARM's Thread protocol for mesh networking between IoT devices looks interesting and seems focused on security. The devices connect only through a "gateway" through the Internet (which can be your smartphone). That feels like the right approach to me.