Live data from Hacker News

Internet of Crappy Things

blog.kaspersky.com

41–50 of 95 posts

Re: Internet of Crappy Things

#41
post #11

I continue to fail to see how connecting appliances or small electronics to a network adds actual value. Simply throwing technology at a thing doesn't automatically make it better. Yet, here we are, rushing headlong into the "IoT". We ought to recognize this for what it is: pursuit of profit from uninformed purchasers.

I can see some limited benefits, like applying inventory tracking tech to refrigerators. But for the most part you need to be there to refill the device etc.

I work in the foodservice equipment sector at the moment and there's a huge demand from the manufacturers to add upstream monitoring to their devices.

This is mostly motivated by the HACCP (Hazard Analysis and Critical Control Points) guidelines that the US FDA has set in place. Someday that designation will change from "suggested" to "mandatory".

The equipment requirements are pretty large. Restaurants need devices to track refrigeration temperatures, cooking/holding/production temperatures and times, equipment status, check probes, and lots more. Eventually most of the devices in a kitchen will be IoT connected in some form or another. Many of the larger chains will also want this data pushed upstream to their servers for overall safety monitoring and, eventually, other "big data" benefits from seeing store production in near real-time.

Re: Internet of Crappy Things

#42
post #30

Earlier quoted context omitted.

I agree with the sentiment but do you really trust the government can actually audit some giant codebase? The internet of things really includes your computer and your PS4 and every piece of software on them. It includes your router and your printer and your IP cam that's basically the same thing as your router with camera attached. I don't know what the solution is but I really can't imagine a government body able t…

> I agree with the sentiment but do you really trust the government can actually audit some giant codebase? He didn't say that the government would do the code auditing (unless I missed it). It would be outside firms. I believe they do something similar for certifying hardware. The FCC certifies outside hardware testing labs as being qualified to certify that hardware satisfies FCC requirements. The hardware makers w…

Indeed... the government can't even audit their own code, let alone someone else's!...

Re: Internet of Crappy Things

#43
post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

Frankly, that sounds like a good way to kill open source IoT projects (which can't afford to hire Matasano) while helping TLAs by centralizing the information on just a few companies. I'd much rather have strong penalties to companies selling unreasonably insecure devices, with reimbursements to clients and rewards to the reporters of security flaws.

That could work as well... Perhaps a better method than the certification approach. My point is just: we probably need the government to help somehow.

Re: Internet of Crappy Things

#44
post #2

I wonder if this might be the push that functional programming + formal verification needs to hit the mainstream. Compare Erlang, for example, which must have seemed needlessly complex and theoretical outside of modern super-horizontal-scale computing. I understand that NASA, the #1 in "if this code breaks we all lose our jobs" driven development, are big into formal methods. I think applying that same rigor to smart…

The formal verification subject is tricky. For a lot of software (especially in the web startup world) it is often not possible to hire someone trained in formal methods to perform extensive checks/proofs on software which undergoes rapid change as the company pivots every couple of months.

Functional programming alone doesn't give you any guarantees about safer or more correct software than any object oriented language unless you ruthlessly exploit its type-system. Even if you do, the specs have to exist upfront and they have to be correct and stable. One can make the case that isolating side effects and capsuling them in a controlled structure is "the right thing" to do, but that alone does not give you any formal verification of your program.

From personal experience I can only say that whenever I brought up formal verification because of security/correctness concerns, I was immediately shut down by business, because it's simply too expensive for software that doesn't control life-critical systems.

Re: Internet of Crappy Things

#45
post #36

I know these aren't all web-based hacks, but I'm guessing the majority of connected devices are using http. Simply switching to https everywhere would remove a huge amount of attack surface for almost no cost.

This is partly due to the big red warnings you get with self-signed certificates. Yes, it would certainly help, but to the user seeing a crossed-out https is worse than a simple http. And the user's perception matters much more than security does to these people.

@tootie didn't say anything about the certificates being self-signed. Later this year, the new Let's Encrypt CA will make it free and easy to get certificates.[1]

Moreover, it's my understanding that the default with HTTP/2 is for connections to be secure.

[1] https://www.eff.org/deeplinks/2014/11/certificate-authority-...

Re: Internet of Crappy Things

#46
post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

The government is something of a blunt instrument. The difficulty in the proposal as described is how you can precisely define the terms such that you can reliably measure 'compliance' -- cue: lots of legalese and paperwork (cf medical device regs where you really do want stringent controls and considered processes). Sanctions for data breaches and poor security might work but then they simply become costs of doing business and don't necessarily lead to improvments (just passing the buck).

In my view (see my other comment [1]), we need to reconsider how we build, deploy and manage software for this 'connected-age'. If developers are not willing to try to solve this with better tools/infrastructure, then no amount of legislation is going to fix it. If anything, the poorly-secured incumbents will simply misappropriate existing laws to go after those who uncover faults.

(NB: I'm not suggesting that government doesn't have a role to play, but solely relying on them is doomed to fail -- eg who d'you think would be advising them on such legislation? Not the people you'd likely want.)

[1] https://news.ycombinator.com/item?id=9089160

Re: Internet of Crappy Things

#47
post #46
post #4

I hate to be running to the government for this, but... the FCC has regulations that require some level of testing for devices that are going to use certain parts of the spectrum. Some parts have been declared "free zones" and I believe that's where the wifi systems tend to operate. Perhaps we need the FCC to step in there and mandate some basic security certification for connected devices. At the very least the cert…

The government is something of a blunt instrument. The difficulty in the proposal as described is how you can precisely define the terms such that you can reliably measure 'compliance' -- cue: lots of legalese and paperwork (cf medical device regs where you really do want stringent controls and considered processes). Sanctions for data breaches and poor security might work but then they simply become costs of doing b…

I thoroughly agree that this is something we developers have to fix instead of adding yet more hoops to jump through. Like you I am also working on the problem of tools/infrastructure to solve this problem though probably a different aspect of the problem, with my startup resin.io

Re: Internet of Crappy Things

#48
post #42
post #30

Earlier quoted context omitted.

> I agree with the sentiment but do you really trust the government can actually audit some giant codebase? He didn't say that the government would do the code auditing (unless I missed it). It would be outside firms. I believe they do something similar for certifying hardware. The FCC certifies outside hardware testing labs as being qualified to certify that hardware satisfies FCC requirements. The hardware makers w…

Indeed... the government can't even audit their own code, let alone someone else's!...

The government does't audit their own code; they contract Lockheed, SAIC, and Raytheon to do that.

Re: Internet of Crappy Things

#49
post #45

Earlier quoted context omitted.

This is partly due to the big red warnings you get with self-signed certificates. Yes, it would certainly help, but to the user seeing a crossed-out https is worse than a simple http. And the user's perception matters much more than security does to these people.

@tootie didn't say anything about the certificates being self-signed. Later this year, the new Let's Encrypt CA will make it free and easy to get certificates.[1] Moreover, it's my understanding that the default with HTTP/2 is for connections to be secure. [1] https://www.eff.org/deeplinks/2014/11/certificate-authority-...

But then you'd have to update the certs, which an appliance manufacturer isn't going to do.

Re: Internet of Crappy Things

#50

IoT devices should not be connected directly to the Internet. I don't want my "smart" lightbulbs to be turned on or off through the Internet . I also don't want them to become yet another way for the NSA to spy on us. All things that are connected to the Internet can be hacked, let alone things that come with poor security and from manufacturers that never intend to update them either. In fact, the plaftform makers f…

One problem with a mesh, is it might be hard to avoid or shutdown.

I will never, ever, connect a TV to the internet. At least at current very low quality levels. There's no reason an Apple iTV would have to suck as much as present smart-ish TVs.

I'd be pretty angry if a junky TV got owned and started spamming all viewers because it connected to the internet by talking to my kids video game console which is connected, or my roku or even worse my cabletv settop box.

Post reply on HN