Internet of Things security is so bad, there’s a search engine for sleeping kids

The joys of being a killjoy and explaining why your toasters web interface won't do much good if you have to get up and insert the toast manually.

Or SmartXthing to introduce the obsolescence cycles of digital electronics to everything else. No sympathy.

I guess I'm just a bitter old person, and a way to young one at that.

To put your example in the perspective : how much useful would it be to operate the TV remote over the internet ? Yeah, it sounds cool that I've set the TV to channel 5, but I'm not there to watch it anyway, so it's kinda useless. Only thing that is now possible is some other people jerking around with the remote.

I can no longer push buttons on the device itself, I have to spend 10 or 15 minutes a day, if I'm lucky, trying to find the "labor saving device", just so I can change the channel or pause a show.

At least some devices (e.g. - Roku) let you use your phone or tablet as the remotes (plural!), which I guess finally is actual progress.

Honestly, adveillance and order automation seem like they'll be useful. And abused. People hacking into celebrity fridges, script kiddies ordering toner and other very shady things on the ORM side will inevitably happen.

I will however plead the Stallman on ownership-to-rent. DRM on Keurigs and usage timers on light bulbs just feel underhanded. So opposed to that. That's an entirely different argument though.

Well, I kinda get consumer IoT now, but I'm still confused why people are going on about it like it's the best thing since sliced blue-tooth. Guess I'm not imaginative enough. Guess I'll be the old grumpy paranoid man at the end of the road that never showers and orders his own ink.

But if I start raving about that people think I'm crazy.

The really disturbing thing about a lot of these IoT devices with sensors and remote communications in the future will be when they no longer rely on an explicit Internet connection being provided via the home network, and instead use some sort of mesh arrangement where they can get online independently and you won't even know about it. At that point, I think robust laws about both disclosure and the ability to opt out will probably be necessary.

Without available firmware updates, you forgot to add.

https://www.shodan.io/search?query=port%3A8099+unknown+messa...

So each TV will be a dumb screen. Output is provided by two Raspberry Pies - one for each of the first two HDMI inputs. HDMI 1 = monitoring, HDMI 2 = office IPTV. The TV feed network is physically separated from everything else, and connected to a dedicated switch. With no uplink to internet.

And to give some context, we discussed our setup with some of the Cloudflare engineers in London. They consider our setup "pretty hardcore". From a company that lives by security, we consider that a compliment.

For better or worse, this trend is going to keep going until something truly egregious happens and either market forces or government regulation steps in. Hopefully we'll see a pattern similar to that we've seen with desktop computers, where there'll be some messy worms or viruses that infect enough people that the big players in the field start taking these threats seriously.

There's no grey area here. Get this wrong and there's potential for foreign state or terrorist attacks that are as destructive - in their own way - as 9/11.

Currently IOT has the makings of the next Pearl Harbour. It would be good if that didn't happen.

Industrial control software doesn't get the attention that normal software does because it takes a specially-seasoned consulting sales person to get industrial software on the docket for a consultancy. The really good consultancies are overbooked anyways (the big 5 Internet firms buy consultant/years the way smaller firms buy consultant/hours), so there's not much incentive for the best talent to get applied to these projects.

If Charlie Miller and Chris Valasek hadn't gotten on stage in track suits to talk about car hacking, the same might be true of automotive, but now every consultancy wants a car-hacking practice.

I've managed a few energy-sector projects. The targets were really, really bad.

When you're building a target, security aneeds to be designed for across the board. If you want to shortcut your way out of that, don't use general-purpose operating systems and don't build networks.

Federal regulations have gone from 20,000 pages in 1970, to 80,000 this year. With a 60% increase just since 1990. The US loves regulation. And that's just at the Federal level, there's an entire government system nearly the size of the Federal Government at the State level.

The only answer that makes any sense at all is funamdental legislation that any product where the primary product is the physical article and not the software must publish the source to included software. That way even if IoT devices are abandoned or become insecure we can update our own hardware.

Most people would not be able to maintain their own devices, but we can easily end up with OpenWRT / DDWRT style products for each class of IoT device if they are required to be freedom respecting. Then techies will naturally instruct their peers to use supported devices, and the natural progression should get us most of the way to where we are today on routers - the liberated ones are recommended and can be supported by the community even if the OEM abandons them, and the ones that are not are a red flag to avoid. The only problem today is that since there is no compulsion to liberate routers a lot of them are sold to ignorant consumers who do not realize the mistake they are making.

So maybe that should be a regulation? Like with how cigarettes must inform consumers of how dangerous they are, proprietary IoT devices must have an FCC general warning their security is out of the users control.

I too am not in favor (at this point) of requiring licensed assessors to approve software after it is complete, at least for most products. Embedded medical devices, vehicle control systems, and things like that probably should have an outside assessment.

I'd be happy for now just having some rules to try to make it so IoT device breaches are mostly due to bugs in the implementation of a good design, rather than due to the producers not having a clue about security.

I think we are fast approaching (if we have not already past) the point where good security practices are something that almost every programmer and software architect should know and practice. There should be basic coverage of this in the standard computer science/software engineering curriculum, and there should be more extensive coverage as an optional part of the curriculum. If you take these optional courses, your degree is "B.S. in Computer Science and Computer Security" (BS CSCS). (There should also be a way to get this training outside of college, and get some sort of certificate that you have had this training).

Those making products that reach the thresholds for regulation should have to have someone with a BS CSCS (or a certification of equivalent security training) who signed off on the architecture, development standards, and testing process used for the product.

My expectation is that as everything (for better or worse) gets connected, the vast majority of CS students will go for the CSCS option and so people with a BS CSCS will not be significantly harder to find or more expensive to hire than people with just a BS CS, and so even small new companies should be able to afford them once they get past the point of the founders doing all the work and start hiring employees.

There is good regulation and bad regulation, but regulation can accelerate innovation. With or without regulation, addressing this problem with more standardization of secure software and hardware infrastructure would reduce the need for human assessors (or at the very least, push what they're worrying about higher in the stack). Addressing it with licensing and more humans is probably not the kind of regulation I'd look for. So could there be bar-raising regulation that encouraged infrastructural solutions that benefited the industry as a whole?

I'd hate to inject insurers into this world, but one way might be to require IoT manufacturers to carry some sort of indemnification against potential consumer damages, and the insurers drive the security quality. In the 1990s, it was insurers, tired of anesthesia-related malpractice losses, who created back-pressure on the profession to put better clinical standards in place, and errors related to anesthesia-related causes dropped, as did premiums for practitioners following the guidelines. Everyone benefited--especially the patients.

But in the IoT world today, there are no meaningful incentives around securing devices, and consumers have little influence.

The one which would make the most sense to me is something like a souped-up CERT: researchers report vulnerabilities to them, staff grades the severity, and a company has increasingly strict penalties if the fix isn't shipped within certain timeframes. Imagine if e.g. Samsung, Lenovo, etc. executives knew that their personal assets would be frozen in the U.S. if they continued not to support all of the millions of vulnerable Android devices?

The main thing I'd hope an approach like this could avoid would be the PCI bureaucracy you mentioned where a company might choose to avoid riskier areas rather than being required to expensively audit a process.

Such laws won't work, however, without a regulatory framework that ensures that -- for example -- click-through EULAs aren't used to lock customers into sleazy "binding arbitration" agreements that sacrifice their rights in return for permission to use an appliance they bought in good faith.

It may be difficult for regulators to keep up with specific technologies, but much tougher consumer rights protection is essential in order to hold negligent manufacturers responsible, because it's cheaper for the cowboy manufacturers to hire a lawyer to draft some dodgy contract boilerplate than it is for them to hire security experts and ship a safe product.

The trouble with this is that "actual harm" in a legal context tends to mean something that can be proven in some specific context and have some specific monetary value attached to it.

Personally, I think harm is also done if someone knows their financial details might have leaked and then worries about their credit record and future financial security, or if someone discovers that a creep somewhere in another country has been watching their baby sleeping, or if a "smart" TV has been transmitting personal conversations of whatever nature from the living room to someone else. However, if we're only talking "actual damages", how do you decide what financial compensation is appropriate in such cases?

In reality, the most damaging violations probably aren't the ones with tangible financial losses attached, because financial losses can at least be made good after the fact. You can't make up for lost time, though maybe you can at least assign some nominal value to compensate for time spent on things like updating credentials after a breach. No amount of money can make up for the kind of distress caused to a teenager if a compromised device leaks something like their diary or an intimate video of them getting changed and the results go all around their school.

If security and privacy implications for the Internet of Things are to be taken seriously, I suspect the laws will need updating so that (a) there is a presumption of harm in cases where personal information leaks to an unintended party, and (b) there is a punitive value attached to leaks that cause non-monetary damage, with that value being very high for leaks that cause severe and/or ongoing distress.

I don't think this needs regulation. All it needs is a scale of meaningful penalties, leading up to company-destroying fines and/or jail time for executives for the most serious infringements caused by gross negligence or malice.

> On top of that, if actual harm comes to users of these devices as a result of these devices then we already have plenty of consumer laws protecting them.

When was the last time a software company was held liable for their software not working correctly, and exposing users unnecessarily? Most of them EULA their way out of any lawsuit to begin with.

That would be simple if companies weren't able to lawyer up and weasel out of any and all liability that doesn't come with explicit standards required by ... regulation. What makes the definition of "defective" vs "not defective" in determining liability is regulation. Regulations don't have to be "fine X will be levied if Y" it can be "Y is required for product Z". That is regulation and it is how we define liability in the legal system. What you are proposing -- establishing bad design -- is the basic definition of regulation.

So maybe you're talking about changing the law, but good luck with that.

> verifies that known invalid credentials don't permit access

you need a second test: "use invalid credentials, then try to download file, expect failure", i.e. a sequence of actions in a single test.

That test is evidently missing from my heating system's web interface, which has exactly this problem. There's a box to type in a PIN code, and it lets you proceed / retry correctly. But it's not necessary to bother with this, you can change the temperature without authenticating if you know the URL.

http://www.nytimes.com/interactive/2015/07/03/upshot/a-quick...

You're totally right that you should have a unit test that verifies failure with invalid credentials, not just success with valid credentials. But a lot of programmers are not as smart as you are here!

I actually uncovered a bug in a JWT library once when I wrote a test for my application to verify that an invalid token would be rejected.

Let's just say there was no corresponding test in the libraries test suite.

For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc.

The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site.

I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible.

The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures.

The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago.

[1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm...

[2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?m...

[3] http://www.base64online.com/hc.php

I had a Linksys WVC11B IP camera like 12 years ago, I don't remember how expensive it was but it was definitely cheap and targeted consumers for home use.