Hacker News Reader

Comment by M_Grey | Hacker News Reader

The IoT is a disaster in slow-motion, and outside of highly technical circles, it seems to be one that is totally invisible.

View on HN

These devices, when taken as a whole, will be largely vulnerable and there will be enough of them to carry-out enormous DDoS attacks. Our toasters are gonna take down the Internet.

This is not the rise of the machines that I think anyone was expecting, although I suspect Futurama gave us a bit of preview. DDOS'ed by a toaster... the future is weird.

> there are enough of them to carry-out enormous DDoS attacks

Fixed that for you.

No there aren't. "Enormous" would be 15 million conficker nodes hitting someone, not a shitty 500k node "IoT" net.

5 million conficker nodes hitting someone

I can't be the only person who moaned out loud at that notion, and who also sees no way to stop it. People so often need to be burned to learn about fire, but in this case owning an IoT item is unlikely to burn the owner.

I don't see a good solution to this, that is likely to actually happen, unless as another person said, ISP's just start blacklisting people with compromised IoT devices.

Why can't Google/Apple/FB et al get together and start blacklisting them? if it gets bad enough, that might be the only chance (good luck getting a random Moldovian ISP to blacklist their spammers)

Maybe because almost everyone is infected with some sort of malware?

relevant Joy of Tech web comic titled: "The Internet of Ransomeware Things"

http://www.geekculture.com/joyoftech/joyarchives/2340.html

just became a patron myself patreon.com/joyoftech

Sounds like a scene right outta PKD's "Ubik" (the AI door that wanted payment for each entry).

I think ISP's are going to start shutting off the internet accounts of people with compromised devices.

What if that's 10% or more of their customer base? I doubt they are willing to lose the revenue.

That's still the only thing that I can imagine connecting the harm done by the IoT, to the owners of IoT devices.

It's not clear that customers should be held responsible. Maybe UL should look into this.

At some point surely the people who are not willing to pay for security, cannot be bothered with security, yet will buy IoT crap have to take some responsibility? After all, they are the market which is being catered to.

At least in the US that's not how any other product category works. People have offloaded all safety and security concerns to the government or the market so that it's just assumed that any mass-produced product is safe enough and customers don't need to worry about it.

A lot of places try to manage that by holding retailers responsible - making it a fine-able offence to sell, for example, RF emitting gear that breaks local regulations. This _kinda_ works where most of the retailers are concerned about their reputation and are in the local jurisdiction, but breaks down _fast_ when thinks like AliExpress are taken into account.

(And it even occasionally fails spectacularly in cases where it _ought_ to have worked OK - people offloading lithium battery charging safety to large locally represented brands like Samsung instead of self-importing Xaiomi or Doogee "brand" phones directly from China...)

ISPs could at least give customers warnings that they have been compromised. Not everybody will heed those warnings of course...

Not until there's a profit motive for them to do so.

What're ISPs more likely to do: Boot off a regular monthly paying customer because they're a "bad network citizen"? Or just charge them for any excess bandwidth they consume each month?

I suspect if some of the big CDNs start blocking ip address ranges that're sending large volumes of forged-source ip packets, ISPs will respond to customer complaints of "I can't load $website because Akamai/Cloudflare/PornHubCDN have blocked you!" (Not that this would have helped the Mirai L7 DDoS agains Krebs...)

It's hard to work out how to fix this, without somehow ending up on the slippery slope of "All ISPs need to to deep packet inspection and traffic analysis of every user's network use, to be able to block suspected-compromised customer devices". (And remember, as soon as we _require_ ISPs to record/store/analyse that, it's going ot get sold on to whoever else thinks they can extract value from it - advertisers, marketers, credit reporting agencies, insurance companies - I;m sure if you put your "evil monetization ideas" hat on you can think of a _big_ list of businesses you'd try to sell access to that data stream to...)

IoT is no more of a disaster than the computers we have today. The IoT botnets are a complete joke compared to actually big botnets consisting of desktop computers, they just haven't been used for DDoS attacks.

Reply on news.ycombinator.com