Fear of litigation may be key to security on the Internet of Things

I've been saying this for as long as anyone cared to listen: the IoT industry doesn't give a flying fuck about security. They care about shipping their product ASAP and preferably for under the price of their competitor.

The average consumer also does not give a flying fuck about the security of these devices unless they find out their baby camera is connected to the internet and strangers are watching their kids sleep. (E.g. no consumer is going to care that their smart lightbulb participated in a DDoS)

It was always going to be external factors that lead manufacturers to start giving a damn about security. Whether this is litigation (more likely in the US) or regulation (more likely in Europe) is yet to be seen.

I doubt manufacturers in China will care at all, unless the Chinese government starts caring because it's causing them issues on their domestic internet.

I'm not saying the solution here is to have lawyers suing every manufacturer for an RCE, that's not sustainable. I also don't think that requiring all IoT devices to be UL Security Certified™ (I just made this up) is a great idea either.

Something which is secure when tested in 2017, might not be secure in 2018.

I think the real solution will be when consumers realize most of this IoT stuff is a gimmick for manufacturers to be able to sell you something that requires a paid subscription to function, when the old model, while admittedly not "smart" worked just fine.

If you buy an IoT device and there's no subscription, then the only way the manufacturer stays in business is by selling more devices. For a device that requires updates to stay secure, this is a recipe for a bad time.

IoT isn't for the average consumer, it's for companies to be able to sell more chips and services.

Look no further than smart meters if you want a prime example of how utilities have utterly wasted the benefits of having nearly real-time data on their customer's consumption. Meanwhile the meter and IoT chip manufacturers have been able to sell them X million units. Billions of dollars invested and they are still no closer to the "smart grid" than when they started.

>…device makers build in pattern learning so devices can recognize when they're been compromised. A coffee maker that suddenly starts sending out email, for instance, would be suspicious and should set off alarms.

Or, you know, don't install an e-mail server in your coffeepot to begin with.

(You'd think that would be a lot easier, too, but I guess the other way they can charge more for "machine learning".)

Not until someone sues Amazon or WalMart and wins.

It's probably the key to give all that business to China.

How is it that IoT devices are compromised? I'd figure that most would be sitting in an environment where there are no incoming connections allowed without some amount of user action. Which means either the network is already compromised, or something more complex is going on?

Won't they just stick in "mandatory arbitration" and "no class action" clauses into license agreements?

Seems like a no brainer as long as we continue to allow companies to get away with such bullshit.

The key to IoT security is open, user updatable firmware and reasonable per byte transit costs.

Too many bucks to pass, the court cases would never end.