11 ms·

Internet of Things security is so bad, there’s a search engine for sleeping kids

208 points by nikbackm 11y ago

miander 11y ago
I'm not sure how many others share my view but I think that regulation is worth the benefit to security. I have always been very skeptical of the "but it'll hurt innovation" claim. Won't it promote innovation in new approaches for securing low-cost devices? It sure seems nebulous to me, but I am willing to be convinced otherwise.
- xbmcuser 11y ago
  I agree US dislike of regulations is understandable becuase of the cost it adds but they let things go to far. Subprime mortgage crisis is a good example they gave an inch and the banks stole miles.
  - merpnderp 11y ago
    The banks were told by the regulators to give out this loans and the government even invented the scheme to cook the books. More like partners in crime than dereliction of duty.
  - adventured 11y ago
    The US dislikes regulations? Since when? It has one of the most regulated major economies. With banking being arguably the most regulated industry. Federal regulations have gone from 20,000 pages in 1970, to 80,000 this year. With a 60% increase just since 1990. The US loves regulation. And that's just at the Federal level, there's an entire government system nearly the size of the Federal Government at the State level.
- abrezas 11y ago
  We already have regulations for things like safety, so it all depends on how seriously you think of the matter, and how well you think the government will be able to regulate it.
- yk 11y ago
  Any kind of suggestion, how regulation should look like? For example, automatic updates would probably be a must-have for network connected devices. On the other hand, I do not really want my TV to phone home. The problem is, that computers are too flexible for meaningfull regulation, contrast it with the case of a boiler, the interest of the user is that the boiler does not explode, both for the engineer and the housewive.
  - Joeri 11y ago
    Security can never be perfect, but it can be sufficient. Simple sufficient regulation could be having a clearly documented address and process for security issues to get reported and an obligation to provide fixes for remote vulnerabilities in a reasonable time frame after becoming aware of them within the warranty period (they are design flaws, so warranty should cover them). In other words, legally mandate everyone should do what conscientious vendors already do.
    - yk 11y ago
      Your suggestion is not sufficient, you need also a way to roll out the updates, which means a network connection to the outside world, but for someone who has done a IoT set up himself it is probably a sane thing to put the IoT things onto their own network, without internet connectivity. So yes, it is likely possible that there could be sane regulation, but I lack thrust that regulation will be sane, and even more, I suspect that regulation will interfere with my use case, so that I have to jailbreak my light bulbs.
      - JoBrad 11y ago
        Your light bulbs already have to adhere to regulation, and it's largely not been a hindrance at all. In fact, most of it has been helpful.
  - zanny 11y ago
    Just compelling the ability to update does not mean anyone will make updates. The only answer that makes any sense at all is funamdental legislation that any product where the primary product is the physical article and not the software must publish the source to included software. That way even if IoT devices are abandoned or become insecure we can update our own hardware. Most people would not be able to maintain their own devices, but we can easily end up with OpenWRT / DDWRT style products for each class of IoT device if they are required to be freedom respecting. Then techies will naturally instruct their peers to use supported devices, and the natural progression should get us most of the way to where we are today on routers - the liberated ones are recommended and can be supported by the community even if the OEM abandons them, and the ones that are not are a red flag to avoid. The only problem today is that since there is no compulsion to liberate routers a lot of them are sold to ignorant consumers who do not realize the mistake they are making. So maybe that should be a regulation? Like with how cigarettes must inform consumers of how dangerous they are, proprietary IoT devices must have an FCC general warning their security is out of the users control.
- tptacek 11y ago
  If you believe any part of innovation comes from new products launched by small new companies, then regulation will hurt security, because to a first approximation none of those kinds of companies have any coherent plan for software security. None of them can afford market rates for this kind of work. Another problem with regulating software security is that it will inevitably involve licensing software security assessors (it's hard to meaningfully require audits without doing that). The history of licensed security auditors is not reassuring; the economics predict a race-to-the-bottom, and that's what you get (see: PCI).
  - tzs 11y ago
    The concerns in the first paragraph could perhaps be addressed by having volume thresholds before regulation kicks in. If your internet-connected special purpose device has more than N unit sales, more than $M dollar sales, or is offered in more than K brick-and-mortar stores, then it is subject to security regulation. I too am not in favor (at this point) of requiring licensed assessors to approve software after it is complete, at least for most products. Embedded medical devices, vehicle control systems, and things like that probably should have an outside assessment. I'd be happy for now just having some rules to try to make it so IoT device breaches are mostly due to bugs in the implementation of a good design, rather than due to the producers not having a clue about security. I think we are fast approaching (if we have not already past) the point where good security practices are something that almost every programmer and software architect should know and practice. There should be basic coverage of this in the standard computer science/software engineering curriculum, and there should be more extensive coverage as an optional part of the curriculum. If you take these optional courses, your degree is "B.S. in Computer Science and Computer Security" (BS CSCS). (There should also be a way to get this training outside of college, and get some sort of certificate that you have had this training). Those making products that reach the thresholds for regulation should have to have someone with a BS CSCS (or a certification of equivalent security training) who signed off on the architecture, development standards, and testing process used for the product. My expectation is that as everything (for better or worse) gets connected, the vast majority of CS students will go for the CSCS option and so people with a BS CSCS will not be significantly harder to find or more expensive to hire than people with just a BS CS, and so even small new companies should be able to afford them once they get past the point of the founders doing all the work and start hiring employees.
- noonespecial 11y ago
  I think it will hurt real innovation. The big companies will just build the same crap they always do, but have an army of clerics and lawyers to shepherd that crap through the kafkaesque paperwork scheme that will certainly develop. The real innovators will then not be able to come to market because the don't have $750k extra laying around for 6 months of burn waiting for/obtaining certifications, bonds, insurance etc. Edit: In theory, I agree with OP, but in practice, these things almost always end up being more about permission than proficiency so we end up with corruption instead of competence.
- fiatmoney 11y ago
  The problem is that a regulation like "be secure" is impractical, because to a close approximation no system is actually, 100% secure - it's just a matter of the effort taken to hack it. So the regulation ends up being "go through the security process" (take something like PCI compliance as your model). This always ends up being a crappy fit because the guy doing the process can typically only throw out a list of "best practices" that may or may not make any sense for any particular application, and in any event aren't comprehensive enough. It's also wildly expensive, since the process is embedded in a regulatory-certified person who charges N$ / hour. Empirically the best you can do absent some specific industrial setup is a series of bright-line rules like "don't store passwords in the clear", but that's far from sufficient.
  - acdha 11y ago
    What if the regulation largely ignored the technology and instead focused on responsibility: prohibit license terms requiring arbitration or restricting class action cases, setting minimum warranty terms which treat software support as a primary requirement (no selling a washing machine with a 10+ year hardware lifetime but ending software support 6 months after release), and restricting liability disclaimers so a company can't completely shirk responsibility the way everyone does now? The one which would make the most sense to me is something like a souped-up CERT: researchers report vulnerabilities to them, staff grades the severity, and a company has increasingly strict penalties if the fix isn't shipped within certain timeframes. Imagine if e.g. Samsung, Lenovo, etc. executives knew that their personal assets would be frozen in the U.S. if they continued not to support all of the millions of vulnerable Android devices? The main thing I'd hope an approach like this could avoid would be the PCI bureaucracy you mentioned where a company might choose to avoid riskier areas rather than being required to expensively audit a process.
    - mikeash 11y ago
      Maybe we could go a bit further and say that a proven security breach (i.e. an unauthorized person actually accesses your device) carries some concrete liability, for example $500 plus a refund of the purchase price? It's a bit like the laws for junk faxes or illegal telemarketing calls. You don't have to take them to court or prove actual damages, you just press the "statutory damages" button when an actual violation occurs. I could see some difficulty arising from people who are breached not because of some fault with the product, but because the people made their password "password" or whatever. But maybe this would just encourage manufacturers to make it difficult to set up their devices insecurely. There might be problems with people knowing that they're breached. To combat this, you might make the $500 (or whatever amount) payable to anybody who accesses such a device in good faith. These "find an insecure web cam pointed at a baby" web sites would go from voyeuristic amusements to money makers. Just some random ideas....
- manyxcxi 11y ago
  I wholeheartedly disagree about letting regulators have anything to do with technology. It moves too fast and has too many interpretations to be codified into common sense law, leaving just the big pocket corps to write the regulations just like they've already done everywhere else. How do you define reasonable security practices? If there's PII, what's reasonable then? What's reasonable today OAuth, tokens, 2FA was over the top crazy/impractical/expensive/impossible in 2001. You think there's going to be a committee evolving this crap every month in perpetuity? On top of that, if actual harm comes to users of these devices as a result of these devices then we already have plenty of consumer laws protecting them. Granted, they're going to have to come up with ways to apply it sometimes and you're going to have to prove it was that device that allowed the harm, but we have it. I will say this though: I'm mostly okay with laws (whether they exist or not yet) that say that if your negligence or stupidity was the root cause, as a manufacturer of these goods, you are on the hook for a multiplier of damages. There are a lot of companies out there that know they are pushing shit to market in a race to the bottom and then just claim security is hard and they tried their best when clearly, they knew about an 8 year old bug and shipped anyway. I'm that case, I'm okay with hitting them hard.
  - cstross 11y ago
    > I'm mostly okay with laws (whether they exist or not yet) that say that if your negligence or stupidity was the root cause, as a manufacturer of these goods, you are on the hook for a multiplier of damages. Such laws won't work, however, without a regulatory framework that ensures that -- for example -- click-through EULAs aren't used to lock customers into sleazy "binding arbitration" agreements that sacrifice their rights in return for permission to use an appliance they bought in good faith. It may be difficult for regulators to keep up with specific technologies, but much tougher consumer rights protection is essential in order to hold negligent manufacturers responsible, because it's cheaper for the cowboy manufacturers to hire a lawyer to draft some dodgy contract boilerplate than it is for them to hire security experts and ship a safe product.
    - manyxcxi 11y ago
      I agree with that. I'm much more in favor of punishing harshly when the mess up happens and could've been avoided but for willful negligence than trying to write a bunch of catch all regulations before we have a problem. I think, at least in the US, we need much stronger consumer advocacy laws, something with teeth that can't be arbitrated down by a group of expensive lawyers. We'd have to find a balance though, as we are already way too litigious and we'd be stifling innovation out of fear of getting accused of negligence.
- ctulek 11y ago
  +1 Regulations on hardware devices do not stop innovation in hardware. One can say there are far few hardware startups than software startups, but I don't think regulations are the main reasons of this difference.
- golergka 11y ago
  My be instead of prohibiting insecure products we can just put labels on them? Want to buy shiny new thing from kickstarter, be my guest, but it'll have a huge SECURITY NOT CERTIFIED label on the side or something like that. Which will not turn away a dedicated geek, but will give a hint to an average soccer mom.
  - JoBrad 11y ago
    Certified by whom? And how do we keep those security labels from becoming as useless as certifications like "organic", "natural", and "fat free"?
    - golergka 11y ago
      By some appropriate government agency, I assume.
- pdkl95 11y ago
  Specific security regulation is not necessary, because the solution is simple: liability. If a product leaks pictures of your kids to the internet when it is used normally, the product is defective. If the problem was caused by a bad design[1], then the manufacturer should be liable for their negligence. Yes, this would make entire categories of currently-used software unusable. It would probably require recalling many current and upcoming products. Adding complex network features (or any network connectivity at all) would also add liability risk, so this would also discourage (but not ban) throwing internet connectivity on everything. As Dan Geer recommended[2], when the product is Free Software (including the build environment), the end user has the ability to defend themselves, liability can probably be limited to a refund. However with proprietary software or embedded devices where changing the software is not practical, the manufacturer should be liable for any damage their products cause. I'm sure there will be a lot of resistance to this idea, as many products currently rely on bad design (smart TVs, nest), but allowing a security-free internet of things to happen would be a yet another Sword Of Damocles hanging over our head. Liability may be bad, but the problems that will happen if we connect everything to the internet without serious would be much worse. [1] "bad design" would not include things outside o f the manufacturer's control, such as new way to weaken crypto or a completely new attack method. Buffer overflows, protocol design problems, incorrect configuration or permissions, unauthenticated updates or other downloads, and sending plaintext over a network should count. [2] http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt
  - daveguy 11y ago
    > Specific security regulation is not necessary, because the solution is simple: liability That would be simple if companies weren't able to lawyer up and weasel out of any and all liability that doesn't come with explicit standards required by ... regulation. What makes the definition of "defective" vs "not defective" in determining liability is regulation. Regulations don't have to be "fine X will be levied if Y" it can be "Y is required for product Z". That is regulation and it is how we define liability in the legal system. What you are proposing -- establishing bad design -- is the basic definition of regulation.
  - cmurf 11y ago
purpled_haze 11y ago
While I agree this is bad, I think it's a misuse of the term IoT. Webcams have been around since the 90s.
- masklinn 11y ago
  Online webcams are part of the IoS, and if webcams remain insecure after having been in use for 20 years, there's little hope for the rest of IoS to be any better.
  - Houshalter 11y ago
    What does this have to do with ios?
- oxide 11y ago
  I think it's a perfect example of lackluster security oversight when it comes to the IoT. people want a webcam they can plug in and use, most people don't consider the features it offers nor do they secure it beyond what is enabled by default. webcams are a thing, like it or not, and they use the internet, like it or not. if you think a rascally teenager turning your webcam lights on in the middle of the night is bad, wait until he changes your e-fridge settings and all your food spoils.
- paulojreis 11y ago
  Maybe it is. But, on the other hand, it's a nice example because it makes you wonder: if companies who've been making webcams are failing so much in security, what should we expect from companies making products which aren't related to IT at all? How are the oven-making companies faring, security-wise, in this IoT thing?
  - Symbiote 11y ago
    TLDR: the "authenticate" HTTP call on my heating system is optional, so you can change the temperature without the PIN. For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc. The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site. I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible. The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures. The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago. [1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm... [2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?mt=8 https://itunes.apple.com/dk/app/roth-touchline/id498448526?m... [3] http://www.base64online.com/hc.php http://www.base64online.com/hc.php
gengkev 11y ago
Isn't it common sense to at least set a randomly generated password as the default one? Especially for something as sensitive as an Internet webcam.
- deleted 11y ago
  [deleted]
- _pmf_ 11y ago
  > Isn't it common sense to at least set a randomly generated password as the default one You're increasing your support cost by a factor of 100 to 500, and that's a very conservative estimation.
  - masklinn 11y ago
    Boo-fucking-hoo? As things stand these devices are dysfunctional or broken, would you recommend delivering new cars without brakes and brake fluid because that saves you money?
    - paulddraper 11y ago
      Eloquent.
    - nommm-nommm 11y ago
      I don't think pmf was recommending anything, just stating a reason why a company wouldn't want to do something like that. He/she wasn't endorsing it or saying that it would be a good choice.
    - _pmf_ 11y ago
      > would you recommend delivering new cars without brakes and brake fluid because that saves you money? No, I recommend delivering cars with brakes and brake fluid because that saves support costs.
  - pjc50 11y ago
    I doubt it - I've started seeing this on consumer routers. The BT one came with the random password printed on a convenient piece of plastic slotted into the router.
saboot 11y ago
It's much worse than just passive webcams. Some devices which were never meant to be connected to the internet are out there. Stoplights? HVAC Systems? Carwashes? Ice Rinks? POWER PLANTS? Yes! https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64 EDIT: I looked at his more recent talk from last November ... the situation has not improved "115 batshit stupid things you can put on the internet in as fast as I can go by Dan Tentler" https://www.youtube.com/watch?v=hMtu7vV_HmY https://www.youtube.com/watch?v=hMtu7vV_HmY Featuring Spanish Chicken Controls
- elorant 11y ago
  How about smart TVs? Give it a few years and you’ll have hundreds of millions of TVs with a camera on them exposed to the wild.
  - Silhouette 11y ago
    The disturbing thing today about smart TVs in particular is that it's increasingly difficult to buy a TV without those features. Personally, I have no interest in them even without the obvious security and privacy concerns. I want my TV and speakers to be as good as possible at showing pictures and making sounds, and to accept signals from whatever sources I want to use in sensible ways. Everything else is just more cost, more scope for failure, and less future-proofing. The really disturbing thing about a lot of these IoT devices with sensors and remote communications in the future will be when they no longer rely on an explicit Internet connection being provided via the home network, and instead use some sort of mesh arrangement where they can get online independently and you won't even know about it. At that point, I think robust laws about both disclosure and the ability to opt out will probably be necessary.
    - rangibaby 11y ago
      Have you considered using a PC monitor instead of a TV? Honestly, their biggest feature when used as a TV is their lack of "features".
api 11y ago
Most embedded engineer types know nothing about and never think about security. One example I saw once was an FTP server where the auth commands worked but were irrelevant. All commands always worked. It passed the unit tests therefore it was good.
- gardano 11y ago
  I started taking a deep-dive look at iOS HomeKit, and was alarmed at the security implications that would be on my shoulders. I'm not an embedded engineer type, so the security burden I saw being hefted upon my shoulders felt much more onerous than the typical REST type API I've been accustomed to. At this point, I cannot imagine writing an app using IoT while at the same time feeling confident in understanding every bad security use-case. Perhaps `IoT Security Expert` is an up-and-coming career path, but it's not a job description for the faint of heart nor for the one-off developer to be able to approach with any sense of confidence.
- jlgaddis 11y ago
  I'm not even a developer so I know very little about unit tests but I would assume that in something with an authentication system you would have a unit test that verifies that known invalid credentials don't permit access.
  - api 11y ago
    This one just validated that good credentials worked and bad ones didn't. It passed of course. Good to ship.
  - Symbiote 11y ago
    Verifying that invalid credentials are rejected by the part that checks credentials is one thing, and I'd expect this to be an obvious test case. But to > verifies that known invalid credentials don't permit access you need a second test: "use invalid credentials, then try to download file, expect failure", i.e. a sequence of actions in a single test. That test is evidently missing from my heating system's web interface, which has exactly this problem. There's a box to type in a PIN code, and it lets you proceed / retry correctly. But it's not necessary to bother with this, you can change the temperature without authenticating if you know the URL.
abrkn 11y ago
Brings to mind the Twitter account @internetofshit https://twitter.com/internetofshit https://twitter.com/internetofshit
50CNT 11y ago
I still don't get the Internet of Things. The mental calculation just doesn't work out for most things. My personal rule of thumb is: benefitofmeaccessingXremotely(X) - costofotherpeopleaccesingXremotely(X)*riskofthathappening Benefits being low for most things, costs high, and risks...uhmm...nah. Only exception I can think of is very limited amounts of sensors (eg. is X on?). What's the benefit of me turning on a gas stove remotely? Almost none. What's the cost of someone else turning on my gas stove? Really high. How much is the risk? Way too high. Then there's smart devices, another component of IoT. But how much smarts do we actually want? Screens are nice. Making my shower multi touch isn't (capacitive touch + water = no bueno. Imagine water from hell scenario and no way of turning it off with your wet hands). Fridge compiling shopping lists automatically? Neat. Cheap android tablet that comes with a fridge glued to it? Nah. The only utility I see is locally connected devices. Using your phone as a remote. That seems handy. To a certain degree, we have that. Extra points if I don't need to download an app for everything, because don't you dare tell me that your blue-tooth on/off switch needs a 15mb .apk. If I gave one about the 14.9mb of branding you're including, I'd download your press kit. There's some utility in home IoT wudget-thingimabobs, but I'm almost certain we'll mess it up to no end in our excitement. There'll be some legitimately useful products coming from it, but most of it will be utterly cringe worthy in retrospect. /rant('IoT')
- sorokod 11y ago
  I was around when TV remote controls became popular. Couldn't see what was the point of them.
  - 50CNT 11y ago
    Good point. I do believe that some very interesting things will come of IoT, it's the crass amounts of enthusiasm some people have regarding it that grinds my gears. The joys of being a killjoy and explaining why your toasters web interface won't do much good if you have to get up and insert the toast manually. Or SmartXthing to introduce the obsolescence cycles of digital electronics to everything else. No sympathy. I guess I'm just a bitter old person, and a way to young one at that.
  - 11y ago
exogen 11y ago
I have a Denon receiver with a web interface, which can control everything over HTTP (volume, source selection, firmware, etc). Of course there's no CSRF protection, so anyone could just control my receiver by getting me to visit a page that tried POSTing to 192.168.0.XXX – it would be trivial.
davidgerard 11y ago
1995: Every object in your home has a clock & it is blinking 12:00 2025: Every object in your home has a IP address & the password is Admin https://twitter.com/mcclure111/status/688775402584731649 https://twitter.com/mcclure111/status/688775402584731649
deleted 11y ago
[deleted]
arthur_pryor 11y ago
well, that was mostly depressing, but i found the part about mudge and the UL-like initiative encouraging: "Peiter “Mudge” Zatko is a member of the high-profile L0pht hacker group who testified before Congress in 1998, and since he's gone on to head cybersecurity research at the Defense Advanced Research Projects Agency (DARPA) before joining Google in 2013. In June, Zatko announced he was leaving the search giant to form a cybersecurity NGO modelled on Underwriters Laboratories." and above that, a section about a similar "consumer reports" style rating organization. that was also the first time i'd heard of the group i am the cavalry, which seems like a cool idea (in principle, at least, without really knowing much about the actual group). and i understand this objection to that sort of approach: "It’s not the same quality problem... UL is about accidental failures in electronics. CyberUL would be about intentional attacks against software. These are unrelated issues. Stopping accidental failures is a solved problem in many fields. Stopping attacks is something nobody has solved in any field. In other words, the UL model of accidents is totally unrelated to the cyber problem of attacks." it is a very different problem in a lot of ways, but that doesn't mean that an approach similar in spirit or presentation is doomed to failure. and i think it does fit into the broad category of messy consumer information problems that are hard to solve with specific detailed regulation.
DyslexicAtheist 11y ago
During a review of W3C WoT & ETSI M2M standards I noticed that security is totally ignored in these tech-standardization bodies. The standards leave security as an exercise to the industry and the maker communities (who are not spending money on security until they have an problem). That said, it's also not trivial to implement something that at first sight seems straight-forward like 802.15.4 Security[0][1] without a deep understanding of the security architecture supported by the underlying platform: [0] http://www.jwcn.eurasipjournals.com/content/pdf/1687-1499-2006-093830.pdf http://www.jwcn.eurasipjournals.com/content/pdf/1687-1499-20... [1] https://www.cs.berkeley.edu/~daw/papers/15.4-wise04.pdf https://www.cs.berkeley.edu/~daw/papers/15.4-wise04.pdf Since the web is now getting "engaged" to the devices with CoAP and other protocols I wanted to create awareness of how bugs can spill over into the real world and do real damage there. If hacked insulin pumps or baby monitors don't scare you enough how about hacking a train? https://media.ccc.de/v/32c3-7490-the_great_train_cyber_robbery https://media.ccc.de/v/32c3-7490-the_great_train_cyber_robbe... ?? (everyone should probably watch this simply because SCADA strangelove guys are crazy and awesome) Anyway to counteract the usually very "marketing intensive" tone of IoT groups on LinkedIn I decided to start this IoT Security group: https://www.linkedin.com/groups/4807429 https://www.linkedin.com/groups/4807429 it would be great to see people from all camps (IoT is a combination of 3 silos: 1) embedded, 2) web 3) infosec) actively contributing with technical topics in this group. I will keep it open to posts from marketeers but am heavily policing it for blogspam and remove any posts that are not security related). Also I have some ideas about hackerspaces (http://hackerspaces.org/ http://hackerspaces.org/) which IMO every city should have and support. They're needed to propagate knowledge between these individual camps properly. (my contact details are in my profile in case you are interested to discuss more offline).

208 points by nikbackm 11y ago

I'm not sure how many others share my view but I think that regulation is worth the benefit to security. I have always been very skeptical of the "but it'll hurt innovation" claim. Won't it promote innovation in new approaches for securing low-cost devices? It sure seems nebulous to me, but I am willing to be convinced otherwise.

xbmcuser 11y ago
I agree US dislike of regulations is understandable becuase of the cost it adds but they let things go to far. Subprime mortgage crisis is a good example they gave an inch and the banks stole miles.
- merpnderp 11y ago
  The banks were told by the regulators to give out this loans and the government even invented the scheme to cook the books. More like partners in crime than dereliction of duty.
- adventured 11y ago
  The US dislikes regulations? Since when? It has one of the most regulated major economies. With banking being arguably the most regulated industry. Federal regulations have gone from 20,000 pages in 1970, to 80,000 this year. With a 60% increase just since 1990. The US loves regulation. And that's just at the Federal level, there's an entire government system nearly the size of the Federal Government at the State level.
abrezas 11y ago
We already have regulations for things like safety, so it all depends on how seriously you think of the matter, and how well you think the government will be able to regulate it.
yk 11y ago
Any kind of suggestion, how regulation should look like? For example, automatic updates would probably be a must-have for network connected devices. On the other hand, I do not really want my TV to phone home. The problem is, that computers are too flexible for meaningfull regulation, contrast it with the case of a boiler, the interest of the user is that the boiler does not explode, both for the engineer and the housewive.
- Joeri 11y ago
  Security can never be perfect, but it can be sufficient. Simple sufficient regulation could be having a clearly documented address and process for security issues to get reported and an obligation to provide fixes for remote vulnerabilities in a reasonable time frame after becoming aware of them within the warranty period (they are design flaws, so warranty should cover them). In other words, legally mandate everyone should do what conscientious vendors already do.
  - yk 11y ago
    Your suggestion is not sufficient, you need also a way to roll out the updates, which means a network connection to the outside world, but for someone who has done a IoT set up himself it is probably a sane thing to put the IoT things onto their own network, without internet connectivity. So yes, it is likely possible that there could be sane regulation, but I lack thrust that regulation will be sane, and even more, I suspect that regulation will interfere with my use case, so that I have to jailbreak my light bulbs.
    - JoBrad 11y ago
      Your light bulbs already have to adhere to regulation, and it's largely not been a hindrance at all. In fact, most of it has been helpful.
- zanny 11y ago
  Just compelling the ability to update does not mean anyone will make updates. The only answer that makes any sense at all is funamdental legislation that any product where the primary product is the physical article and not the software must publish the source to included software. That way even if IoT devices are abandoned or become insecure we can update our own hardware. Most people would not be able to maintain their own devices, but we can easily end up with OpenWRT / DDWRT style products for each class of IoT device if they are required to be freedom respecting. Then techies will naturally instruct their peers to use supported devices, and the natural progression should get us most of the way to where we are today on routers - the liberated ones are recommended and can be supported by the community even if the OEM abandons them, and the ones that are not are a red flag to avoid. The only problem today is that since there is no compulsion to liberate routers a lot of them are sold to ignorant consumers who do not realize the mistake they are making. So maybe that should be a regulation? Like with how cigarettes must inform consumers of how dangerous they are, proprietary IoT devices must have an FCC general warning their security is out of the users control.
tptacek 11y ago
If you believe any part of innovation comes from new products launched by small new companies, then regulation will hurt security, because to a first approximation none of those kinds of companies have any coherent plan for software security. None of them can afford market rates for this kind of work. Another problem with regulating software security is that it will inevitably involve licensing software security assessors (it's hard to meaningfully require audits without doing that). The history of licensed security auditors is not reassuring; the economics predict a race-to-the-bottom, and that's what you get (see: PCI).
- tzs 11y ago
  The concerns in the first paragraph could perhaps be addressed by having volume thresholds before regulation kicks in. If your internet-connected special purpose device has more than N unit sales, more than $M dollar sales, or is offered in more than K brick-and-mortar stores, then it is subject to security regulation. I too am not in favor (at this point) of requiring licensed assessors to approve software after it is complete, at least for most products. Embedded medical devices, vehicle control systems, and things like that probably should have an outside assessment. I'd be happy for now just having some rules to try to make it so IoT device breaches are mostly due to bugs in the implementation of a good design, rather than due to the producers not having a clue about security. I think we are fast approaching (if we have not already past) the point where good security practices are something that almost every programmer and software architect should know and practice. There should be basic coverage of this in the standard computer science/software engineering curriculum, and there should be more extensive coverage as an optional part of the curriculum. If you take these optional courses, your degree is "B.S. in Computer Science and Computer Security" (BS CSCS). (There should also be a way to get this training outside of college, and get some sort of certificate that you have had this training). Those making products that reach the thresholds for regulation should have to have someone with a BS CSCS (or a certification of equivalent security training) who signed off on the architecture, development standards, and testing process used for the product. My expectation is that as everything (for better or worse) gets connected, the vast majority of CS students will go for the CSCS option and so people with a BS CSCS will not be significantly harder to find or more expensive to hire than people with just a BS CS, and so even small new companies should be able to afford them once they get past the point of the founders doing all the work and start hiring employees.
noonespecial 11y ago
I think it will hurt real innovation. The big companies will just build the same crap they always do, but have an army of clerics and lawyers to shepherd that crap through the kafkaesque paperwork scheme that will certainly develop. The real innovators will then not be able to come to market because the don't have $750k extra laying around for 6 months of burn waiting for/obtaining certifications, bonds, insurance etc. Edit: In theory, I agree with OP, but in practice, these things almost always end up being more about permission than proficiency so we end up with corruption instead of competence.
fiatmoney 11y ago
The problem is that a regulation like "be secure" is impractical, because to a close approximation no system is actually, 100% secure - it's just a matter of the effort taken to hack it. So the regulation ends up being "go through the security process" (take something like PCI compliance as your model). This always ends up being a crappy fit because the guy doing the process can typically only throw out a list of "best practices" that may or may not make any sense for any particular application, and in any event aren't comprehensive enough. It's also wildly expensive, since the process is embedded in a regulatory-certified person who charges N$ / hour. Empirically the best you can do absent some specific industrial setup is a series of bright-line rules like "don't store passwords in the clear", but that's far from sufficient.
- acdha 11y ago
  What if the regulation largely ignored the technology and instead focused on responsibility: prohibit license terms requiring arbitration or restricting class action cases, setting minimum warranty terms which treat software support as a primary requirement (no selling a washing machine with a 10+ year hardware lifetime but ending software support 6 months after release), and restricting liability disclaimers so a company can't completely shirk responsibility the way everyone does now? The one which would make the most sense to me is something like a souped-up CERT: researchers report vulnerabilities to them, staff grades the severity, and a company has increasingly strict penalties if the fix isn't shipped within certain timeframes. Imagine if e.g. Samsung, Lenovo, etc. executives knew that their personal assets would be frozen in the U.S. if they continued not to support all of the millions of vulnerable Android devices? The main thing I'd hope an approach like this could avoid would be the PCI bureaucracy you mentioned where a company might choose to avoid riskier areas rather than being required to expensively audit a process.
  - mikeash 11y ago
    Maybe we could go a bit further and say that a proven security breach (i.e. an unauthorized person actually accesses your device) carries some concrete liability, for example $500 plus a refund of the purchase price? It's a bit like the laws for junk faxes or illegal telemarketing calls. You don't have to take them to court or prove actual damages, you just press the "statutory damages" button when an actual violation occurs. I could see some difficulty arising from people who are breached not because of some fault with the product, but because the people made their password "password" or whatever. But maybe this would just encourage manufacturers to make it difficult to set up their devices insecurely. There might be problems with people knowing that they're breached. To combat this, you might make the $500 (or whatever amount) payable to anybody who accesses such a device in good faith. These "find an insecure web cam pointed at a baby" web sites would go from voyeuristic amusements to money makers. Just some random ideas....
manyxcxi 11y ago
I wholeheartedly disagree about letting regulators have anything to do with technology. It moves too fast and has too many interpretations to be codified into common sense law, leaving just the big pocket corps to write the regulations just like they've already done everywhere else. How do you define reasonable security practices? If there's PII, what's reasonable then? What's reasonable today OAuth, tokens, 2FA was over the top crazy/impractical/expensive/impossible in 2001. You think there's going to be a committee evolving this crap every month in perpetuity? On top of that, if actual harm comes to users of these devices as a result of these devices then we already have plenty of consumer laws protecting them. Granted, they're going to have to come up with ways to apply it sometimes and you're going to have to prove it was that device that allowed the harm, but we have it. I will say this though: I'm mostly okay with laws (whether they exist or not yet) that say that if your negligence or stupidity was the root cause, as a manufacturer of these goods, you are on the hook for a multiplier of damages. There are a lot of companies out there that know they are pushing shit to market in a race to the bottom and then just claim security is hard and they tried their best when clearly, they knew about an 8 year old bug and shipped anyway. I'm that case, I'm okay with hitting them hard.
- cstross 11y ago
  > I'm mostly okay with laws (whether they exist or not yet) that say that if your negligence or stupidity was the root cause, as a manufacturer of these goods, you are on the hook for a multiplier of damages. Such laws won't work, however, without a regulatory framework that ensures that -- for example -- click-through EULAs aren't used to lock customers into sleazy "binding arbitration" agreements that sacrifice their rights in return for permission to use an appliance they bought in good faith. It may be difficult for regulators to keep up with specific technologies, but much tougher consumer rights protection is essential in order to hold negligent manufacturers responsible, because it's cheaper for the cowboy manufacturers to hire a lawyer to draft some dodgy contract boilerplate than it is for them to hire security experts and ship a safe product.
  - manyxcxi 11y ago
    I agree with that. I'm much more in favor of punishing harshly when the mess up happens and could've been avoided but for willful negligence than trying to write a bunch of catch all regulations before we have a problem. I think, at least in the US, we need much stronger consumer advocacy laws, something with teeth that can't be arbitrated down by a group of expensive lawyers. We'd have to find a balance though, as we are already way too litigious and we'd be stifling innovation out of fear of getting accused of negligence.
ctulek 11y ago
+1 Regulations on hardware devices do not stop innovation in hardware. One can say there are far few hardware startups than software startups, but I don't think regulations are the main reasons of this difference.
golergka 11y ago
My be instead of prohibiting insecure products we can just put labels on them? Want to buy shiny new thing from kickstarter, be my guest, but it'll have a huge SECURITY NOT CERTIFIED label on the side or something like that. Which will not turn away a dedicated geek, but will give a hint to an average soccer mom.
- JoBrad 11y ago
  Certified by whom? And how do we keep those security labels from becoming as useless as certifications like "organic", "natural", and "fat free"?
  - golergka 11y ago
    By some appropriate government agency, I assume.
pdkl95 11y ago
Specific security regulation is not necessary, because the solution is simple: liability. If a product leaks pictures of your kids to the internet when it is used normally, the product is defective. If the problem was caused by a bad design[1], then the manufacturer should be liable for their negligence. Yes, this would make entire categories of currently-used software unusable. It would probably require recalling many current and upcoming products. Adding complex network features (or any network connectivity at all) would also add liability risk, so this would also discourage (but not ban) throwing internet connectivity on everything. As Dan Geer recommended[2], when the product is Free Software (including the build environment), the end user has the ability to defend themselves, liability can probably be limited to a refund. However with proprietary software or embedded devices where changing the software is not practical, the manufacturer should be liable for any damage their products cause. I'm sure there will be a lot of resistance to this idea, as many products currently rely on bad design (smart TVs, nest), but allowing a security-free internet of things to happen would be a yet another Sword Of Damocles hanging over our head. Liability may be bad, but the problems that will happen if we connect everything to the internet without serious would be much worse. [1] "bad design" would not include things outside o f the manufacturer's control, such as new way to weaken crypto or a completely new attack method. Buffer overflows, protocol design problems, incorrect configuration or permissions, unauthenticated updates or other downloads, and sending plaintext over a network should count. [2] http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt
- daveguy 11y ago
  > Specific security regulation is not necessary, because the solution is simple: liability That would be simple if companies weren't able to lawyer up and weasel out of any and all liability that doesn't come with explicit standards required by ... regulation. What makes the definition of "defective" vs "not defective" in determining liability is regulation. Regulations don't have to be "fine X will be levied if Y" it can be "Y is required for product Z". That is regulation and it is how we define liability in the legal system. What you are proposing -- establishing bad design -- is the basic definition of regulation.
- cmurf 11y ago

purpled_haze 11y ago

While I agree this is bad, I think it's a misuse of the term IoT. Webcams have been around since the 90s.

masklinn 11y ago
Online webcams are part of the IoS, and if webcams remain insecure after having been in use for 20 years, there's little hope for the rest of IoS to be any better.
- Houshalter 11y ago
  What does this have to do with ios?
oxide 11y ago
I think it's a perfect example of lackluster security oversight when it comes to the IoT. people want a webcam they can plug in and use, most people don't consider the features it offers nor do they secure it beyond what is enabled by default. webcams are a thing, like it or not, and they use the internet, like it or not. if you think a rascally teenager turning your webcam lights on in the middle of the night is bad, wait until he changes your e-fridge settings and all your food spoils.
paulojreis 11y ago
Maybe it is. But, on the other hand, it's a nice example because it makes you wonder: if companies who've been making webcams are failing so much in security, what should we expect from companies making products which aren't related to IT at all? How are the oven-making companies faring, security-wise, in this IoT thing?
- Symbiote 11y ago
  TLDR: the "authenticate" HTTP call on my heating system is optional, so you can change the temperature without the PIN. For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc. The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site. I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible. The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures. The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago. [1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarme-varianter--Roth-Komplet-Traadloes-Gulvvarmestyring-inkl-Pumpe-4-Kredse-611638.html http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm... [2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?mt=8 https://itunes.apple.com/dk/app/roth-touchline/id498448526?m... [3] http://www.base64online.com/hc.php http://www.base64online.com/hc.php

gengkev 11y ago

Isn't it common sense to at least set a randomly generated password as the default one? Especially for something as sensitive as an Internet webcam.

deleted 11y ago
[deleted]
_pmf_ 11y ago
> Isn't it common sense to at least set a randomly generated password as the default one You're increasing your support cost by a factor of 100 to 500, and that's a very conservative estimation.
- masklinn 11y ago
  Boo-fucking-hoo? As things stand these devices are dysfunctional or broken, would you recommend delivering new cars without brakes and brake fluid because that saves you money?
  - paulddraper 11y ago
    Eloquent.
  - nommm-nommm 11y ago
    I don't think pmf was recommending anything, just stating a reason why a company wouldn't want to do something like that. He/she wasn't endorsing it or saying that it would be a good choice.
  - _pmf_ 11y ago
    > would you recommend delivering new cars without brakes and brake fluid because that saves you money? No, I recommend delivering cars with brakes and brake fluid because that saves support costs.
- pjc50 11y ago
  I doubt it - I've started seeing this on consumer routers. The BT one came with the random password printed on a convenient piece of plastic slotted into the router.

saboot 11y ago

It's much worse than just passive webcams. Some devices which were never meant to be connected to the internet are out there. Stoplights? HVAC Systems? Carwashes? Ice Rinks? POWER PLANTS? Yes! https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64 EDIT: I looked at his more recent talk from last November ... the situation has not improved "115 batshit stupid things you can put on the internet in as fast as I can go by Dan Tentler" https://www.youtube.com/watch?v=hMtu7vV_HmY https://www.youtube.com/watch?v=hMtu7vV_HmY Featuring Spanish Chicken Controls

elorant 11y ago
How about smart TVs? Give it a few years and you’ll have hundreds of millions of TVs with a camera on them exposed to the wild.
- Silhouette 11y ago
  The disturbing thing today about smart TVs in particular is that it's increasingly difficult to buy a TV without those features. Personally, I have no interest in them even without the obvious security and privacy concerns. I want my TV and speakers to be as good as possible at showing pictures and making sounds, and to accept signals from whatever sources I want to use in sensible ways. Everything else is just more cost, more scope for failure, and less future-proofing. The really disturbing thing about a lot of these IoT devices with sensors and remote communications in the future will be when they no longer rely on an explicit Internet connection being provided via the home network, and instead use some sort of mesh arrangement where they can get online independently and you won't even know about it. At that point, I think robust laws about both disclosure and the ability to opt out will probably be necessary.
  - rangibaby 11y ago
    Have you considered using a PC monitor instead of a TV? Honestly, their biggest feature when used as a TV is their lack of "features".

api 11y ago

Most embedded engineer types know nothing about and never think about security. One example I saw once was an FTP server where the auth commands worked but were irrelevant. All commands always worked. It passed the unit tests therefore it was good.

gardano 11y ago
I started taking a deep-dive look at iOS HomeKit, and was alarmed at the security implications that would be on my shoulders. I'm not an embedded engineer type, so the security burden I saw being hefted upon my shoulders felt much more onerous than the typical REST type API I've been accustomed to. At this point, I cannot imagine writing an app using IoT while at the same time feeling confident in understanding every bad security use-case. Perhaps `IoT Security Expert` is an up-and-coming career path, but it's not a job description for the faint of heart nor for the one-off developer to be able to approach with any sense of confidence.
jlgaddis 11y ago
I'm not even a developer so I know very little about unit tests but I would assume that in something with an authentication system you would have a unit test that verifies that known invalid credentials don't permit access.
- api 11y ago
  This one just validated that good credentials worked and bad ones didn't. It passed of course. Good to ship.
- Symbiote 11y ago
  Verifying that invalid credentials are rejected by the part that checks credentials is one thing, and I'd expect this to be an obvious test case. But to > verifies that known invalid credentials don't permit access you need a second test: "use invalid credentials, then try to download file, expect failure", i.e. a sequence of actions in a single test. That test is evidently missing from my heating system's web interface, which has exactly this problem. There's a box to type in a PIN code, and it lets you proceed / retry correctly. But it's not necessary to bother with this, you can change the temperature without authenticating if you know the URL.

abrkn 11y ago

Brings to mind the Twitter account @internetofshit https://twitter.com/internetofshit https://twitter.com/internetofshit

50CNT 11y ago

I still don't get the Internet of Things. The mental calculation just doesn't work out for most things. My personal rule of thumb is: benefitofmeaccessingXremotely(X) - costofotherpeopleaccesingXremotely(X)*riskofthathappening Benefits being low for most things, costs high, and risks...uhmm...nah. Only exception I can think of is very limited amounts of sensors (eg. is X on?). What's the benefit of me turning on a gas stove remotely? Almost none. What's the cost of someone else turning on my gas stove? Really high. How much is the risk? Way too high. Then there's smart devices, another component of IoT. But how much smarts do we actually want? Screens are nice. Making my shower multi touch isn't (capacitive touch + water = no bueno. Imagine water from hell scenario and no way of turning it off with your wet hands). Fridge compiling shopping lists automatically? Neat. Cheap android tablet that comes with a fridge glued to it? Nah. The only utility I see is locally connected devices. Using your phone as a remote. That seems handy. To a certain degree, we have that. Extra points if I don't need to download an app for everything, because don't you dare tell me that your blue-tooth on/off switch needs a 15mb .apk. If I gave one about the 14.9mb of branding you're including, I'd download your press kit. There's some utility in home IoT wudget-thingimabobs, but I'm almost certain we'll mess it up to no end in our excitement. There'll be some legitimately useful products coming from it, but most of it will be utterly cringe worthy in retrospect. /rant('IoT')

sorokod 11y ago
I was around when TV remote controls became popular. Couldn't see what was the point of them.
- 50CNT 11y ago
  Good point. I do believe that some very interesting things will come of IoT, it's the crass amounts of enthusiasm some people have regarding it that grinds my gears. The joys of being a killjoy and explaining why your toasters web interface won't do much good if you have to get up and insert the toast manually. Or SmartXthing to introduce the obsolescence cycles of digital electronics to everything else. No sympathy. I guess I'm just a bitter old person, and a way to young one at that.
- 11y ago

exogen 11y ago

I have a Denon receiver with a web interface, which can control everything over HTTP (volume, source selection, firmware, etc). Of course there's no CSRF protection, so anyone could just control my receiver by getting me to visit a page that tried POSTing to 192.168.0.XXX – it would be trivial.

davidgerard 11y ago

1995: Every object in your home has a clock & it is blinking 12:00 2025: Every object in your home has a IP address & the password is Admin https://twitter.com/mcclure111/status/688775402584731649 https://twitter.com/mcclure111/status/688775402584731649

deleted 11y ago

[deleted]

arthur_pryor 11y ago

well, that was mostly depressing, but i found the part about mudge and the UL-like initiative encouraging: "Peiter “Mudge” Zatko is a member of the high-profile L0pht hacker group who testified before Congress in 1998, and since he's gone on to head cybersecurity research at the Defense Advanced Research Projects Agency (DARPA) before joining Google in 2013. In June, Zatko announced he was leaving the search giant to form a cybersecurity NGO modelled on Underwriters Laboratories." and above that, a section about a similar "consumer reports" style rating organization. that was also the first time i'd heard of the group i am the cavalry, which seems like a cool idea (in principle, at least, without really knowing much about the actual group). and i understand this objection to that sort of approach: "It’s not the same quality problem... UL is about accidental failures in electronics. CyberUL would be about intentional attacks against software. These are unrelated issues. Stopping accidental failures is a solved problem in many fields. Stopping attacks is something nobody has solved in any field. In other words, the UL model of accidents is totally unrelated to the cyber problem of attacks." it is a very different problem in a lot of ways, but that doesn't mean that an approach similar in spirit or presentation is doomed to failure. and i think it does fit into the broad category of messy consumer information problems that are hard to solve with specific detailed regulation.

DyslexicAtheist 11y ago

During a review of W3C WoT & ETSI M2M standards I noticed that security is totally ignored in these tech-standardization bodies. The standards leave security as an exercise to the industry and the maker communities (who are not spending money on security until they have an problem). That said, it's also not trivial to implement something that at first sight seems straight-forward like 802.15.4 Security[0][1] without a deep understanding of the security architecture supported by the underlying platform: [0] http://www.jwcn.eurasipjournals.com/content/pdf/1687-1499-2006-093830.pdf http://www.jwcn.eurasipjournals.com/content/pdf/1687-1499-20... [1] https://www.cs.berkeley.edu/~daw/papers/15.4-wise04.pdf https://www.cs.berkeley.edu/~daw/papers/15.4-wise04.pdf Since the web is now getting "engaged" to the devices with CoAP and other protocols I wanted to create awareness of how bugs can spill over into the real world and do real damage there. If hacked insulin pumps or baby monitors don't scare you enough how about hacking a train? https://media.ccc.de/v/32c3-7490-the_great_train_cyber_robbery https://media.ccc.de/v/32c3-7490-the_great_train_cyber_robbe... ?? (everyone should probably watch this simply because SCADA strangelove guys are crazy and awesome) Anyway to counteract the usually very "marketing intensive" tone of IoT groups on LinkedIn I decided to start this IoT Security group: https://www.linkedin.com/groups/4807429 https://www.linkedin.com/groups/4807429 it would be great to see people from all camps (IoT is a combination of 3 silos: 1) embedded, 2) web 3) infosec) actively contributing with technical topics in this group. I will keep it open to posts from marketeers but am heavily policing it for blogspam and remove any posts that are not security related). Also I have some ideas about hackerspaces (http://hackerspaces.org/ http://hackerspaces.org/) which IMO every city should have and support. They're needed to propagate knowledge between these individual camps properly. (my contact details are in my profile in case you are interested to discuss more offline).