7 ms·

It's much worse than just passive webcams. Some devices which were never meant to be connected to the internet are out there. Stoplights? HVAC Systems? Carwash

• elorant 11y ago
  How about smart TVs? Give it a few years and you’ll have hundreds of millions of TVs with a camera on them exposed to the wild.
  • Silhouette 11y ago
    The disturbing thing today about smart TVs in particular is that it's increasingly difficult to buy a TV without those features. Personally, I have no interest in them even without the obvious security and privacy concerns. I want my TV and speakers to be as good as possible at showing pictures and making sounds, and to accept signals from whatever sources I want to use in sensible ways. Everything else is just more cost, more scope for failure, and less future-proofing. The really disturbing thing about a lot of these IoT devices with sensors and remote communications in the future will be when they no longer rely on an explicit Internet connection being provided via the home network, and instead use some sort of mesh arrangement where they can get online independently and you won't even know about it. At that point, I think robust laws about both disclosure and the ability to opt out will probably be necessary.
    • rangibaby 11y ago
      Have you considered using a PC monitor instead of a TV? Honestly, their biggest feature when used as a TV is their lack of "features".
      • gambiting 11y ago
        It's a bit hard to buy 50" PC Monitor though.
        • j2981190 11y ago
          Yeah, why did they decide to stop at 40"?
      • Silhouette 11y ago
        Unfortunately, PC monitors tend to be missing a few too many features that really are basic TV functionality -- remote control, sound, large numbers of switchable inputs (particularly HDMI) on high-end models, etc. They also tend to be physically smaller but often with a higher native resolution than TV/movie standards, so not the best fit for efficiently showing that kind of content.
        • golergka 11y ago
          Everything but size is solvable by building a small PC to use it as TV controller, no?
          • kbenson 11y ago
            The cost difference of this theoretical setup is now reaching laughable proportions (in time, money, or both)
        • walterbell 11y ago
          How about a short-throw projector?
    • tdkl 11y ago
      Don't plug it in the LAN ? Set the firewall rule for the TV to block internet on the router ? (I agree with you, the "smart TV" bonanza is going too far)
      • izacus 11y ago
        Well, that works until the smart TV refuses to set up without internet connection like modern STBs and mobile phones.
        • deleted 11y ago
          [deleted]
        • pdkl95 11y ago
          At some point - probably sooner than we expect - the hot new system-on-a-chip will have a built-in baseband processor and (probably software) radio. Once that is available, negotiating for off-peak/low-priority use of the cellular network will suddenly become very popular and the analytics (spyware) will no long needs your permission when it wants to spy on you.
    • hughw 11y ago
      Any device could have its own connection to the mobile network, a la Kindle.
  • qb45 11y ago
    > How about smart TVs? Give it a few years and you’ll have hundreds of millions of TVs with a camera on them exposed to the wild. Without available firmware updates, you forgot to add.
  • achillean 11y ago
    FYI: you can already find smart TVs connected to the Internet. Here is a search query for Vizio TVs: https://www.shodan.io/search?query=port%3A8099+unknown+message https://www.shodan.io/search?query=port%3A8099+unknown+messa...
  • bostik 11y ago
    This is tge reason I pushed down hard on our design for TV walls and monitoring screens. We have set up a number of TV screens around the office (some as walls, some individuals). I refused to have any of them plugged in to our office network, because I don't trust the smart TVs to either remain secure or not to spy on us "accidentally". So each TV will be a dumb screen. Output is provided by two Raspberry Pies - one for each of the first two HDMI inputs. HDMI 1 = monitoring, HDMI 2 = office IPTV. The TV feed network is physically separated from everything else, and connected to a dedicated switch. With no uplink to internet. And to give some context, we discussed our setup with some of the Cloudflare engineers in London. They consider our setup "pretty hardcore". From a company that lives by security, we consider that a compliment.
  • icedchai 11y ago
    Aren't most people at least putting their TV behind a firewall / NAT box?
• s_kilk 11y ago
  This, along with the topic link, give me the impression that the Internet of Things can't possibly work, not in the medium/long run. Not without a huge shift in how manufacturers and developers think about security and maintenance of devices deployed in the field. As long as the general approach remains "take a device, slap some nodejs on it, deploy" then the whole endeavour is doomed to a spectacular (and potentiall bloody) failure.
  • skywhopper 11y ago
    Indeed, lots of smart people have been saying that the Internet of Things vision is naive, counterproductive, and potentially dangerous. Some recent polls have indicated that most consumers at least have a sense that random cheap Internet-connected devices are problematic, so these sorts of stories are at least making an impact. For better or worse, this trend is going to keep going until something truly egregious happens and either market forces or government regulation steps in. Hopefully we'll see a pattern similar to that we've seen with desktop computers, where there'll be some messy worms or viruses that infect enough people that the big players in the field start taking these threats seriously.
  • jessriedel 11y ago
    The situation will slowly improve with time as wisdom and expertise with software diffuses throughout industry. Right now, software is a crude tool in most industries, with little understanding among the decision makers. That's why the best software is found in pure software companies. (However good or bad Microsoft software may be, it's still true that Microsoft >> Ford >> Honeywell.) Over the coming years, better software practices will suffuse through non-software industries, and the CEO of the company that makes your toaster will need a gut level understanding of software in the same way he currently understands inventory management.
• tzs 11y ago
  A few years ago, DHS and DOE set up a test power plant using similar equipment to what is actually in widespread production use, and invited select hackers to see what they could do to it. Here are the results: https://www.youtube.com/watch?v=fJyWngDco3g https://www.youtube.com/watch?v=fJyWngDco3g There was some discussion of this on the excellent Nova episode "Rise Of The Hackers", where they mentioned that the damage to the generator was extensive enough that it would not be just a quick in place repair. It would have to be replaced, which could take months (they don't have these things lying around in stock...). If someone did a successful coordinated attack on several power plants, it quite possibly could knock a very large number of people off the grid for many months. We need to stop allowing this. If this trend of putting everything online without paying serious attention to security continues, two things are going to happen: 1. The bad guys are going to succeed at some point in causing a major disaster. If we are lucky it will just cause widespread economic loss and inconvenience. More likely, though, there will be widespread loss of life too. 2. You think 9/11 prompted too big a swing in the wrong direction on the "safety vs. civil liberties" scale? That will seem quaint and mild in comparison once an attack knocks a large region off the grid for months, or causes a chemical plant to release a large toxic cloud, or takes down air traffic control, and so on.
  • TheOtherHobbes 11y ago
    Agreed 100%. IT'S A NATIONAL SECURITY ISSUE. There's no grey area here. Get this wrong and there's potential for foreign state or terrorist attacks that are as destructive - in their own way - as 9/11. Currently IOT has the makings of the next Pearl Harbour. It would be good if that didn't happen.
  • tptacek 11y ago
    One of the problems is that SCADA has its own software culture and its own security culture. There are specialty SCADA security firms (for no good reason I can come up with) and it sometimes feels like software security research is progressing in parallel on two (or three, or four) separate tracks. Industrial control software doesn't get the attention that normal software does because it takes a specially-seasoned consulting sales person to get industrial software on the docket for a consultancy. The really good consultancies are overbooked anyways (the big 5 Internet firms buy consultant/years the way smaller firms buy consultant/hours), so there's not much incentive for the best talent to get applied to these projects. If Charlie Miller and Chris Valasek hadn't gotten on stage in track suits to talk about car hacking, the same might be true of automotive, but now every consultancy wants a car-hacking practice. I've managed a few energy-sector projects. The targets were really, really bad.