4 ms·

I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going throug

by csydas 10y ago

I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. In particular, start ups trying to capitalized on IoT in niche products will need excess scrutiny in order to ensure they're not trying to run fly-by-night operations just to make a quick buck. Chinese IoT knock-offs will also need to be monitored carefully as well. What's most frightening to me on something like this is even tech-savvy users are fairly screwed as your ability to interact with the device and try to remove or clear the ransomware manually will be restricted by the same methods meant to prevent you from tampering with the device in the first place. This likely can leave people without any recourse to ranson scenarios like the thermostat being hijacked, and the end-user will have no option except to remove the device. Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. I think it's preposterous for companies to assume that their devices will never be compromised, and if they're going to lock down the devices, they need to provide a guaranteed way to reset the device; a bit of set up work certainly beats paying to make sure your fridge still works tomorrow. With IoT creeping out as the next "must include" feature for manufacturers, this sort of consumer protection is going to be essential.

ssharp 10y ago
I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. I suppose I can see some potential future value to devices like thermostats, that directly control "large" resources like natural gas (by "large", I mean relative to what other resources a household consumes). Smarter controls at the household level could provide substantial energy savings in the aggregate. However, the pessimist in me says "why does anyone really need appliances connected to the internet?". So you're trading off some potential future value to reduce overall energy use by better optimizing your own consumption in the present. You're also exposing yourself to faulty equipment that might also pose security risks. Do these thermostats have some sort of hardware kill switch that prevents software from doing clearly stupid things, like shutting off entirely or setting the heat to a maximum setting? Finally, there was this gem in the article that I did not remember hearing about: Munro, who last year found that a Samsung smart fridge leaked Gmail passwords What exactly is the purpose of a "smart fridge", why does it need Gmail passwords, etc.
- 59nadir 10y ago
  > However, the pessimist in me says "why does anyone really need appliances connected to the internet?". I think it's important to answer this without any of the qualifications you write after it. No one needs it. It's not even necessarily about how secure it is; if you're paying extra for these features you're just throwing your money away in the name of gadgetism. You really don't need to fill in that they're unsafe or made with crap components. The truth is that no one would have a need of a perfectly made one.
  - Klathmon 10y ago
    Well nobody has a need for 99% of the crap in our lives. You don't need a car, you don't need a TV, you don't need a computer. But it sure as hell is nice to have all of those things. I find it funny that in an article about how manufacturers are locking down their devices to only the features that the consumer needs (effectively having the manufacturer tell you what you need), you are going around telling others what they need.
  - ssharp 10y ago
    I should have said "want" or "find value in" rather than "need". Of course you don't need it but I get hung up on what benefits a smart refrigerator is actually providing. Maybe I've reached curmudgeon-status but I don't see the benefit in a fridge telling me I need milk. I can generally tell if I need milk based on the last time I used the milk.
- Klathmon 10y ago
  Why does a car need a radio? Why does a cell phone need "candy crush"? Why does your TV need a remote? None of these things are necessary, 99% of them aren't "need to haves", but they are "nice to haves". I've gone down the "home automation" path, and i'm currently about $600 in and with that i've got most of the light switches in my house connected, as well as my thermostat and stuff like door locks and the garage door to the house. So keep in mind that I have a bias here. Individually there is no one thing that is "worth it", but together it all adds up to a nicer life to me. Being able to turn all the lights out after i've gotten comfy in bed, being able to make sure the door is locked after i took in groceries, turning on the porch light for the delivery guy, or even checking to make sure the garage door wasn't opened when our car was broken into a few weeks ago. Nobody wants a "Fridge that needs gmail passwords", but they want a fridge that can show your calendar. A fridge that can message you when you run out of something, a fridge that can show some photos from an album on your google account, or can send usage reports to your email on how much power it's using, or show you the weather or even the news. Now there are much better ways to implement all of that than just storing the gmail password and using it, but less technical people don't know that. Don't conflate the users' want of features with them wanting the security flaws as well. Now I still don't think any refrigerators on the market have reached the point where it's worth the extra money for the "smart features" (at least as of a year ago when i was looking for a new fridge), but I feel it's close. After all, a refrigerator is a large appliance very in-view in the middle of your kitchen. People have put things on them for years with magnets and tape, it's a prime location for a touchscreen that can control not only the fridge, but can show and control other parts of your life/home. IMO it's a perfect location for something like a screen, and a pretty logical extension of what people have been using that space for already for years. But to be honest I want other appliances to be "connected" first. Namely the dishwasher, and the clothes washer and dryer. Being able to schedule those, send alerts when they are done, to have the dishwasher determine if it's full enough to run now, or if it should wait, etc... Those are the things i'm looking for.
VLM 10y ago
A good summary and I propose three minor additions to the issue list: 1) One big part of IoT is replacing capital goods with decades long depreciation with goods having months long depreciation. Yes your $20 Honeywell lasted three decades and a new one would last three more decades, but this $200 IoT thermostat simply won't be supported in a large number of months and the end users need an economic plan to replace it, say, annually, rather than a couple times per century. Which has interesting environmental/ecological concerns of its own. Your 1996 dumb thermostat works fine in 2016, but your 2016 IoT thermostat absolutely will not work with whatever passes for an iphone in 2036, or probably even 2026. 2) Demarcation points and interoperability and DRM need to be monitored. Oh so sorry your IoT thermostat got powned and tried to burn down your house, unfortunately instead of the standard current loop interface it uses a DRMed proprietary RS-485 based interface to talk to the DRMed furnace so rather than swapping in a new thermostat (which would just get powned in minutes anyway) you'll need a newer model thermostat and those only connect to new furnaces, so an IoT thermostat with a severe DRM infestation getting powned means a $5000 new HVAC system not just a new thermostat. 3) As more and more people recognize IoT as an anti-feature or unwanted at best, people are going to refuse to set it up, sorta like the millions of VCRs blinking 12:00 in the 80s/90s. My MiL has a long obsolete smart TV that's never been connected to the internet and is merely a dumb TV. Selected because she liked how the bezel matched her home decor. Likewise IoT devices are going to have to get used to the idea that very soon many/most users will never connect them to the internet, yet they still have to at least minimally operate.
- pavel_lishin 10y ago
  Did your MiL refuse to set it up as a protest, or just because she couldn't be bothered, same as the blinking 12:00? My understanding of the blinking 12:00 wasn't that people refused to set them up, but most simply couldn't figure out how, and didn't see the advantage in spending more than five minutes in trying to figure it out, when there was probably a clock hanging above the TV anyway. When we bought a new TV, we picked the dumbest possible one, and did the bare minimum to make it work, skipping all the solicitations to hook it up to our wifi.
  - ryandrake 10y ago
frandroid 10y ago
If there's enough crap IoT devices out there, and a good, well-publicized scare, someone could run a good security certification program for IoT devices that would become a must-have.
nbadg 10y ago
> like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures... Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. Part of the difficulty here is precisely that when it comes to IoT, there is no such thing as "expected security procedures", in no small part because established best practices on the internet often simply don't transfer well to a set of devices where a great many are expected to be acting as servers positioned behind very aggressive consumer firewalls. Even the "ideal case" applying the web security model to these kinds of devices leaves you with a very difficult NAT problem, and a very difficult authentication problem. You're left, more or less, with two mainstream approaches: either find a way to open up consumer firewalls (or bypass them entirely, for example by setting up your own dedicated access point for the device) and then issue the devices with its own TLS cert, OR use a centralized trusted-third-party auth model. Both, in addition to presenting enormous scaling problems, are shitty "solutions" when you're talking about devices with extremely high reliability requirements, like thermostats. If you have to connect to a TTP auth service for your heat to turn on, and your internet goes down, and it's winter in Canada... So there are countless examples and anecdotes as to why it's not really as simple as establishing new best practices; entire new technologies may need to be established here. Now on the one hand, privacy and security are always secondary markets, so I don't think we'll see any direct calls for change through their advocates. On the other hand, these problems aren't just a matter of privacy and security: if you've ever tried to put together a consumer-grade solution for something like IoT, you know how hard it is -- largely as a result of the same technological shortfalls that are compromising security. As a business, anything that can save you development time/costs is going to be tremendously appreciated. So there's a nascent market gap for a technology that 1.) makes development companies happy by decreasing time/cost to market, and 2.) gives/forces security on them, in such a way that 1.) is inseparable from 2.). And that, I think, is really the way forward for privacy and security in IoT. That's what I'm hoping, anyways, because I've sorta started a company trying to do that. The rest of this is basically a plug, so feel free to ignore it, but our product is called Hypergolix[1] and we're planning on releasing a very early preview alpha in the next few weeks. Our value prop for developers is that we're "Dropbox for Python objects, with an emphasis on IoT and privacy/security", and everything is enforced directly by cryptography. This also lets us do some really cool things like failover-to-LAN if your internet drops out, completely transparently to applications built on top of it. [1] https://www.hypergolix.com https://www.hypergolix.com

by csydas 10y ago

ssharp 10y ago

I don't think there is much to say here that hasn't already been said about IoT security - like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures, and consumer awareness campaigns will be necessary to educate less savvy consumers about the potential dangers of IoT devices at the moment. I suppose I can see some potential future value to devices like thermostats, that directly control "large" resources like natural gas (by "large", I mean relative to what other resources a household consumes). Smarter controls at the household level could provide substantial energy savings in the aggregate. However, the pessimist in me says "why does anyone really need appliances connected to the internet?". So you're trading off some potential future value to reduce overall energy use by better optimizing your own consumption in the present. You're also exposing yourself to faulty equipment that might also pose security risks. Do these thermostats have some sort of hardware kill switch that prevents software from doing clearly stupid things, like shutting off entirely or setting the heat to a maximum setting? Finally, there was this gem in the article that I did not remember hearing about: Munro, who last year found that a Samsung smart fridge leaked Gmail passwords What exactly is the purpose of a "smart fridge", why does it need Gmail passwords, etc.

59nadir 10y ago
> However, the pessimist in me says "why does anyone really need appliances connected to the internet?". I think it's important to answer this without any of the qualifications you write after it. No one needs it. It's not even necessarily about how secure it is; if you're paying extra for these features you're just throwing your money away in the name of gadgetism. You really don't need to fill in that they're unsafe or made with crap components. The truth is that no one would have a need of a perfectly made one.
- Klathmon 10y ago
  Well nobody has a need for 99% of the crap in our lives. You don't need a car, you don't need a TV, you don't need a computer. But it sure as hell is nice to have all of those things. I find it funny that in an article about how manufacturers are locking down their devices to only the features that the consumer needs (effectively having the manufacturer tell you what you need), you are going around telling others what they need.
- ssharp 10y ago
  I should have said "want" or "find value in" rather than "need". Of course you don't need it but I get hung up on what benefits a smart refrigerator is actually providing. Maybe I've reached curmudgeon-status but I don't see the benefit in a fridge telling me I need milk. I can generally tell if I need milk based on the last time I used the milk.
Klathmon 10y ago
Why does a car need a radio? Why does a cell phone need "candy crush"? Why does your TV need a remote? None of these things are necessary, 99% of them aren't "need to haves", but they are "nice to haves". I've gone down the "home automation" path, and i'm currently about $600 in and with that i've got most of the light switches in my house connected, as well as my thermostat and stuff like door locks and the garage door to the house. So keep in mind that I have a bias here. Individually there is no one thing that is "worth it", but together it all adds up to a nicer life to me. Being able to turn all the lights out after i've gotten comfy in bed, being able to make sure the door is locked after i took in groceries, turning on the porch light for the delivery guy, or even checking to make sure the garage door wasn't opened when our car was broken into a few weeks ago. Nobody wants a "Fridge that needs gmail passwords", but they want a fridge that can show your calendar. A fridge that can message you when you run out of something, a fridge that can show some photos from an album on your google account, or can send usage reports to your email on how much power it's using, or show you the weather or even the news. Now there are much better ways to implement all of that than just storing the gmail password and using it, but less technical people don't know that. Don't conflate the users' want of features with them wanting the security flaws as well. Now I still don't think any refrigerators on the market have reached the point where it's worth the extra money for the "smart features" (at least as of a year ago when i was looking for a new fridge), but I feel it's close. After all, a refrigerator is a large appliance very in-view in the middle of your kitchen. People have put things on them for years with magnets and tape, it's a prime location for a touchscreen that can control not only the fridge, but can show and control other parts of your life/home. IMO it's a perfect location for something like a screen, and a pretty logical extension of what people have been using that space for already for years. But to be honest I want other appliances to be "connected" first. Namely the dishwasher, and the clothes washer and dryer. Being able to schedule those, send alerts when they are done, to have the dishwasher determine if it's full enough to run now, or if it should wait, etc... Those are the things i'm looking for.

VLM 10y ago

A good summary and I propose three minor additions to the issue list: 1) One big part of IoT is replacing capital goods with decades long depreciation with goods having months long depreciation. Yes your $20 Honeywell lasted three decades and a new one would last three more decades, but this $200 IoT thermostat simply won't be supported in a large number of months and the end users need an economic plan to replace it, say, annually, rather than a couple times per century. Which has interesting environmental/ecological concerns of its own. Your 1996 dumb thermostat works fine in 2016, but your 2016 IoT thermostat absolutely will not work with whatever passes for an iphone in 2036, or probably even 2026. 2) Demarcation points and interoperability and DRM need to be monitored. Oh so sorry your IoT thermostat got powned and tried to burn down your house, unfortunately instead of the standard current loop interface it uses a DRMed proprietary RS-485 based interface to talk to the DRMed furnace so rather than swapping in a new thermostat (which would just get powned in minutes anyway) you'll need a newer model thermostat and those only connect to new furnaces, so an IoT thermostat with a severe DRM infestation getting powned means a $5000 new HVAC system not just a new thermostat. 3) As more and more people recognize IoT as an anti-feature or unwanted at best, people are going to refuse to set it up, sorta like the millions of VCRs blinking 12:00 in the 80s/90s. My MiL has a long obsolete smart TV that's never been connected to the internet and is merely a dumb TV. Selected because she liked how the bezel matched her home decor. Likewise IoT devices are going to have to get used to the idea that very soon many/most users will never connect them to the internet, yet they still have to at least minimally operate.

pavel_lishin 10y ago
Did your MiL refuse to set it up as a protest, or just because she couldn't be bothered, same as the blinking 12:00? My understanding of the blinking 12:00 wasn't that people refused to set them up, but most simply couldn't figure out how, and didn't see the advantage in spending more than five minutes in trying to figure it out, when there was probably a clock hanging above the TV anyway. When we bought a new TV, we picked the dumbest possible one, and did the bare minimum to make it work, skipping all the solicitations to hook it up to our wifi.
- ryandrake 10y ago

frandroid 10y ago

If there's enough crap IoT devices out there, and a good, well-publicized scare, someone could run a good security certification program for IoT devices that would become a must-have.

nbadg 10y ago

> like many commentors mentioned before, we're going to be going through a very rough period for some time where IoT devices just aren't up to par with expected security procedures... Hopefully either a consumer or business alliance crops up with suggested practices for IoT devices, including remediation methods for these very scenarios. Part of the difficulty here is precisely that when it comes to IoT, there is no such thing as "expected security procedures", in no small part because established best practices on the internet often simply don't transfer well to a set of devices where a great many are expected to be acting as servers positioned behind very aggressive consumer firewalls. Even the "ideal case" applying the web security model to these kinds of devices leaves you with a very difficult NAT problem, and a very difficult authentication problem. You're left, more or less, with two mainstream approaches: either find a way to open up consumer firewalls (or bypass them entirely, for example by setting up your own dedicated access point for the device) and then issue the devices with its own TLS cert, OR use a centralized trusted-third-party auth model. Both, in addition to presenting enormous scaling problems, are shitty "solutions" when you're talking about devices with extremely high reliability requirements, like thermostats. If you have to connect to a TTP auth service for your heat to turn on, and your internet goes down, and it's winter in Canada... So there are countless examples and anecdotes as to why it's not really as simple as establishing new best practices; entire new technologies may need to be established here. Now on the one hand, privacy and security are always secondary markets, so I don't think we'll see any direct calls for change through their advocates. On the other hand, these problems aren't just a matter of privacy and security: if you've ever tried to put together a consumer-grade solution for something like IoT, you know how hard it is -- largely as a result of the same technological shortfalls that are compromising security. As a business, anything that can save you development time/costs is going to be tremendously appreciated. So there's a nascent market gap for a technology that 1.) makes development companies happy by decreasing time/cost to market, and 2.) gives/forces security on them, in such a way that 1.) is inseparable from 2.). And that, I think, is really the way forward for privacy and security in IoT. That's what I'm hoping, anyways, because I've sorta started a company trying to do that. The rest of this is basically a plug, so feel free to ignore it, but our product is called Hypergolix[1] and we're planning on releasing a very early preview alpha in the next few weeks. Our value prop for developers is that we're "Dropbox for Python objects, with an emphasis on IoT and privacy/security", and everything is enforced directly by cryptography. This also lets us do some really cool things like failover-to-LAN if your internet drops out, completely transparently to applications built on top of it. [1] https://www.hypergolix.com https://www.hypergolix.com