10 ms·
Web hosting company OVH said it had been attacked by a botnet (zombie army) of hacked devices such as webcams. It's scary to think about the potential for leve
by smaili 10y ago
Web hosting company OVH said it had been attacked by a botnet (zombie army) of hacked devices such as webcams.
It's scary to think about the potential for leveraging IoT devices for DDoS attacks. Your dishwasher, fridge, thermostat, mattress, chairs could all be partipants without you even knowing.
- unclebucknasty 10y agoYeah, and these things will continue to proliferate. Probably near hopeless to expect all of these manufacturers to stem this. But, it seems that ISPs could play a more pivotal role in combating this, and that they'd have financial incentive to do so. For instance, what if we built more security/detection into routers/gateways (especially those that ISPs push)? What if we combined this with mandates for ISPs to better monitor their traffic and established minimum standards for doing so?
- kijin 10y agoWhat financial incentive? I won't be surprised if we see, before the end of the year, news along the lines of "Toaster catches virus, leaves owner with $5K data bill." Why bear any costs when you can pass them on to your captive customers?
- unclebucknasty 10y ago>What financial incentive? If the network starts to serve an increasingly disproportionate amount of illegitimate traffic for n customers, then the ISP will have to increase throughput (and costs) to continue serving n customers. It's tempting to argue that they could just pass the extra costs on to customers, but that obviously makes them less competitive, especially vs an ISP that better manages costs.
- gregmac 10y agoMany ISPs have basically no real competition. Don't like your cable company? Your alternative is <5Mbps DSL with a tiny amount of upload, high-latency and low data caps on satellite, and if you're lucky, a wireless connection that's even worse than DSL.
- unclebucknasty 10y agoMaybe in some places. But, that says they could raise prices now. And, to the extent that this is true (or not), they are still better off with reduced costs.
- luma 10y agoCreating a framework where my ISP is legally required to perform deep packet inspection on my traffic seems like the wrong way to handle this for a whole pile of reasons.
- kijin 10y agoWhat I find even scarier is that, with computers and mobile devices, at least someone might notice when they're running slower than usual or consuming more data than usual. Most people have at least heard of computer viruses, and antivirus vendors have been trying pretty hard to get their crap on Android phones as well. But would you notice if your thermostat was running a little slower than usual? Would it even occur to anyone that their dishwasher might have caught a virus? These things could participate in DDoS attacks all year long and nobody would suspect a thing. And even if someone did, fixing them would be much more difficult than taking your laptop to the nearest Best Buy (or even impossible, thanks to DRM).
- foepys 10y agoI can also imagine that the microchips and their connected components wear out faster because they are under high load and therefore become hotter than usual. So after a few months your fridge is mysteriously dead just because of malware and you won't even know about it.
- manarth 10y agoImagine an army of fridge-hosted bitcoin miners…it'd be extraordinarily inefficient, but the bot-herders wouldn't care about the electricity bill.
- ssharp 10y agoAre there consumer routers (that are relatively easy to use) that can alert you or shut down a device, when all of a sudden your thermostat is making tons of network requests?
- kijin 10y agoThere are routers that can control how much data a given downstream device can transfer in a given time, shut them down entirely during certain times of day, etc. But then I'd guess the crooks will just compromise the router itself.
- zitterbewegung 10y agoIts even scarier when someone takes one of your IoT devices and intends to harm you. Like making your fridge's ice maker flood your house. They talked about this at Defcon 24.
- unclebucknasty 10y agoI'm really having trouble finding a use case for connecting some of this stuff, especially one that merits the risk.
- SEJeff 10y agoOne word: convenience
- briandear 10y agoI don't know what is convenient about a connected dishwasher. You still have to load the thing. Is pushing a physical start button that hard?
- SEJeff 10y agoBut it will tell you when it is done, same for a connected washer/dryer. Or a connected refrigerator that tells you when the filters are low or when you need to buy more eggs. I think it is silly. You think it is silly, but people will buy this crap. They think apps will solve their problems.
- stephengillie 10y agohttps://www.ietf.org/rfc/rfc2324.txt https://www.ietf.org/rfc/rfc2324.txt
- unclebucknasty 10y agoYeah, but a lot of that stuff is already doable. It's just not telling you remotely. For instance, the filter light is on when you walk by the refrigerator or the dishwasher beeps and shows an indicator when it's done. It's really more than sufficient to me. In fact, with everything else I have going on, I don't need my refrigerator texting me whenever it thinks it deserves my attention. That would actually be inconvenient. Then, there's this hidden cost of the purported "convenience". More stuff updating, hacked etc. And, with the thousand other devices, now I have to spend time configuring what I want to manage, etc. Reminds me of something I read years ago about the hidden costs of some tech. In one anecdote, subway riders were excited when A/C was installed on the train. Now, they could ride in comfort. What they didn't realize was the A/C exhaust heated the platform another 10 degrees or so, and they were actually less comfortable while waiting.
- vesinisa 10y agoMake the manufacturers of these faulty devices liable for the damages.
- kayoone 10y agoJust last week i heard a talk at a conference about this very topic because many of these smart IoT devices have horrible software and shoddy security practices and are basically never checked by their owners, while having quite powerful socs nowadays.
- eriknstr 10y agoThe IoTification is fast approaching and I believe that only OpenBSD can save us now. Well, one can wish anyway... for a safe and open source future.
- JoelBennett 10y agoHow does OpenBSD save us from poorly written software?
- RandomlyGen 10y ago>safe In 99% of cases these devices are exploited using vulnerabilities in the software or configuration added by the vendor (such as telnet access with root:root), not bugs in Linux. >open source How exactly would a permissively licensed kernel get vendors to disclose the source code?
- whatwasmypwd 10y agoaren't IoT connections throttled by default?
- manarth 10y agoThrottled by what? Most home/consumer routers lack the capability to throttle a specific device, and most consumers wouldn't think to configure this if the capability was there. There's a good argument to say that they should be throttled by their own software, but the basic premise of the issue is that IoT software is badly designed, badly programmed, and badly maintained, so I wouldn't hold out much hope of throttling in the device itself.