6 ms·

Time to start calling IoT what it really is - the Internet of Threats. No, I didn't come up with that myself: http://www.nbcnews.com/tech/security/kaspersky-sm

by mtgx 10y ago

Time to start calling IoT what it really is - the Internet of Threats. No, I didn't come up with that myself: http://www.nbcnews.com/tech/security/kaspersky-smart-fridges-internet-things-i-call-it-internet-threats-n380541 http://www.nbcnews.com/tech/security/kaspersky-smart-fridges... In just a few years we may be dealing with tens of Tbps DDoS attacks thanks to the "explosion of IoT", unless IoT manufacturers get their shit together (perhaps also encouraged by aggressive government actions and fines against those who don't follow some set best practices on security).

unclebucknasty 10y ago
>unless IoT manufacturers... >encouraged by aggressive government actions and fines... Funny, I just replied to another comment that it seems near hopeless to expect this of manufacturers. Seems that ISPs, on the other hand, might be able to play a more pivotal role.
- pyvpx 10y ago
  ISPs should implement BCP38 (prevention of spoofed traffic originating from their networks, in short) but when a device is compromised, it doesn't necessarily have to spoof traffic at all. ISPs have thin margins, and get paid to push bits. DDoS mitigation services are extremely expensive not because they are complex or novel but because they require significant resources (both in hardware and in software expertise). If manufacturers are going to sling "shit" and we can't hold them accountable; consumers are going to buy the polished turds and we can't prevent them plugging it into their networks; and ISPs have little to zero incentive or ability to "filter out the bad traffic" then we're basically looking at a 5-10 year span of increasingly detrimental, expensive, and effective denial of service attacks.
  - bkmartin 10y ago
    Why aren't the major backhaul providers like L3 forcing this as part of their pass through agreements? If the ISP cannot invest enough to follow the simplest of best practices then why do they allow them to connect? Seem dangerous for the backbone people.
    - pyvpx 10y ago
      because none of them can and none of them have a financial interest to do so. Default free providers such at NTT, GTT, Zayo/AboveNet, Level3/Global Crossing, ATT, CenturyLink/Qwest, Deutsche Telekom, Vodafone/Cable & Wireless, and others commonly (but incorrectly) known as Tier 1/"backbone" providers peer with other networks in a settlement free (no money is exchanged, or, on an accounting basis, everything zeros out) fashion because they are "peers" in the strictest sense: same size, same reach, same markets (mostly...) there is no danger for them in passing bits
- the_trapper 10y ago
  > Seems that ISPs, on the other hand, might be able to play a more pivotal role. Well, maybe there is a silver lining to Comcast and friends' data caps after all.
briandear 10y ago
Do we blame the ice maker manufacturer when poisoned water flows from the city water pipes? Do ice machines have viral and chemical threat detection? Wouldn't the ISP be a better place to assign liability? Or, perhaps, just maybe, the actual user of a device? It's not Lenovo's fault when a user gets a virus. I agree device security ought to be better, but the free market can solve that. If a particular brand of toaster is constantly being hacked, the market would respond. I wouldn't expect an ice maker manufacturer to be held liable for poisoned water supplies. It's a tough issue, but 'more government' isn't the answer. The government can barely keep their own data safe let alone be trusted to enforce how others ought to keep their's safe. The FDA is supposed to keep medicines safe yet it has become a monster that adds billions to the costs of drug development. I am not saying to ditch the FDA, but I would be fearful of releasing a new IOT device required FDA-level approval. Your connected toaster would cost $9000.
- manarth 10y ago
  If a particular brand of toaster is constantly being hacked, the market would respond That depends whether "the market" is directly affected. If my toaster is hacked and starts getting used in a DDOS botnet - but still makes toast as expected - would I even know? The way to ensure market forces influence this is to ensure that the market is negatively affected: whether that's their ISP disconnecting their internet, their device stopping working, etc.
  - cesarb 10y ago
    > If my toaster is hacked and starts getting used in a DDOS botnet - but still makes toast as expected - would I even know? How is the toaster connected to the Internet? If through wireless, a DDOS could easily use too much airtime, making every other wireless device in the same channel slower. You wouldn't notice the toaster misbehaving, but you would notice everything else not working as well.
    - vkou 10y ago
      And most people will troubleshoot this problem by restarting their router. And when that doesn't solve the problem, complain about cosmic rays, or humid weather.

by mtgx 10y ago

unclebucknasty 10y ago

>unless IoT manufacturers... >encouraged by aggressive government actions and fines... Funny, I just replied to another comment that it seems near hopeless to expect this of manufacturers. Seems that ISPs, on the other hand, might be able to play a more pivotal role.

pyvpx 10y ago
ISPs should implement BCP38 (prevention of spoofed traffic originating from their networks, in short) but when a device is compromised, it doesn't necessarily have to spoof traffic at all. ISPs have thin margins, and get paid to push bits. DDoS mitigation services are extremely expensive not because they are complex or novel but because they require significant resources (both in hardware and in software expertise). If manufacturers are going to sling "shit" and we can't hold them accountable; consumers are going to buy the polished turds and we can't prevent them plugging it into their networks; and ISPs have little to zero incentive or ability to "filter out the bad traffic" then we're basically looking at a 5-10 year span of increasingly detrimental, expensive, and effective denial of service attacks.
- bkmartin 10y ago
  Why aren't the major backhaul providers like L3 forcing this as part of their pass through agreements? If the ISP cannot invest enough to follow the simplest of best practices then why do they allow them to connect? Seem dangerous for the backbone people.
  - pyvpx 10y ago
    because none of them can and none of them have a financial interest to do so. Default free providers such at NTT, GTT, Zayo/AboveNet, Level3/Global Crossing, ATT, CenturyLink/Qwest, Deutsche Telekom, Vodafone/Cable & Wireless, and others commonly (but incorrectly) known as Tier 1/"backbone" providers peer with other networks in a settlement free (no money is exchanged, or, on an accounting basis, everything zeros out) fashion because they are "peers" in the strictest sense: same size, same reach, same markets (mostly...) there is no danger for them in passing bits
the_trapper 10y ago
> Seems that ISPs, on the other hand, might be able to play a more pivotal role. Well, maybe there is a silver lining to Comcast and friends' data caps after all.

briandear 10y ago

Do we blame the ice maker manufacturer when poisoned water flows from the city water pipes? Do ice machines have viral and chemical threat detection? Wouldn't the ISP be a better place to assign liability? Or, perhaps, just maybe, the actual user of a device? It's not Lenovo's fault when a user gets a virus. I agree device security ought to be better, but the free market can solve that. If a particular brand of toaster is constantly being hacked, the market would respond. I wouldn't expect an ice maker manufacturer to be held liable for poisoned water supplies. It's a tough issue, but 'more government' isn't the answer. The government can barely keep their own data safe let alone be trusted to enforce how others ought to keep their's safe. The FDA is supposed to keep medicines safe yet it has become a monster that adds billions to the costs of drug development. I am not saying to ditch the FDA, but I would be fearful of releasing a new IOT device required FDA-level approval. Your connected toaster would cost $9000.

manarth 10y ago
If a particular brand of toaster is constantly being hacked, the market would respond That depends whether "the market" is directly affected. If my toaster is hacked and starts getting used in a DDOS botnet - but still makes toast as expected - would I even know? The way to ensure market forces influence this is to ensure that the market is negatively affected: whether that's their ISP disconnecting their internet, their device stopping working, etc.
- cesarb 10y ago
  > If my toaster is hacked and starts getting used in a DDOS botnet - but still makes toast as expected - would I even know? How is the toaster connected to the Internet? If through wireless, a DDOS could easily use too much airtime, making every other wireless device in the same channel slower. You wouldn't notice the toaster misbehaving, but you would notice everything else not working as well.
  - vkou 10y ago
    And most people will troubleshoot this problem by restarting their router. And when that doesn't solve the problem, complain about cosmic rays, or humid weather.