9 ms·
The "S" in IoT stands for Security.
by 0xfeba 10y ago
The "S" in IoT stands for Security.
- salesguy222 10y agoHahaha i spent a good 3 minutes looking for where the S was, until the joke hit me
- jgamman 10y agoshouldn't that be 'SH' ?
- Crosseye_Jack 10y agoSome of us do give a shit about security. It's just a shame that it feels like we are the exception to the rule.
- elorant 10y agoWe do because we realize what the lack of it entails. So will the general public, eventually. And the only way to get there is if more cases like this start happening. It's a shame they have to learn the hard way but there's no other way. That, or we as an industry act up (in ways I can't even fathom).
- mulmen 10y agoThe fact that you allude to it suggests you can fathom it in some way. Maybe you don't want to but clearly bad actors can exploit insecure systems and that's especially easy from the inside.
- elorant 10y agoSure I can, but they're all unrealistic so no point mentioning them. We could for example start boycotting companies that don't take security seriously. But I'm afraid we'd end up with a very, very long list. Publicity can work wonders. You end-up with sensitive data for kids in the wild, possibly in the hands of perverts, nothing could work better than that in raising awareness for the general public. It's harsh, but it fucking works. So we'll stick with it for now, unless someone comes with a better idea.
- jdbernard 10y agoThe problem is that it generates awareness based on raw emotion, and of course that always leads to rational, measured decision making. /s On the other hand, I don't know any better idea either.
- otakucode 10y agoLawsuits for criminal negligence against the CEOs of the companies themselves would be a damn good start. Their business practices are why these problems happen. They cut every corner they can find, put business school grads in charge of deciding schedules and resource allocation to engineering, and make sure that if an engineer says 'we need more time and testing' that any low-level manager can tell them business goals come first.
- pessimizer 10y agoComputer/network security will never be important until governments start regulating this stuff through specialized agencies. It's the opposite of profitable to care, so businesses who do care are disadvantaged.
- Crosseye_Jack 10y ago> Computer/network security will never be important until governments start regulating this stuff through specialized agencies. Well I wouldn't say never, just needs some people determined to have it on the core of the team. Certs are free to low cost depending on the type you want. Compute needed for "Security" is minimal (Heck we can even do RootCA Validation on the the ESP8266 these days). But this isn't directly connected to the internet and goes via Blue Tooth connection, issues like this are down to lax security practices. > It's the opposite of profitable to care. How much profit does it cut to not to put your mongoDB instance internet facing? Firewall off 27017 and Enable Auth shouldn't cut into their profits too much. EDIT: Slapping a sig creation/check on the content urls shouldn't eat into profits either. This breach had nothing to do with the toy itself but was server side.
- otakucode 10y ago>How much profit does it cut to not to put your mongoDB instance internet facing? Wrong question. How much profit does it cut to hire an engineer who knows not to make your mongoDB instance Internet-facing and to empower that engineer enough that they can tell the CEO that the product is not ready to launch and they can't just open public access to the develop/test environment is the question. And it's not even a matter of profit. It's a matter of pride. Engineers are seen as typists and nerds, low level functionaries. They're the ones who don't understand the divine wisdom of "don't let the perfect be the enemy of the good enough." You wonder why companies are so stupendously desperate for H1B visas and why so many job listings are looking for 2 years experience and no more? It's because they don't WANT knowledgeable staff. Those tend to be expensive, and problematic.
- NumberCruncher 10y agoAnd they talk in real life to their kinds and not through a toy.
- Crosseye_Jack 10y agoI can see a novelty use that would quickly die off. If you want to talk to your kids via a teddy bear instead of phone or Skype, then that is up to them. The Demo for the toy shows distant relatives using the toy to talk their kids/grand-kids. But the purpose of the device has nothing to do with the security of the device.
- deleted 10y ago[deleted]
- Cyph0n 10y agoI took a grad course last semester where one of the groups analyzed a Nest cam and the other analyzed the Mother sensor device. Both were surprisingly quite secure, especially the Mother, which had security features all the way down the stack.
- nickpsecurity 10y agoThere's security features then assurance. Features without assurance of correctness are often bypassed. Im curious what was in those you talk about down the stack.
- AndonAndonov 10y agoOne of my professors worked on the key exchange protocol [0], used in Nest. When discussing that particular point, he was very complimentary of Google's security practices, especially when it comes to Nest. [0] https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-into-google-nest-thermostats/ https://blogs.ncl.ac.uk/security/2015/07/28/j-pake-built-int...
- conradev 10y agoI like Apple's approach, where HomeKit certification requires that the device use some form of secure transport to communicate with iOS.
- Xylakant 10y agoWhich totally would not have helped in this case: using https would still have left the DB exposed.
- po 10y agoIt doesn't help the server side data leak but at least you can't connect to it and make it say 'destroy all humans'
- Xylakant 10y agoThat's not necessarily the case. TLS protects the connection, but by default does not provide authentication. I also see a lot of instances where certificate checking has been disabled, so that the client just ignores a MitM attack. So with TLS it would seem more secure at first glance, but given the implementation blunders here I wouldn't expect any real improvement.
- po 10y agoYeah that's true, I'm totally assuming 'competently implemented TLS' when I say it would protect the connection.