4 ms·
this is simply server security... the application happens to be classed as IoT, but this is has nothing to do with the IoT aspects.
by TickleSteve 7y ago
this is simply server security... the application happens to be classed as IoT, but this is has nothing to do with the IoT aspects.
- hallihax 7y agoIf the functionality of your home depends on a privately owned, 3rd-party server, then I'd say it very much highlights the potential risks of IoT devices / applications.
- SmellyGeekBoy 7y agoMy electricity, gas, water etc all come from 3rd-party providers and work just fine. Probably because they're all heavily regulated. (FWIW I don't have any IoT devices in my house)
- hallihax 7y agoThey work just fine because you don't need to log in to your electricity meter to turn your lights on.
- monocasa 7y agoThe backend component is just as important as the endpoint component. Pretending that IoT is one or the other, but not both is one of the biggest security root causes.
- 0xd171 7y agoSo how would this play out differently if an exposed Elasticsearch cluster was connected to an endpoint different from IoT? The problem is neither IoT nor ES - whoever built this just didn't bother to implement even basic security.
- koolba 7y agoI bet the server is publicly accessible because the data collection from the IoT devices does a POST directly to the ElasticSearch server.
- menzoic 7y agoIt could still use authentication