4 ms·

I used to be more concerned with this but the longer ive thought about it the more convinced I get that none of this matters. Most tech gadgets are a distracti

I used to be more concerned with this but the longer ive thought about it the more convinced I get that none of this matters. Most tech gadgets are a distraction and are about as useful off as on. Industrial stuff sure, but if someone's internet fridge or smart TV goes haywire, so what.

arcticbull 1y ago
I think the risk isn't that your fridge is unable to suddenly to phone home about your butter consumption but that it gets turned into a giant botnet or joins some crypto mining pool. Sensors don't have much horsepower but some of those smart appliances have decent application processors.
- wetpaws 1y ago
  [dead]
eadmund 1y ago
The issue is that one’s fridge or light bulb becomes a lodgment from which an adversary can launch LAN attacks (e.g. via Ethernet) on one’s more-sensitive devices, such as one’s personal computer (which contains more-or-less one’s entire life: banking details, correspondence and so forth). I don’t really care if the IoT device is compromised; I do care if it is used to compromise my trusted devices.
raylad 1y ago
This article is specifically discussing industrial Internet of things. And I think it’s a good and instructive article actually. Please read before commenting.
- spencerflem 1y ago
  I did read the article. It was not very good about separating the two cases (for example by saying the total # of IoT devices to sound dramatic while also only listing examples of industrial ones to sound more worrying). I love and care pretty deeply about security, I run Graphene OS & am trying to switch to Genode / Sculpt sometime this year. I care. But I'm coming to realize that for the 'personal computing' use-case it doesn't matter much for people who aren't nerds. In any case, the sort of "hardware root of trust" reccomended is an insidious way of going about it.
graemep 1y ago
> Industrial stuff sure, but if someone's internet fridge or smart TV goes haywire, so what If large numbers of fridges or cars fail to work properly or go haywire at the same time, it matters. The article also mentions enabling DDOS. The same with things like routers, any type of infrastructure. We have increasing amounts of electricity generation and storage moving to consumer devices. Its a good idea and could make the system more resilient if done right, but if it relies on insecure devices it would be a huge systemic vulnerability.
Reubachi 1y ago
Encryption and non-repudiation to-from any deployed field device back home is analogous to putting a lock and your ID on your front door. It would deter the average "front door unlocked" criminal of opportunity. When does a device not authenticating itself and all it's comms matter? Mossad was able to (at great cost, and with an inept enemy) hijack a telecom supply chain to embedd explosives in internet radios. Were there any operational oversight to simply have these devices call home with signed key challenge, the literal virus OS/code execution/explosive would have at least been caught. I only bring up THAT example to show that supply chains are as exposed as a bad actor wants them to be.
Ekaros 1y ago
Fridge could have interesting attack vectors. Say allow temperature peak during evening and night and then lower it before morning. Keep repeating this. You get lot of spoiled food and worst case even dead people.
- netsharc 1y ago
  How about home thermostats? Turn off the heating during a snowmageddon, freeze some people to death. Opposite thing during a heatwave. Or a distributed attack, turn on all ACs of a city, and overload the power grid...

arcticbull 1y ago

I think the risk isn't that your fridge is unable to suddenly to phone home about your butter consumption but that it gets turned into a giant botnet or joins some crypto mining pool. Sensors don't have much horsepower but some of those smart appliances have decent application processors.

wetpaws 1y ago
[dead]

eadmund 1y ago

The issue is that one’s fridge or light bulb becomes a lodgment from which an adversary can launch LAN attacks (e.g. via Ethernet) on one’s more-sensitive devices, such as one’s personal computer (which contains more-or-less one’s entire life: banking details, correspondence and so forth). I don’t really care if the IoT device is compromised; I do care if it is used to compromise my trusted devices.

raylad 1y ago

This article is specifically discussing industrial Internet of things. And I think it’s a good and instructive article actually. Please read before commenting.

spencerflem 1y ago
I did read the article. It was not very good about separating the two cases (for example by saying the total # of IoT devices to sound dramatic while also only listing examples of industrial ones to sound more worrying). I love and care pretty deeply about security, I run Graphene OS & am trying to switch to Genode / Sculpt sometime this year. I care. But I'm coming to realize that for the 'personal computing' use-case it doesn't matter much for people who aren't nerds. In any case, the sort of "hardware root of trust" reccomended is an insidious way of going about it.

graemep 1y ago

> Industrial stuff sure, but if someone's internet fridge or smart TV goes haywire, so what If large numbers of fridges or cars fail to work properly or go haywire at the same time, it matters. The article also mentions enabling DDOS. The same with things like routers, any type of infrastructure. We have increasing amounts of electricity generation and storage moving to consumer devices. Its a good idea and could make the system more resilient if done right, but if it relies on insecure devices it would be a huge systemic vulnerability.

Reubachi 1y ago

Encryption and non-repudiation to-from any deployed field device back home is analogous to putting a lock and your ID on your front door. It would deter the average "front door unlocked" criminal of opportunity. When does a device not authenticating itself and all it's comms matter? Mossad was able to (at great cost, and with an inept enemy) hijack a telecom supply chain to embedd explosives in internet radios. Were there any operational oversight to simply have these devices call home with signed key challenge, the literal virus OS/code execution/explosive would have at least been caught. I only bring up THAT example to show that supply chains are as exposed as a bad actor wants them to be.

Ekaros 1y ago

Fridge could have interesting attack vectors. Say allow temperature peak during evening and night and then lower it before morning. Keep repeating this. You get lot of spoiled food and worst case even dead people.

netsharc 1y ago
How about home thermostats? Turn off the heating during a snowmageddon, freeze some people to death. Opposite thing during a heatwave. Or a distributed attack, turn on all ACs of a city, and overload the power grid...