Homeland Security Issues 'Strategic Principles' For Securing The Internet Of Broken Things

from the my-smart-toaster-just-destroyed-the-internet dept

For much of the last year, we've noted how the rush to connect everything from toasters to refrigerators to the internet -- without adequate (ok, any) security safeguards -- has resulted in a security, privacy and public safety crisis. At first, the fact that everything from Barbies to tea kettles were now hackable was kind of funny. But in the wake of the realization that these hacked devices are contributing to massive new DDoS botnet attacks (on top of just leaking your data or exposing you to hacks) the conversation has quickly turned serious.

Security researchers have been noting for a while that it's only a matter of time before the internet-of-not-so-smart-things contributes to human fatalities, potentially on a significant scale if necessary infrastructure is attacked. As such, the Department of Homeland Security recently released what they called "strategic principles" for securing the Internet of Things; an apparent attempt to get the conversation started with industry on how best to avoid a dumb device cyber apocalypse.

Most of the principles are simple common sense, such as recommending that companies, oh, actually think about security a little bit during the product design phase. Other principles are a bit ironic given the government's behavior on other fronts, including the recommendation that companies implement encryption at the processor level for devices like the iPhone:

"Use hardware that incorporates security features to strengthen the protection and integrity of the device. For example, use computer chips that integrate security at the transistor level, embedded in the processor, and provide encryption and anonymity."

Again though, most of the recommendations are painfully basic, including actually "understanding what consequences could flow from the failure of a device," ensuring devices are more quickly and automatically updated, and engaging in "red teaming exercises" where employees probe devices for vulnerabilities before launch. Still, just getting some of this stuff in writing isn't a bad idea, given that most of the new IoT DDoS malware relies on something as stupid as not changing default login credentials. So there is value in just establishing some kind of core best practices (apparently incompetent) companies can look to.

As such, the DHS is clear that this is just a "first step":

"These non-binding strategic principles are designed to enhance security of the IoT across a range of design, manufacturing, and deployment activities, and include relevant suggested practices for implementation. It is a first step to motivate and frame conversations about positive measures for IoT security among IoT developers, manufacturers, service providers, and the users who purchase and deploy the devices, services and systems. "

The problem of course is that voluntary guidelines are no guarantee that the companies involved will actually adhere to them. After all, these are companies (and IoT evangelists) that were so keen on selling hardware that they couldn't be bothered to do the bare minimum to secure their products or acknowledge this rising, obvious problem. As a result, you have hardware like the Jidetech 720p WiFi enabled security camera, which security researcher Rob Graham noted this week can be hijacked by malware and participate in a botnet in all of five minutes after being unboxed: As a result, there are many security researchers arguing that voluntary guidelines simply won't be enough. Bruce Schneier, for example, earlier this month proclaimed that the internet-of-broken-things is a clear case of market failure that will require tougher regulations if we're going to actually solve the problem:

"An additional market failure illustrated by the Dyn attack is that neither the seller nor the buyer of those devices cares about fixing the vulnerability. The owners of those devices don't care. They wanted a webcam —­ or thermostat, or refrigerator ­— with nice features at a good price. Even after they were recruited into this botnet, they still work fine ­— you can't even tell they were used in the attack. The sellers of those devices don't care: They've already moved on to selling newer and better models. There is no market solution because the insecurity primarily affects other people. It's a form of invisible pollution."

That's certainly not going to be good news for the regulation phobic, but Schneier argues the alternative is, quite literally, chaos:

"Regardless of what you think about regulation vs. market solutions, I believe there is no choice. Governments will get involved in the IoT, because the risks are too great and the stakes are too high. Computers are now able to affect our world in a direct and physical manner."

One problem of course is that U.S. regulation certainly won't help deter the rest of the world from creating internet-connected devices that can wreak havoc on vital infrastructure. There's also the very real concern that federal regulations would be crafted poorly, restricting sector innovation or consumers' freedom to tinker with their own device. In fact, many of these devices have such abysmal interfaces and control systems that hacking and modifying them is in some instances the only path to actually securing them and controlling what traffic is being sent over the network.

As such, IoT regulation is going to be a debate that rages for several years, when it's not entirely clear we have several years to waste. In the interim, the only recourse left to consumers continues to be to establish smart security in your own home and business, and continue to name and shame IoT vendors that clearly prioritized profits over human lives and the health of the internet at large.

Filed Under: cybersecurity, devices, dhs, hacking, homeland security, internet of things, iot

Security Startup MedSec Shorts St. Jude Medical Stock To Punish It For Flimsy Pacemaker Security

from the broken-workarounds-for-a-broken-system dept

The one-two punch of incompetent IT administrators and botched connected device security has resulted in an unsurprising spike in ransomeware attacks across the medical industry. And while the rise in easily hacked "smart" TVs, tea kettles, and kids toys is superficially funny in the consumer internet of things space, it's less amusing when you're a patient relying on poorly secured pace makers and essential medical equipment. But much like the internet of things space these devices are not only poorly secured, they're supported by companies that aren't very good at releasing timely security updates.

Case in point: a team of hackers working for cybersecurity startup MedSec found a bevy of flaws in medical devices sold by St. Jude Medical Inc, ranging from a lack of overall encryption to vulnerabilities letting unauthorized devices communicate with the company's pacemakers and defibrillators. And while we've talked about the threat of hackable pacemakers for more than a decade, hackers are increasingly worming their way into poorly secured radiology equipment, blood gas analyzers and other hospital and nursing home equipment to steal data for identity theft, giving the threat an added dimension.

According to MedSec Chief Executive Officer Justine Bone, St. Jude has a long history of implementing sub-standard security, and then doing little to nothing once these vulnerabilities are pointed out:

"As far as we can tell, St. Jude Medical has done absolutely nothing to even meet minimum cybersecurity standards, in comparison to the other manufacturers we looked at that have made efforts," Bone said. There are steps St. Jude can take relatively quickly to protect patients, including changing the programming of implanted pacemakers and defibrillators through a method that would involve a doctor’s visit, she said.

So MedSec tried something relatively unique. Historically, many hackers and security firms either contact companies to alert them to vulnerabilities, or try to sell the not-yet-public vulnerabilities to corporate espionage and security firms or government agencies, who then happily exploit any impacted, unpatched systems (in this case, with potentially fatal results). But MedSec did something notably different. It reached out to the Muddy Waters Capital LLC investment firm, suggesting a partnership to short sell St. Jude stock before reporting the vulnerabilities to the FDA. Under the deal, MedSec makes more money the further shares fall.

The report has been posted to the Muddy Waters website (pdf), with both companies standing to profit should the company's stock price take a tumble (which has already begun, with the stock dropping 12% before trading being halted). The timing is trouble for St. Jude, which is in the process of finalizing a potential $25 billion acquisition by Abbott Laboratories. MedSec, for what it's worth, says they only took this route because they believed St. Jude would either ignore the vulnerabilities or engage in legal hostilities:

"We were worried that they would sweep this under the rug or we would find ourselves in some sort of a hush litigation situation where patients were unaware of the risks they were facing," said Bone, an experienced security researcher and the former head of risk management for Bloomberg LP, the parent of Bloomberg News. "We partnered with Muddy Waters because they have a great history of holding large corporations accountable."

Unsurprisingly, the decision to punish St. Jude in this fashion immediately triggered an ethics debate in the hacker and security community. Some were quick to argue that failing to update necessary medical equipment was the real ethics violation. Some believe both St. Jude and Muddy Waters are being intentionally misleading for the sake of profit and marketing, and others are solely appalled by the short selling tactic itself. In the latter category sits security researcher Kenn White, who called the moved little more than "pure naked greed":Not too surprisingly, St. Jude was quick to issue a statement claiming MedSEC used "flawed test methodology on outdated software," demonstrating "lack of understanding of medical device technology.":

"We have examined the allegations made by Capital and MedSec on August 25, 2016 regarding the safety and security of our pacemakers and defibrillators, and while we would have preferred the opportunity to review a detailed account of the information, based on available information, we conclude that the report is false and misleading. Our top priority is to reassure our patients, caregivers and physicians that our devices are secure and to ensure ongoing access to the proven clinical benefits of remote monitoring. St. Jude Medical stands behind the security and safety of our devices as confirmed by independent third parties and supported through our regulatory submissions."

MedSec says it found two 0 day exploits opening pacemakers to attack, either by draining the battery or crashing the device software (both require being relatively close to the target). But the group also found that the company's pacemakers often use no encryption nor authentication over wireless, and the devices all use the same password to connect to the St Jude network, opening the door to a reverse engineering hack on the network at large. MedSec and Muddy Waters continue to insist the company's history indicates it would not have fixed the vulnerabilities in a timely fashion using traditional reporting methods and bounties.

Regardless of which side you believe is being more or less self-serving, punishing companies for their security incompetence using the only language they truly understand adds a massive and interesting new wrinkle in the never-ending debate over hacking ethics, and the over-arching quest to bring some accountability to companies still treating life-protecting security like an annoying afterthought.

Filed Under: cybersecurity, internet of things, pacemaker, security, short selling
Companies: medsec, muddy waters, st. jude medical

Your 'Smart' Power Outlets Are Now Botnets Thanks To The Internet Of Broken Things

from the I-just-hacked-your-stapler dept

Making fun of the Internet of Things has become a sort of national pastime, made possible by a laundry list of companies jumping into the space without the remotest idea what they're actually doing. When said companies aren't busy promoting some of the dumbest ideas imaginable, they're making it abundantly clear that the security of their "smart," connected products is absolutely nowhere to be found. And while this mockery is well-deserved, it's decidedly less funny once you realize these companies are introducing thousands of new attack vectors in every home and business network the world over.

Overshadowed by the lulz is the width and depth of incompetence on display. Thermostats that fail to heat your home. Door locks that don't protect you. Refrigerators that leak Gmail credentials. Children's toys that listen to your kids' prattle, then (poorly) secure said prattle in the cloud. Cars that could, potentially, result in your death. The list goes on and on, and it grows exponentially by the week.

The latest gift of the Internet of Things industry, revealed last week by security researchers at Bitdefender, is smart electrical sockets that can be hacked to hand over e-mail credentials, create a botnet, or (potentially) burn your house down by firing up connected appliances. The devices are sold as an amazing new tool to help create a connected home, allowing users to manage any device plugged into them via a smartphone and/or the internet. The problem, as usual, is an (unspecified) company that treated security as an afterthought. From the full Bitdefender research paper:

"Bitdefender researchers observed that the hotspot is secured with a weak username and password combination. Furthermore, the application does not alert the user to risks associated with leaving default credentials unchanged. Changing them can be done by clicking ‘Edit’ on the name of the smart plug from the main screen and choosing a new name and a new password.

Secondly, researchers noticed that, during configuration, the mobile app transfers the Wi-Fi username and password in clear text over the network. Also, the device-to-application communication that passes through the manufacturer’s servers is only encoded, not encrypted.

That's not just bad security, that's yet another company that's not even trying. And not even trying, it should be added, despite a constant flood of news reports that have demolished an endless list of different brands for failing to embrace things like fundamental encryption. We're building a mansion out of flammable toothpicks and empty promises, and as Bruce Schneier recetly noted, it's really only a matter of time before the check comes due on a fairly massive scale.

And while security is a big part of the problem, equally troubling is the rise of "smart" products that stop working once the company's manufacturer gets bored or sold. Like, you know, connected light bulbs that no longer really connect to much of anything:

"Earlier this month, our colleague and Consumerist reader Michelle spotted a great deal on some Connected by TCP smart lightbulbs she’d been eyeing for her home. Before buying, she checked to see if they’d be compatible with her Amazon Echo or Wink app, and it’s good that she checked first. As it turns out, those bulbs are no longer compatible with any device, app, or hub, because TCP pulled the plug on their server as of June 1.

Whoops, sorry! Not only is the Internet of Things a total shit show when it comes to security and privacy, you also don't really own the things you buy, creating a universe of new possibilities when it comes to dysfunction, fraud, and misleading advertising promises. There are plenty of reasons why this incompetence is coming home to roost, though the simplest is that many companies were just too cheap and lazy to invest in quality kits, research and technology, and most IOT "evangelists" were too focused on self-promotion to much care about the fact that they were selling us an industrial-grade disaster.

Filed Under: internet of things, iot, power outlets, security

The Internet Of Things Is a Security And Privacy Dumpster Fire And The Check Is About To Come Due

from the no-hyperbole-intended dept

If you're a long-standing reader of Techdirt, you know we've well documented the shitshow that is the "internet of things." It's a sector where countless companies were so excited to develop, market and sell new "smart" appliances, they couldn't be bothered to embrace even the most rudimentary security and privacy standards once these devices were brought online. The result is an endless stream of stories about refrigerators, TVs, thermostats or other "smart" devices that are busy hemorrhaging personal data, inadvertently advertising that sometimes the smart option -- is actually the dumb one.

This systemic incompetence has now fused with a cultural disdain for more modern consumer privacy protections. The end result has been an obvious uptick in concern about how much data is now being collected by even childrens' toys like Barbie dolls, something that last year's Vtech hack illustrated isn't just empty fear mongering. Convincing parents who already find technology alienating has proven to be difficult, as is attempting to craft intelligent regulation that protects kids' playtime babbling from being aggressively monetized, without hindering emerging sector innovation and profits.

To that end, the Family Online Safety Institute and the Future of Privacy Forum held a presentation last week (you can find the full video here) where analysts and experts argued, among other things, that privacy policies need to be significantly simplified and modernized for an era where a child's doll can profoundly impact the privacy of countless people. It has been, needless to say, an uphill climb.

And while this all is seen as kind of cute and theoretical when we're talking about not-so-smart tea kettles or talking dolls, the amusement has worn off as the conversation has shifted to territory where incompetence or a clever hack can kill you (namely, automobiles). As Bruce Schneier notes over at Motherboard, this massive introduction of privacy flaws is a pretty big problem at scale, when appliances aren't swapped out or updated often:

"As more things come under software control, they become vulnerable to all the attacks we've seen against computers. But because many of these things are both inexpensive and long-lasting, many of the patch and update systems that work with computers and smartphones won't work. Right now, the only way to patch most home routers is to throw them away and buy new ones. And the security that comes from replacing your computer and phone every few years won't work with your refrigerator and thermostat: on the average, you replace the former every 15 years, and the latter approximately never."

And while mocking the internet of things has become a running joke, Schneier notes it quickly becomes less funny when you begin to realize that the interconnected nature of all of these devices means we're introducing millions of new attack vectors daily in homes, businesses, utilities, and government agencies all over the world. Collectively these flaws will, no hyperbole intended, inevitably result in significant deaths:

"Systems are filled with externalities that affect other systems in unforeseen and potentially harmful ways. What might seem benign to the designers of a particular system becomes harmful when it’s combined with some other system. Vulnerabilities on one system cascade into other systems, and the result is a vulnerability that no one saw coming and no one bears responsibility for fixing. The Internet of Things will make exploitable vulnerabilities much more common. It’s simple mathematics. If 100 systems are all interacting with each other, that’s about 5,000 interactions and 5,000 potential vulnerabilities resulting from those interactions. If 300 systems are all interacting with each other, that’s 45,000 interactions. 1,000 systems: 12.5 million interactions. Most of them will be benign or uninteresting, but some of them will be very damaging."

At that scale, the argument that you didn't embed useful security because "it was only a refrigerator" or you didn't impose some basic privacy protections and guidelines because "it might hurt an emerging sector's ability to make more money" start to lose their luster. Schneier tries to argue that the only way we can truly mitigate the looming risk is the involvement of an informed public and an accountable government:

"Security engineers are working on technologies that can mitigate much of this risk, but many solutions won’t be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public; the interconnections can make it impossible to connect data breaches with resultant harms; and the interests of the companies often don’t match the interests of the people.

Governments need to play a larger role: setting standards, policing compliance, and implementing solutions across companies and networks. And while the White House Cybersecurity National Action Plan says some of the right things, it doesn’t nearly go far enough, because so many of us are phobic of any government-led solution to anything.

The next president will probably be forced to deal with a large-scale internet disaster that kills multiple people. I hope he or she responds with both the recognition of what government can do that industry can’t, and the political will to make it happen.

This is of course the part of the story where the author is supposed to inform you that with good intentions and enough gumption, government, the public and industry will come together and quickly nip this problem in the bud. Of course this particular post's readership is painfully aware that the same government Schneier hopes will come to the rescue is too busy trying to embed its own problematic backdoors in everything under the sun while a large portion of it rushes to gut the funding and authority of any regulator capable of imposing basic privacy and security protections.

Said readers are also probably painfully aware that neither looming major Presidential candidate has shown the remotest competence in regards to technology or genuine cyber-security. That means it's more than likely these unfortunate outcomes Schneier predicts will need to arrive before we're collectively even willing to begin to take serious steps to address them. At that point the only certain outcome is that all of the players involved will be sure to shirk their own personal responsibility for the security and privacy nightmare they helped build. Still, for whatever it winds up being worth, we can't say we weren't warned.

Filed Under: bruce schneier, internet of things, iot, privacy, security

Mitsubishi Outlander Just The Latest 'Smart' Car That's Trivial To Hack And Control

from the not-so-smart dept

Yet another vehicle heavily advertised as being "smart" has proven to be notably less secure than its older, dumber counterparts. This week, researchers discovered that flaws in the Mitsubishi Outlander leave the vehicle's on-board network vulnerable to all manner of hacker attack, allowing an intruder to disable the alarm system, drain the car's battery, control multiple vehicle functions, and worse.

The app for most "smart" vehicles connects to a web-based service hosted by the manufacturer. This service in turn connects to a GSM module inside of the automobile, letting a user control the vehicle from anywhere. While convenient, this has proven to be problematic when poorly implemented -- something Nissan recently discovered after the company failed to implement any real authentication, letting an attacker use the Leaf app to track a driver's driving behavior, physically control the Leaf's heating and cooling systems, and drain the car's battery.

Analysis of the Mitsubishi Outlander's security flaw found that Mitsubishi did things differently, requiring users connect to an on-board Wi-Fi hotspot before controlling the vehicle using the associated app (presumably to save money on an online hosting service). But the researchers found that the Wi-Fi key was relatively trivial to hack:

"The Wi-Fi pre shared key is written on a piece of paper included in the owners’ manual. The format is too simple and too short. We cracked it on a 4 x GPU cracking rig at less than 4 days. A much faster crack could be achieved with a cloud hosted service, or by buying more GPUs."

Given the embedded access point has a unique SSID, an attacker can use public resources like Wigle.net to easily geolocate any Outlander PHEVs they might like to target. With the PSK and the SSID, the security firm was able to compromise the remainder of the car's rudimentary security using a man-in-the-middle attack to sniff the traffic flowing between the car and the app. Once inside, researchers noted that like the Leaf hack they could drain the car's battery, turn various vehicle functions on and off, and turn off the alarm. But they also note the vulnerability goes much deeper than with the Leaf:

"Once unlocked, there is potential for many more attacks. The on board diagnostics port is accessible once the door is unlocked. Whilst we haven’t looked in detail at this, you may recall from a hack of some BMW vehicles which suggested that the OBD port could be used to code new keys for the car. We also haven’t looked at connections between the Wi-Fi module and the Wi-Fi module and the Controller Area Network (CAN). There is certainly access to the infotainment system from the Wi-Fi module. Whether this extends to the CAN is something we need more time to investigate."

Like with so many vulnerabilities, the researchers say that when they brought the problem to the attention of Mitsubishi, the company showed "disinterest" in a dialogue. At least until they contacted the BBC, at which point Mitsubishi got chatty:

"Initial attempts by us to disclose privately to Mitsubishi were greeted with disinterest. We were a bit stumped at this point: As so often happens, the vendor takes no interest and public disclosure becomes an ethical dilemma. So, we involved the BBC who helped us get their attention. Mitsubishi have since been very responsive to us! They are taking the issue very seriously at the highest levels."

We've noted for a few years now that in-car security -- as with most products on board the "internet of things" hype train -- is aggressively atrocious. And it's not really clear it's getting any better despite several government warnings and bad press. Many car manufacturers still aren't quick to respond to disclosures, and even if they can, they often take far too long to patch problems when found. That's of great benefit to government, private or criminal entities that surely appreciate the easy new way to spy on, stall or even potentially kill via methods most police departments likely don't have the chops to adequately investigate.

Filed Under: connected cars, hacking cars, internet of things, outlander, smart car
Companies: mitsubishi

Nest May Be The First Major Casualty Of Hollow 'Internet Of Things' Hype

from the hero-to-zero dept

When the Nest smart thermostat was launched back in 2011, you may recall that it was met with an absolute torrent of gushing media adoration, most of it heralding the real arrival of the smart home. That was in part thanks to the fact the company was founded by Tony Fadell and Matt Rogers, both ex-Apple engineers with some expertise in getting the media to fawn robotically over shiny kit. But a parade of high-profile PR failures have plagued the effort since, including several instances where botched firmware updates briefly bricked the device, leaving even the media's resident internet of things evangelists annoyed.

Under the hood it has become increasingly clear that the company was plagued by what some cooperating companies recently proclaimed was an overall "culture of arrogance", manifested in a reputation for blaming Nest's own problems on partner companies. And being acquired by Alphabet (Google) didn't seem to help matters. Despite expanding the company's employee count from 280 to 1200 and being provided a "virtually unlimited" budget, the same press that built Nest into an internet of things god based on a single pretty thermostat design has suddenly and comically realized that Nest hasn't actually done or produced much of anything:

"In return for all this investment, Nest delivered very little. The Nest Learning Thermostat and Nest Protect smoke detector both existed before the Google acquisition, and both received minor upgrades under Google's (and later Alphabet's) wing. A year after buying Dropcam, Nest released the Nest Cam, which was basically a rebranded Dropcam. Two-and-a-half years under Google/Alphabet, a quadrupling of the employee headcount, and half-a-billion dollars in acquisitions yielded minor yearly updates and a rebranded device. That's all."

There's also the recent kerfuffle involving Nest acquiring smart home hub manufacturer Revolv in 2014, then effectively bricking a $300 device as of last month (again, without really providing anything to replace it with). Over the last year Nest also started leaking many top employees and there was a notably ugly and public feud with Dropcam co-founder and departing Nest employee Greg Duffy, who blamed Nest's dysfunction on Fadell's "tyrant bureaucrat" management style.

Now after six years leading Nest's frontal assault to nowhere, co-founder Tony Fadell announced last Friday in a blog post that he will be stepping down as CEO. The departing executive tries valiantly to claim it was just time to "leave the nest" (ba dum bum):

"Today though, my news is bittersweet: I have decided that the time is right to “leave the Nest.” While there is never a perfect time to transition, we’ve grown Nest to much more than a thermostat company. We’ve created a hardware + software + services ecosystem, which is still in the early growth stage and will continue to evolve to move further into the mainstream over the coming years.

Alphabet CEO Larry Page meanwhile issued a rosy statement of his own about this firing dressed up as a not firing:

"Under Tony’s leadership, Nest has catapulted the connected home into the mainstream, secured leadership positions for each of its products, and grown its revenue in excess of 50% year over year since they began shipping products. He’s a true visionary, and I look forward to continuing to work with him in his new role as advisor to Alphabet. I’m delighted that Marwan will be the new Nest CEO and am confident in his ability to deepen Nest’s partnerships, expand within enterprise channels, and bring Nest products to even more homes."

And while that's sweet and all, Fadell reportedly held an all hands Google meeting back in April after which he was pretty furiously mocked by Google employees, many of which wanted (and presumably still want) Fadell fired and Nest sold off. Google/Alphabet, meanwhile, appears to have gone full speed ahead on a variety of smart home projects that have nothing to do with Nest, including the company's Asus and TP-Link OnHub routers (which have baked in IOT functionality not fully enabled yet), and the more recently unveiled Google Home (Google's version of Amazon Echo).

Nest can certainly still turn things around whether it's sold or remains at Alphabet, and it should soon be clear just how big of a role Fadell's management style played in the company's gear grinding. But the media's manufacture and subsequent demolition of Nest is also part of a broader cautionary tale about the tech media's boundless adoration of style over substance (or, security, as "smart" tea kettles, refrigerators, TVs, and vehicles keep illustrating) when it comes to the internet of shiny things.

Filed Under: hype, internet of things, smart things, thermostat, tony fadell
Companies: alphabet, dropcam, google, nest

FBI Response To FOIA Request About Whether It Is Hacking Your Amazon Echo: ¯\_(ツ)_/¯

from the so,-yes-then? dept

We've talked in the past about how claims of dangerous silence from certain law enforcement and intelligence groups within the American government are so much the crying of "wolf!" As some will decry the use of security tools like encryption, or other privacy tools, the fact is that the so-called "internet of things" industry has created what is essentially an invited-in army of confidential informants. Domestic surveillance, once a time-consuming, laborious, and difficult task for those doing the spying has since become laughably easy by relative standards. One can imagine J. Edgar Hoover having to change his trousers if he learned exactly to what degree Americans today have accepted hackable or easily-compromised cameras and microphones into our homes, so excited would he be.

In this era, then, it would seem the public buying these IoT products would have an interest in learning if their government is using those products against them in this way. In large part, it seems that the government ain't telling. Take the Amazon Echo, for instance, a device with a microphone that is voice-activated to play your favorite music, tell you the weather, read you the latest news, *cough*-let the government spy on you-*cough*, tells you the traffic, and reads you your audiobook-- wait, what was that government spying thing? Is that for real?

Gizmodo recently tried to find out via an FOIA request. The government's response was a shrug of the shoulders and the wink of an eye.

Back in March, I filed a Freedom of Information request with the FBI asking if the agency had ever wiretapped an Amazon Echo. This week I got a response: “We can neither confirm nor deny...”

In many ways the Echo is a law enforcement dream. Imagine if you could go back in time and tell police that one day people would willingly put microphones in their own homes that, with a little hacking, could be heard from anywhere in the world 24/7. First, you’d need to explain what hacking was, but then they’d be like, “Nah bruh, yer pullin’ my leg.”

The full FOIA response is embedded below. As Gizmodo notes, there is neither a confirmation or denial that records of surveillance by Echo exist, and the letter even goes on to insist that this response shouldn't be taken to mean that there are in fact such records. But, particularly in a post-Snowden world in which we live, what else can you expect the public to think? With all that's gone on, both the innocent and nefarious alike would be crazy not to simply operate on the assumption that the alphabet agencies were hacking all the internet of things it could before this FOIA response. The government's non-answer in this case will serve as confirmation for some and a return to this SOP for most others.

And screaming in the vaccum of certainty here is the overriding sense that any oversight of these surveillance practices that might exist is sorely lacking in teeth. It's difficult not to picture Americans shuffling within their own homes, casting worried looks at the devices around them, wondering for all the world when each might be weaponized as a telescreen. If the internet of things is going to become a new great industry, this is certainly going to be one of the hurdles it must overcome.

Filed Under: amazon echo, fbi, foia, glomar response, internet of things, iot

Samsung SmartThings Platform Latest To Highlight Internet Of Things Security Is A Joke

from the just-buy-a-dog dept

Stop us if you've heard this one before: a new study has found that the "Internet of Things" may bring some added convenience, but at the high price of severe security vulnerabilities. Researchers at the University of Michigan say they've uncovered (pdf) some major new vulnerabilities in Samsung's SmartThings platform that could allow an attacker to unlock doors, modify home access codes, create false smoke detector alarms, or put security and automation devices into vacation mode. Researchers say this can be done by tricking users into either installing a malicious app from the SmartThings store, or by clicking a malicious link.

The URL attack relies on SmartThings' flawed implementation of the OAuth authentication protocol. In short, a malicious URL can be used to trick the consumer into giving up his login tokens without the slightest indication anything has gone wrong, but providing an attacker with the ability to create his own backdoor -- into your front door:

"Broadly, this part of the attack involves getting a victim to click on a link that points to the authentic SmartThings domain with only the redirect_uri portion of the link replaced with an attacker controlled domain. The victim should not suspect anything since the URL indeed takes the victim to the genuine HTTPS login page of SmartThings. Once the victim logs in to the real SmartThings Web page, SmartThings automatically redirects to the specified redirect URI with a 6 character codeword. At this point, the attacker can complete the OAuth flow using the codeword and the client ID and secret pair obtained from the third-party app’s bytecode independently."

If the malicious URL approach isn't used, attackers can also rely on tricking consumers into downloading a malicious app that -- for example -- might claim to offer you insight into device battery consumption, but can actually also give an attacker the keys to your kingdom. This is in part, the researchers note, due to the fact that 42% of over 500 apps in the SmartThings store are are given significantly more system privileges than they actually need to accomplish the task at hand:

"We found that SmartApps were significantly overprivileged: (a) 55% of SmartApps did not use all the rights to device operations that their requested capabilities implied; and (b) 42% of SmartApps were granted capabilities that were not explicitly requested or used. In many of these cases, overprivilege was unavoidable, due to the device-level authorization design of the capability model and occurred through no fault of the developer. Worryingly, we have observed that 68 existing SmartApps are already taking advantage of the overprivilege to provide extra features, without requesting the relevant capabilities.

As is pretty standard behavior in the Internet of Things space, Samsung was quick to downplay the problems in a statement to the media and throw developers under the bus (despite the report clearly outlining Samsung's responsibility):

"The potential vulnerabilities disclosed in the report are primarily dependent on two scenarios - the installation of a malicious SmartApp or the failure of third party developers to follow SmartThings guidelines on how to keep their code secure," a SmartThings representative said. "Following this report, we have updated our documented best practices to provide even better security guidance to developers."

The problem is the report clearly notes that neither of these two scenarios is all that unlikely. In an admittedly small survey of 22 SmartThings users, the study found that 91% would let a battery monitoring app check the status of their smart lock. But quite justly, just 14% of those polled believed that providing such access would somehow involve the app being able to send door access codes to a remote server. The study, and Samsung's reaction to it, are just another example of how if you really want a smart and secure home, "dumber" solutions -- like dead bolts and a dog -- remain the more intelligent option.

Filed Under: hacking, internet of things, security, smartthings
Companies: samsung

Intelligence Director James Clapper Warmly Welcomes The Internet Of Things To The NSA's Haystacks

from the my-god...-it's-full-of-data dept

The NSA isn't too concerned about the use of encryption. Unlike the FBI, which continues to claim the sky is falling darkening thanks to the spread of math, the NSA is relatively comfortable with the march of technology in this direction.

For one thing, the NSA has made progress towards cracking some forms of encryption. On top of that, it maintains a unit that does nothing but stick implants into hardware that allows it to bypass protection schemes used by its targets.

There's no "going dark" fear at the NSA. The Director of National Intelligence -- James Clapper -- has just issued a "Worldwide Threat Assessment" and nowhere in it will you find an extensive discussion about encryption's supposed deleterious effect on national security. There is one small paragraph that notes it's likely a part of terrorists' efforts to hide their communications, but not the element that concerns his office the most.

Terrorists will almost certainly continue to benefit in 2016 from a new generation of recruits proficient in information technology, social media, and online research. Some terrorists will look to use these technologies to increase the speed of their communications, the availability of their propaganda, and ability to collaborate with new partners. They will easily take advantage of widely available, free encryption technology, mobile-messaging applications, the dark web, and virtual environments to pursue their objectives.

There are far too many options for those who'd like to keep the NSA out of their business, according to the report. There's no sense in decrying a single aspect of it -- especially one that also provides substantial security benefits to non-terrorists.

But the Internet giveth just as certainly as it taketh away. Echoing the sentiments of the recent report debunking the "going dark" fears of James Comey, certain legislators and a handful of smaller law enforcement agencies, Clapper points out that the Internet of Things will provide intelligence services with plenty of data to fill in their surveillance holes. (h/t Emptywheel)

Internet of Things (IoT). “Smart” devices incorporated into the electric grid, vehicles—including autonomous vehicles—and household appliances are improving efficiency, energy conservation, and convenience. However, security industry analysts have demonstrated that many of these new systems can threaten data privacy, data integrity, or continuity of services. In the future, intelligence services might use the IoT for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials.

The tea kettle that talks to the thermostat that shares a signal with the fridge that exposes your emails to the wardriving criminal who just obtained your Wi-Fi password from the doorbell will all be sources of useful data for law enforcement and intelligence agencies. Considering much of the industry has opted to ship smart things with dumbass defaults most users will never change, the Internet of Eminently Crackable Things will be the informants government agencies always wished they had -- ones that can tell when suspects are home, what they're doing and opening up otherwise secured networks for easy intrusion.

Also worth noting is the highly dubious use of the future tense when referring to the surveillance of targets via their Smart Things. It's hard to believe the NSA isn't already on top of this. It's not as though it would need to alter its permission slips. Section 702 gives it the power to snake info from the internet from basically anywhere in the world and the government is busy arguing that people "know" their connected devices share tons of identification/location info with "the world," so there's really no expectation of privacy that might limit surveillance via smart objects.

While overseas terrorists may not be purchasing Nest thermostats in bulk at the moment, the march towards the interconnectedness of everything means it's likely one object or another will provide another surveillance vector for intelligence agencies in the near future.

Filed Under: internet of things, iot, james clapper, mass surveillance, nsa, surveillance

Nest Thermostat Goes From 'Internet Of Things' Darling To Cautionary Tale

from the benefit-of-dumb-devices dept

Back when the Nest thermostat was announced in 2011, it was met with waves of gushing adoration from an utterly uncritical technology press. Much of that gushing was certainly warranted; Nest was founded by Tony Fadell and Matt Rogers, both former Apple engineers, who indisputably designed an absolutely gorgeous device after decades of treating the thermostat as an afterthought. But the company also leaned heavily on the same media acupressure techniques Apple historically relies on to generate a sound wall of hype potentially untethered from real life.

Courtesy of marketing and design, Nest slowly but surely became the poster child for the connected home. Over the last year or so however things have changed, and while now Alphabet-owned Nest remains an internet of things darling, the unintended timbre of the message being sent is decidedly different. For example, Nick Bilton recently wrote a piece in the New York Times noting how a glitch in the second generation of the supposedly "smart" product drained the device battery, resulting in numerous customers being unable to heat their homes just as a cold snap hit the country:

"The Nest Learning Thermostat is dead to me, literally. Last week, my once-beloved “smart” thermostat suffered from a mysterious software bug that drained its battery and sent our home into a chill in the middle of the night. Although I had set the thermostat to 70 degrees overnight, my wife and I were woken by a crying baby at 4 a.m. The thermometer in his room read 64 degrees, and the Nest was off."

Again, that's the poster child of the so-called "smart" device revolution failing utterly to complete a task thermostats have been successfully accomplishing for a generation. Other tech reporters like Stacey Higginbotham reported the exact opposite. As in, her Nest device began trying to cook her family in the middle of the night, something Nest first tried to blame on her smart garage door opener, then tried to blame on her Jawbone fitness tracker (Nest never did seem to pinpoint the cause). Her report suggests that an overall culture of "arrogance" at Nest shockingly isn't helping pinpoint and resolve bugs:

"One Nest partner, who declined to be named to preserve his business relationship with the company, said that Nest being quick with the blame didn’t surprise him, citing a culture of arrogance at the company. When something went wrong during integration testing between his device and Nest’s, problems were first blamed on his servers and team."

And fast-forward to last week, when researchers putting various internet of thing devices through tests found that the Nest thermostat was one of many IOT devices happily leaking subscriber location data in cleartext (with Nest, it's only the zip code, something the company quickly fixed in a patch). Granted Nest's not alone in being an inadvertent advertisement for a product's "dumb" alternatives. In 2016, smart tea kettles, refrigerators, televisions and automobiles are all busy leaking your private information and exposing you to malicious intrusion (or worse).

It's a fascinating, in-progress lesson about how our lust for the sexy ideal of the connected home appears to be taking a brief pit stop in reality, where sexy doesn't matter if the underlying product, person or device remains inherently dysfunctional. As a result, dumb and ugly technology is poised to make a dramatic comeback.

Filed Under: internet of things, iot, nest, reliability, security
Companies: alphabet, nest