Carnegie Mellon Researchers Design 'Nutrition Label' For The Internet Of Broken Things

from the watching-you-watching-me dept

Thanks to a laundry list of lazy companies, everything from your Barbie doll to your tea kettle are now hackable. Worse, these devices are now being quickly incorporated into some of the largest botnets ever built, resulting in devastating and historic DDoS attacks. In short: thanks to "internet of things" companies that prioritized profits over consumer privacy and the safety of the internet, we're now facing a security and privacy dumpster fire that many experts believe will, sooner or later, result in even bigger security and privacy headaches than we're seeing today.

One problem is that consumers often don't know what they're buying, which is why groups like Consumer Reports have been working on an open source standard to include security and privacy issues in product reviews. Another big problem is that these devices are rarely designed with GUIs that provide transparent insight into what these devices are doing online. And unless users have a semi-sophisticated familiarity with monitoring their internet traffic via a router, they likely have no idea that their shiny new internet-connected doo-dad is putting themselves, and others, at risk.

This lack of transparent data for the end user also extends to company privacy policies and company privacy practices, which are often muddy and buried beneath layers of fine print, assuming they're even truthful in the first place.

Enter the CyLab Security and Privacy Institute at Carnegie Mellon, where researchers say they're hoping to create a standardized "nutrition label" of sorts for IOT devices. Researchers say the labels will provide 47 different pieces of information about a device’s security and privacy practices, including the type of user and activity data the device collects, with whom the data is shared, how long the device retains data, and how frequently this data is shared. The goal is to take something incredibly confusing to the average user and simplify it in a way that's more easily understandable.

To do so, the researchers say they consulted with 22 security and privacy experts across industry, government, and academia to design the easy to understand labels:

They've also built a label generator for those interested. Ideally, by including more accurate labels and privacy and security issues in reviews, you could ideally shame at least some companies into trying a little harder, and help consumers and businesses alike avoid platforms and companies that pretty clearly couldn't care less about end user privacy and security. A more detailed breakdown of a device's habits would be available for experts or researchers looking to know more about a particular device or its habits:

"We have designed a that includes a simple, understandable primary layer for consumers and a more detailed secondary layer that includes information important to experts. The primary layer is designed to be affixed to device packaging or shown on an online shopping website, while the secondary layer can be accessed online via a URL or QR code."

One interesting finding from the researchers: consumers polled were interested in paying more to have this kind of insight into what a product actually does. Granted such labels are only useful if they're actually used, and there's a long list of overseas Chinese companies that will see no penalty for not including them (though the lack of such a label could be a deterrent from buying such products). To be truly effective, you'd likely need to incorporate such requirements as part of the United States' first actual privacy law for the internet era, should such legislation ever actually get crafted.

Filed Under: cybersecurity, internet of things, iot, nutrition label

Driver Stranded After 'Smart' Rental Car Can't Phone Home

from the dumb-tech-is-smart-tech dept

If there's one recurring theme for the internet-connected era, it's that smart technology increasingly isn't all that smart. Your smart locks bleed personal data and can be easily hacked. Your "smart" refrigerator can leak your Gmail credentials. Your "smart" oven can turn on in the middle of the night, potentially putting you at risk. Even your "smart" Barbie doll would be better left in its dumb incarnation given it can be used to spy on toddlers.

Some "smart" rental cars appear keen on continuing the theme.

Last weekend, Guardian journalist Kari Paul took a trip to rural California for a story she was working on. To get there, she rented a car through a local car-sharing service called GIG Car Share, which rents a fleet of electric Chevrolet Bolt EVs and hybrid Toyota Priuses to Bay Area residents. But Paul, who was headed to a rural area roughly three hours north of Oakland didn't have much fun on her trip. In part because the car she rented effectively became useless after the car's computer system lost cell signal. Without a tendril to the mothership, the rental car simply refused to start, leaving Paul stranded:

Ultimately the joy of modern technology didn't prove much of a joy, and the company added insult to injury via terrible customer service, which involved some 20 (!) calls to support staff, and the recommendation that the customer sleep in the car overnight:

As Ars Technica notes, the company does offer users an RFID card to use to lock or unlock the car in areas of poor cell service, though that clashes with the company's marketing for instant convenience and "on the spot" rentals. The company's messy design will now likely result in a massive PR nightmare, and a reminder that in the modern era, dumb technology routinely winds up being the smarter option.

Filed Under: apps, car rentals, internet connected cards, internet of things, kari paul, stranded
Companies: gigcarshare

Forget Huawei, The Internet Of Things Is The Real Security Threat

from the somebody's-watching-you dept

We've noted for a while how a lot of the US protectionist security hysteria surrounding Huawei isn't supported by much in the way of hard data. And while it's certainly possible that Huawei helps the Chinese government spy, the reality is that Chinese (or any other) intelligence services don't really need to rely on Huawei to spy on the American public. Why? Because people around the world keep connecting millions of internet of broken things devices to their home and business networks that lack even the most rudimentary of security and privacy protections.

Week after week we've documented how these devices are being built with both privacy and security as a distant afterthought, resulting in everything from your television to your refrigerator creating both new attack vectors and wonderful new surveillance opportunities for hackers and state actors.

The latest case in point: a popular Chinese GPS tracker, used to track everything from vehicles to kids and the elderly, has been found to contain a significant flaw that can trick the device into handing over GPS data using little more than a text message. The devices, which are made in China and rebranded and sold by more than a dozen companies, can also be used as remote surveillance devices, notes cybersecurity researchers:

"Researchers at U.K. cybersecurity firm Fidus Information Security say the device can be tricked into turning over its real-time location simply by anyone sending it a text message with a keyword. Through another command, anyone can call the device and remotely listen in to its in-built microphone without alerting anyone.

Another command can remotely kill the cell signal altogether, rendering the device effectively useless."

While the device can be protected with a PIN, that setting isn't enabled by default, and the researchers found the devices can be remotely reset, bypassing the pin anyway. This is, if you hadn't been paying attention, kind of the norm when it comes to IOT devices. By the time flaws like this are exposed the company involved has usually moved on to marketing new devices with an entirely new array of vulnerabilities. And since most such devices don't offer much in the way of transparency, consumers usually are largely clueless to the fact that their devices are putting their private data at risk.

Security researchers keep warning us that the check is going to come due on the internet of things front, and we're not taking the warnings seriously:

"This device is marketed at keeping the most vulnerable safe and yet anybody can locate and listen into thousands of people’s lives without their knowledge,” said Fidus’ Andrew Mabbitt, who wrote up the team’s findings. “This day and age, everything is connected one way or another and we seem to be leaving security behind; this isn’t going to end well.”

As security researchers have been saying for several years, it's likely going to take a major attack on significant infrastructure and some significant fatalities before we wake up out of our collective stupor. In the interim DC is obsessed with whether companies like Huawei are covert Chinese spies, but largely apathetic to the fact that the internet of broken things already provides all the spying opportunities a nosy government or rogue actor would ever need.

Filed Under: computer security, internet of things, iot, security
Companies: huawei

Kid Tracking 'Smart' Watches, Like Most IOT Devices, Prove Not So Smart, Easy To Hack

from the internet-of-broken-things dept

We've long noted how the painful lack of security and privacy standards in the internet of (quite broken) things is also a problem in the world of connected toys. Like IOT vendors, toy makers were so eager to make money, they left even basic privacy and security standards stranded in the rear view mirror as they rush to connect everything to the internet. As a result, we've seen repeated instances where your kids' conversations and interests are being hoovered up without consent, with the data frequently left unencrypted and openly accessible in the cloud.

When this problem is studied, time and time again we're shown how most modern, internet-connected toys can be fairly easily hacked and weaponized. Granted since we haven't even gotten more pressing security and privacy problems tackled (like the vulnerability of our critical infrastructure), problems like Barbie's need for a better firewall tend to fall by the wayside.

Another recent case in point: A location-tracking smartwatch worn by thousands of children has proven... you guessed it... rather trivial to hack. The MiSafes Kid's Watcher Plus is a "smart watch for kids" that embeds a 2G cellular radio and GPS technology, purportedly to let concerned helicopter parents track their kids' location at all times. But security researchers at UK's Pen Test Partners have issued a report calling the devices comically unsecure. As with many IOT devices, the researchers found that the devices and systems they rely on did not encrypt any of the data being transmitted:

"I proxied the iOS app through Burp and could see that the traffic was not encrypted. Personal and sensitive information could be entered into the application such as phone numbers, passwords, as well as information relating to children. Profile pictures, names, gender, date of birth, height, and weight all transmitted across the internet in cleartext."

The researchers were quick to note that the only check the system's API appears to perform is matching the UID with the session_token, so simply changing the family_id in the get_watch_data_latest action, allows an attacker to return the watch location and device_id associated with that family. Since the watch updates the GPS coordinates to the API every five minutes, it provides a hacker near real-time insight into your kid's location. Worse, spoofing a caller ID would let said theoretical attacker covertly listen in on your kids, or contact them... while pretending to be you:

"The watch did have some protection against arbitrary people calling the child. It implemented a whitelist of authorised phone numbers that the watch would both call and receive. The problem with that is that Caller IDs can be spoofed. So as a proof-of-concept, I used crazycall.net to spoof the Caller ID to a test watch.

Using the data from the API, an attacker could get both the child’s and a parent’s phone number, and spoof a call to the watch. As shown below, the child would think that it was their Dad that was calling. Would a child do what they were asked if a call came in like this?

Yeah, that's not creepy at all.

Of course like so many IOT devices, MiSafes' child-tracking smartwatches, which have been on the market in since 2015, are made by a Chinese company that had no interest responding to inquiries by security researchers. And being sold at around £9 ($11.50) per pop, there's certainly no incentive for its makers to suddenly start dramatically improving their security and privacy standards. It's another reason why efforts to standardize the inclusion of security and privacy problems in product reviews is something we all need to get behind, since it's abundantly clear legislation and regulation alone can't really address the problem.

Filed Under: hacking, internet of things, iot, security, smart watch

Yet Another Study Shows The Internet Of Things Is A Privacy And Security Dumpster Fire

from the the-dumber-the-better dept

Day in and day out, it's becoming increasingly clear that the smart home revolution simply isn't all that smart.

Security analysts like Bruce Schneier have been sounding the alarm bells for years now about the lax to nonexistent security and privacy standards inherent in the internet of broken things space. From refrigerators that leak your Gmail credentials to Barbie dolls that can be easily hacked to spy on kids, it's increasingly clear that dumber technology is often the smarter solution. Not only do many of these devices actually make us less secure, their lack of real security has resulted in their use in historically large DDoS attacks.

Study after study shows it's a problem that's not really getting better. For example, despite a decade of reports about the lack of real security and privacy standards in smart TVs, Consumer Reports recently found that most smart TVs remain impressively open to attack and abuse. And a new study out of the UK by Which? studied 19 different smart gadgets and found a "staggering level of corporate surveillance of your home" by devices that routinely hoovered up consumer data, then funneled it out to dozens of partner companies -- often without clear consumer permission:

"Many apps ask for your exact location when they don’t actually need it for the product or service to work. Far too often, specific information is requested about you when the justification seems arguable at best. Then there’s the galaxy of other companies busily working in the background of your smart gadgets. During our testing we saw more than 20 other operators involved behind the scenes, including marketing companies. When we used a smart TV for just 15 minutes, it connected with a staggering 700 distinct addresses on the internet.

You'll recall that a few years ago, the revelation that there was now a search engine specifically built to provide easy access to poorly secured webcams resulted in all manner of consternation about the problem of default usernames and passwords and devices with paper-mache-grade security. But despite flimsy webcam security being such a hot topic for years, many vendors still haven't gotten the message:

"We’re also concerned over how companies secure your data. In a separate test together with other consumer organisations, we found a flaw in this wireless security camera’s app (provided by a company called Sricam), which meant that we could access more than 200,000 passwords and device IDs for other ieGeek cameras. We could then see live video feeds of other users, and talk to those users via the camera’s microphone (which we didn’t do). ieGeek/Sricam fixed this flaw in late March 2018, but we’ve subsequently found and disclosed other critical vulnerabilities with the camera and app."

Security analysts like Bruce Schneier have clearly illustrated why there's no incentive to fix these problems:

"The market can't fix this because neither the buyer nor the seller cares. The owners of the webcams and DVRs used in the denial-of-service attacks don't care. Their devices were cheap to buy, they still work, and they don't know any of the victims of the attacks. The sellers of those devices don't care: They're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution, because the insecurity is what economists call an externality: It's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

The reality is we're collectively more interested in making money and obsessing over the latest gadget than addressing the problem. And while there's some very good ongoing efforts to create some basic security and privacy standards in the IOT space, the prevailing attitude among IOT users and vendors alike that this is all somebody else's problem. Folks like Schneier have been warning for a while that it's likely going to take a mass casualty event (caused by hacked infrastructure) to finally motivate some changes in the internet of broken things space.

Filed Under: internet of things, privacy, security

Bad Ideas: Tesla Bars Ride Sharing Drivers From Using Its Superchargers

from the pray-we-don't-alter-it-any-further dept

Tesla remains a fascinating company. Elon Musk famously likes to do things his own way, and doesn't much care for convention. And that's often a great recipe for innovation. At times, it leads to really awesome things like giving away all the company's patents for anyone to use without licensing. But, sometimes it does some weird things that should make people think twice about buying into the Telsa vision -- even when at first pass it may make sense. For example, a few months ago, we were concerned about the "surprise" remote range extension that Tesla gave to drivers in Florida to help them evacuate before Hurricane Irma hit. On its face, this obviously seems like a good thing. Helping people evacuate a hurricane by extending their mileage is unquestionably good.

But it did raise some concerns -- about a company remotely, and without notification, updating the car you purchased from afar. Because if it can be used for "good" reasons (like giving you extra range to escape a hurricane) it might also be used at other times for bad reasons. What if, for example, Elon Musk decides he doesn't like you. Last year, Musk famously banned famed venture capitalist Stewart Alsop from buying one of Tesla's cars after Alsop publicly complained about a poorly staged event by Tesla. Could Musk "brick" someone's car for displeasing him? The backlash to that would be massive, which probably keeps such a move out of the realm of likelihood, but there are still problems with the company changing your car after purchase.

Similarly, last year there were reports that Tesla was banning people from using its self-driving car technology as part of any ride-sharing project. This seemed like an anti-competitive move, as Tesla has talked about setting up its own sort of Uber using self-driving cars that people would buy (basically, you'd "rent out" your car while you weren't using it). We thought that was a neat idea, but were troubled by the idea of contractually blocking Tesla owners from working with other vendors on such a project.

And now there's another troubling move: Tesla is telling "commercial" drivers of its vehicles (mainly ride-sharing drivers) that they can't use the company's Supercharger network to charge their cars. There are perfectly legitimate, non-nefarious reasons for this. Mainly: there are apparently problems with Superchargers being overcrowded these days, and you could see why the company doesn't want them clogged up with ride sharing drivers, effectively subsidizing their driving jobs. At the very least, the company has made it clear the policy only applies to new Tesla buyers, so it's not a bait-and-switch situation.

But, still, there's something troubling about the idea that the company can ban you from using its Superchargers based solely on the type of driving you're doing. Again, that leads to questions about what other situations may arise where Tesla bans people from using its chargers in one form or another. I'm sure that many won't think this is a big deal -- and will point out that the company needed to do something to avoid congestion. But we should be concerned about how this is subtly changing our relationship to the products we (thought we) own, and the control that companies have over our usage, post-purchase.

I don't think Tesla is doing anything nefarious here, and there are plenty of seemingly good reasons for why the company chose this path. But we should be quite careful and thoughtful about how we move into a world where the company that sells you something retains an astounding amount of control over how and even if you are allowed use it, based on how much it likes or dislikes you or your profession. Because sooner or later, these issues are going to get bigger and more problematic -- and it might help if we really thought about them now, before things get messy.

Filed Under: cars, elon musk, internet of things, ownership, ride sharing, superchargers
Companies: tesla

Welcome To The Technological Incarceration Project, Where Prison Walls Are Replaced By Sensors, Algorithms, And AI

from the shocking-new-approach dept

At heart, a prison is a place where freedom is taken away, and inmates are constrained in what they can do. Does that mean a prison has to consist of a special building with bars and prison guards? How about turning the home of a convicted criminal into a kind of virtual prison, where they are limited in their actions? That's what Dan Hunter, dean of Swinburne University's Law School in Melbourne, suggests, reported here by Australian Broadcast News:

Called the Technological Incarceration Project, the idea is to make not so much an internet of things as an internet of incarceration.

Professor Hunter's team is researching an advanced form of home detention, using artificial intelligence, machine-learning algorithms and lightweight electronic sensors to monitor convicted offenders on a 24-hour basis.

The idea is to go beyond today's electronic tagging systems, which provide a relatively crude and sometimes circumventable form of surveillance, to one that is pervasive, intelligent -- and shockingly painful:

Under his team's proposal, offenders would be fitted with an electronic bracelet or anklet capable of delivering an incapacitating shock if an algorithm detects that a new crime or violation is about to be committed.

That assessment would be made by a combination of biometric factors, such as voice recognition and facial analysis.

Leaving aside the obvious and important issue of how reliable the algorithms would be in judging when a violation was about to take place, there are a couple of other aspects of this approach worth noting. One is that it shifts the costs of incarceration from the state to the offender, who ends up paying for his or her upkeep in the virtual prison. That would obviously appeal to those who are concerned about the mounting cost to taxpayers of running expensive prisons. The virtual prison would also allow offenders to remain with their family, and thus offers the hope that they might be re-integrated into society more easily than when isolated in an unnatural prison setting. Irrespective of any possible financial benefits, that has to be a good reason to explore the option further.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: internet of things, prison

'Smart' Lock Vendor Locks Hundreds Out Of Their Home With Bungled Firmware Update

from the sorry-I-can't-do-that,-Dave dept

So we've talked repeatedly about how the real "smart" choice in the era of "smart" internet of things devices is often -- dumber technology. Whether it's your smart refrigerator or TV leaking your gmail details or viewing data over unencrypted connections, your smart car opening the door to potentially fatal attack, or your smart doorbell creating new attack vectors into your WiFi network, more often than not you're quite frankly better off with the older, less sophisticated versions of these technologies if you want the smart path toward a more secure life.

The latest case in point: smart door lock vendor Lockstate managed to completely disable the smart door locks of an estimated 500 customers after a botched firmware update left customers unable to access their own properties:

A subset of smart locks made by Lockstate have been bricked after an update. The smart lock vendor is part of Airbnb’s Host Assist program, and integrates with the accommodation rental platform so, for instance, hosts can automatically generate and email one-time codes for their guests to use during check-in....Two models of Lockstate smart lock are apparently affected, one of which currently retails for $469.

Airbnb offers property owners a $50 discount code if they use Lockstate products as part of the Host Assist program — where said products are heralded as “revolutionary” and capable of withstanding “high usage”. Because the botched update made it impossible for these locks to subsequently connect to the internet for a new fix, the vendor is informing owners that their only recourse is to wait anywhere from a week to eighteen days for a physical replacement, inundating them with neither smart nor revolutionary added costs:

In the mass mailer email, which begins “Dear Lockstate customer” and summarizes its contents as an “update” pertaining to LockState 6i/6000i, affected customers are asked to wait as long as 18 days for a full replacement. Or up to a week if they choose to remove and send the back portion of the lock to the company for repair.

Feel smarter yet? Of course this isn't the first problem of this type. Internet of things brand darling Nest has, at several different points, botched their own firmware updates for supposedly smart thermostats, resulting in users either being cooked or chilled until they were able to remedy the problem. This is the kind of stuff internet of things evangelists still don't spend much time talking about when they're busy hyping and pitching the latest and greatest internet-connected widgets, built by a rotating crop of companies with a fleeting interest in actual security, functionality and privacy.

Granted bungled firmware updates are only one risk. A recent report took a look at sixteen different brands of Bluetooth-enabled smart locks, and found that at least twelve of the brands were notably susceptible to remote attacks. The flaws are fairly standard at this point, ranging from user data and passwords being transmitted in plain text, or a bungled use of encryption to transmit user data when encryption was used at all. Short version of the lesson: if you're trying to build a smart home either do your homework and consult a hacker to find the best quality devices available, or save both time and money and revert to the best available dumb alternative.

Filed Under: internet of things, iot, smart lock
Companies: airbnb, lockstate

Hackers Set Off Dallas' 156 Warning Sirens Dozens Of Times

from the not-everything-should-be-connected-to-the-internet dept

So we've talked repeatedly how the shoddy security in most "internet of things" devices has resulted in increasingly-vulnerable home networks, as consumers rush to connect not-so-smart fridges, TVs and tea kettles to the home network. But this failure extends well beyond the home, since these devices have also resulted in historically-large DDoS attacks as this hardware is compromised and integrated into existing botnets (often in just a matter of minutes after being connected to the internet).

Whether it's the ease in which a decidedly-clumsy ransomware attacker was able to shut down San Francisco's mass transit system, or the fact that many city-connected devices like speed cameras often feature paper mache security, you can start to see why some security experts are worried that there's a dumpster fire brewing that will, sooner rather than later, result in core infrastructure being compromised and, potentially, mass fatalities. If you ask security experts like Bruce Schneier, this isn't a matter of if -- it's a matter of when.

In what should probably be seen as yet another warning shot across the bow: slightly before midnight in Dallas last Friday a hacker compromised the city's emergency warning systems and managed to set off the city's 156 warning sirens more than a dozen times. Needlessly to say, the scale of of the warning, and the number of sirens, led many people in Dallas to believe that the city had somehow been physically attacked in the middle of the night:

Dallas officials were forced to shut the system down around 1:20 am on Saturday, and despite informing the public to ignore the false alarms, a city that had already been having 911 issues the last few months found its 911 systems inundated with a massive influx of calls from concerned citizens:

"Even as the city asked residents not to dial 911 to ask about the sirens, more than 4,400 calls were received from 11:30 p.m. to 3 a.m. — twice the average number made between 11 p.m. and 7 a.m., Syed said. The largest surge came from midnight to 12:15 as about 800 incoming calls caused wait times to jump to six minutes, far above the city's goal to answer 90 percent of calls within 10 seconds.

The city is, frankly, fortunate that this didn't result in more problems than it did. City officials say they've identified how the attacker compromised the system, but won't be revealing technical details for obvious reasons (Update: it looks like the attacker used a radio signal attack on city gear to repeatedly set off the sirens). Over at his Facebook page, Dallas Mayor Mike Rawlings was quick to highlight how the attack made it clear the city needs to spend significantly more money on its technology infrastructure:

"This is yet another serious example of the need for us to upgrade and better safeguard our city’s technology infrastructure. It’s a costly proposition, which is why every dollar of taxpayer money must be spent with critical needs such as this in mind. Making the necessary improvements is imperative for the safety of our citizens."

Of course while older, out-dated systems are certainly a problem, rushing to throw money at companies promising the "connected city of tomorrow in a box" isn't a panacea, either. While it likely had nothing to do with the recent hack, AT&T has been advertising Dallas as the centerpiece of its "IOT" ambitions for the last few years, just one of countless companies rushing into the space in pursuit of new revenue and quarterly growth. The problem, again, is that many of these smart city solutions are from many of the same vendors for which security and privacy were an afterthought in the residential market.

So yes, most cities are in desperate need of a technology and security upgrade, yet often lack the budgets to do so. You just hope that when these upgrades actually occur, they aren't sabotaged by the same superficial concern for privacy and security already plaguing the connected home market.

Filed Under: dallas, hacked, internet of things, iot, warning sirens