Princeton Project Aims To Secure The Internet Of Broken, Shitty Things

from the Barbie-needs-a-better-firewall dept

Year after year, we're installing millions upon millions of "internet of things" devices on home and business networks that have only a fleeting regard for security or privacy. The width and depth of manufacturer incompetence on display can't be understated. Thermostats that prevent you from actually heating your home. Smart door locks that make you less secure. Refrigerators that leak Gmail credentials. Children's toys that listen to your kids' prattle, then (poorly) secure said prattle in the cloud. Cars that could, potentially, result in your death.

The list goes on and on, and it grows exponentially by the week, especially as such devices are quickly compromised and integrated into massive new botnets. And as several security experts have noted, nobody in this chain of dysfunction has the slightest interest in doing much about this massive rise in "invisible pollution":

"The market can't fix this because neither the buyer nor the seller cares. Think of all the CCTV cameras and DVRs used in the attack against Brian Krebs. The owners of those devices don't care. Their devices were cheap to buy, they still work, and they don't even know Brian. The sellers of those devices don't care: they're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution because the insecurity is what economists call an externality: it's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

One core part of the problem is that IOT device makers refuse to provide much control or transparency over what their internet-connected devices actually do once online. Often the tools and device interfaces provided to the end user are comically simple, providing you with virtually no data on how much bandwidth your devices are consuming, or what data they're transferring back to the cloud (frequently unencrypted). As a result, many normal people are participating in historically massive DDOS attacks or having their every behavior monitored without having the slightest idea it's actually occurring.

To that end Princeton's computer science department has launched a research program called the IOT Inspector they hope will provide users with a little more insight into what IOT devices are actually up to. The researchers behind the project say they spent some time analyzing fifty different common IOT devices, and like previous studies found that security and privacy in these devices was a total shitshow. Sending private user data unencrypted back to the cloud was common:

Unfortunately, many of the devices we have examined lack even these basic security or privacy features. For example, the Withings Smart Blood Pressure Monitor included the brand of the device and the string “blood pressure” in unencrypted HTTP GET request headers. This allows a network eavesdropper to (1) learn that someone in a household owns a blood pressure monitor and (2) determine how frequently the monitor is used based on the frequency of requests. It would be simple to hide this information with SSL."

As were devices that immediately began chatting with all manner of partner services whether the user wants them to or not:

Samsung Smart TV: During the first minute after power-on, the TV talks to Google Play, Double Click, Netflix, FandangoNOW, Spotify, CBS, MSNBC, NFL, Deezer, and Facebook—even though we did not sign in or create accounts with any of them.

Again, user control and transparency is almost always an afterthought. Obviously, the creation of some unified standards is one solution. As is creating routers and hardware that alert users to when their devices have been compromised. Smarter networks and hardware are going to need to be a cornerstone of any proposed solution, the researchers note:

We are experimenting with machine learning-based DDoS detection using features using IoT-specific network behaviors (e.g., limited number of endpoints and regular time intervals between packets). Preliminary results indicate that home gateway routers or other network middleboxes could automatically detect local IoT device sources of DDoS attacks with high accuracy using low-cost machine learning algorithms.

Of course better standards are going to need to be built on the backs of a joint collaboration between governments, companies, consumers and researchers. And while we've seen mixed results on that front so far, efforts like this (and the Consumer Reports' open source attempt to make privacy and security an integral part of product reviews) are definitely a step in the right direction.

Filed Under: iot, princeton, security
Companies: princeton

A Broken System: Einstein Wouldn't Have Been 'Qualified' To Teach High School Physics

from the time-to-fix-things dept

We've argued for years that many professions that require certain forms of "licensing" are often more about restricting supply. That's not to say those who set up the licensing effort didn't have the best of intentions, but the end effect often doesn't actually do much to benefit the public. I'm reminded of this after reading economist Charles Wheelen explaining why Albert Einstein technically wouldn't have been "qualified" to teach high school physics after retiring from a distinguished career at Princeton. And, for Wheelen, it's not just hypothetical:

When my wife tried to make a mid-career switch to teaching math in the Chicago Public Schools, I no longer needed a hypothetical example. I realized that licensing had the potential to be every bit as harmful in practice as I'd been saying it was in theory.

My wife Leah graduated Phi Beta Kappa from Dartmouth. She was a computer science major with an emphasis on math. She worked in the software industry, built a company, and then sold it. She seemed, in every respect, perfectly qualified to teach middle-school math.

She found a job at a school adjacent to a public housing project on Chicago's South Side. On about day three of that job—after she had met the students, decorated the classroom, and started teaching—the principal informed Leah that she did not have a "middle-school math endorsement," which the State of Illinois requires.

Amazingly, this happened a second time as well. She did get the "math endorsement," but then lost a job teaching algebra because she didn't have a special "algebra endorsement." And yet, she's clearly qualified to teach those subjects. And, even more importantly, Wheelen points to research showing that students with "certified" teachers don't do any better than those with "uncertified" teachers -- suggesting the whole process has little to do with making sure students get the best education.

Filed Under: chicago, education, einstein, licensing, physics, princeton

Princeton Tells Its Academics Not to Hand Over Copyright When Publishing In Scholarly Journals

from the we-paid-for-it dept

Open access (OA) starts from the premise that the results of academic research conducted with public funds should be freely available to the public. In practice that means that scholarly articles arising from such research are made accessible online in some way – nobody expects physical journals to be given away for free.

Open access comes in two main forms:

"Green OA" is provided by authors publishing in any journal and then self-archiving their postprints in their institutional repository or on some other OA website. Green OA journal publishers endorse immediate OA self-archiving by their authors.

"Gold OA" is provided by authors publishing in an open access journal that provides immediate OA to all of its articles on the publisher's website.

Since it is hard for the publishers of academic papers to argue with the idea that the public has a right to access research it has paid for, the key issue has been the control of the copyright. Even when preprints or postprints can be posted online by authors, publishing houses often demand that copyright of the final article be assigned exclusively to them.

Against that background, this is significant move:

Prestigious US academic institution Princeton University will prevent researchers from giving the copyright of scholarly articles to journal publishers, except in certain cases where a waiver may be granted.

The new rule is part of an Open Access policy aimed at broadening the reach of their scholarly work and encouraging publishers to adjust standard contracts that commonly require exclusive copyright as a condition of publication.

Universities pay millions of dollars a year for academic journal subscriptions. People without subscriptions, which can cost up to $25,000 a year for some journals or hundreds of dollars for a single issue, are often prevented from reading taxpayer funded research. Individual articles are also commonly locked behind pay walls.

This essentially gives back to researchers control over the articles they have written – something they have lost in the past few decades. It by no means prevents publishers from accepting such articles for their paid-for journals, but it does make it easier for the final version of the papers to be made freely available without restrictions, something that Princeton specifically wants to see become more common:

Academics will also be encouraged to place their work in open access data stores such as Arxiv or campus-run data repositories.

Princeton is just the latest in a line of top US universities mandating open access:

Princeton will be the sixth Ivy League school to adopt an open-access scholarship policy, joining Harvard, Columbia, the University of Pennsylvania, Cornell and Dartmouth. Other institutions with developed open-access policies include MIT, Duke, University of California, Berkeley and the University of Michigan.

Similar moves in Europe and elsewhere have led to the situation where open access is no longer on the fringes of academic publishing:

DOAJ [Directory of Open Access Journals] is now over 7,000 journals, and still adding more than 4 titles per day. The Electronic Journals Library now lists more than 30,000 titles that are freely available. OpenDOAR [Directory of Open Access Repositories] now lists more than 2,000 repositories, and the BASE search engine searches more than 31 million documents in repositories. ROARMAP now lists a total of 300 open access mandate policies.

Princeton's high-profile move may well be a tipping point for others, and lead to scholars retaining copyright over their work as a matter of course.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: copyright, journals, open access, princeton, publishing

Princeton Demands Website Remove Elena Kagan's Thesis; Claiming Copyright Infringement

from the fair-use? dept

Obviously, there's been lots of talk about Supreme Court nominee Elena Kagan in numerous areas. There have been various reports concerning Kagan's supposed views on copyright, but those seem pretty blown out of proportion from what I've seen and in talking to folks who know Kagan. She was a big supporter of the Berkman Center at Harvard, but that was part of her job. Other than her recommendation in the Cablevision case, there doesn't seem to be much to go on. In fact, I'm considerably more concerned with the idea that one of the leading contenders for Kagan's current job of Solicitor General is one of the entertainment industry's favorite legal attack dogs who led the industry's case in Grokster and was a major player in the Jammie Thomas trial before being appointed to the Justice Department (where he didn't last very long before moving over to the White House as associate White House counsel). Still, if Kagan really is a big supporter of fair use, you have to wonder what she thinks of the following situation.

With everyone digging deeper and deeper to find out more about Kagan, the website Red State apparently dug up her undergraduate thesis and posted it to their website... leading Princeton to demand that the thesis be taken down -- not, of course, for political reasons, but copyright ones. The University is selling copies of her thesis, and apparently the commercial value just shot up:

It has been brought to my attention that you have posted Elena Kagan's senior thesis online.... Copies provided by the Princeton University Archives are governed by U.S. Copyright Law and are for private individual use only. Any electronic distribution is prohibited, as noted on the first page of the copy that is on your website. Therefore I request that you remove it immediately before further action is taken.

Of course, ordering that the document be pulled down pretty much guarantees that it will get spread more widely -- and there's definitely a journalistic reporting defense for posting the document (though, I'm not particularly convinced that anything anyone wrote in college has much meaning once they've spent a few decades outside of college). And, of course, in trying to get the document taken down, it's just going to lead conspiracy-minded folks to think there's more to the document than there is (in actuality, it's a rather bland historical analysis, but you wouldn't know that from what some sites are claiming about it). But from a journalistic standpoint, it seems you could make a decent argument for fair use in distributing the document. In fact, publications like Newsweek are already sharing parts of the thesis as well (mostly to debunk the hysteria around it). It's difficult to see what Princeton gained in issuing the takedown notice, other than to rile up people.

Filed Under: copyright, elena kagan, princeton, thesis

Kindle Flunking Out Of Princeton?

from the bad-grades dept

theodp writes "At Jeff Bezos' alma mater, The Daily Princetonian reports that less than two weeks after 50 students received free Kindle DX's as part of the University's e-reader pilot program, many of them said they were dissatisfied and uncomfortable with the devices. 'I hate to sound like a Luddite, but this technology is a poor excuse of an academic tool,' said Aaron Horvath '10, a student in Civil Society and Public Policy. 'It's clunky, slow and a real pain to operate.' How about a second opinion? The device is 'hard to use,' added Horvath's professor, Stan Katz."

I have to admit that I don't quite understand the value of the Kindle DX as a reading device for schools or... anything, really. In the meantime, why are schools using closed off DRM-encrusted devices for training students anyway?

Filed Under: education, kindle, princeton

How Could Anyone Possibly Mess With With E-Voting Machines... When They're Left Unguarded For Days?

from the oh,-that's-right,-it's-easy dept

One of the common complaints from the e-voting companies about the various independent security tests that find problems with their machines, is that those test occur under conditions that would never happen in the real world. Specifically, the e-voting companies like to claim that most of the "hacks" revealed would require a lot of access to the machines with no one noticing -- and that just wouldn't be feasible during an election with election officials all around. While even that might be questioned, a much bigger issue is that most polling places leave the e-voting machines totally unguarded and totally unprotected, sometimes for days before the election -- giving anyone with nefarious intent plenty of time to mess around with the machines.

Ed Felten has been pointing this out for years. He took photos of such machines at Princeton in 2006 and then again at the primary election earlier this year. This past Tuesday was another election day in many places, including New Jersey, and Ed Felten, once again, took photos of a whole bunch of totally unguarded e-voting machines that any passerby could have accessed. Of course, given that the software itself doesn't seem to work maybe someone will actually adjust the machines to make them work better. Always look on the bright side.

Filed Under: e-voting, ed felten, princeton, security