Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Privacy The Internet

Stanford Starts the 'Secure Internet of Things Project' 77

Posted by Soulskill from the let's-call-it-"thing-neutrality" dept.
An anonymous reader writes: The internet-of-things is here to stay. Lots of people now have smart lights, smart thermostats, smart appliances, smart fire detectors, and other internet-connect gadgets installed in their houses. The security of those devices has been an obvious and predictable problem since day one. Manufacturers can't be bothered to provide updates to $500 smartphones more than a couple years after they're released; how long do you think they'll be worried about security updates for a $50 thermostat? Security researchers have been vocal about this, and they've found lots of vulnerabilities and exploits before hackers have had a chance to. But the manufacturers have responded in the wrong way.

Instead of developing a more robust approach to device security, they've simply thrown encryption at everything. This makes it temporarily harder for malicious hackers to have their way with the devices, but also shuts out consumers and white-hat researchers from knowing what the devices are doing. Stanford, Berkeley, and the University of Michigan have now started the Secure Internet of Things Project, which aims to promote security and transparency for IoT devices. They hope to unite regulators, researchers, and manufacturers to ensure nascent internet-connected tech is developed in a way that respects customer privacy and choice.
This discussion has been archived. No new comments can be posted.

Stanford Starts the 'Secure Internet of Things Project' More

Stanford Starts the 'Secure Internet of Things Project'

Comments Filter:

  • Dumb as a Rock (Score:5, Funny)

    by pubwvj ( 1045960 ) on Tuesday June 30, 2015 @04:25PM (#50021809)

    I prefer a Dumb Home. Our home is built of stone. It has no brains. It is solid state. It stores incoming solar and wood fired heat and then releases it slowly. It never freezes despite our very cold northern mountain winters. It's too much thermal mass to freeze. Dumb wins. The doors are manual. The windows are manual. The security system is operated by a pack of local wolves - they eat predators. We have no thieves.

  • Think business, not technology (Score:5, Insightful)

    by captaindomon ( 870655 ) on Tuesday June 30, 2015 @04:28PM (#50021829)
    Companies that make these devices are driven by business interests, not technology concerns. Which is what their shareholders expect and require. So the question isn't "Can someone hack this?" the question is "Given 0.001% of these get hacked, and our recourse is to return the $50 in a refund which is our highest liability exposure due to terms & conditions, that equates to five cents cost per unit. So if we are selling 10 million of these per year, we should not spend more than $500,000 on security engineering. That pays the full run rate for two full-time engineers. Hire them and see what they can do". We sometimes forget the economics side of things in technology arguments...

    • Then somebody hacks into a thermostat, uses it to burn somebody's house down for luls. The couple whose house was burned down tries to sue, loses due to the contract that says their only recourse is a refund of the 50$ even though WTF, it makes all the news everywhere, and the device is forever known as "that device that burned some guy's house down and they gave him a whopping 50 bucks". They're now out 50 bucks in direct cost, and a jillion dollars in lost sales.

      We sometimes forget the economics side of things, but companies *often* forget the social side of things (i.e. if you treat people like crap, they'll tell their friends, who will tell their friends, and eventually you'll be "that company that treats people like crap". Unless, of course, you're a monopoly, or if all your competition is equally terrible, in which case do what you like.)

      • Re: (Score:2)

        by AmiMoJo ( 196126 )

        As a real engineer let me explain how it works. Both of you are a bit off.

        Even if you hire security engineers, they will be overridden by the need to add marketable features and reduce support costs. If it's too hard to set up, if it can't do what the competitor's product can do, security is irrelevant and will be at best an afterthought.

        In practice, they won't hire security engineers with that $500k, some manager will spend $5k on PR making them out to be the victims if they are hacked, and the rest will b

      • Then somebody hacks into a thermostat, uses it to burn somebody's house down for luls.

        How do you propose it will even do this? The thermostat just asks the heater for heat, the heater typically has an overheat switch and will shut itself off if somehow it approaches starting a fire.

  • How about IoT devices use a LAN? (Score:3)

    by mlts ( 1038732 ) on Tuesday June 30, 2015 @04:32PM (#50021853)

    TFA was "meh" at best, but why not design a secure architecture where the $50 device communicates to some type of secure hub (or hubs if one wants redundancy), and the hub is what communicates on the Internet. This way, only one device has to be hardened against attack via the Net. Yes, it doesn't stop attacks done at the LAN level... but any security is better than none, and it would help lock out all intruders except those close by in physical proximity.

    This can be done a number of ways, by the central hub being a Wi-Fi AP, or just part of a BT PAN pairing.

    To boot, if devices need to communicate with a remote site, there are many ways to communicate via secured link.

    A hub topology is the proper way to do IoT. Letting every device go out via 3G or whatnot is only asking for compromise.

    Realistically, if the device is "smart", it should just get passed up. If we don't pass up on these devices, we will be seeing fridges demands one sit through a 30 second ad before it unlocks the door, or the oven to allowing Slurm brand turkeys to be baked in it.

    • Re: (Score:2)

      by kesuki ( 321456 )

      would you kill me if i told you every single password to every single account of every single computing account? on every platform ever imagined, with up to 2048 bit password legths in an automatically compressed (only used space of passwords not 2048 bit for every single password) format in rot 13 encryption?

      • Re: (Score:2)

        by kesuki ( 321456 )

        note: i'm not claiming i can do this, i only have 25 GB blurays to store it on so it probably cuts off. but really i mean why the hell do we need 100 years of chat logs for every single marine made in any starcraft game ever played.

        • Re: (Score:2)

          by kesuki ( 321456 )

          and why do they all have houses families kids and favorite movies and favorite books, and high paying jobs in wet lush paradise cities where they only fade away when the hard drive fill up.

    • The link didn't take me directly to the video and the transcript didn't turn up. I'm on mobile if that's why it didn't work right. Any help?

  • Here's my way... (Score:1)

    by Anonymous Coward

    How to secure 'Internet of Things' things: Firewall them oRf from having access to the Internet.

  • There is no IoT (Score:3)

    by AK Marc ( 707885 ) on Tuesday June 30, 2015 @04:46PM (#50021919)
    Everyone I've seen selling IoT things have been selling "non-Internet connected network of things that we call IoT because that sounds cooler". The IoT is when the devices are connected to the Internet. Not when they are connected to a proprietary private network owned, controlled and managed by a single company, and "Internet" access is through a paywalled proxy. My home power meter is "IoT" and there is no way to access it from the Internet, directly or indirectly. Though the reports the power company pulls through their closed and private network are shared time-delayed in emails and paper reports sent out.

    Similar are the mobile-phone network IoT car-based devices, a number of which will "IoT" when back at base, through secure WiFi to a private server, with no data in the loop *ever* traveling over the Internet (unless the customer buying the solution goes out of their way to send things over a WAN, that's still not Internet connectivity, just using the Internet for a private WAN).

    The level of control around IoT at the moment prevents any IoT from working over the Internet. The IoT is when every device in your house is connected (probably IPv6, with a /56 for your personal items), and you can reach your own stuff from anywhere. When the "lock your door remotely" is app-based and locked into your Samsung phone, and Samsung home server, and lock from a short approved list that pays Samsung (sorry, the last IoT home demo I saw was one of Samsungs), that's not IoT, that's a Samsung home automation solution.

  • IoT is unsecurable (Score:3)

    by sinij ( 911942 ) on Tuesday June 30, 2015 @04:48PM (#50021931)
    You can't secure IoT, there is not enough value in each individual device to implement robust security. To make things worse - consumers don't understand security and don't put any pressure on demand side. The only way I can see the whole mess could be secured is with establishing secure perimeters and access control border devices.

    For example, your house has ACME smart thermostat, ACME smart fridge, and ACME remote baby monitor device all connected to the Internet. Since ACME is competing/pressured based on price-point to keep their ShopMart contracts going, they have not spent any time securing their devices. It is 2025 and they are still stuck using badly-broken TLS 1.4! Fortunately for the consumer, home routers market stepped up and developed sophisticated access controls, reputation services, pattern-based communication analysis, and anomaly detection techniques. This way when a script kiddie attempts to exploit your thermostat, the router detects attempt and blocks the access to the IoT device.

    • Re: (Score:2)

      by mlts ( 1038732 )

      Some IoT devices will wind up with their own cellular antenna. This will wind up being used as a nice entry point for attackers who will be able to jump through the device to a private network, or just use it for distributed Dogecoin mining.

    • Don't forget, ACME smart appliances all require you to agree to letting ACME access your address book, location, browsing history and other personal information. But their website says "We take your privacy seriously".

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      You can create a secure base OS that runs on low cost ARM, for example, and then have a limited, sandboxed application layer. Think browser plugins - they can do a lot, have network access etc. but are executed on a virtual machine (Javascript) and with heavy sandboxing, with masses of security protections in place.

      The problem with emebedded system is that you often can't remotely update the OS, or if you can manufacturer's won't bother. You can limit the damage from exploits to things like information leak

  • Comment removed based on user account deletion

  • I'll be interested in the Internet of Things as soon as I can get an IPv6 address for my balls.

    • I'll be interested in the Internet of Things as soon as I can get an IPv6 address for my balls.

      Then rejoice! Hurricane Electric [tunnelbroker.net] will give you your own /48 for free. Just set up a box to accept and route it and you can assign an IP to every single sperm in your beloved balls.

      • Then rejoice! Hurricane Electric [tunnelbroker.net] will give you your own /48 for free. Just set up a box to accept and route it and you can assign an IP to every single sperm in your beloved balls.

        Do they also make a router that looks like Scarlett Johansson? I may find this "internet of things" acceptable after all.

  • This actually sounds like a good thing--namely a Secure Internet of Things. But I think that might be a large undertaking. Perhaps they should start smaller with an Internet of Secure Things.

  • The internet-of-things is here to stay. (Score:4, Interesting)

    by Alomex ( 148003 ) on Tuesday June 30, 2015 @06:42PM (#50022469) Homepage

    The internet-of-things is here to stay.

    To the contrary, in my experience most things that have a catchy name before they are implemented go nowhere. Multicasting, Named Data Networking, Internet of Things, OLP, Web Ontology, Neural Networks, etc. The project is more focused in sounding trending than in finding reasons why things want to access the internet (presumably so that your toaster can watch youtube videos while you are away?)

    Successful projects usually start from the other end. People first create a small iteration of the thing that proves the concept, it starts to catch up (fancy name might be created here but this is entirely optional) and one day you turn around and its taken over the world.

    • The internet-of-things is here to stay.

      To the contrary, in my experience most things that have a catchy name before they are implemented go nowhere. Multicasting, Named Data Networking, Internet of Things, OLP, Web Ontology, Neural Networks, etc. The project is more focused in sounding trending than in finding reasons why things want to access the internet (presumably so that your toaster can watch youtube videos while you are away?)

      Successful projects usually start from the other end. People first create a small iteration of the thing that proves the concept, it starts to catch up (fancy name might be created here but this is entirely optional) and one day you turn around and its taken over the world.

      On the other hand, if IoT does take off, then about 3 to 5 years after that I'm going to start a new company and sell products with the exciting label of "Not Internet Connected!", and I'll make billions.

  • Color ma a skeptic, but... (Score:4, Interesting)

    by WalrusSlayer ( 883300 ) on Tuesday June 30, 2015 @07:27PM (#50022695)

    ...from my experience with embedded engineers, the past cluster-f*cks implemented by that category of engineer (think SCADA), and the more-of-the-same coming down the pike (think "we'll just invent our own security rather than using proven solutions"), it's doomed from the start. These are guys that optimize down to the last 1/8 of a bit of RAM, the last 10Hz of processing speed, the last milliwatt of power. Given that mindset, they don't have a clue that security is a top line concern for anything that communicates with the outside world. The necessary solutions are just way outside their sense of scale.

    There is also this intrinsic mistrust of anybody else's code, which is polar opposite to the instincts required to do proper security. Of course, if you see the crap code they get force-fed from the chip vendors, and anything else that has to run in 16K of code space, it's not hard to see where the bunker mentality comes from.

    But I've peeked into that world, and I don't see it changing. That's going to be a Very Bad Thing(tm).

  • Comcast has those creepy surveillance sysems where Mom at work can breathe a sigh of relief when she spys on her children when they get home from school. What is Comcast and mom's liability when say, one of her underage daughters decides to prance around the house naked?

    I had a friend back in Junior high who used to do just that - it's not uncommon. So is Mom and Comcast now disseminating kiddie pr0n?

    Fun History fact. Winston Churchill used to run around the house naked.

  • The safest strategy (Score:4, Interesting)

    by argStyopa ( 232550 ) on Tuesday June 30, 2015 @08:33PM (#50022973) Journal

    The safest strategy for connecting everything in your home to the internet is....don't.

    Why the fuck do you need to connect your front door lock, your coffeemaker, and your refrigerator to the internet?
    Forget to lock your door? GO BACK AND LOCK IT. People have been doing it for 1000 years and the world continues to spin.
    Don't want to get up in the morning to turn on your coffeemaker? Either a) get up and stop being a pussy or b) get one of the umpteen programmable ones, or c) just plug your damn coffeemaker into a christmas-light timer set to power up before you wake up.
    Want your refrigerator to tell you when you're almost out of milk or better still, to automagically order restocks of food? LOOK INSIDE IT. Decide what you need to buy. THEN GO TO THE STORE. You'll meet actual humans there, and interact with them. I suspect there's more actual human value to that than to the supposed minutes you'll save (so you can what, play more video games? Do some more work emails?) not doing those things.

  • Alternate realities (Score:3)

    by WaffleMonster ( 969671 ) on Wednesday July 01, 2015 @04:22AM (#50024223)

    Internet connected toasters was supposed to be a joke highlighting the futility of perusing technological solutions to problems that don't exist.

    Now we have assistant professors at Stanford acting like politicians who quote the Onion to defend their policy positions.

  • Secure Internet of Things is going to be like Safe Drunk Driving.

Slashdot Top Deals

"Free markets select for winning solutions." -- Eric S. Raymond

Close