http://www.nbcnews.com/tech/security/kaspersky-smart-fridges...
In just a few years we may be dealing with tens of Tbps DDoS attacks thanks to the "explosion of IoT", unless IoT manufacturers get their shit together (perhaps also encouraged by aggressive government actions and fines against those who don't follow some set best practices on security).
I agree device security ought to be better, but the free market can solve that. If a particular brand of toaster is constantly being hacked, the market would respond. I wouldn't expect an ice maker manufacturer to be held liable for poisoned water supplies.
It's a tough issue, but 'more government' isn't the answer. The government can barely keep their own data safe let alone be trusted to enforce how others ought to keep their's safe.
The FDA is supposed to keep medicines safe yet it has become a monster that adds billions to the costs of drug development. I am not saying to ditch the FDA, but I would be fearful of releasing a new IOT device required FDA-level approval. Your connected toaster would cost $9000.
If a particular brand of toaster is constantly being hacked, the market would respond
If my toaster is hacked and starts getting used in a DDOS botnet - but still makes toast as expected - would I even know?
The way to ensure market forces influence this is to ensure that the market is negatively affected: whether that's their ISP disconnecting their internet, their device stopping working, etc.
How is the toaster connected to the Internet? If through wireless, a DDOS could easily use too much airtime, making every other wireless device in the same channel slower.
You wouldn't notice the toaster misbehaving, but you would notice everything else not working as well.
you would notice everything else not working as well
Let's assume a little bit of packet-sniffing would uncover the cause, that's still only a very small minority of people with the skills and tools to go through that process.
>encouraged by aggressive government actions and fines...
Funny, I just replied to another comment that it seems near hopeless to expect this of manufacturers.
Seems that ISPs, on the other hand, might be able to play a more pivotal role.
ISPs have thin margins, and get paid to push bits. DDoS mitigation services are extremely expensive not because they are complex or novel but because they require significant resources (both in hardware and in software expertise).
If manufacturers are going to sling "shit" and we can't hold them accountable; consumers are going to buy the polished turds and we can't prevent them plugging it into their networks; and ISPs have little to zero incentive or ability to "filter out the bad traffic" then we're basically looking at a 5-10 year span of increasingly detrimental, expensive, and effective denial of service attacks.
Default free providers such at NTT, GTT, Zayo/AboveNet, Level3/Global Crossing, ATT, CenturyLink/Qwest, Deutsche Telekom, Vodafone/Cable & Wireless, and others commonly (but incorrectly) known as Tier 1/"backbone" providers peer with other networks in a settlement free (no money is exchanged, or, on an accounting basis, everything zeros out) fashion because they are "peers" in the strictest sense: same size, same reach, same markets (mostly...)
there is no danger for them in passing bits
Well, maybe there is a silver lining to Comcast and friends' data caps after all.