How to force manufacturers to take IoT security seriously?
securitybytes.io
securitybytes.io
Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware with something that flashes some red text reading "contact manufacturer for replacement", and simultaneously closing the security hole in of which they came in the first place.
This would be a sort of middle ground, giving consumers a minor annoyance rather than a bricked device, but still leveling the playing field between white hats and black hats.
Perhaps adding a $1 bounty per device for the white hats, paid by the device manufacturer. Then the manufacturer would be forced to purchase insurance, who would want to look at the security of the software before giving a offer on the policy.
Unfortunately, insurance is all about risk management. In layman's terms: why bother worrying about security when you can just buy insurance for it. Then they'll pick up the tab for any problems, right?
Insurers want to make sure that a building meets the code before offering insurance on it. If a building collapses or burns down and it is later shown that it was not built to code, the insurance policy will be void.
I imagine similar incentives would hold for IoT security. The insurance would be contingent on the manufacturer following all available best practices to show that they did all they could to make the device secure.
[1] http://www.nfpa.org/about-nfpa/nfpa-overview/history-of-nfpa
So for large scale key area's you will find that insurance/reinsurance companies have more than actuaries giving values to a risk. It is in their interest after all, more so when large sums of money are equally at risk of theirs.
AS for driving standards, yes, it happens. Though in some cases it happens after the horse has bolted.
For example in the UK ALL insurance has a premium added to it to cover people who have high-risk properties subject to flooding and with many houses built upon flood planes in the 80's with low regard to risk of flooding than they should, then it is a sticky plaster solution that fixes a legacy issue that we all end up paying for. That is the concern with IoT and I do fear that a solution that see's everybody paying the premium to cover the issues of the past, will transpire either directly or indirectly.
It's not going to be affordable to cheapo-Chinese manufacturers, so they won't bother. Their products will remain cheap and people who don't know (or don't care) will keep buying it.
If you want to make insurance "work" you need a system similar to roads, with every device registered and insured to connect.
Now we have insurance companies deciding what we're allowed to run. I don't like this future.
I think something comparable to this is going to be necessary. There's simply not enough pressure to fix devices otherwise.
With IoT especially, we seem to have an ugly incentive structure where there's no motivation to improve security unless there are lots of high-profile failures (and perhaps attendant lawsuits) that create demand. White hat work is often prohibited and almost always disdained - we've all seen stories of disclosures being completely ignored. So we get bad security not because consumers don't care about flaws but because they never know the weaknesses are there.
To me it is unreasonable to ever expect that all of them will be linux specialists, expert cryptographers, network specialists, etc.
Fundamentally we are at the convergence of software and hardware, but the software is too complicated, give people too many ways to shoot themselves in the foot.
I'd argue we need better software, not IoT manufacturers sinking ressources in hundreds of unrelated expertises.
To drive a car or keep people's Credit Card information you need certain certification. What makes no sense for me is to assume that keeping kids records on a public DB because someone has no clue on what they are doing is reasonable (for example). Or that needing an internet connection for turning off your heater is reasonable.
We need to understand IoT is not a toy, we should require certification, fines or both.
Similarly, I don't think it's unreasonable to hold IoT manufacturers accountable for releasing blatant security vulnerabilities into the wild (like that webcam that DDoS'd all those sites).
This isn't an "aww, growing pains" kinda moment of care for the poor budding IoT industry. They need to realize that they must be held accountable.
Edit: "bulletproof" isn't even what's being asked, but putting some thought into the security of their IoT devices is something we must demand of manufacturers
If a product desperately needs network connectivity, but is still prohibitively expensive to secure, I'm sympathetic. (Not forgiving, mind, but I understand the difficulty.) But when you're releasing a wifi teakettle, or a networked lightswitch that's talking to one other switch 5 feet away? At that point I think there's basically no excuse at all. Teakettles work great as is, adding insecure network support creates a product substantially worse than one without any software at all.
More theoretically, I can imagine an IoT product so good that they should just pay for the externalities they cause and keep manufacturing. But most insecure products out there today are creating far more externality than value, and wouldn't exist if they had to deal with the harm they cause.
The only realistic solution I can think of is creation of the open communication and security protocols with easily available standard libraries. A good example is HTTPS, which is far from perfect now, but is common today thanks to TLS and OpenSSL. We need something like Linux kernel - free, widespread, well understood, easy to port and use. Few big companies could make it work, but the problem is that there's not much money in creating open protocols and FOSS libraries. Maybe some IoT orientated Linux kernel branch with minimal set of functionality, safer of out-of-box configuration and basic security solutions preinstalled?
There is also the open-source Zephyr RTOS for IoT, of Intel WindRiver lineage, under Linux Foundation governance, https://www.zephyrproject.org
Edit: See http://mender.io for OTA updates (open-source client and server). If IoT device vendors separate their application code from the base operating system, e.g. via containers or virtualization, it may be possible for a vendor-authorized subscription service (like Mender) to deliver OTA updates for security-critical components.
IoT manufacturers don't have to contract Linus Torvald to review their code, but it's entirely reasonable to expect IoT manufacturers to use existing best practices to secure these products.
"Are all your device privates derived from the same key? Do you ask your users to install your public root to get past security warnings?"
Yet they clearly don't understand PKI 101 and think what they are doing is completely appropriate because they are "following standards" while of course missing the bigger picture entirely.
Hell, the Ring issue wouldn't even require one direct employee to avoid. You could solve that in a 30 minute call to an "is this obviously terrible?" hotline.
When I got to make a website, I don't say I can't make it secure because I can't afford to be an expert in security at every level of the OSI. I say I'm not an expert in every level of the OSI so I rely on accepted best practices and community standards to make my site secure.
I don't replace HTTPS with my own standard because I can't afford to make an adequate and secure replacement. If IoT makers can't make their own custom solutions secure then they need to build their devices out of standardized pieces that are secure.
That's exactly the problem with IoT-- there's no standard, out-of-box solutions right now. Try to google for "IoT security": you will find a bunch of (mostly proprietary) competing solutions with no clear leaders among them. See my other comment on this thread, were I've provided HTTPS as an example for IoT ecosystem. I'm an experienced embedded developer and most often, when it comes to security, I still have resort back to "invent my own" security solution, because I can't find anything that fits project needs.
note: I know you were not suggesting HTTPS as a solution only as an example of a standard used other places. I'm only pointing it out as another example of an issue IoT has which is lack of solutions .
The only solution I know of is Plex's solution which was to partner with a CA for $$$$$$
https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...
What's wrong with using the mbed security stack as a standard for mcu's ?
Sorry, but this is complete and utter nonsense.
Nobody is asking IoT manufacturers to provide perfect security. It's about the absolute minimum basics. There's one single security mechanism that's totally obvious that would have completely prevented the whole Mirai botnet: Don't use default passwords. It's not too much to ask for that.
Try to find a piece of hardware in your home that was not built by a software company where the software is even close to decent.
A self-updating debian install with a unique random password you deliver in a piece of paper inside the box should be enough.
If it isn't then there's something very odd with the legal processes, as your team of experts wouldn't be able to deliver it either.
i built a system that other people will be able to use to secure their IoT products; in fact, if you can write a simple arduino sketch, you can secure it very quickly
http://ardiri.com/blog/stockholm_terror_attack_how_iot_could...
> The "S" in "IoT" stands for "Security".
• Develop a standard interface/protocol for integrating IoT devices with the major mobile operating systems:
• Upon unboxing an IoT device and first power-on, require physical contact (via NFC?) with user's primary smartphone/wearable, and register the device with the user's third-party cloud account (e.g. Apple's iCloud/HomeKit).
• Only allow control of the IoT device from the smartphones/wearables that are signed into the user's iCloud/Google/Microsoft/etc. account.
• Web interfaces for IoT control should require two-factor authentication on the user's smartphone/wearable, again like the web interfaces for iCloud/Google/Microsoft accounts.
• Expose a different set of controls based on the user's physical distance from the IoT device, and the level of authentication on the controlling phone/wearable. For example: To unlock your front door you'd have to be standing right there (similar to unlocking a MacBook with the Apple Watch) but you could turn the lights on/off from across the world if you've unlocked your phone and entered your iCloud/Google/Microsoft password – and only from that phone.
• Sharing control with spouses/family could be similar to how Family Sharing for the App Store currently works; set a level of access on each IoT device for each member, and fallback on asking the family "admins" for permission.
No doubt there must be some non-apparent holes in this, but just throwing an idea out there.
Sorry, you lost me here. The last thing we need right now is another database of users' personal information. Why every gadget should be attached to my personal phone?
"Only allow control of the IoT device from the smartphones/wearables that are signed into the user's iCloud/Google/Microsoft/etc. account."
No again. It's enough Google owns my phone and email, I don't want it to own my home. What happens when Google's algorithm decides to ban you for no apparent reason (there are plenty of such horror stories around)?
Tl;DR if that's the price to pay for IoT security, I'm resorting back to "dumb" devices or going to live in woods.
Your iDevices, once registered on the same iCloud account, just talk to themselves, without needing to tell or ask Apple anything, other than just checking that you've signed into the same iCloud account.
One of the major problems I've seen again and again (especially on this site) is people saying things like "these devices should be 100% local". That's not realistic.
It seems like many attempts to improve the situation are met with hostility that they aren't "perfect" and the people trying to help lose interest because they are being fought on all sides.
If we would defined that device with a known security vulnerability is broken, the manufacturers/resellers would need to take action. Suddenly there would be direct financial consequences for shipping broken devices for which updates don't exist. I'm sure this would quite quickly lead to manufacturers putting more effort on providing updates and maybe even to proactively preventing security issues.
The loss of customers and reputation should a major security concern arise is a serious market driver and calls for regulation will only ensure that nobody does anything until a multitude of governments agree on a standard. As further food for thought, do you honestly trust the government to make the best choices for your security as a private citizen?
If "customers and reputation" were sufficient, we wouldn't need regulations on the safety of e.g. medical stuff, food and cars. (And history, as well as comparison with other countries, confirms that we do need those.)
Whenever one needs to establish a minimum of quality (and this is what that's ultimatively about), establishing laws mostly works, while trusting the market mostly fails.
Markets are good at many things, but are really bad at establishing a minimum of quality (or provision with basic supplies, for that matter).
The potentially nice thing about regulation is that you can have some level of trust in a compliant manufacturer. In your example, customers don't know anything about the security of their chosen vendor until a breach happens.. At which point, presumably they leave that manufacturer (and they fix their shit or die), and go to a new manufacturer who hasn't had a breach yet, or has used PR expertise to hide their mishaps, or... maybe they are actually secure. But who knows? Customers don't have the details they need to do anything but hop about randomly between manufacturers.
What? It might force companies not to bleed user data, yeah - people got pretty upset about the dolls spying on their children. But "enabling a DDoS" is a textbook externality. It doesn't hurt the device buyers appreciably, most of them don't even know it's happening, but it causes lots of harm to someone who didn't contract with the company.
More broadly: do you see any evidence at all that the market is actually solving this? It's pleasant to say an efficient market would handle this, but the market we actually have is one where people sell broken products to customers who pay before the flaws are revealed, then move on to a new company name if their reputation gets bad enough. Add in overseas production so that you can't even sue if the seller violates a contract, and the real-world market isn't making any progress on this.
So, the question then becomes, how do you make it cost them significant amounts of money?
There exists an FCC ID for every device that uses the RF spectrum. Similarly, there should be a similar required license for any device/product that operates on the Internet.
The license should be easy to get initially (basic examination by 3rd party). However, once the product is out on the market, if it is shown to be demonstrably broken (insecure), the license is revoked. It now becomes illegal to operate or sell the product as-is (both for user and manufacturer). It now has to be disconnected from the Internet (or the user and manufacturer face a fine).
Devices that are produced in very low quantities will be exempt from this (prototypes, specialty equipment, etc).
This is similar to the mandatory safety checking of a motor vehicle.
A cop pulls you over since your car mirrors are broken? You need to fix them before its legal to drive.
Some one finds out that all models have a fatal life-endangering flaw? It is now both illegal to drive them, and to sell new ones (as-is). Note that in this case, manufacturers will always foot the bill and do a recall.
I get that this is extreme. I don't see how anything else would work, though.
Which reminds me that it is not a new issue and a read of few years back raises concerns for IoT and security, by the FTC:
https://www.ftc.gov/system/files/documents/reports/federal-t...
Laws can't solve all problems, but I think they could help.
See "What laws should be created to improve computer security?" - https://www.dwheeler.com/essays/law-security.html - because I think some could help.
For example, many solutions use MQTT, why not make a secure TCP/UDP one by implementing one of the higher layers in OSI stack?
- There are so many different kinds of devices and different hardware
- Vendors want to maximize profits like everyone else, which entails making new devices all the time, and ending support on the last model fairly quickly (typically within two years,) but consumers regularly keep their devices for more than two years.
- Hardware vendors historically were not software vendors. For many IoT makers, this is their first real foray into software. The mistakes being made are amateurish, at a level that we saw on PCs in the mid-90s.
- Although there are some IoT standards, they're mostly concerned with communications, not the operating system. It feels like we're still 5+ years off from something as basic as automatic updates being a given (even just notifying users that an update is available and allowing them to easily install it is a challenge currently.)
Two things that are really bothersome:
- A huge number of IoT devices don't need the 'I'. They are perfectly capable of serving their purpose without an Internet connection (e.g. over Bluetooth,) but a huge attack surface is added to make you able to configure the device via a central website, or simply to monetize usage data.
- It is futile to trust each vendor to have the security expertise to lock down every device. An "IoT operating system" would be highly desirable, but there is nothing anywhere near real world implementation, and given the heterogeneous of hardware components it doesn't seem likely something non-Linux-based will come along.
Brickerbot is hostile and aggressive and shouldn't be necessary, but maybe it is. That's beside the point, though: Nobody has to be given permission to brick insecure IoT devices. Vendors don't feel it where it hurts (the bottom line,) and consumers increasingly just don't care (studies show people have grown accustomed to security incidents -- "it happens to everyone and everything; replace it and move on, there's nothing you can do")
Hacks made Microsoft shape up in the 90s and early 2000s, but Windows has only become actually secure since after Vista. Maybe just don't buy IoT devices for another 5-10 years, or at least put them on a separate vlan.
There are a bunch of groups trying to spread the word, but it doesn't seem many vendors are listening (or if they are, they don't have the capability to really secure their devices.) We've had some success with Securing Smart Cities working with local and state governments, and trying to address some of these issues before hilariously insecure IoT hardware becomes ubiquitous in cities/related to critical infrastructure: http://securingsmartcities.org/
It's hard to see how it's not going to get much, much worse before it gets better.
The key will likely be something like Android, that's based on the Linux kernel, but locks the vendors into some notion of a safe environment, and applies updates in a timely manner (the Linux kernel still has frequent critical security fixes.)
(Having vendors be able to articulate what the devices should be able to connect to or do, and having the OS/runtime enforce that would be a huge step forward.)
But Android itself is also insecure primarily due to fragmentation and end-of-lifeing, hence the feeling of hopelessness.
I always feel the need to disagree with this.
The biggest "value add" in most of my "connected" stuff is the fact that I can access and manage it from outside the home.
Z-Wave light switches are nice, but being able to turn them off when I forgot to after i've left is a huge bonus (and taking it a step further and tracking my and my families phones and turning them all off when nobody is home automatically).
A thermostat I can control when I'm on the couch is a convenience, but a thermostat that notices when I'm at work or the store or a friends house and turns off during that time saves tons of money and energy.
A garage door that I can control from anywhere in my house is normal, but a garage door that I can have ensure it's closed when i'm not home, and that I can open for a friend that showed up to my house 20 minutes before I did is awesome.
I really do think that the "I" in IoT is absolutely necessary (in many cases, not all), but I agree with the rest of your points.
(before people start commenting on the tracking stuff, it's all implemented on a home-server where the phones literally "phone home" to that server, nothing is processed outside the house)
A good example of this is my garage door opener. Instead of building a WiFi connection into the opener itself, there is a separate little gateway device that sits inside my house. The gateway talks to the door (RF) and to the Internet (ethernet). I can still control my garage door, but if something is compromised, I can always detach that gateway and still have a working (secure) garage door.
Why not focus on software which can use WiFi more securely and with a better focus on local connectivity? I can understand the "ultra low power" needs, but many of these devices are mains powered, and that's not really a concern.
But yes, what I do right now for the most part is use z-wave which is connected to a central "hub" which is then connected to the outside world. But IMO that's a hacky-workaround for this problem, not a real solution.
https://news.ycombinator.com/item?id=14029572
which shows some of the risks of an internet connected device (no, it is not about lack of security)
At the same time, a lot of IoT stuff only connects to the outside to be reachable by its apps, and maybe sent notifications. The router could manage these things instead, independent of any device-specific "cloud" service.
So many things in my house have static IP addresses because I want to access them locally, it's an absolute pain in the ass and not at all something that your average person could manage.
Having an IoT device send all of it's data to a "cloud" server is the easiest and most fullproof way to make sure everyone can use see it. Without that, you are looking at complicated local addressing systems, hoping that your users aren't using client isolation or something like it (and you WILL get calls because they tried to use the device on a hotel network where each client is isolated and it didn't work), and ugly URLs at best.
This is a shitty response. It's like telling the person who wants a better mousetrap to just live somewhere that doesn't have mice. It might be a "solution" but it's not a good one.
>You can do that locally with passive infrared sensors.
So now you want me to purchase 10+ infrared sensors for throughout my small condo? And what happens when my pets set them off? what happens when I'm laying still on the couch? What happens when I'm taking a shower?
I can just get a keypad? what happens when I want to change my keycode while I'm away for a week? What about the nice notification I get on my phone when someone opens a door or the garage door when I'm not home? What about the snapshot of the security camera I have sent to my phone every time someone enters the house when nobody is home? What about the routine which begins warming/cooling my house when i'm less than 15 minutes from home?
Those aren't solutions, they are shitty workarounds that only work in a fraction of the situations. Just like most other "solutions" that attempt to act like every single thing is 100% possible without outside communication are.
I think it's unlikely that the IoT door lock features add enough security to make up for the increased attack surface compared to the local only version.
I've had IR light switches before, not only do they have tons of false positives (I ended up removing it because I would roll over in bed and the lights would turn on at 1AM...), but they have a significant number of false negatives (I can't count the number of times i've had to stand up and wave at the damn thing like a crazy person to get it to turn the light on because it shut it off on me when i was sitting reading).
I also have 2 of them as part of my "home automation" system, and they are mostly useless. You say they are good at telling people from pets, but my 2 small cats set them off about 30-50 times a day, and if I point them up to where they don't go off that often any more, they won't go off for people at that point.
And like I said above, this isn't just "turns some lights on for a few minutes", this is turning the thermostat on/off, turning the water heater on/off, lights, locks, doors, tvs, computers, fans, speakers, etc...
And they STILL don't solve the other issues. What about notifications when someone enters/leaves the house? What about pre-heating/cooling the house when i'm close to home? what about external camera access? what about the alerts about water leakage, or gas usage while i'm not home? or the notification that I left oven on?
Why try to "reduce attack surface" of my door lock, when it's feet away from a window? I personally think a lock which sends a notification when used, or IoT devices which notify when used and nobody is home is magnitudes more "secure" than a dumb lock which will do nothing while all of my stuff is stolen.
Telling me I don't need those things isn't a "solution", it's letting perfect be the enemy of good.
>> it doesn't seem likely something non-Linux-based will come along
The Mbed seems like ARM's answer to that, and it seems pretty good, works well of the mcu scale, and not that many vulnerabilities. But customers can't reliably choose it when buying, hence companies don't usually use it at scale. Simply put, IOT security is a "market for lemons".
What's needed is an mcu(or maybe a communication module), that comes with connectivity + security + updates from a major player - in a way that the product designers can't hurt security(no matter what mistake they make) - for example, by only offering a secure link to the company secure cloud server.
Than when users buy online, they can see that "this product's security is provided by Amazon/ARM/etc or maybe even a small third-party brand[1], with guaranteed updates for X years, or updates for $Y per year".
And it should be easy to verify that fact - for example, by using an app to scan the box or product label, and communicating with the product.
At this point, if this is done affordably, some users may decide to pay for that security, right ?
[1]It's possible to build good security and security brands online, like copperheadOs, for example.
http://ardiri.com/blog/utls_defining_lightweight_security_fo...
Either IoT market will die because of this or the IoT will become IoST - internet of secure things.