Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[dhouston]

While it does not address security, per se, a proposal from several major manufacturers that would create interoperability standards for IoT devices is encouraging. Their interest is industrial applications but I think it inevitable that similar standards will evolve for the types of devices of interest here.

• http://bits.blogs.nytimes.com/2014/03/27/consortium-wants-standards-for-internet-of-things/?ref=business

[dhouston]

An article in today's NYT indicates that 25%-75% of corporate network hacker penetration comes by way of third party devices/systems connected to the corporate network.

• http://www.nytimes.com/2014/04/08/technology/the-spy-in-the-soda-machine.html?hp&_r=0

HVAC systems, vending machines, even online menus from restaurants frequented by employees are among the exploits. As IoT devices proliferate in homes, hackers are sure to follow.

[dhouston]

The OpenSSL Heartbleed bug, currently in the news, is likely to affect a multitude of embedded devices (e.g. routers) used in home networks, most of which use open-sores versions of Linux.

• http://www.nytimes.com/2014/04/11/business/security-flaw-could-reach-beyond-websites-to-digital-devices-experts-say.html?ref=business

You should check with the manufacturers of your various devices to see whether their hardware is affected and, if so, how to fix the problem.

[dave w]

I think it only a matter of time before we have our own Fukushima or total collapse of the grid, do to hacking. Seems like the "IoT" will only exacerbate that threat.

[dhouston]

And I've expected a catastrophic cloudburst ever since cloud computing became the latest thing.

I had to change a couple of online passwords where OpenSSL was in use. My wireless router did not use it but I'm not sure how to check whether my Smart TV uses it nor how to update it in case it does.

EDIT: Vizio tech support tells me my TV is not affected by Heartbleed.

[Brian H]

There was a news story here in CT. On constant attacks on the utilities from all around the world. In hopes of taking down the power grid and other utilities. As most are controlled by computers. 

[HA Dave]

There was a news story here in CT. On constant attacks on the utilities from all around the world. In hopes of taking down the power grid and other utilities. As most are controlled by computers.  

Doesn't the nations communications (network and phone) backbone run through there too?  

I think it only a matter of time before we have our own Fukushima or total collapse of the grid, do to hacking. Seems like the "IoT" will only exacerbate that threat.

I think it's already happened! Actually I am pretty positive the NSA already has complete access to all PC's, and phones (mobile and landline), along with the records of all the traffic by the device users. And if the bumbling idiots in the government can do that... who can't?!?!?!?

There are no secrets... and any device.... gadget or structure can be broken into. Your phones, your PC's, your steel clad front door, the fireproof safe.... all are easy to get into. A half a century ago.... the police had devices that could listen to conversations whispered in a bedroom. Privacy... is an illusion. 

[dhouston]

The author of this article in the NYT shares my concerns with IoT security.

• http://bits.blogs.nytimes.com/2014/06/01/dark-side-to-internet-of-things-hacked-homes-and-invasive-ads/?ref=business

While it doesn't address IoT security explicitly, here is an excellent security primer for those using iOS or Android devices.

• http://www.tomsguide.com/us/mobile-security-guide,review-1918-3.html

[dhouston]

A Heartbleed variant called Cupid allows hackers to penetrate networks (home and commercial) through WiFi routers.

• http://www.techzone360.com/topics/techzone/articles/2014/06/03/380273-heartbleed-strikes-aga-android-devices-wi-fi-routers.htm

[Brian H]

I have seen web posts. That some of the larger Cable Companies {Comcast for one} now use the WiFi interface they supply. For local hot spots for their systems.
Customer does not see the data used by the hot spots as part of their monthly data usage.

IMHO.
Going to cloud storage and use is a real bad idea.
I have seen the Insteon HUB users standing out in the cold. When the cloud service went down.

[HA Dave]

.....
IMHO.
Going to cloud storage and use is a real bad idea.
I have seen the Insteon HUB users standing out in the cold. When the cloud service went down.

Of course you're correct! As the world... and our technologies.... get more advanced/complex the more interdependent and fragile they become. But what do we do? Kerosene lamps, wood burning stoves, letter writing instead of email, and [automation] club memberships instead of forums? To be honest.... that doesn't sound half bad. But it's never going to happen.

We've eliminated the drudgery of cleaning soot from lanterns and chimneys... with the boredom of updating software and running virus scans. The recent events with X10 have taught us all that all things sooner or later do fail. Efforts and risks will forever alter and change. We just keep changing and altering with them. Nothing lasts forever. 

[dhouston]

I'm no Luddite - I tend to surf the bleeding edge of technology - but I do think it important to be aware of the security issues that these new technologies present and to point to 'best practice' methods.

I try to avoid clouds, preferring the sunny side of the street. Not only are there those issues noted about Insteon Hub cloud services and X10 servers but I see no reason why security cameras need to connect to remote servers. For data backup, I prefer local HDDs. I have a 500GB USB HDD connected to each PC plus a 1TB USB HDD connected to my router, providing common storage for all my network devices. While I have to worry about security issues vis a vis my router, I don't have to worry about little birdies (NSA drones) flying through remote clouds coming across my data.

A little more about 'best practices'...
My WiFi router does not advertise its presence, is password protected and uses MAC filtering for all WiFi connections. My main PC runs an antivirus scan daily. Other PCs, which are only on occasionally, run a virus scan at least once a week. I have implemented most, although not all, of these 'best practices'...

• http://compnetworking.about.com/od/wirelesssecurity/tp/wifisecurity.htm

[JeffVolp]

For data backup, I prefer local HDDs. I have a 500GB USB HDD connected to each PC plus a 1TB USB HDD connected to my router, providing common storage for all my network devices.

I agree with you.  All the PCs I've built have at least 2 physical hard drives, and the second is used for on-line backup.  More recently I'm using the huge memory sticks for off site backup.  I just bought another 128G for $40 to back up all our photographs.  It is incredible how cheap storage has become.

Jeff

[dhouston]

It is incredible how cheap storage has become.

Agreed! Yesterday I saw an eBay vendor selling 32GB microSDHC cards with SD adapter for $0.99 + $2.00 shipping.

When I later tried to order, the page appeared to be a mistake as neither the Buy Now or Add to Cart buttons would work. Going to the vendors store revealed a $9 price + $2 shipping.

[dhouston]

...some of the larger Cable Companies {Comcast for one} now use the WiFi interface they supply. For local hot spots for their systems.

Those might prove to be more tempting targets for war-drivers than run-of-the-mill home routers.

• https://en.wikipedia.org/wiki/Wardriving

And, they are also likely to be vulnerable to man-in-the-middle attacks by exploiting a newly discovered 10 year old bug in OpenSSL.

• http://bits.blogs.nytimes.com/2014/06/05/new-bug-found-in-widely-used-openssl-encryption/?ref=business

And now comes yet another OpenSSL bug. This one is 15 years old. So much for the virtues of open-sores software.

• http://www.thewire.com/technology/2014/06/another-heartbleed-style-open-ssl-vulnerability-discovered/372319/

And, it continues - seven security flaws have NOW been found and patched in OpenSSL.

• http://www.toptechnews.com/article/index.php?story_id=020000OU61KO