Skip to main content

Home/ Open Web/ Group items tagged Internet-of-things

Rss Feed Group items tagged

Paul Merrell

'Nice Internet You've Got There... You Wouldn't Want Something To Happen To It...' | Te... - 0 views

  • Last month, we wrote about Bruce Schneier's warning that certain unknown parties were carefully testing ways to take down the internet. They were doing carefully configured DDoS attacks, testing core internet infrastructure, focusing on key DNS servers. And, of course, we've also been talking about the rise of truly massive DDoS attacks, thanks to poorly secured Internet of Things (IoT) devices, and ancient, unpatched bugs.

    That all came to a head this morning when large chunks of the internet went down for about two hours, thanks to a massive DDoS attack targeting managed DNS provider Dyn. Most of the down sites are back (I'm still having trouble reaching Twitter), but it was pretty widespread, and lots of big name sites all went down. Just check out this screenshot from Downdetector showing the outages on a bunch of sites:
  • You'll see not all of them have downtime (and the big ISPs, as always, show lots of complaints about downtimes), but a ton of those sites show a giant spike in downtime for a few hours.

    So, once again, we'd like to point out that this is as problem that the internet community needs to start solving now. There's been a theoretical threat for a while, but it's no longer so theoretical. Yes, some people point out that this is a difficult thing to deal with. If you're pointing people to websites, even if we were to move to a more distributed system, there are almost always some kinds of chokepoints, and those with malicious intent will always, eventually, target those chokepoints. But there has to be a better way -- because if there isn't, this kind of thing is going to become a lot worse.
Paul Merrell

We Need to Save the Internet from the Internet of Things | Motherboard - 0 views

  • Brian Krebs is a popular reporter on the cybersecurity beat. He regularly exposes cybercriminals and their tactics, and consequently is regularly a target of their ire. Last month, he wrote about an online attack-for-hire service that resulted in the arrest of the two proprietors. In the aftermath, his site was taken down by a massive DDoS attack.

    In many ways, this is nothing new. Distributed denial-of-service attacks are a family of attacks that cause websites and other internet-connected systems to crash by overloading them with traffic. The "distributed" part means that other insecure computers on the internet—sometimes in the millions—are recruited to a botnet to unwittingly participate in the attack. The tactics are decades old; DDoS attacks are perpetrated by lone hackers trying to be annoying, criminals trying to extort money, and governments testing their tactics. There are defenses, and there are companies that offer DDoS mitigation services for hire.

    Basically, it's a size vs. size game. If the attackers can cobble together a fire hose of data bigger than the defender's capability to cope with, they win. If the defenders can increase their capability in the face of attack, they win.

    What was new about the Krebs attack was both the massive scale and the particular devices the attackers recruited. Instead of using traditional computers for their botnet, they used CCTV cameras, digital video recorders, home routers, and other embedded computers attached to the internet as part of the Internet of Things.

    Much has been written about how the IoT is wildly insecure. In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.

    Bruce Schneier pointing to a massive security hole in the Internet of Things ("IoT").
Paul Merrell

The Internet of Things Will Turn Large-Scale Hacks into Real World Disasters | Motherboard - 0 views

  • Disaster stories involving the Internet of Things are all the rage. They feature cars (both driven and driverless), the power grid, dams, and tunnel ventilation systems. A particularly vivid and realistic one, near-future fiction published last month in New York Magazine, described a cyberattack on New York that involved hacking of cars, the water system, hospitals, elevators, and the power grid. In these stories, thousands of people die. Chaos ensues. While some of these scenarios overhype the mass destruction, the individual risks are all real. And traditional computer and network security isn’t prepared to deal with them.

    Classic information security is a triad: confidentiality, integrity, and availability. You’ll see it called “CIA,” which admittedly is confusing in the context of national security. But basically, the three things I can do with your data are steal it (confidentiality), modify it (integrity), or prevent you from getting it (availability).

  • So far, internet threats have largely been about confidentiality. These can be expensive; one survey estimated that data breaches cost an average of $3.8 million each. They can be embarrassing, as in the theft of celebrity photos from Apple’s iCloud in 2014 or the Ashley Madison breach in 2015. They can be damaging, as when the government of North Korea stole tens of thousands of internal documents from Sony or when hackers stole data about 83 million customer accounts from JPMorgan Chase, both in 2014. They can even affect national security, as in the case of the Office of Personnel Management data breach by—presumptively—China in 2015.

    On the Internet of Things, integrity and availability threats are much worse than confidentiality threats. It’s one thing if your smart door lock can be eavesdropped upon to know who is home. It’s another thing entirely if it can be hacked to allow a burglar to open the door—or prevent you from opening your door. A hacker who can deny you control of your car, or take over control, is much more dangerous than one who can eavesdrop on your conversations or track your car’s location.

    With the advent of the Internet of Things and cyber-physical systems in general, we've given the internet hands and feet: the ability to directly affect the physical world. What used to be attacks against data and information have become attacks against flesh, steel, and concrete.

    Today’s threats include hackers crashing airplanes by hacking into computer networks, and remotely disabling cars, either when they’re turned off and parked or while they’re speeding down the highway. We’re worried about manipulated counts from electronic voting machines, frozen water pipes through hacked thermostats, and remote murder through hacked medical devices. The possibilities are pretty literally endless. The Internet of Things will allow for attacks we can’t even imagine.

    Bruce Scneier on the insecurity of the Internet of Things, and possible consequences.
Gary Edwards

Electronic Imp: Former Apple, Google, Facebook engineers launch IoT startup - 2012-05-1... - 0 views

  • "We've put it in a user-installable module. The user buys the card and just plugs it into any device that has a slot," Fiennes explained." All a developer needs to do is add a socket and a 3-pin Atmel ID chip to their product. That's 75 cents: 30 cents for the ID chip and 45 cents for the socket." This assumes the availability of 3.3 V. "But given that most things you want to control from the Internet are electrical, we think that's reasonable," he said. If not, developers can include a battery.
  • Fiennes demonstrated a power adaptor with an Imp socket. He installed a card and an appropriately labeled block appeared in a browser window. Fiennes plugged in a chain of decorative lights and we clicked on the box on our browser. After clicking, the box text went from "off" to "on." Over Skype, we could see the lights had come on.

    Fiennes emphasized that control need not be manual and could be linked to other Internet apps such as weather reports, or to Electric Imp sensor nodes that monitor conditions such as humidity.

    A second example is an Electric Imp enabled passive infrared sensor. Fiennes demonstrated how it could be programmed to report the time and date of detected motion to a client's Web pages on the Electric Imp server. In turn, those pages could be programmed to send an alarm to a mobile phone. The alarm could also be triggered if no motion was detected, allowing the sensor to serve as a monitor for the elderly in their homes, for example. If there is no activity before 9 a.m., a message is sent to a caregiver.
  • The final example is an Electric Imp washing machine. Machine operation can be made conditional on a number of variables, including the price of electricity. "Every washing machine has microcontroller and that microcontroller has a lot of data," said Fiennes. "That data could be sent back to a washing machine service organization that could call the client up before the washing machine breaks down."
  • ...1 more annotation...
  • The cards will be on sale to developers by the end of June for $25 each and Electric Imp will also supply development kits that include a socket, ID chip and power connection on a small board for about $10. While these are intended for consumer electronics developers Electric Imp is happy to sell them to students and non-professional developers. "Hobbyists can play with it and tell us what they think."
    Put Electronic Imp at the top of the "Technologies to watch" list.  Good stuff and great implementation - platform plan.  

    "We've put it in a user-installable module. The user buys the card and just plugs it into any device that has a slot," Fiennes explained." All a developer needs to do is add a socket and a 3-pin Atmel ID chip to their product. That's 75 cents: 30 cents for the ID chip and 45 cents for the socket." This assumes the availability of 3.3 V. "But given that most things you want to control from the Internet are electrical, we think that's reasonable," he said. If not, developers can include a battery.

    When the $25 card is installed in a slot and powered up, it will find the ID number and automatically transmit the information to Electric Imp's servers. Fiennes and his colleagues have written a virtual machine that runs under a proprietary embedded operating system on the node and looks for updates of itself on the Internet. SSL encryption is used for data security when transmitted over the link.

1 - 4 of 4
Showing 20 items per page