Homeland security looks at Internet of Things

The lightbulbs are revolting

The Obama administration has ordered Homeland Security to come up with a cunning plan to make the Internet of Things devices more secure after a huge DoS attack on major websites.

Twitter, Spotify, Netflix and dozens of other major websites were taken down by botnets built from compromised Internet of Things devices.

Homeland Security said it had held a conference call with 18 major communication service providers shortly after the attack began and was working to develop a new set of “strategic principles” for securing internet-connected devices.

DHS said its National Cybersecurity and Communications Integration Centre was working with companies, law enforcement and researchers to cope with attacks made possible by the rapidly expanding number of smart gadgets that make up the Internet of Things.

Already two manufacturers whose devices had been hijacked for the attack pledged Monday to try to fix them. Chinese firm Hangzhou Xiongmai Technology, which makes components for surveillance cameras, said it would recall some products from the United States. Dahua Technology, acknowledged that some of its older cameras and video recorders were vulnerable to attacks when users had not changed the default passwords. Like Xiongmai, it said it would offer firmware updates on its website to fix the problem and would give discounts to customers who wanted to exchange their gear.

But the fear is that the majority of IoT devices are never going to be fixed because it would cost manufactures too much.

Basically they have to be issued with better passwords, mechanisms for updates and some onboard security. This is somewhat a lot to ask of a lightbulb.

What is possible is that the manufacturers could agree on some unified software and insist on better standards.

A day late and a dollar short, in several respects. Not only have we already suffered an IoT-related DDoS, but the security community has been warning for several years now that most IoT devices are horrifically unsecure, and risks on several fronts.

To paraphrase Ian Malcom: The IoT developers “...were so preoccupied with whether or not they could, they didn’t stop to think if they should.”

Want to know if you have a vulnerable device?

Internet of Things Scanner

The first step is to see if your IP is listed on Shodan: a search engine like Google that looks for Internet-connected devices like webcams.

After that first step, you can also request a "deep scan" of your IP to determine if you have a vulnerable device.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.