Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Internet Of Things Security Reaches Tipping Point
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:30:43 AM
Re: Network access point
Good point--the existing not-so-secure devices need retrofitting. Not sure how this would be marketed, but maybe the automakers could provide an IPS in a recall, for instance. We'll see how it all unfolds.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:28:50 AM
Re: Network access point
good point, although there could be an after market for automobiles and high-end wearables. It's a brave new world! It sure will be interesting to watch it unfold...
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:25:41 AM
Re: Network access point
This is all speculation, of course, but I would think the vendors would have to provide it since consumers shouldn't be expected to know they need to add this security feature, etc. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:04:36 AM
Re: Network access point
Kelly, I think there definitely is an emerging market here, although I wonder if it will be targeted to consumers or manufacturers? Maybe both?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/14/2014 | 1:25:18 PM
Re: Network access point
I wonder if this opens the door for a new generation of mini-security tools/apps that are built for IoT's requirements. Heck, Chris Valasek and Charlie Miller built a prototype IPS of sorts that plugs into a car and detects attacks. I'm not sure how quickly the iOT and consumer product vendors can clean up their buggy code, etc., so maybe there's a stopgap option here. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:13:58 PM
Re: Wow
Good strategy. If you are not connected there is no risk, confidentiality and Integrity are satisfied. However this also means security in general failed since we could not talk about third leg of security: Availability.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:10:15 PM
Re: Wow
I hear you. Low tech devices are main drivers for the security holes at the same time. They even found vulnerability in a flash drive, which is HW mainly, anything can happen from that point forward.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:07:22 PM
Network access point
 

One way of avoiding problems that would be coming from IoT is to build a secure network and not allowing all these small devices connecting internet by themselves. This is what we do at work and home currently actually. What is important is to make sure there is only one gateway and that gateway is secured properly.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/13/2014 | 6:49:51 PM
Re: Wow
I have a fairly low-tech house and vehicles, so sadly, that makes me feel better. But most consumers have no idea that their smart thermostat, or their fully loaded vehicle could be compromised or used as a bot to attack others. They're having a tough enough time coming to terms with their PCs as targets. The security researchers who've explored weaknesses in consumer and other embedded devices are concerned about how this could play out. That's why it's promising to see I Am The Cavalry and BuildItSecure.ly, plus other outreach efforts. So don't unplug yet, Sara!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/13/2014 | 5:45:52 PM
Re: Wow
Historically, manufacturers haven't gotten around to taking public safety seriously until they start losing product liability suits. The legal concept of "due care" should definitely be applied to the connected "things" that we use everyday and will be increasingly the target of hackers, criminals and other bad actors.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-40690
PUBLISHED: 2021-09-19
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract...
CVE-2021-41073
PUBLISHED: 2021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
CVE-2021-23441
PUBLISHED: 2021-09-19
All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
CVE-2021-41393
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
CVE-2021-41394
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.