Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Internet Of Things Security Reaches Tipping Point
Threaded  |  Newest First  |  Oldest First
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
8/13/2014 | 5:27:38 PM
Wow
GREAT story, Kelly. When you put it like this, I'm tempted to run around my house and unplug everything. One of the main takeaways for me, here, is that manufacturers should have been and could have been on top of IoT security BEFORE releasing all these superconnected products... but they ignored the research. Same old song -- security always ends up playing catch up.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/13/2014 | 5:45:52 PM
Re: Wow
Historically, manufacturers haven't gotten around to taking public safety seriously until they start losing product liability suits. The legal concept of "due care" should definitely be applied to the connected "things" that we use everyday and will be increasingly the target of hackers, criminals and other bad actors.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/13/2014 | 6:49:51 PM
Re: Wow
I have a fairly low-tech house and vehicles, so sadly, that makes me feel better. But most consumers have no idea that their smart thermostat, or their fully loaded vehicle could be compromised or used as a bot to attack others. They're having a tough enough time coming to terms with their PCs as targets. The security researchers who've explored weaknesses in consumer and other embedded devices are concerned about how this could play out. That's why it's promising to see I Am The Cavalry and BuildItSecure.ly, plus other outreach efforts. So don't unplug yet, Sara!
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:10:15 PM
Re: Wow
I hear you. Low tech devices are main drivers for the security holes at the same time. They even found vulnerability in a flash drive, which is HW mainly, anything can happen from that point forward.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:13:58 PM
Re: Wow
Good strategy. If you are not connected there is no risk, confidentiality and Integrity are satisfied. However this also means security in general failed since we could not talk about third leg of security: Availability.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:07:22 PM
Network access point
 

One way of avoiding problems that would be coming from IoT is to build a secure network and not allowing all these small devices connecting internet by themselves. This is what we do at work and home currently actually. What is important is to make sure there is only one gateway and that gateway is secured properly.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/14/2014 | 1:25:18 PM
Re: Network access point
I wonder if this opens the door for a new generation of mini-security tools/apps that are built for IoT's requirements. Heck, Chris Valasek and Charlie Miller built a prototype IPS of sorts that plugs into a car and detects attacks. I'm not sure how quickly the iOT and consumer product vendors can clean up their buggy code, etc., so maybe there's a stopgap option here. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:04:36 AM
Re: Network access point
Kelly, I think there definitely is an emerging market here, although I wonder if it will be targeted to consumers or manufacturers? Maybe both?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:25:41 AM
Re: Network access point
This is all speculation, of course, but I would think the vendors would have to provide it since consumers shouldn't be expected to know they need to add this security feature, etc. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:28:50 AM
Re: Network access point
good point, although there could be an after market for automobiles and high-end wearables. It's a brave new world! It sure will be interesting to watch it unfold...
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:30:43 AM
Re: Network access point
Good point--the existing not-so-secure devices need retrofitting. Not sure how this would be marketed, but maybe the automakers could provide an IPS in a recall, for instance. We'll see how it all unfolds.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29763
PUBLISHED: 2021-09-16
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267.
CVE-2021-29825
PUBLISHED: 2021-09-16
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470.
CVE-2021-29842
PUBLISHED: 2021-09-16
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
CVE-2021-29752
PUBLISHED: 2021-09-16
IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users under specific conditions. IBM X-Fporce ID: 201780.
CVE-2021-34798
PUBLISHED: 2021-09-16
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.