Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Future Shock: The Internet of Compromised Things
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
SteveC227
SteveC227,
User Rank: Apprentice
1/23/2014 | 2:16:48 PM
Dangerous appliances
I have long suspected my toaster of plotting against me. Sometimes it fails to make the toast pop up in the hopes that I will stick a fork in the slot and get electrocuted. These days you have to work hard to keep one step ahead of your electrical appliances. I have never worried about my refrigerator, however. But now I am going to monitor it more carefully. Thank your for alerting us all to these threats.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
1/23/2014 | 4:30:41 PM
Re: Dangerous appliances
Sounds like an idea for a sequel to Disney's classic, The Brave Little Toaster. 

 

 
Shane M. O'Neill
Shane M. O'Neill,
User Rank: Apprentice
1/23/2014 | 4:54:35 PM
Re: Dangerous appliances
I don't think the Internet of Things movement will play out for consumers for awhile. Seems more of an enterprise/manufacturing/supply chain technology for the time being. But when it does eventually come to kitchens and living rooms, will we rely on Symantec, McAfee and Kaspersky to provide protection software for our refrigerators like we do for PCs? The use of third-party anti-virus software in IoT home situations didn't come up in the article so I was curious.
cbabcock
cbabcock,
User Rank: Apprentice
1/23/2014 | 5:27:57 PM
Hacker: Good afernoon, sir, is your house empty now?
In addition to fearing that hackers will learn my milk is out of date, I would hate for intruders to snoop on our local area network to learn, for marketing purposes or worse, what my family's habits were or when the house was empty. If all the home appliances were on a household network, a great deal of information would become available to hackers, the public utility, the appliance dealership. Martin Lee is right. We don't quite realize what we're getting into here.   
seppleyt5j01
seppleyt5j01,
User Rank: Apprentice
1/23/2014 | 5:47:59 PM
Compimise your services?
Let's suppose for a moment that you live in Phoenix. It's July and  109 degrees outside. As a purveyor of ransomeware, I would shut off your refrigerator and air conditioning. I would only require that you pay me $100 in order to restore their services...
MartinL923
MartinL923,
User Rank: Apprentice
1/24/2014 | 4:47:48 AM
Re: Dangerous appliances
Quite right! My toaster burnt my toast this morning, probably out of spite. However, my current toaster is entirely mechanical. As the price of computing power keeps dropping computers are finding their way into even the smallest device. Experience tells us that where you have software, you have bugs which can frequently be exploited. Lurking in a cupboard I have a mechanical telephone, its laughable to imagine that this device could contain malware, yet I now have a smart phone on which I can install all sorts of dubious software if I so wish, or if I don't pay attention. With the current pace of technology, I'll be willing to bet that within a few years there will be a smart-toaster in every kitchen.

Martin
MartinL923
MartinL923,
User Rank: Apprentice
1/24/2014 | 4:58:00 AM
Re: Compimise your services?
seppleyt5j01: Exactly, I see this as the biggest risk. We've already seen attackers seeking to distract security teams within the financial services industry by launching a denial of service attack just before attempting to compromise high value systems. Taking malicious control of environmental control systems would be a very effective mechanism of causing disruption to a security team or business.

I hadn't thought of a ransomware style attack on environmental control, but a lack of heating at this time of year, or the a/c set to full heat in the middle of summer would no doubt lead many people to reach for their credit card to pay off their attackers.
MartinL923
MartinL923,
User Rank: Apprentice
1/24/2014 | 5:33:39 AM
Re: Hacker: Good afernoon, sir, is your house empty now?
cbabcok: Like most things in security its a trade off. I don't doubt that there will be many advantages to the Internet of Things. Anything that can help us better manage our limited resources, allow us to do more with less, or even just make less demands on my free time has to be a good thing. Nevertheless, there will be risks. If we can prepare for those risks now and think about how we can manage them, then we can maximise our benefits while minimising any downsides.
MartinL923
MartinL923,
User Rank: Apprentice
1/24/2014 | 5:44:36 AM
Re: Dangerous appliances
Shane: I think a slightly different approach is needed to detect malicious code running within embedded devices. Anti-virus is very good a detecting known bad code, and allowing the vast numbers of 'good' software that you could install on a desktop device to run unimpeeded.

An embedded device should only ever run one programme and contain no other software apart from updates. So we would need to establish that only authorised software can run on the device, and that any instructions received by the processor (or any sensors or actuators) has been generated from legitimate code operating correctly.

Its a subtly different problem that requires a different approach.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
1/24/2014 | 8:16:35 AM
Re: Dangerous appliances --subtly different problem that requires a different approach.
Martin, I think you hit the nail on the head when you describe the security issues related to the IoT as a "subtly different problem that requires a different approach. I suspect your use of the words "subtly different" is an understatement!   Thanks for raising the issues about the brave new world (let alone toaster) that we are entering, and also your very thoughtful comments.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31883
PUBLISHED: 2022-06-28
Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.
CVE-2022-31885
PUBLISHED: 2022-06-28
Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
CVE-2022-31886
PUBLISHED: 2022-06-28
Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.
CVE-2021-3430
PUBLISHED: 2022-06-28
Assertion reachable with repeated LL_CONNECTION_PARAM_REQ. Zephyr versions >= v1.14 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr
CVE-2021-3431
PUBLISHED: 2022-06-28
Assertion reachable with repeated LL_FEATURE_REQ. Zephyr versions >= v2.5.0 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7548-5m6f-mqv9