Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Securing Networks In the Internet of Things Era

timothy posted about 2 months ago | from the glad-that-someone-finally-invented-things dept.

Communications 106

An anonymous reader writes "Gartner reckons that the number of connected devices will hit 26 billion by 2020, almost 30 times the number of devices connected to the IoT in 2009. This estimate doesn't even include connected PCs, tablets and smartphones. The IoT will represent the biggest change to our relationship with the Internet since its inception. Many IoT devices themselves suffer from security limitations as a result of their minimal computing capabilities. For instance, the majority don't support sufficiently robust mechanisms for authentication, leaving network admins with only weak alternatives or sometimes no alternatives at all. As a result, it can be difficult for organizations to provide secure network access for certain IoT devices."

cancel ×

106 comments

Sorry! There are no comments related to the filter you selected.

WoT IoT? (-1)

Anonymous Coward | about 2 months ago | (#47735387)

Is this?

Whoop! Whoop!

Slashdot went dead ? (0)

Anonymous Coward | about 2 months ago | (#47735391)

Slashdot didn't pay their server bill ?

Re:Slashdot went dead ? (0)

Anonymous Coward | about 2 months ago | (#47735407)

Not dead enough! Oh why does it have to be back up? Stay dead!!

Re: Slashdot went dead ? (0)

Anonymous Coward | about 2 months ago | (#47735519)

Slashdot went beta. That might as well be a death sentence.

One time pad (1)

Anonymous Coward | about 2 months ago | (#47735403)

Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years. Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.

Re:One time pad (0)

Anonymous Coward | about 2 months ago | (#47735705)

Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years. Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.

The same thing has held true for our disposable consumer society for a very long time. You usually replace your computing devices every few years too.

Re: One time pad (0)

Anonymous Coward | about 2 months ago | (#47735721)

Recycling makes me feel good!

Re:One time pad (0)

Anonymous Coward | about 2 months ago | (#47735955)

Yeah, except the servers then need to store several billion one time pads.

Re:One time pad (2)

Zero__Kelvin (151819) | about 2 months ago | (#47736041)

"Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years."

Assuming you will ever read this after posting as an AC, how do you propose the distribution of these One Time Pads will occur? How will each device determine which One Time Pads have been used and which haven't? What happens when you want to check your refridgerator contents from an internet cafe? Even if you can distribute a new OTP set efficiently and securely, how will that be synchronized? How, for example, will the other ten devices in your home know that one of them has a different OTP set installed without using the network? How will you keep people from performing denial of service attacks by invalidating your current OTP set? What happens if the device you use to manage OTP sets fails? How far into this post did you have to read before you realized that your idea is an EPIC FAIL, and you really hadn't given any actual thought to the problem?

"Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.""

What do you mistakenly think this has to do with OTPs?

Re:One time pad (0)

Anonymous Coward | about 2 months ago | (#47737631)

For personal use sneaker net works just fine. That's why I mentioned microSD cards. None of the problems that you mentioned present much of a challenge for personal use. These days most people carry smart phones capable of holding huge libraries of OTPs and exchanging them face-to-face.

There is a large industry of talking heads and idiots that insist on complex insecure encryption approaches to justify their existence. You seem to have bought into their garbage. It is usually only necessary to risk using these algorithms between people who do not meet in meat space (e-commerce is the most common use where the key distribution problem is real). E-commerce is a large and important problem but it is not the same problem as personal communication with your friends, family and "things."

The point about banks is that they already deliver a physical card to you every few years. The economics of non-volatile memory makes it inexcusable that personal financial transactions are not properly secured with OTPs. Unfortunately they don't seem to have the correct economic incentive.

While, I'm on my soapbox OTP is also the reason that we know that the NSA mass surveillance can never be an effective tool against terrorist communications. It really IS all about the metadata, finding the connections between people and organizations -- perhaps years before any criminal activity is contemplated.

Finally, to answer your question: yes I have thought about this a lot. I design secure communication devices for a living. They are used by the US government/military and undergo lengthy certification. I'm not just talking out my ass.

Re:One time pad (1)

Zero__Kelvin (151819) | about 2 months ago | (#47737759)

"For personal use sneaker net works just fine. "

Yes, I'll just sneakernet my OTPs to every light fixture, toaster, refrigerator and whatever else, fire up the UI, plug in the MicroSD card to the MicroSD Card Reader ... oh wait! Did I just suggest that all my light fixtures will have a UI and MicroSD card?

I didn't read the rest of your post. You have a history of lack of forethought and I have no doubt it would be far too easy to blow holes in every other thing you wrote.

Re:One time pad (1)

Darinbob (1142669) | about 2 months ago | (#47738707)

Some devices use those, or smartcards. However some devices don't; they're too small, or are owned by utilities who don't want someone else messing with them, etc. A MicroSD is not necessarily secure either, how do you know if one has been removed and replaced with a fake? On-board flash with write protected blocks is a lot safer, though at some point someone highly determined will break in (desolder things, etc).

When was gartner... (2, Insightful)

Anonymous Coward | about 2 months ago | (#47735429)

When was gartner right about anything ?

Re:When was gartner... (2)

Cornwallis (1188489) | about 2 months ago | (#47735625)

Many many years ago Gartner said it cost some ridiculous amount of $$$ to support a workplace desktop. A little over a decade ago they said it would cost $3K/yr to support a handheld. I've never paid attention to anything they've had to say since.

Re:When was gartner... (1)

tepples (727027) | about 2 months ago | (#47736363)

A little over a decade ago they said it would cost $3K/yr to support a handheld.

How much did cellular voice and data cost back then?

Re:When was gartner... (0)

Anonymous Coward | about 2 months ago | (#47739581)

I remember that one. According to Gartner's calculations, my workplace's desktop support costs exceeded my total IT budget by a factor of 2 or 3. They're right about a lot of things, but it's important to remember that they and the other big consulting/think tank firms will NEVER tell you do keep on doing what you're doing because you already know how to do that and are good at it. Instead, they want you thinking you need to be doing things you're not good at and therefore need their help with. Hence: the Internet of Things as the buzzword of the year.

Luckily this one is easy to manage by yourself since it largely consists of putting things on the Internet that have no business being there in the first place other than making some marketer happy. Properly firewalling these things off with rules denying inbound OR outbound access or never connecting them in the first place is the correct and only suitable response. So is not buying them in the first place and, if possible, avoiding dealing with companies stupid enough to make them. For example, I don't need my f*cking thermostat connected to the Internet, and if I do for some reason desire that, I don't need a managed privacy invading cloud app to get me hooked up to it. If you require such a setup to connect to your own stuff, you don't know what you're doing and shouldn't have one anyway.

As long as I'm on that rant: Attention everybody who has some kind of managed security system with cameras inside your house: If you can connect to your camera over the Internet, so can the alarm company and anybody who bribes/bullies/legally compels them to.

will NOT have learned from Target (4, Insightful)

dltaylor (7510) | about 2 months ago | (#47735463)

Most of the management types I've met have just enough functioning brain cells to kiss ass and repeat whatever mantra they learned in MBA school or during the most recent management retreat.

Target was breached because HVAC maintenance had access to the same network as the POS terminals, which is inexcusable stupidity. Unfortunately, this is exactly what will happen with the IoT devices. Putting them on an entirely separate network (own APs for wireless, blinkenlights, ...) will cost something, and, since the CIOs don't spend hard time in a closed prison for exposing their systems, or the personal data of employees or customers, they simply will not authorize the expenditure.

Re:will NOT have learned from Target (5, Insightful)

Anonymous Coward | about 2 months ago | (#47735525)

Exactly. I have yet to see a compelling argument or application for this "Internet of Things." I mean, it's a really catchy buzzword. I know my toaster is bored most of the day, having only 5 minutes' work to do each morning, and I can see where it might enjoy surfing the web during downtime. Maybe I'm just not very creative, that I fail to imagine the wondrous potential embodied in uploading my toast-cooking routine and consumption to the cloud. WTF do people want this?

Until someone can explain the actual benefit to me, I'm going to see "Internet of Things" as a way to turn every object in my house into an advertisement and a potential hole in my already fragile network security.

Re:will NOT have learned from Target (3, Interesting)

Anonymous Coward | about 2 months ago | (#47735627)

Exactly. I have yet to see a compelling argument or application for this "Internet of Things." I mean, it's a really catchy buzzword. I know my toaster is bored most of the day, having only 5 minutes' work to do each morning, and I can see where it might enjoy surfing the web during downtime. Maybe I'm just not very creative, that I fail to imagine the wondrous potential embodied in uploading my toast-cooking routine and consumption to the cloud. WTF do people want this?

Until someone can explain the actual benefit to me, I'm going to see "Internet of Things" as a way to turn every object in my house into an advertisement and a potential hole in my already fragile network security.

You want an explanation?

Outside of IT, name 10 people you know who that have ever used the words "potential hole" and "fragile network security" when discussing their home wifi concerns.

As far as your quest for a compelling argument, the audience hardly compels me with their brilliance. Consumers are for the most part children regardless of age, proven by the billions generated on some of the silliest shit in existence. Children want toys, not rules, hence the IOT we have today.

Re:will NOT have learned from Target (2)

CaptainDork (3678879) | about 2 months ago | (#47736557)

This is wrong-think.

People who support the, "users are stupid," mentality are asshats.

Design shit that works the way it is supposed to. Expecting consumer paranoia is evidence of crappy system design.

The first thing I test for when hiring is a flawed outlook like yours and when I do, the interview is over.

Re:will NOT have learned from Target (1)

alen (225700) | about 2 months ago | (#47735931)

but imagine if you can put bread in your toaster and start it up on your phone in the shower so it will be perfectly toasted when you get out of the shower

Re:will NOT have learned from Target (1)

Opportunist (166417) | about 2 months ago | (#47736173)

How did we ever exist without...

Re:will NOT have learned from Target (2)

Zero__Kelvin (151819) | about 2 months ago | (#47737633)

"but imagine if you can put bread in your toaster and start it up on your phone in the shower so it will be perfectly toasted when you get out of the shower"

This is Slashdot. Who the hell only eats bread once a week?

Re:will NOT have learned from Target (1)

Darinbob (1142669) | about 2 months ago | (#47738745)

We already have an "internet of things", for many years now. Computers are things. Mobile phones are things. The difference is now smaller things are networked (not necessarily on the "internet" though), and things not typically networked. Ie, smart meters, remote monitoring devices and sensors, televisions. There are the things that are only extremely loosely considered to be networked, attachment via bluetooth.

Many of those internet of things devices won't ever be addressable by the general public, and there won't be any "cloud". This stuff is not just about phones or social media. And many of the devices have quality security designed with a paranoia mindset rather than devices with an attitude to sell advertising.

Re:will NOT have learned from Target (0)

Anonymous Coward | about 2 months ago | (#47740533)

but omg social!! I have comcast social media service!!

Re:will NOT have learned from Target (2, Informative)

Anonymous Coward | about 2 months ago | (#47735589)

The entire premise of the article as given by the headline "Securing Networks in the Internet of Things Era" is bogus. The hard shell soft core (aka boundary security) strategy isn't applicable to the internet of things, because the things are necessarily going to be on a "network" that an attacker can access: It's all wireless. If you can't get to them through the gateway, you can always talk to them directly over the air. You can't protect the things by protecting the network. (With more and more ways for hostile systems to access "internal" networks directly, network border security is increasingly becoming a useless strategy in general computing as well. Reflection attacks, where compromised internal hosts are used as stepping stones to get to the entire network, have been eating away at border gateway security for a long time anyway.)

Re:will NOT have learned from Target (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736057)

If you can't get to them through the gateway, you can always talk to them directly over the air.

Somebody should invent WPA2!

Re:will NOT have learned from Target (1)

Darinbob (1142669) | about 2 months ago | (#47738769)

We already have better security than WPA2, which existed before WPA2 was invented.

Wired networks are not necessarily more secure than wireless networks. The only thing wired networks provides is a minor physical hurdle. We have plenty of rs232 cables connecting vital infrastructure which is vastly less secure than many wireless devices.

Re:will NOT have learned from Target (1)

Zero__Kelvin (151819) | about 2 months ago | (#47738799)

Is there some reason for your rambling? The OP said that anything wireless can be accessed by anyone in range. I pointed out how stupid that was. I never said there is no better security than WPA2 or that wired is automagically more secure than wireless. These are all fantasies you seem to have had spontaneously.

Re:will NOT have learned from Target (0)

Anonymous Coward | about 2 months ago | (#47740847)

How stupid that was? Anything wireless CAN be accessed by anyone in range. The only way to prevent shenanigans is to secure the device, i.e. make it refuse data from anyone who isn't authorized to talk to it. That is DEVICE SECURITY, not network security. What you fail to realize is that a secure wireless network is an abstraction. The "secure" part is only as secure as each individual device's implementation. The network can do jack shit to prevent an attacker from talking to a device.

Re:will NOT have learned from Target (1)

Zero__Kelvin (151819) | about 2 months ago | (#47741385)

You're right. I should have mentioned that wireless security stopspeople from accessing the device, and makes it untrue to say that anyone withing range can access it. Oh wait ...

" That is DEVICE SECURITY, not network security."

All I can say is Holy Shit! I mean seriously. Holy Fscking Shit. The fact that you think device security isn't a subset of network security just boggles the mind.

Re:will NOT have learned from Target (1)

NotSanguine (1917456) | about 2 months ago | (#47737539)

...(With more and more ways for hostile systems to access "internal" networks directly, network border security is increasingly becoming a useless strategy in general computing as well. Reflection attacks, where compromised internal hosts are used as stepping stones to get to the entire network, have been eating away at border gateway security for a long time anyway.)

Not useless, just not enough. cf. Defense in-depth [wikipedia.org] .

Re:will NOT have learned from Target (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736051)

So maybe nobody mentioned this, but you do know that most homes, and even most companies, don't have CIOs, right?

Re:will NOT have learned from Target (2)

Opportunist (166417) | about 2 months ago | (#47736189)

And that's what's wrong with our world. The most important positions remain unfilled, I'm almost certain that I'm the only household around this area that has a CISO.

Re:will NOT have learned from Target (1)

dltaylor (7510) | about 2 months ago | (#47736229)

Actually, they do, but the person in that position doesn't even know what it means, much less how to deal with it.

Picture an internet where home users must havea license to access the iy, or hire a "chaffeur" to manage their systems and there are penalties for failing to secure them. Many fewer bot farms, I suspect.

Re:will NOT have learned from Target (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736355)

"Actually, they do, but the person in that position doesn't even know what it means, much less how to deal with it."

Yes, and every computer owner is a software engineer; most of them simply don't know the first thing about software engineering*!

* Substitute Slashdot member for computer owner to make the above statement true :-)

Re:will NOT have learned from Target (1)

epyT-R (613989) | about 2 months ago | (#47740541)

Yeah, but only because the net will then be so expensive and legally risky to use that people just won't use it very much.

That's ridiculous. Smaller is easier to secure. (1)

Anonymous Coward | about 2 months ago | (#47735485)

The most secure computing device in general use is also the smallest: The (mini-, micro-, nano-) SIM card in your GSM phone does crypto that's good enough for payment processing. NFC cards are the same technology, just wireless. These cards run on microwatts. If the internet of things is insecure than it's due to laziness and cheapness, not because there's a technological problem. Minimal computing capabilities my ass.

Re:That's ridiculous. Smaller is easier to secure. (0)

Anonymous Coward | about 2 months ago | (#47735653)

Yeah well, I'm just not going to plug these "things" in.

Now that's truly secure.

Securing the Internet of Things is easy (2)

Rosco P. Coltrane (209368) | about 2 months ago | (#47735641)

The Internet of Things is a buzzword. Buzzwords don't need securing. Problem solved.

Re:Securing the Internet of Things is easy (1)

Ol Olsoc (1175323) | about 2 months ago | (#47735885)

The Internet of Things is a buzzword. Buzzwords don't need securing. Problem solved.

Speaking of Buzzwords, just imagine a Sybian on the internet.

Re:Securing the Internet of Things is easy (1)

fisted (2295862) | about 2 months ago | (#47735953)

Honestly, there are enough sybians on the internet already...

Re:Securing the Internet of Things is easy (1)

Ol Olsoc (1175323) | about 2 months ago | (#47736025)

Honestly, there are enough sybians on the internet already...

Yeah, but think about the business model.

People could pay to give Felicity a good time, just use their credit card to keep them good vibes coming.

Felicity too.

Re:Securing the Internet of Things is easy (1)

tepples (727027) | about 2 months ago | (#47736381)

Before or after Elop?

Re:Securing the Internet of Things is easy (1)

Livius (318358) | about 2 months ago | (#47735907)

It's not easy, since "Securing Networks In the Internet of Things Era" means exactly the same thing as "Securing Networks".

Re:Securing the Internet of Things is easy (2)

Zero__Kelvin (151819) | about 2 months ago | (#47736107)

It's actually not a buzzword, any more than the term network was a buzzword in the 1970s. Cloud is a buzzword. Web 2.0 is a buzzword. Paradigm can be a buzzword when used incorrectly. The IoT is a term that describes something that is not only implementable, but currently being implemented. It describes something that actually exists. There is no cloud. There is no seperate Web called Web 2.0. There is an Internet, and it does have things attached to it.

Re:Securing the Internet of Things is easy (1)

Anonymous Coward | about 2 months ago | (#47736203)

It is a buzzword. The "Internet of Things" is just "The Internet". There is zero difference between the two beyond superficialities.

Re:Securing the Internet of Things is easy (0)

Zero__Kelvin (151819) | about 2 months ago | (#47736337)

No. It is not. You could argue with DARPA if you want, but the Internet was always intended to connect computers. While it is true that coke machines have been connected to the network by MIT as a novelty (for example), saying that the idea of connecting completely different systems to the internet for the purpose of doing something other than computing is just "the internet" is patently absurd.

What's a thing? (1)

tepples (727027) | about 2 months ago | (#47736415)

connecting completely different systems to the internet for the purpose of doing something other than computing

Define a "thing" and distinguish it from "computing" to help some of us understand. Is a printer a "thing"?

Re:What's a thing? (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736501)

Most of us have graduated from elementary school, and understand that "Internet of a bunch of things that aren't related to computing" is excessivey and unecessarily verbose. Clearly, you are a unique individual. It turns out that isn't always a good thing, BTW.

Re:What's a thing? (1)

tepples (727027) | about 2 months ago | (#47736579)

Let me rephrase: What makes a thing "related to computing"?

Re:What's a thing? (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736603)

Let me rephrase: Attend an elementary school. They teach that now!

Re:What's a thing? (0)

Anonymous Coward | about 2 months ago | (#47736873)

Most of us have graduated from elementary school, and understand that "Internet of a bunch of things that aren't related to computing" is excessivey and unecessarily verbose.

Yeah, that's why those of us with working brains realize that it's just called "The Internet".

Re:Securing the Internet of Things is easy (0)

Anonymous Coward | about 2 months ago | (#47736861)

No. It is not.

So how do "things" make the Internet something other than interconnected networks?

You could argue with DARPA if you want, but the Internet was always intended to connect computers.

And these "things" run computers in them.

While it is true that coke machines have been connected to the network by MIT as a novelty (for example), saying that the idea of connecting completely different systems to the internet for the purpose of doing something other than computing is just "the internet" is patently absurd.

In what way beyond superficialities is it different? You've merely asserted it is different.

Re:Securing the Internet of Things is easy (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736951)

"And these "things" run computers in them."

That sentence doesn't even parse, but no. On a completely unrelated note, please look up the definition of computing*. The intelligent members of the universe thank you.

* I'll even give you a hint. Cars aren't computers!

Re:Securing the Internet of Things is easy (1)

NotSanguine (1917456) | about 2 months ago | (#47737563)

"And these "things" run computers in them."

That sentence doesn't even parse, but no. On a completely unrelated note, please look up the definition of computing*. The intelligent members of the universe thank you. * I'll even give you a hint. Cars aren't computers!

That's true. But How many computers are embedded in cars? [nytimes.com] .

Re:Securing the Internet of Things is easy (1)

Zero__Kelvin (151819) | about 2 months ago | (#47737589)

That was the point actually*, but thanks for playing!

*Putting a computer in something doesn't make the thing a computer

Re:Securing the Internet of Things is easy (1)

NotSanguine (1917456) | about 2 months ago | (#47737681)

That was the point actually*, but thanks for playing! *Putting a computer in something doesn't make the thing a computer

That is true. However, just because you embed a computer in something that's not a computer doesn't magically make that embedded computer something else. It's still a computer. And that computer will, assuming it has power applied and some code to execute, compute. I guess I'm not really clear on your point. Please elucidate. Thanks!

Re:Securing the Internet of Things is easy (1)

Zero__Kelvin (151819) | about 2 months ago | (#47737957)

" I guess I'm not really clear on your point."

That's OK. We'll just add it to the very long list of things you are not clear on.

Re:Securing the Internet of Things is easy (1)

NotSanguine (1917456) | about 2 months ago | (#47738187)

" I guess I'm not really clear on your point."

That's OK. We'll just add it to the very long list of things you are not clear on.

Please. Publish that list. Do you really get off on this whole trolling business? My feathers aren't ruffled, I'm not annoyed or upset. More than anything, I'm just amused at the mixture of insults, poorly delineated thoughts and general silliness on your part.

In any case, why don't you go upstairs and raid mom's fridge while I discuss this stuff with the grownups. There's a good boy.

Re:Securing the Internet of Things is easy (0)

Anonymous Coward | about 2 months ago | (#47737027)

"...but the Internet was always intended to connect computers"

What the fuck do you think the IoT is FFS? Your toaster doesn't get just a network card bolted on to the side. It comes with a small purpose built computer to run the interface.

That is what is wrong with /. nowadays. You are all over this fucking thread with your bullshit and you know nothing at all about the basic tech involved.

Re:Securing the Internet of Things is easy (0)

Zero__Kelvin (151819) | about 2 months ago | (#47737123)

" It comes with a small purpose built computer to run the interface."

And the purpose of that small computer is not to ... wait for it ... act as a general purpose computer!

"That is what is wrong with /. nowadays. You are all over this fucking thread with your bullshit and you know nothing at all about the basic tech involved."

Actually there are at least two things wrong with Slashdot today:

1) It has been flooded with peope who are too stupid to create a Slashdot account and don't understand that the purpose of AC is supposed to be to post when there is a reason why you would want to remain anonymous (e.g. you work at a company and want to provide inside info)

2) Those same idiots don't know the difference between an embedded system and a general purpose computer.

Re:Securing the Internet of Things is easy (1)

NotSanguine (1917456) | about 2 months ago | (#47737607)

2) Those same idiots don't know the difference between an embedded system and a general purpose computer.

Ooh! Ooh! Mr. Kotter! Mr. Kotter! I know the difference! But I'm not sure why that matters. Ask yourself this question (since you clearly haven't done so yet): What is the purpose of connecting anything to a network? To communicate with other devices. Whether those devices are toasters, routers, switches, fondue machines, laptops, automatic tie racks or smart phones is irrelevant. The raison d'etre for network connectivity is the same.

Here's a good question for you. Is a smartphone an embedded device or a general purpose computer? A better question: Does it really matter?

Re:Securing the Internet of Things is easy (0)

Zero__Kelvin (151819) | about 2 months ago | (#47737665)

"What is the purpose of connecting anything to a network? To communicate with other devices."

I'm learning something new from a guy with a ridiculously high SlashID now! Up until now I thought that the purpose of the internet was to allow people to communicate! Now I know it is was devices the whole time! RFC822 was just a ruse! That Tim Berners Lee guy? Just trying to throw us off the scent with has damn human readable content ruse! The ability to share documents? Again, it is about the devices sharing, not people! Network printers? Again, nobody was ever supposed to read the shit after it was printed!

Yes kid, you are clueless.

Re:Securing the Internet of Things is easy (1)

NotSanguine (1917456) | about 2 months ago | (#47737861)

"What is the purpose of connecting anything to a network? To communicate with other devices."

I'm learning something new from a guy with a ridiculously high SlashID now! Up until now I thought that the purpose of the internet was to allow people to communicate! Now I know it is was devices the whole time! RFC822 was just a ruse! That Tim Berners Lee guy? Just trying to throw us off the scent with has damn human readable content ruse! The ability to share documents? Again, it is about the devices sharing, not people! Network printers? Again, nobody was ever supposed to read the shit after it was printed! Yes kid, you are clueless.

Again, I'm not clear on your point. I did get the ad-hominems (thanks for those, by the way -- that was very sweet!). And your attempt to ridicule me for my /. ID was especially humorous. What is more, at 47 years old, it is kind of nice to be called 'kid'.

While having (with appropriate security controls) control systems and other devices connected to a network (note, I did not say "the Internet" although in appropriate circumstances that can be useful too) can be extremely useful, I'm no fan of connecting every damn fool thing to the Internet. There's no reason why I need to monitor my microwave oven (someone might be making popcorn -- that must be stopped!) or make sure that the bleach levels in my washing machine are optimal while I'm at the movies.

Beyond that, go ahead and read the IP [ietf.org] , UDP [ietf.org] and TCP [ietf.org] protocol specifications. I have -- and first did so nearly a decade *before* Berners-Lee, et. al. published the the HTTP protocol specification [ietf.org] . The whole point of the TCP/IP suite, as well as the DARPA/NSFNet/Internet was to interconnect devices to facilitate communications. Having read and understood those documents over the last 20+ years, I can say with some confidence that they do not require that connected devices be "general purpose" or "human focused." New applications which take advantage of these protocols are developed all the time.

SMTP and HTTP are applications that ride on top of the TCP/IP suite. They are applications which were developed to enhance the capabilities of interconnected networks. Others, such as the RPC spec [ietf.org] are designed specifically for device to device communications.

Leaving aside your sarcasm, ill humor and general negativity, I still don't understand what point you're trying to make. Other than attacking me what, if anything, are you trying to add to this conversation? That's not a veiled slur, I really would like to understand. Please elucidate. Pretty please!

Re:Securing the Internet of Things is easy (1)

Zero__Kelvin (151819) | about 2 months ago | (#47737941)

" The whole point of the TCP/IP suite, as well as the DARPA/NSFNet/Internet was to interconnect devices to facilitate communication of people. -implied content added

That's the part you don't quite seem to get. The difference between people and things seems to elude you.

Re:Securing the Internet of Things is easy (1)

NotSanguine (1917456) | about 2 months ago | (#47738175)

" The whole point of the TCP/IP suite, as well as the DARPA/NSFNet/Internet was to interconnect devices to facilitate communication of people. -implied content added

That's the part you don't quite seem to get. The difference between people and things seems to elude you.

I see. So your premise is that there is no *valid* purpose for computer networks other than to connect people to other people? Okay then. So, you've never heard of Networked Control Systems [wikipedia.org] or automated data transfers or machine generated/updated databases or a myriad of other applications where people are completely irrelevant to the equation.

I'm guessing you're not quite that stupid, so I'm going to assume you're trolling and ignore you. Ciao! Have a great day!

Re:Securing the Internet of Things is easy (1)

Zero__Kelvin (151819) | about 2 months ago | (#47738775)

Great. Now show me where I said that networks have never connected things before prior to 2014*, then show me in the DARPA proposal where it talks about creating a network of things, or an IETF ratified RFC that specifies the protocols and implementation details that would be used to do it.

"I'm guessing you're not quite that stupid"

Great. Now if you could just figure out that you are quite stupid, we'll have made some headway.

*Oh wait, that's right. I explicitly pointed out that they have, and used the MIT Soda Machine as an example!

Re:Securing the Internet of Things is easy (3, Insightful)

Opportunist (166417) | about 2 months ago | (#47736225)

Sorry, but "Internet of Things", the term at least, has become a buzzword. As you correctly identified, it's bullshit bingo material considering that pretty much anything connected to the internet almost invariably has to be a thing (apologies to all the cyborgs out there). The "buzzwordism" (I really hope that doesn't become a buzzword now...) lies in the term meaning something along the line of "appliances connected to the internet that were not supposed to be connected when they were originally created". Routers, switches, hubs, bridges... they are by definition supposed to be connected to some sort of network. They have no use outside of one. Computers, gaming consoles and maybe even TVs kinda "belong" on a network, because even though they have a use without, it kinda makes sense to connect them.

It's different for what the appliance industry termed "white goods". Washing machines, dryers, fridges, stoves... they came into existence long, long before anything remotely resembling a computer or internet, and people don't immediately consider them something they would possibly connect to a network. Those are the "things" the "internet of things" talks about.

And this is basically also the reason why "internet of things" belongs to the buzzwords. Or, maybe rather, buzzterms. It's a made up term that qualifies a certain group of items that makes no sense whatsoever outside the world of marketing.

Re:Securing the Internet of Things is easy (1)

Zero__Kelvin (151819) | about 2 months ago | (#47736373)

"bullshit bingo material considering that pretty much anything connected to the internet almost invariably has to be a thing"

Well I've never played Bullshit Bingo, but the term refers to all that which is not for the purposes of computing. One could also argue that when someone is using the internet they are a person connected to the internet, and that when a location that did not have internet acces, that place now has internet acccess, and thus that place is now connect to the intenet. See also: I was going to go to that cafe, but they don't have internet :-("

" Routers, switches, hubs, bridges... they are by definition supposed to be connected to some sort of network."

Your mistake seems to be in thinking that the IoT refers to these devices. It doesn't.

"Those are the "things" the "internet of things" talks about."

Hey. You figured it out, if a little too late. All you have to figure out now is that you just pointed out why IoT is absolutely not a buzzword, but rather describes something new that actually exists, and continues to evolve.

Seperate VLAN. (3, Interesting)

Karmashock (2415832) | about 2 months ago | (#47735759)

You can buy a router for 200 bucks that can do port by port VLAN or create different Wifi SSIDs that link to different VLANs.

Put all your internet of things stuff on VLAN 2, then setup firewall rules that allow the hub for the internet of things devices to either communicate directly with a control system on VLAN1 or just go out to the internet. If VLAN 2 is compromised... it will not compromise VLAN 1.

Re:Seperate VLAN. (3, Interesting)

dotwhynot (938895) | about 2 months ago | (#47735843)

You can buy a router for 200 bucks that can do port by port VLAN or create different Wifi SSIDs that link to different VLANs.

Put all your internet of things stuff on VLAN 2, then setup firewall rules that allow the hub for the internet of things devices to either communicate directly with a control system on VLAN1 or just go out to the internet. If VLAN 2 is compromised... it will not compromise VLAN 1.

What happens when your 200 bucks router is compromised?

Re:Seperate VLAN. (3, Interesting)

Karmashock (2415832) | about 2 months ago | (#47735909)

Same thing that happens when your router is compromised today. Its a zero sum game. At least the router has a chance of repelling an intrusion because it has some security features built into it. The IoTs stuff is naked.

My worry with IoTs stuff is that an outside intruder will gain control over them through the internet. I'm less worried about a war driver tapping in from the street. The router idea should provide my computers protection from the shotty security of the IoTs.

Ideally the IoTs stuff should not link to some centralized cloud server but rather host itself locally. If it does that, then I can set the incoming port numbers to something random and at that point its pretty unlikely anything is going to touch my system.

Logging into my local hub of IoTs stuff should work something like this:

https://myhomeiprandomportnumb... [myhomeiprandomportnumber]

At that point while a breach is possible its just very unlikely.

Re:Seperate VLAN. (0)

Anonymous Coward | about 2 months ago | (#47737159)

personally I think that a wireless mesh network would work better for the types of things that people here are discussing. your toaster and your iphone both have enough power (both computing and electrically) to support fairly strong encryption a tiny chip in your jeans that lets you know when some one else has the same ones on when you pass them on the street by pushing a notification to your iphone/ smart watch, not so much. Thats where security holes are going to happen, granted in this example it wouldn't be severe but thats the idea.

Re:Seperate VLAN. (2)

Opportunist (166417) | about 2 months ago | (#47736231)

Routers are (hopefully...) a bit more advanced in their security makeup, considering that they are routinely used by people who don't think TCP is the three letter acronym for the Chinese secret service, not to mention that there has been a bit of time now to find bugs in router hard- and software and iron them out.

Re:Seperate VLAN. (0)

Anonymous Coward | about 2 months ago | (#47736515)

Routers are (hopefully...) a bit more advanced in their security makeup, considering that they are routinely used by people who don't think TCP is the three letter acronym for the Chinese secret service, not to mention that there has been a bit of time now to find bugs in router hard- and software and iron them out.

Routers are routinely compromised in large numbers today.

So ... (1)

cascadingstylesheet (140919) | about 2 months ago | (#47735833)

... we need to have an insecure buzzword, to "change our relationship" with the Internet? Why?

Re:So ... (2, Insightful)

Anonymous Coward | about 2 months ago | (#47735979)

You need to for the following reason.

A billion people who are clueless will buy IoT refrigerators, TVs, toasters, lamps, thermostats, washing machines, dishwashers, and so on.

Companies will cater to this market, and moreover will stop making non-IoT enabled devices.

"No problem", you think, "I just won't put them on the network". But to get around this and ensure you can be data-mined, the devices will be designed not to operate without connecting to their "home base" advertising company.

So the answer is: you need to "change your relationship with the internet" because you'll want to keep turning on your lamps, setting your thermostat, washing your clothes, refrigerating your food, etc.

You might think, "OK, I just won't buy any new devices". That works for a while. But eventually devices break, people need new ones, and we'll be locked into the world of IoT.

You might think, "don't buy those devices and they'll stop making them". But it won't work, because a billion other people will buy them, and a handful of people who refuse don't matter on this scale.

That's why.

HTH.

Re:So ... (1)

Opportunist (166417) | about 2 months ago | (#47736241)

Do you write dystopian stories in your pastime? If not, you should.

Re: So ... (0)

Anonymous Coward | about 2 months ago | (#47738083)

If you wrote an accurate description of reality in this day and age and showed that to somebody 20 years ago, it would be described as dystopian.

We are now living in a dystopian era.

Lose Internet and your food spoils (1)

tepples (727027) | about 2 months ago | (#47736439)

Companies [...] will stop making non-IoT enabled devices. [...] the devices will be designed not to operate without connecting to their "home base" advertising company.

Then there's an opportunity for a competitor to say in an ad "Do you want your food to spoil just because your Internet went out? You don't have to worry about that with a QSI refrigerator."

You are probably correct... (1)

bagofbeans (567926) | about 2 months ago | (#47736561)

..but in 30 years. Meanwhile, the toaster manufacturer needs Granny to be able to but and use it without explicitly pluuging in a network or configuring anything.

So IOT devices will have to have wifi sneak capabilities, always trying to establish a wifi connection. They can continually try to crack encrypted wifis.

It will be an interesting household with a few dozen nodes continually spamming the aether trying for connection.

Avoid IoT at all costs (2)

sinij (911942) | about 2 months ago | (#47735949)

There is very little upside to having various infrastructure devices and appliances networked. Downside are too numerous to list here, and securing them is overly expensive.

Solution? Air gap it!

Re:Avoid IoT at all costs (2, Informative)

Anonymous Coward | about 2 months ago | (#47736017)

Then you won't be feeding the ad and data mining engines. Devices will be designed not to work if they can't send your data back to their home base.

Think I'm kidding? [ideerapp.com]

That's just the beginning. Wait and watch. You'll see. There's nothing you can do to prevent it, because people who don't think about things will ensure this model succeeds in the marketplace.

Re:Avoid IoT at all costs (1)

Opportunist (166417) | about 2 months ago | (#47736263)

Just trust the free market.

Or, put another way, rest assured the first thing I do when I find shit like that in my fridge is to create a server that tells my fridge everything is all right and plays a Tom and Jerry cartoon (sans PC-censoring) instead of an ad on the built in screen.

I'll hand you the source when it's done. Just in case you prefer another cartoon

Re:Avoid IoT at all costs (1)

rthille (8526) | about 2 months ago | (#47736899)

The trouble is, you might first have to conduct a side-channel attack on the crypto chip in your fridge to get its key so you can properly encrypt the messages to say "everything is all right".

Re:Avoid IoT at all costs (0)

Anonymous Coward | about 2 months ago | (#47737019)

Yes. And the number of people who will be able to do that is vanishingly small.

Re:Avoid IoT at all costs (1)

flyingfsck (986395) | about 2 months ago | (#47736711)

Yup - an ethernet port is handy to configure something, but there is little need to hook every thingummababber to a network switch.

Re: Avoid IoT at all costs (0)

Anonymous Coward | about 2 months ago | (#47738109)

Air gap it? How is that going to stop it communicating over wireless?

Re:Avoid IoT at all costs (1)

Darinbob (1142669) | about 2 months ago | (#47738827)

The advantages can be enormous though. Consider smart meters. Utilities didn't even know when there was a power outage with old analog meters, until enough customers called in no trucks would roll. That's because if they respond to the first call it's almost always a blown fuse in a home. Similarly utilities did not know even the most basic facts about their infrastructure, like whether a neighborhood is being delivered the right voltage balanced across the phases, unless they sent an employee out to check. Having sensors on the distribution and transmission grids allows monitoring what is happening. It can alert to problems or emergencies quickly, such as gas leaks. It even works in winter when the regular meter readers don't bother showing up for 3 months and just estimate your bill.

Consider street lights and traffic lights. It would be a good idea to know soon when elements have burned out. We have cameras that detect traffic better than the eye-in-the-sky helicopter.

Yes it would be a great jobs program to get rid of all networks, but the municipalities, utilities, and government agencies are going to cut corners and not send someone to monitor every few hours.

No Default Route (1)

Anonymous Coward | about 2 months ago | (#47735981)

Most things like printers do not need to talk to the entire Internet. They just need to talk to the local network. So remove their default route. Without a route to the Internet, discover/communication/mischief becomes much more difficult. Its not perfect, but its an easy policy to remember. If it doesn't need to send packets out, then don't tell it how to get there..

Re:No Default Route (2)

flyingfsck (986395) | about 2 months ago | (#47735999)

Yup - only enable services that are actually needed. That reduces the attack surface. A printer doesn't need a default route, a DNS server address, a FTP/Telnet server and many other things that HP and others enable by default in their printers.

Re:No Default Route (1)

tepples (727027) | about 2 months ago | (#47736463)

Most things like printers do not need to talk to the entire Internet.

Even with things like Apple AirPrint and Google Cloud Print? Or printing postage?

Re:No Default Route (0)

Anonymous Coward | about 2 months ago | (#47737137)

Are you taking your medication? If not please go take it now.

He said "most things like printers", not "all printers everywhere in every situation".

Now why don't you try being part of the actual conversation for once instead of being an immature dink that attacks whatever part of a comment that you happen to fix upon.

Re:No Default Route (1)

tepples (727027) | about 2 months ago | (#47737183)

My fault. I parsed "like" to mean "such as". I could do without the abusive language though.

If it's got a std. BSD IP stack? This helps (-1)

Anonymous Coward | about 2 months ago | (#47737013)

My FREE program for hosts file construction adds security, speed, reliability, + anonymity & does more, more efficiently by FAR vs. addons + fixes DNS' security issues:

APK Hosts File Engine 9.0++ 32/64-bit:

http://start64.com/index.php?o... [start64.com]

Summary:

---

A.) Hosts do more than:

1.) AdBlock ("souled-out" 2 Google/Crippled by default)
2.) Ghostery (Advertiser owned) - "Fox guards henhouse"
3.) Request Policy -> http://yro.slashdot.org/commen... [slashdot.org]

B.) Hosts add reliability vs. downed/redirected dns (& overcome redirects on sites, /. beta as an example).

C.) Hosts secure vs. malicious domains too -> http://tech.slashdot.org/comme... [slashdot.org] w/ less added "moving parts" complexity/room 4 breakdown,

D.) Hosts files yield more:

1.) Speed (adblock & hardcodes fav sites - faster than remote dns)
2.) Security (vs. malicious domains serving malcontent + block spam/phish & trackers)
3.) Reliability (vs. downed or Kaminsky redirect vulnerable dns, 99% = unpatched vs. it & worst @ isp level + weak vs Fastflux + dynamic dns botnets)
4.) Anonymity (vs. dns request logs + dnsbl's).

---

* Hosts do more w/ less (1 file) @ faster levels (ring 0) vs redundant inefficient addons (slowing slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ os, & 1st net resolver queried w\ 45++ yrs.of optimization).

* Addons = more complex + slow browsers in message passing (use a few concurrently & see) & are nullified by native browser methods - It's how Clarityray is destroying Adblock.

* Addons slowup slower usermode browsers layering on more - & bloat RAM consumption too + hugely excessive cpu use (4++gb extra in FireFox https://blog.mozilla.org/nneth... [mozilla.org] )

Work w/ a native kernelmode part - hosts files (An integrated part of the ip stack)

APK

P.S.=> "The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"

...apk

If it's got a std. BSD IP stack? This helps (0)

Anonymous Coward | about 2 months ago | (#47737807)

My FREE program for hosts file construction adds security, speed, reliability, + anonymity & does more, more efficiently by FAR vs. addons + fixes DNS' security issues:

APK Hosts File Engine 9.0++ 32/64-bit:

http://start64.com/index.php?o... [start64.com]

Summary:

---

A.) Hosts do more than:

1.) AdBlock ("souled-out" 2 Google/Crippled by default)
2.) Ghostery (Advertiser owned) - "Fox guards henhouse"
3.) Request Policy -> http://yro.slashdot.org/commen... [slashdot.org]

B.) Hosts add reliability vs. downed/redirected dns (& overcome redirects on sites, /. beta as an example).

C.) Hosts secure vs. malicious domains too -> http://tech.slashdot.org/comme... [slashdot.org] w/ less added "moving parts" complexity/room 4 breakdown,

D.) Hosts files yield more:

1.) Speed (adblock & hardcodes fav sites - faster than remote dns)
2.) Security (vs. malicious domains serving malcontent + block spam/phish & trackers)
3.) Reliability (vs. downed or Kaminsky redirect vulnerable dns, 99% = unpatched vs. it & worst @ isp level + weak vs Fastflux + dynamic dns botnets)
4.) Anonymity (vs. dns request logs + dnsbl's).

---

* Hosts do more w/ less (1 file) @ faster levels (ring 0) vs redundant inefficient addons (slowing slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ os, & 1st net resolver queried w\ 45++ yrs.of optimization).

* Addons = more complex + slow browsers in message passing (use a few concurrently & see) & are nullified by native browser methods - It's how Clarityray is destroying Adblock.

* Addons slowup slower usermode browsers layering on more - & bloat RAM consumption too + hugely excessive cpu use (4++gb extra in FireFox https://blog.mozilla.org/nneth... [mozilla.org] )

Work w/ a native kernelmode part - hosts files (An integrated part of the ip stack)

APK

P.S.=> "The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"

...apk

total security for the IoT... (2)

swschrad (312009) | about 2 months ago | (#47737821)

don't plug toasters, TVs, fridges, etc into the Internet. the geniuses behind them don't even finish the software they're loaded with at the factory.

Retro-Security (0)

Anonymous Coward | about 2 months ago | (#47740491)

My security is retro.

Let feds try and decode a PGP encrypted TRS-80 cassette tape.

It takes my TRS-80 4D a little time to do the work but I'm fairly safe in knowing that file on the cassette is secure.

Heh (0)

Anonymous Coward | about 2 months ago | (#47740665)

First rule of IoT networks: Most things will newer need network for anything...

When the current IoT hype passes we are left with network that's not much changed and some badly engineered appliances that really don't need any networking capabilities..

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?