Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Saturday November 12 2016, @03:11AM   Printer-friendly
from the world-wide-web-pollution dept.

Late last month, popular websites like Twitter, Pinterest, Reddit and PayPal went down for most of a day. The distributed denial-of-service attack that caused the outages, and the vulnerabilities that made the attack possible, was as much a failure of market and policy as it was of technology. If we want to secure our increasingly computerized and connected world, we need more government involvement in the security of the "Internet of Things" and increased regulation of what are now critical and life-threatening technologies. It's no longer a question of if, it's a question of when.

First, the facts. Those websites went down because their domain name provider — a company named Dyn —­ was forced offline. We don't know who perpetrated that attack, but it could have easily been a lone hacker. Whoever it was launched a distributed denial-of-service attack against Dyn by exploiting a vulnerability in large numbers ­— possibly millions — of Internet-of-Things devices like webcams and digital video recorders, then recruiting them all into a single botnet. The botnet bombarded Dyn with traffic, so much that it went down. And when it went down, so did dozens of websites.

Your security on the Internet depends on the security of millions of Internet-enabled devices, designed and sold by companies you've never heard of to consumers who don't care about your security.

The technical reason these devices are insecure is complicated, but there is a market failure at work. The Internet of Things is bringing computerization and connectivity to many tens of millions of devices worldwide. These devices will affect every aspect of our lives, because they're things like cars, home appliances, thermostats, lightbulbs, fitness trackers, medical devices, smart streetlights and sidewalk squares. Many of these devices are low-cost, designed and built offshore, then rebranded and resold. The teams building these devices don't have the security expertise we've come to expect from the major computer and smartphone manufacturers, simply because the market won't stand for the additional costs that would require. These devices don't get security updates like our more expensive computers, and many don't even have a way to be patched. And, unlike our computers and phones, they stay around for years and decades.

Is government regulation the only way to get manufacturers of Internet of Things (IoT) devices to care about security?


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by zocalo on Sunday November 13 2016, @07:49AM

    by zocalo (302) on Sunday November 13 2016, @07:49AM (#426213)
    I agree entirely that a standard that requires best security practices is required, complete with sanctions when breached. Bugs happen, so the vendor should have a chance to make good through a firmware update, product recall, etc., but the possibility of fines and having all products banned from the market needs to be the sword hanging over it. As noted though, the closed vs. open source issue is still a problem for some vendors, and we need the standard ASAP so can't really wait for some vendors to realise OSS is the way to go. That means the option of having the source closed but externally audited - at least for now - but that doesn't (and shouldn't) preclude a vendor opting to forego paying extra for a closed source audit (and there *should* be a premium as a deterrent) by simply opening their code to peer revew.
    --
    UNIX? They're not even circumcised! Savages!
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2