SoylentNews is people
SoylentNews
Submitted via IRC for Bytram
Consumers Urged to Junk Insecure IoT Devices
A security researcher who disclosed flaws impacting 2 million IoT devices in April – and has yet to see a patch or even hear back from the manufacturers contacted – is sounding off on the dire state of IoT security.
More than 2 million connected security cameras, baby monitors and other IoT devices have serious vulnerabilities that have been publicly disclosed for more than two months – yet they are still without a patch or even any vendor response.
Security researcher Paul Marrapese, who disclosed the flaws in April and has yet to hear back from any impacted vendors, is sounding off that consumers throw the devices away. The flaws could enable an attacker to hijack the devices and spy on their owners – or further pivot into the network and carry out more malicious actions.
“I 100 percent suggest that people throw them out,” he told Threatpost in a podcast interview. “I really, I don’t think that there’s going to be any patch for this. The issues are very, very hard to fix, in part because, once a device is shipped with a serial number, you can’t really change that, you can’t really patch that, it’s a physical issue.”
Marrapese said that he sent an initial advisory to device vendors in January, and after coordinating with CERT eventually disclosed the flaws in April due to their severity. However, even in the months after disclosure he has yet to receive any responses from any impacted vendors despite multiple attempts at contact. The incident points to a dire outlook when it comes to security, vendor responsibility, and the IoT market in general, he told Threatpost.
b-b-b-b-but it is still working!
(Score: 2) by MostCynical on Wednesday June 19 2019, @10:54AM (1 child)
even when these things have already been shown to reveal information, real time video feeds and more to other people, they are still being bought...
https://soylentnews.org/submit.pl?op=viewsub&subid=33214 [soylentnews.org]
https://soylentnews.org/submit.pl?op=viewsub&subid=31314 [soylentnews.org]
"It won't happen to me"
or
"they must have done something wrong"
or
"they must have been dumb. I'm not dumb, so it won't happen to me"
is it a good thing these won't lead to Darwin awards?
"I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex
(Score: 4, Insightful) by nobu_the_bard on Wednesday June 19 2019, @06:41PM
That's not why. It's because people don't do research like that. They are blinded by the possibilities - the rave reviews, the marketing push, the cool display in Home Depot, whatever. They don't look at the criticisms unless they are cautious or want to hate it.
I've known a fair number of people that would stop me from telling them about the latest ransomware tactic - they refused to hear it. They don't understand and its nothing but frightening to them. But they heard about people getting rich off this bitcoin thing, they'd love to hear about that...
IT and security people are pessimists by necessity and have to stare into the abyss; others tune out and turn back around and look to the fun parts of the technology.