IoT Security Is So Bad, There's a Search Engine For Sleeping Kids (arstechnica.com) 127
An anonymous reader writes: Shodan, a search engine for the Internet of Things (IoT), recently launched a new section that lets users easily browse vulnerable webcams. The feed includes images of marijuana plantations, back rooms of banks, children, kitchens, living rooms, garages, front gardens, back gardens, ski slopes, swimming pools, colleges and schools, laboratories, and cash register cameras in retail stores. While IoT manufacturers are to blame, this also highlights the creepy stuff you can do with Shodan these days. At the start of January, Check Point recommended companies to block Shodan's crawlers. The infosec community came to defend Shodan, and even its founder said that Shodan is uselessly branded as a tool of evil, saying that attackers have their own scanning tools.
Oh well (Score:0, Funny)
These are some of the same terrified idiots who support things like the TSA and NSA spying. You know, to win the war against terror...
Re:Oh well (Score:0)
Re: Oh well (Score:2)
Yeah, but the wives that you would want to see doing sit-ups in their living room are usually the ones that you would see. It's usually the ones that you wouldn't want to see.
FBI (Score:0)
Now that the FBI's kiddie porn site got shutdown, that task-force needed a new project that exploits children.
It's a search engine for webcams (Score:0)
I'm not a member of the site, but I don't think it's specifically for certain types of images as far as I can tell.
Re:It's a search engine for webcams (Score:5, Informative)
According to TFA, which of course no one has bothered to read:
Shodan crawls the Internet at random looking for IP addresses with open ports. If an open port lacks authentication and streams a video feed, the script takes a snap and moves on. The cameras are vulnerable because they use the Real Time Streaming Protocol (RTSP, port 554) to share video but have no password authentication in place. The image feed is available to paid Shodan members at images.shodan.io. Free Shodan accounts can also search using the filter "port:554 has_screenshot:true."
Re:It's a search engine for webcams (Score:2)
Free Shodan accounts can also search using the filter "port:554 has_screenshot:true."
That doesn't refute what the GP said - you still need to "be a member", even if an unpaid member.
(I also believe there's a limit to the number of search results returned.)
Only three comments so far? (Score:0)
This must not be an article about ad-blockers.
Re:Only three comments so far? (Score:2)
You could always point a webcam at a TV tuned to a telesales channel
Johnny can't encrypt (Score:4, Interesting)
Re:Johnny can't encrypt (Score:2, Offtopic)
Security is hard and companies have to make their video surveillance products easy enough for a socker mom to install.
Or for someone who can't spell the most popular sport in the world.
Re:Johnny can't encrypt (Score:3, Funny)
He was actually referring to an abusive woman.
Re:Johnny can't encrypt (Score:1)
Exactly, and if she gets too uppity you should soccer out.
Re:Johnny can't encrypt (Score:2)
I'm okay with most typos, but that one rubbed me the wrong way, for some reason.
Re:Johnny can't encrypt (Score:0)
Hey moron, brilliant people make spelling mistakes, grammar mistakes, and type-os all the time.
Hey people, morons make spelling mistakes, grammar mistakes, and typos all the time. (and yet they still believe they are brilliant programmers) TFTFY
Re:Johnny can't encrypt (Score:2)
Do they also make type As, type Bs and type ABs?
Also, minutiae. Minutia is the singular.
Re:Johnny can't encrypt (Score:4, Interesting)
As someone who has to provide tech support to family and friends I realize how hard it is to "just make it work" for those who couldn't care less about the technical details.
If you're not charging your relatives for tech support, you're doing it wrong. The fastest way to discourage relatives is to quote the hourly rate of your local mechanic ($100 in my area). If your relatives won't pay to have a mechanic fix the car, you can bet that they won't pay to have you fix the computer.
Re:Johnny can't encrypt (Score:0)
i demand any cash i have to pay for parts and that actually runs mine off.
Re:Johnny can't encrypt (Score:5, Insightful)
Problem with charging your relatives for support is that they will then start charging you for the same. Need a lift to the airport? Help moving house? Look after your cat for the weekend? Childcare?
Rather than becoming the black sheep of the family, just be more assertive at calling in those favours. Start the conversation with "how is your computer doing?" and end it with "so I need help moving this grand piano I bought..." You can even cash in while doing the tech support. When the call up, say you will come over, and then casually ask if they have any of that meatloaf they served the other day you could grab a slice or two of.
Re:Johnny can't encrypt (Score:2)
Are you really this much of an asshole in real life?
Yes. Next question.
Re:Johnny can't encrypt (Score:5, Insightful)
Yet, for wireless routers encryption is enabled by default for most, and a sticker with the password is put on the physical device.
Why not the same for a camera?
Not a perfect solution, but a hell of a lot better than the current situation.
Re:Johnny can't encrypt (Score:2)
Password : admin
Phew , now i'm safe.
Re:Johnny can't encrypt (Score:2)
Re:Johnny can't encrypt (Score:5, Insightful)
Generally speaking, implementing correct security is extremely difficult, but a company that puts security as a priority can design systems that are secure by default, and strike a reasonable balance between customer ease of use and effectiveness. It doesn't have to be impossible for a soccer mom to use a device securely.
You can see the difference in two competing chat apps: Threema vs iChat. Threema is a "trust no-one" model, and requires you to actually meet face to face with a person to pre-exchange keys before you can chat with the maximum security protocol. iChat, on the other hand, "just works", relying on Apple to manage the key exchange. You're giving up a small amount of security for the convenience of a seamless experience, and trusting Apple to keep it the channel secure on your behalf.
I think most people would be fine with trusting the company they bought their devices from to actively manage the security aspects so they don't have to think too much about it, but in many cases, it's not that the security is flawed... it's completely non-existent. Anyone complaining about Shodan is simply blaming the messenger. The blame lies squarely on the companies that are selling these products with zero security in mind.
Re:Johnny can't encrypt (Score:3)
iMessage is aimed more as a replacement for SMS, which worked in the same way - you had to trust your telco and that of the recipient. For casual chat both systems are more than adequate.
Re:Johnny can't encrypt (Score:2)
Don't get too hung up on the analogy. The point I was trying to make is that there's a security vs convenience tradeoff, but it's certainly not impossible to make reasonably secure products accessible to the masses. These IoT companies aren't even trying.
Re:Johnny can't encrypt (Score:3)
Security can be implemented fully transparently to the user. This does of course take quite a bit of effort, and it can be costly since you need a few things on your system that take the workload off the user.
Since both mean more cost for the device, this is not an option. Those gadgets are supposed to be cheap, security is not a selling point so to hell with it.
Re:Johnny can't encrypt (Score:2)
Security is hard and companies have to make their video surveillance products easy enough for a socker mom to install.
Didn't you mean sucking moms instead?
Re:Johnny can't encrypt (Score:2)
I have a solution: until companies carry a legal penalty for being do damned incompetent at security, and they have to give a damn ... stop buying this shit.
I know, it's a wacky idea, and people can't survive without something connected to their smart phone.
But on behalf of those of us who have been saying this shit is defective by design for years, what the hell do you expect? This stuff is entirely predictable.
I've simply ran out of the ability to feel any sympathy for this.
Re: Johnny can't encrypt (Score:2)
You've made your point...now shut it down. (Score:3)
The infosec community came to defend Shodan, and even its founder said that Shodan is uselessly branded as a tool of evil, saying that attackers have their own scanning tools.
It won't matter to the families of the children you have exposed that other scanning tools are available. Yours is public and visible --- and it has a deliberately provocative name. You can't search Google for Shodan and miss the connection.
Re:You've made your point...now shut it down. (Score:1)
Yours is public and visible --- and it has a deliberately provocative name.
That's the point, Shodan is selling a service, and they want publicity.
Hopefully this will make the mainstream news and people who have their cameras connected to the internet will learn and take them down.
Re:You've made your point...now shut it down. (Score:2)
And realistically, Shodan is offering a more useful service for free - showing people that their webcam is broadcasting to the entire world.
The fact that the "solution" is "hey, block this one provider" and not "holy crap, unplug that thing NOW and get one that isn't broadcasting our cash register to anyone with half a brain.
I suspect this will get fixed when someone gets hurt or robbed, and decides to take it out on the manufacturer. (I'm guessing there's a (media) case to be made in "hey, the webcam you sold me isn't secure, so the crooks watched my register to pick the perfect time to rob us")
Re:You've made your point...now shut it down. (Score:1)
It won't matter to the families of the children you have exposed that other scanning tools are available. Yours is public and visible --- and it has a deliberately provocative name. You can't search Google for Shodan and miss the connection.
The device manufacturers are clearly to blame here.....this isn't a Shodan problem. Any reasonable timeline for a response to responsible disclosure has long since passed.
Re:You've made your point...now shut it down. (Score:1)
The device manufacturers *are* to blame.
And so is Shodan.
Re:You've made your point...now shut it down. (Score:5, Insightful)
Because sweeping this under the rug means bad guys won't ever attack these devices. *rolls eyes* Their point won't have been made until these *groan* IoT *groan* device making shitheads secure their crapware.
Re:You've made your point...now shut it down. (Score:4, Insightful)
I'm afraid I have to agree. This search engine needs to receive as much publicity as possible, not get swept under the rug. Only then, I hope, will the people become aware of how orwellian the IoT really is.
Re:You've made your point...now shut it down. (Score:2)
You're talking to the wrong guy. (Score:2)
Because sweeping this under the rug means bad guys won't ever attack these devices. *rolls eyes* Their point won't have been made until these *groan* IoT *groan* device making shitheads secure their crapware.
The geek makes this argument whenever one of his pet "white hat" hacking projects is clearly open to abuse.
The problem here is that the argument appeals only to other geeks --- not to those who see only an invasion of privacy made possible --- made easier --- by a search engine like Shodan. That a door was unlocked or the lock was broken does not imply a right to enter.
The geek needs to learn that others see him as the shithead whether he is wearing the white hat or the black.
Re:You're talking to the wrong guy. (Score:1)
Then "the others" need to learn that without the white hats bringing things to attention, the criminal scum would already be abusing them left, right, and center. If you prefer your security by obscurity, good luck.
You still don't get it. This isn't about "security through obscurity." It is about Shodan.
It is about how the geek is perceived by others. It is about how he undermines relationships with those outside his own community for what he perceives to be the greater good.
Re:You've made your point...now shut it down. (Score:3)
Yours is public and visible --- and it has a deliberately provocative name. You can't search Google for Shodan and miss the connection.
The malevolent AI villain in System Shock 2? I fail to see the connection...
You've made your point...now shut it down.
Yes. They've made their point. Now it's the job of the manufacturer to shut it down, since people anywhere on the planet can run a similar service, and there's not dick you can do about it without a policing treaty, and extradition treaty, and a willingness to spend a lot of money following up the events.
Re:You've made your point...now shut it down. (Score:2)
SHODAN is an artificial intelligence whose moral restraints were removed from her programming by a hacker in order for Edward Diego, station chief of Citadel Station, on which SHODAN was installed, to delete compromising files regarding illegal experiments and his corruption. She is a megalomaniac with a god complex and sees humans as little better than insects, something which she constantly reminds the player of.
No moral restraints, megalomaniac?
Re:You've made your point...now shut it down. (Score:2)
I did the impossible. I searched Google and came up with martial arts, Go, and this article. And similar articles from back when this was news. The connection you claim is obvious is clearly missing.
I'm more interested in this having been news for years, and devices aren't even using minimal security via obscurity. A normal ISP might knock you off for port scanning, but hitting random addresses on a single port might not trigger the same response, making it trivial to replicate this search engine.
Re:You've made your point...now shut it down. (Score:0)
Wait, why would you want to film you sleeping children in the first place? I find that terribly creepy, borderline perverse and sure as shit stinks, a violation of their privacy! Laissez-faire parenting gone amok. Stop it at once.
Re:You've made your point...now shut it down. (Score:2)
So killing the messenger it is again? Let's hush it up, when nobody talks about it, maybe it just goes away.
You know the old saying, if you make Shodan a criminal, only criminals will go onto the orbital station and fight her. Or something like that.
Re:You've made your point...now shut it down. (Score:2)
You can search Google for unsecured webcams. They periodically remove them from their database, but if you stay ahead of the curve with new models they are easily accessible via google.
Shodan *started* as a webcam search engine (Score:3)
I'm not sure if everyone already knew this but Shodan *started* as an non-secured webcam search engine back in 2009.
Re:Shodan *started* as a webcam search engine (Score:5, Informative)
That's actually incorrect. I launched the search engine with the idea of it being used to empirically gather market intelligence ("Netcraft for everything"). And the first search queries that the infosec community ran were for printers. Webcams only came around much later.
Re:Shodan *started* as a webcam search engine (Score:2)
According to Youtube the webcams are much more entertaining than printers:
https://www.youtube.com/watch?... [youtube.com]
Here is one where the victim calls cam tech support, and tech is clueless:
https://www.youtube.com/watch?... [youtube.com]
The feds will shut it down in a couple of weeks (Score:1)
The feds will shut down the sleeping-kids search engine in a couple of weeks, after they infect a bunch of computers with phone-home-ware.
What's that you say? I'm posting in the wrong thread [slashdot.org]? Sorry, saw "kids" and "cameras" and "creepy" and they sort of blended together there for a minute.
Strange but true: My captcha is warrants. Now THAT is creepy!
Offering data to the public Internet (Score:5, Insightful)
An AC wrote:
There was no breaking in.
If you provide data to the public Internet without any form of restriction, you can't then validly complain when the Internet public sees that data. You offered it publicly, and the public took you up on your offer.
This isn't anything like breaking and entering, nor even like someone walking through a door which you left wide open. It's much more intentional on your part than that:-- you offered data to the public by creating an unrestricted access port on the Internet, your offer was accepted when someone opened that port, and then you deliberately sent your data out to that recipient. It was your choice, before and after you made the offer to the public. Nobody can force you to send your data if you don't want to. Your system wasn't hacked to change its code to something that you did not intend.
The closest analogy I can make is to imagine yourself standing on the sidewalk in the high street, an open sweet jar in one hand, and the other hand outstretched offering sweets to passers by. The highstreet is the public Internet, and your invitingly outstretched hand is the open port. If someone takes hold of the sweet, you can still prevent it from being taken by holding tightly onto the wrapper (an access restriction, perhaps you want to check that recipients are smiling first).
But if you first offer a sweet and then release it, you don't get to complain --- it was your visible intention to hand out sweets to passers by, and nobody can read your mind, only your actions. If you don't understand this then perhaps you don't grasp how Internet protocols work, and you would be best advised to stay well clear of the Internet.
You may wish that Internet protocols worked some other way, perhaps using ESP, but they don't. They work as they were defined.
Re:Offering data to the public Internet (Score:0)
Ok so how about somebody standing on a public street and peeping into a house through a window that has a small opening and person getting undressed on the other side. Im fairly sure you can get arrested for that, so why not be arrested for peeping through an open internet port?
Re:Offering data to the public Internet (Score:2)
Re:Offering data to the public Internet (Score:0)
Ok so how about somebody standing on a public street and peeping into a house through a window that has a small opening and person getting undressed on the other side. Im fairly sure you can get arrested for that,
Not where I live you don't, and I wager nowhere in the civilized free world either. Just by definition.
The one doing the stripping down in front of the window might be reprimanded, but I doubt it would go as far as fines.
Re:Offering data to the public Internet (Score:2)
It's considered impolite where I'm from. And it's considered indecent to undress in front of open windows. I fail to see the illegal part, though, on either side. Well, maybe the one undressing could be in for indecent exposure, but that would have to be like a shopping window in a well frequented street where you pretty much have to assume someone would be looking in.
Re:Offering data to the public Internet (Score:3)
If you provide data to the public Internet without any form of restriction, you can't then validly complain when the Internet public sees that data. You offered it publicly, and the public took you up on your offer.
Was it their choice though? Were they aware that the device is exposed?
Part of the blame lies on the manufacturer if they make it too easy for an uninformed person to leave the device in an unwanted state. Bad design.
Re: Offering data to the public Internet (Score:0)
The thing is that all these devices are designed to be placed behind a statefull firewall.
Re: Offering data to the public Internet (Score:2)
Of course, they don't bother telling that to consumers who don't even know what a firewall is.
Re: Offering data to the public Internet (Score:2, Insightful)
You are so beyond wrong here, and very emotional about your response as well.
People are putting private data on a public medium, in many cases without so much as a login password. Completely open. There's a certain level of personal responsibility here. Framing this is some sort of crime ignores the reality that people are doing things like this out of ignorance, but ignorance does not remove people from being responsible for their actions.
Re:Offering data to the public Internet (Score:0)
> stop blaming the victims
I don't see anyone blaming the victims, only blaming technical incompetence of the installer. If you don't have the competence to secure a device on the internet, don't put your device on the internet.
If you don't have the competence to pack your own parachute, don't pack your own parachute. Get an expert to pack it for you. If you pack your own and it fails to open, you have nobody to blame but yourself. Trying to avoid your responsibility in the matter by saying that it's "blaming the victim" won't get you anywhere, because you were clearly to blame by exceeding the limits of your competence. The internet is no different.
It's not only a problem with technical incompetence of users, but also that of providers. If a company is knowingly selling webcams to the mass public (hence knowingly to non-technical users), you have every right to expect that the products provide access protection out of the box. Alas, many IoT companies are not acting responsibly in that respect.
Despite that though, you do NOT get to shed your own responsibility in the matter and only to blame others. It is you who put an open viewport on the internet after all, nobody else.
Note also that victim and incompetent technician are two entirely separate parties, except by coincidence. If you incompetently installed an open webcam and a child became a victim, or if you incompetently packed a parachute for another and he plummeted to his death, then they are the victims but you are the party to blame, in both cases. The victims would not be blamed because the responsibility would lie with someone else who performed a technical task while lacking the necessary competence to do so.
Re:Offering data to the public Internet (Score:0)
Regardless, you're still DOING the thing you shouldn't be DOING
The day that you shouldn't be asking a system at the other end of an IP address whether or not they have a service listening at such and such a port is the day the entire Internet is a thing of the past.
And this website is ENABLING people to do that.
Okay.
They are RECORDING it.
Maybe try suing for copyright infringement, then. Going to be a hard sell, given you're intentionally offering data to the public, though.
Re: Offering data to the public Internet (Score:1)
If you leave the blinds and curtains off your windows and do aerobics in the nude in front of them its YOUR fault, not the passerby that sees it or the person that told him about it or even the person with the camera recording it.
When you install one of these cameras and connect it to the net you are the one that put up a live video feed broadcasting to everyone, that makes it your fault just like failing to put up curtains does. You have a responsiblity to protect your privacy and if you abdicate that responsibility it makes the result YOUR fault.
Re:Offering data to the public Internet (Score:0)
Why shouldn't they view what you provide? You gave them permission to view that data when you provided it as an open service on the public Internet.
It appears that you don't understand how network services are created on the Internet, and the role and responsibility of the administrator of an Internet-connected device. It's quite simple, so I'll explain.
Webcam images or video stay on the webcam and aren't going anywhere without administrator action. When an admin connects a device properly to the Internet, a path becomes available from anywhere on the Internet to the device., but a mere path is not enough to make the device usable or even detectable. The admin also has to set up a network listener port, without which a webcam will not send its feed despite being reachable. Setting up the listener port on a reachable IP address constitutes "offering a service" in Internet networking terms.
Accesses to your new service will begin almost immediately if you attach a device to the open Internet, whether you advertise it or not. It is the role of an administrator to impose any desired restrictions on the service that they have just offered to the Internet, because in the absence of configured restrictions it will be an open public service. This may be fine and intentional, or it may be unwanted and very bad.
The billions on the Internet cannot know what your intentions are. If a service is made accessible by you, then they will use it. By making it accessible, you have given them implicit permission to use it, because if you had not wanted them to use it then you would not have made it accessible. That is how all Internet services work. There is no paperwork, contract, or any other red tape involved, just the mere enabling of a service creates an invitation to use it, and the service is available to everyone unless you configure access restrictions either within the device or in a separate firewall. Internet services wouldn't have gained billions of users if there had been red tape involved.
That's all there is to it. You said that nobody understands the point that you're making, but that stems from the fact that you are ignoring the cause of the problem and trying to cure a symptom. Access restrictions are under your control, and if you have not imposed any restrictions then you have offered an open public service. You can't validly blame anyone for using a service which you have offered. You have given them implicit permission to use it by making it open and public.
Of course you may have given this implicit permission by accident, quite possibly through lacking technical competence in networking, but the Internet billions cannot possibly know that. The power to provide or restrict a service lies with you, and you must exercise it. Blaming the Internet public for the consequences of your failure to do so is misplaced, and moreover, it is ineffective.
Re:Offering data to the public Internet (Score:0)
Go fuck yourself and get the fuck off the Internet. You're clearly too stupid.
Re:Offering data to the public Internet (Score:1)
How is it my fault when someone looks into my bedroom when I fail to close the blinds? It's THEIR fault for looking in. They go toy MY STREET, look in MY WINDOW. They use THEIR FEET to get there. THEY decided to look in MY DIRECTION to a window that was facing a PUBLIC STREET. Every home can e reached by the public.
So why the fuck do I get nailed with indecent exposure just for this window being the big panorama window to the main street? It's THEIR FAULT for looking in! Not mine for not closing the blinds. How am I supposed to be responsible for my privacy?
Gardens (Score:3)
...front gardens, back gardens...
Aha! But not side gardens! Those have better privacy...
Re:Gardens (Score:0)
Over under sideways down
License for installation!! (Score:0)
Like electricians who need a license to work (atleast where I live), IoT devices should require a license to install.
Re:License for installation!! (Score:2)
Re:License for installation!! (Score:2)
And that makes the devices more secure how?
Re:License for installation!! (Score:0)
Hey, at least we would have someone to blame, that we can agree on!
Re:License for installation!! (Score:2)
Can't argue with that ;-)
Re:License for installation!! (Score:2)
I think you're more thinking of some kind of "seal of security" that such a IoT device needs to be put into circulation, like that seal on electronic devices saying that it doesn't cause any interference and that it can deal with any interference that might happen (forgot the name).
That would actually be a pretty good idea.
IF THEY AREN'T DOING ANYTHING WRONG... (Score:3)
...they they don't need to worry about the surveillance.
And the parents who put these protections in place, that's just like our big brother the NSA and GCHQ putting protections in place for us. No encryption necessary. Hope no bad guys get a hold of this.
But if you're doing nothing wrong... ...you have no reason to worry.
E
Re:IF THEY AREN'T DOING ANYTHING WRONG... (Score:2)
With the ever changing laws and more and more insane laws springing into existence, do you even know anymore whether you do anything wrong? Worse, are you sure that what you enjoy doing today would not be considered "wrong" tomorrow? And that the powers that are might wonder whether you stopped with that "habit" you had that used to be legal before?
All the same stupid mistakes being made again (Score:2)
It is as the IoT people never even have heard of the, by now, 30+ years of history of Internet security fails. These must be the dumbest, most arrogant and most clueless developers, lead by managers of the same quality. It is high time that we get legally actionable gross negligence for manufacturers that ignore Internet security best practices.
Re:All the same stupid mistakes being made again (Score:2)
That last part of your statement is pretty much the reason right there.
Business decisions are driven by simple considerations. Whether some feature is added is decided by basically 3 questions?
1. Is it going to increase revenue?
2. Is it going to increase sales?
3. Do we have to do it to avoid fines?
If none of the 3 apply, it will not be done. Security is "neither of the three". So to hell with it.
Re:All the same stupid mistakes being made again (Score:2)
Indeed. And hence bad security must be made a significant cost factor for those making devices with it.
Re:All the same stupid mistakes being made again (Score:2)
Re:All the same stupid mistakes being made again (Score:2)
Don't tell me, you like to blame victims, no?
Really, the name should've warned them (Score:2)
"Look at you, hacker: a pathetic creature of meat and bone, panting and sweating as you run through my corridors."
IoT (Score:3)
IoT: Internet of Trouble
Lets see....cheaply-made products produced and sold with barely a nod to security, installed by users who are likely to be as clueless as they could possibly be, all connected to a worldwide network easily accessible by lots and lots and lots and lots of malicious people with too much time on their hands.
What could possibly go wrong??
Trust me, you ain't seen nothin' yet. I'd wager that 98% of all of these consumer-grade gadgets are going to be easily hackable in their default configuration. It's only a matter of time- eventually one of them will cause a serious injury or death, or at the very least some kind of significant property damage.
You want your refrigerator to be internet enabled? Great! But should it also have the unfettered ability to turn the temperature down and spoil all the food?
You want door locks you can control from the other side of the world? Great! But should any Joe Blow with a free hacking kit be able to unlock your doors at will?
You want to be able to remotely turn on your stove and start heating some water? Great! But should it blindly start "heating" a cardboard box left sitting on the burner because some dickhead in Moldavia can bypass your login?
You want an internet-enabled thermostat? Great! But should some malicious asshole be able to turn off your heat in the dead of winter when you're on vacation, freezing your house and causing your water pipes to burst?
Don't get me wrong- I think the overall idea of IoT is fascinating and holds great promise, but mark my words... like anything else it's gonna be abused too. Unfortunately I think it's going to take some major-league lawsuits before manufacturers start taking the security aspect of it seriously.
In unrelated news... (Score:2)
Re:Let me get this straight... (Score:5, Insightful)
Calm yourself and then understand one thing: there is no breaking in going on, here. These cameras are broadcasting this shit directly to all comers, wide open to the world. No one is "tak[ing] a hammer and break[ing] into someone's home," they're standing on the sidewalk looking into the front windows where the home builder didn't bother to install any blinds.
Re:Let me get this straight... (Score:0)
Jesus, this again. No. You are wrong. Unless I lock my daughter in her room for her entire life does that mean someone has the right to rape her? I mean, technically, nothing would be being taken from her.
This webcam search is no different. Just because something is present in the universe and not physically hidden, locked, encrypted doesn't mean anyone can (legally or morally) dick about with it
Re: Let me get this straight... (Score:0)
If you take Ä'own the blinds and curtains and someone can stand on the sidewalk and watch your dauhhter undress there is nothing illegal about it and you are at fault, not the guy watching and not the guy who told him.
These cameras broadcast their video to the internet, just like leaving the blinds off.
Re:Let me get this straight... (Score:0)
Re:Let me get this straight... (Score:0)
People who don't secure their systems and devices are to blame for someone breaking into them? Go fuck yourself, if that's how fucking much of a dick you are for believing that shit. And here's why:
Anyone can take a hammer and break into someone's home. I don't see anyone blaming architects, glass blowers, window manufactuers, installers, washers, etc., or the owner of the property
These are, conceptually and practically, completely different acts.
If I break into a home, I am forcing myself past a lock - i.e. destroying property - and ending up in else's property. (N.B. If there's no lock, entering a home is not illegal in many countries, although it is trespassing and you must leave when asked.)
If I "break into" a computer, I'm not actually intruding on property - which is why crimes tend to be defined in terms of "unauthorised access". Unauthorised access involves making a request from a computer which the computer responds to, because its owner has willingly installed it AND provided a method to communicate with it. No force is involved - I'm just saying, "Hey, computer, will you please give me XYZ?" and the computer says, "Sure here you go." It just happens that the owner decides at some point that they don't want the computer to be accessed in that way, even though they provided that method of access.
The solutions? Well, here are some I propose:
1) Unenforceability of disclaimer of liability clauses. If the user has read the manual and something still goes wrong, the manufacturer is responsible for clearing up the mess.
2) Stop putting everything on the Internet, asshats. It's not needed. Capitalism may have an insatiable desire to shovel ever more shit at people, rather than allow people to live in peaceful luxury, but not every trend is necessary to follow!
Re:Let me get this straight... (Score:1)
The only thing broken here is your analogy. If a company sold locks that couldn't be locked or were too trivially pickable, and advertised them as locks, you can guarantee there would be (and historically has been) more or less equivalent blowback. The only real difference being that if you forget to lock your car or don't even fucking try, nobody would be surprised to get their shit stolen.
Re:Let me get this straight... (Score:3)
If a company sold locks that couldn't be locked or were too trivially pickable, and advertised them as locks, you can guarantee there would be (and historically has been) more or less equivalent blowback.
Electronic locks used on hotels? Or the programmable key locks that a lot of people use on their house? You can still bust them open with $50 of off the shelf hardware. That's been going on for 4 or 5 years now, and the amount of blowback has been minimal.
Re:Let me get this straight... (Score:0)
Correct me if I'm wrong (and I know you will, 'cause you're always right and I'm always wrong, according to your POV): Isn't an IP address purchased by ISPs the property of the ISP, and thus, anyone who violates the trust of contract between the ISP and the consumer someone considered liable for violating that contract?
What are you even talking about? If I open my browser and tell it to go to slashdot.org, a web page comes up. I don't have a contract with Slashdot, and I don't have a contract with Slashdot's ISP. I don't really care what contract Slashdot has with its ISP. I'm not violating any contracts by loading slashdot.org in my web browser.
If I open my browser and tell it to go to 12.34.56.78 and up pops a webcam showing the break room in a convenience store, how is this any different? I don't have a contract with the convenience store and I don't have a contract with their ISP. I don't care what contract they have with each other. My web browser asked a server to display some content, and it did. Nobody violated any contracts.
I guess you agree with the analogy that if a woman dresses sexy and is raped, "She was askin' for it," right?
No. I do agree with the analogy that if I ask a woman for sex and she says "OK, let's do it" then everything is fine.
Re:Let me get this straight... (Score:0)
Of course, I know your counter argument: "They left it wide open, so they're responsible."
Please think about this carefully:
The webcam
delivers
the pictures.
One more time:
The client says, "May I watch you?"
And the webcam server says, "Sure, here are the pictures."
A suitable analogy is me asking, "May I watch you?" and you saying, "Yeah, go ahead."
Re:Let me get this straight... (Score:2)
Of course, I know your counter argument: "They left it wide open, so they're responsible."
Please think about this carefully:
The webcam
delivers
the pictures.
One more time:
The client says, "May I watch you?"
And the webcam server says, "Sure, here are the pictures."
A suitable analogy is me asking, "May I watch you?" and you saying, "Yeah, go ahead."
An even more suitable analogy is me asking a Magic 8-Ball "May I watch this guy?"...but all other responses in the 8-ball other than "Yes, definitely" have been removed by the manufacturer.
The person who should be giving the consent is not consulted, or is not aware that consent is being automatically provided by a third party.
Re:Let me get this straight... (Score:3)
If I were to create a device that can be hacked by someone else, then my customers and I are to blame for the act of someone hacking it?
If you make a house that opens the door and throws the owner's jewelry at the person who rang the bell, damn straight you are at fault for making the stupid thing in the first place, and the owner for not locking the door when he goes out.
Nobody is "hacking". The act of a port screen is more like door knock or doorbell ring than walking through a parking lot trying every door handle for one that's unlocked.
Re:Let me get this straight... (Score:2)
You are quite right, the makers of the items throwing valuable stuff around unsecured are doing wrong.
But, someone taking advantage of this problem is still doing wrong.
I don't think you are arguing that it is ethical to take that which is thrown at you, but that the owner had no intention of you having.
I understand that this is a "technicality", that it isn't expected to stop this wrong.
And someone publishing a directory ( or web site ) with directions on how to get to such ill secured items, especially to encourage, even allow viewing something like sleeping kids is doing wrong, verging on evil.
Chorus of above.
Re:Let me get this straight... (Score:2)
I hate how these are called IoT. IoT is for things talking to things. Not people talking to servers. That's just the Internet. The camera only talks to people or things pretending to be people.
The current trend is the Internet of tiny servers. The IoT refrigerator is a server. You connect to it via an app. Or it's a client device in a 3rd party network, where your LG appliances talk to an LG server that your app connects to. Your things *never* talk to your other things. When that happens, that's an IoT. Until then, it's more client-server apps, with the clients and servers getting smaller and more interchangeable.
Re:Let me get this straight... (Score:2)
Re:Let me get this straight... (Score:3)
A service like shodan only increases public awareness, anyone who actually has malicious intent will have their own method of discovering insecure devices and no intention of publicising their activity. Publicity does not benefit those with malicious intent, as the publicity will cause at least some people to improve the configuration of their devices.
If you keep this information out of the public eye, it gets forgotten and overlooked and then the number of vulnerable devices only increases to the benefit of the actually malicious people who want to take advantage of them.
And yes often the device manufacturer is at fault, some devices cannot be reasonably secured and for others the manufacturer provides weak defaults and doesnt do enough to force users to change them.
Some devices these days come with a random password printed on the device, that's perfectly reasonable and prevents casual attackers using blank or default passwords.
Re:Let me get this straight... (Score:2)
The problem is that hacking isn't even involved.
To stay in your house analogy, the current situation is more like every door in your home being unlocked with a butler at the door greeting people and handing them whatever they ask him for. They're not even "illegally entering" your home. They ask your butler "may I take a look at little Cindy?" and he delightedly says "But of course!" without even asking who they are or why they want to take a look at your child.
Re:Let me get this straight... (Score:1)