Security Experts:

IoT Security: Where There is Smoke, There is Fire

We have collectively heard the saying, “where there is smoke, there is fire” throughout our lives. And, sure enough, it is true far more often than it is false. I have been seeing a lot of smoke lately, so I suspect that there is an interesting fire burning. 

First, the smoke

The first sign of smoke was a public service announcement (PSA) by the Federal Bureau of Investigation (FBI) on July 17. The PSA, “Consumer Notice: Internet-Connected Toys Could Present Privacy and Contact Concerns for Children,” was an interesting warning about the risks associated with connected toys. The PSA concisely explains why connected toys create risks, why those risks can affect children, and how families can take steps to minimize the risks. 

For those who have visited this column before, you know I have tracked the connected toy issue in other articles such as “The Connected Toy Conundrum Is Beginning to Boil.” I remain puzzled that there has not been more outcry from the consumer public on the issue. I also continue to wonder when the government will feel compelled to address the risks for children. Therefore, the FBI PSA definitely caught my attention. 

The second billow of smoke emerged in the form of a document distributed by the Cybersecurity Unit of the United States Department of Justice (DOJ) in conjunction with the Consumer Technology Association (CTA), called “Securing Your ‘Internet of Things’ Devices,” published in July. This document addresses the issue in the context of the broad Internet of Things (IoT) market. It too describes the risks and the possible consequences. But, it also focuses on a list of steps consumers could perform to protect themselves from attack. 

More smoke appeared on the horizon when a bill to address IoT security – albeit for a narrow use case – was introduced into the U.S. Senate. The bill compels IoT manufacturers that target the government market to ensure their products demonstrate basic security.

Now, the fire

My takeaway from these two documents is the assumption that the DOJ (the FBI is part of the DOJ) is seeing enough activity surrounding connected toys and IoT to prompt them to act by educating the consumer.

I have had the privilege of making friends who work for the FBI, and too have engaged them for business in my various pursuits. While the FBI is diligent about all crime, I learned quickly that the people of the FBI take the welfare of children quite seriously. If you read between the lines of the PSA, I am confident in assuming they are encountering cases involving children where information such as their name, home address, and the name of their schools were compromised through connected toys. The frequency was clearly enough to spur the FBI to action.

The broader DOJ document cites Mirai malware as illustrative of the problem at hand. However, it is not hard to extrapolate that the DOJ’s Cybersecurity Unit is seeing more evidence of similar attacks in the devices currently flooding the market.

Extinguishing the flames

I applaud the DOJ for attempting to educate the public, but I suspect that we were bringing cups of water to put out the fire.

Problem one is awareness. Ask any friend if they know about either of these documents. When they say “no,” ask them if they are aware of the general problem. I may be wrong, but I suspect you will not get much of an affirmative response for either question.

The lack of awareness surrounding the risks of connected devices confounds me. I am not looking for a deep understanding of the configuration and the specific inherent risks of IoT devices. I am talking about the foundational acknowledgement that a connected device, by design, is connected to something, just as its name implies. This means it collects data and sends that data somewhere. In the case of connected toys, and many of the consumer devices designed for the home, the data collection takes place by listening to the daily activity in the home. And, as the FBI PSA warns, the consumer usually provides personal information willingly to create an account or connect the device. With connected toys, the data contains enough information about the child that it can be used to create trust by those who would exploit the child.

With this foundational level of understanding missing, I don’t hold much promise for the DOJ document and its very detailed steps to reduce the risks of IoT devices. Most consumers don’t know how to do simple IT hygiene like changing the password of their router (if they even know they have a router), updating the password of the device, or updating the firmware (huh?) of the device. The document also prescribes that consumers segment their home networks. By a show of hands, who knows what that means or how to do it?

To give credit where credit is due, the DOJ has been thorough. I just don’t have faith there will be compliance, so the fire will continue to burn and grow hotter. The document urges consumers to do research, but there is no reliable standard for consumers to reference as of yet. Furthermore, reality shows that parents in a toy store—being begged by their child to purchase the latest connected toy—don’t think about doing research first.

As for the Senate bill, I don’t have high hopes for any effective legislation in the short term. But this should wake up the IoT manufacturers to begin policing themselves, or the government will step in. I give the automakers credit that they quickly closed ranks to demonstrate the willingness to embrace security immediately when the car hacks gained public attention precisely to keep the government from feeling compelled to get involved. Sifting the ashes

Based on all this, here are my takeaways:

• I believe the DOJ documents are indicators that attacks on connected devices are on the rise.

• I believe that given that manufacturers are selling devices based largely on price, not their privacy or security, the problem is not being addressed at the source. They are motivated on profit, and security eats into their margins. Ironic, given that security cameras are easily attacked.

• I believe that since the problem is not being addressed by the manufacturers, and that there is no regulatory help on the horizon, the DOJ is resorting to education to put out the fire.

• I believe that, given the observation that consumers still seem oblivious to the risks and the lack of awareness about basic security hygiene, the education push will fall short.

• I believe that the IoT manufacturers may force the government’s hand to enact legislation, and that won’t help any of the parties concerned.

• The fire will get hotter.

Related ReadingNew Legislation Could Force Security Into IoT

view counter
Jim Ivers is VP of Marketing for the Software Integrity Group at Synopsys. Jim is a 30-year technology veteran who has spent the last ten years in IT security. Prior to Cigital, Jim was the CMO at companies such as Covata, Triumfant, Vovici, and Cybertrust, a $200M security solutions provider that was sold to Verizon Business. Jim also served as VP of Marketing for webMethods and VP of Product Management for Information Builders.