The Long and Winding Road Ahead for IoT Security

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology and government. He is currently the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

Most of the time when I write this column, I can explain how events and trends are not actually as bad as they seem, which I recently did in my examination of the nation’s voting technology, or when I concluded the government’s 256-bit encryption can hold out against quantum computing for at least a few more years.

But this time around, it’s going to be difficult for me not to express a bit of fear.

We may not be at the end of the world, but you can see it from here. We’ve used terribly bad computing practices when deploying the so-called internet of things, and the fact it’s now being used for evil could prove devastating.

The internet of things is made up of any device that could become part of a “smart” home or office. These objects were given some intelligence like with televisions that help you find shows, refrigerators that order milk and baby monitors that can alert to trouble in the nursery. It also includes devices that can be controlled from your smartphone like security cameras, DVRs, modern thermostats and many others.

IoT even includes simplistic sensors that do everything from measure temperature to counting how many times a door is opened or how many customers buy a pair of socks. There are already hundreds of millions of IoT devices deployed around the world, and there could be as many as 50 billion by 2020 or so, according to most estimates.

But calling these devices “smart” is kind of a misnomer. They are generally single or limited function devices that only perform a few tasks at most. But they are all able to communicate, with each other and the outside world. Therein lies the problem.

Threat actors can easily search, find and contact these devices, which are only too happy to acknowledge the outside handshake. With no internal security, and with most set to default passwords, if they have password protection at all, they are easily manipulated into sending their signals to places other than their intended target. Then, it becomes like the old saying about a bee sting, that one will annoy you, but hundred—or in this case, millions—will kill you.

Hackers compiled a list of millions of easily hacked IoT devices, formed a botnet dubbed Mirai, and then unleashed them Oct. 21 in a massive denial-of-service attack that took down some of the biggest internet sites in the world. Twitter, Spotify, SaneBox, Reddit, Box, GitHub, Zoho CRM, PayPal, Airbnb, Freshbooks, Wired.com, Pinterest, Heroku and many others were instantly knocked offline for several hours. Level 3 put out a great report that goes into the gory details about Mirai.

But it gets worse. The source code for the Mirai bots was subsequently released, meaning any groups with even moderate programming skills can now use the technology to build their own army of IoT devices, unleashing them against targets of their own choosing. It’s almost guaranteed things will get a lot worse before they start to get better.

So, what can we do?

The problem now is twofold. First, we need to find a way to secure the millions of defenseless IoT devices already out there, not an easy feat because many of them don’t contain enough intelligence to be able to accept a normal type of security patch. They probably would need to be physically replaced. That is happening in very limited numbers. Chinese electronics firm Xiongmai, for example, is recalling all its webcams after learning they were part of the Mirai attacks. And mobile security company Appmobi recently announced a first-of-its-kind effort to work with IoT manufacturers to develop protection for existing devices.

While that mess is being cleaned up, we also need to immediately stop any new devices from being deployed without adequate security in place. That level of pressure would probably need to come from new laws, as there is not much impetus from consumers to make a change as they are not directly affected by these IoT attacks. You could have a compromised thermostat or TV inside your home right now acting as part of Mirai and not even know it.

The Cloud Security Alliance has published guidelines on how to develop and secure future IoT devices. Although there are no legal teeth with these voluntary best-practice type of suggestions, there is hope most manufacturers will follow along. The guide is 75 pages, but the top five suggestions for securing future IoT Include:

1. Design and implement a secure firmware/software update process;

2. Secure product interfaces with authentication, integrity protection and encryption;

3. Obtain an independent security assessment of your IoT products;

4. Secure the companion mobile applications and/or gateways that connect with your IoT products (e.g., encryption/privileges/authentication);

5. And implement a secure root of trust for root chains and private keys on each device.

In one sense, the Mirai bots did the world a favor by attacking now. Cleaning up the mess is going to be a long process, and we are for sure going to have to weather many attacks before things get better. But imagine if this was kept quiet until 50 billion more unsecured devices came online. The entire structure of the internet, and the core of much of our modern technology, could have been at risk.  

At least this way, we have a chance to clean up this mess and stop deploying the equivalent of loaded guns throughout the internet with no security or oversight. Yes, things are going to be bad for a while. I’ve personally written off being able to play on the PlayStation or Xbox networks over the holidays this year; they will likely be brought down or severely hampered by Mirai or some other similar botnet. But this is recoverable if we eliminate the problem and stick to better security practices from now on. Hopefully, we are smarter than our “smart” devices, and can learn from our mistakes.