Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Get HideMyAss! VPN, PC Mag's Top 10 VPNs of 2016 for 55% off for a Limited Time ×
Privacy Security News Technology Your Rights Online

IoT Devices Are Secretly Phoning Home (thenewstack.io) 196

An anonymous reader writes: A popular internet-enabled security camera "secretly and constantly connects into a vast peer-to-peer network run by the Chinese manufacturer of the hardware," according to security blogger Brian Krebs. While the device is not necessarily sharing video from your camera, it is punching through firewalls to connect with other devices. Even if the user discovers it, it's still extremely hard to turn off. Krebs notes that the same behavior has been detected in DVRs and smart plugs -- they're secretly connecting to the same IP address in China, apparently without any mention of this in the product's packaging. One security researcher told Krebs the behavior is an "insanely bad idea," and that it opens an attack vector into home networks.
This discussion has been archived. No new comments can be posted.

IoT Devices Are Secretly Phoning Home

Comments Filter:
  • it's not a secret (Score:4, Insightful)

    by turkeydance ( 1266624 ) on Sunday February 28, 2016 @06:27PM (#51605087)
    c'mon, man. they're all doing it. damn you ET.
    • by Anonymous Coward on Sunday February 28, 2016 @06:54PM (#51605237)

      Here's a list of reasons why I don't like the Internet of Things:

      1) Internet of Things devices could watch me while I sleep.

      2) Internet of Things devices could watch me while I pee.

      3) Internet of Things devices could watch me while I make kaka.

      4) Internet of Things devices could watch me while I pleasure myself.

      5) Internet of Things devices could watch me while I wash my body in the shower.

      6) Internet of Things devices could watch me while I relax in the tub.

      7) Internet of Things devices could watch me while I brush my teeth.

      8) Internet of Things devices could watch me while I make passionate love to my wife.

      9) Internet of Things devices could watch me while I brush my hair.

      10) Internet of Things devices could watch me while I read a book.

      11) Internet of Things devices could watch me while I read Slashdot.

      12) Internet of Things devices could watch me while I bake cake.

      13) Internet of Things devices could watch me while I put in my contact lenses.

      14) Internet of Things devices could watch me while I get ready to play golf.

      15) Internet of Things devices could watch me while I do my laundry.

      16) Internet of Things devices could watch me while I think about rugby.

      17) Internet of Things devices could watch me while I tie my shoes.

      18) Internet of Things devices could watch me while I celebrate the 4th of July.

      19) Internet of Things devices could watch me while I water my flowers.

      20) Internet of Things devices could watch me while I eat ham.

      21) Internet of Things devices could watch me while I use my stapler to staple documents.

      22) Internet of Things devices could watch me while I chew bubble gum.

      23) Internet of Things devices could watch me while I check the oil in my car.

      24) Internet of Things devices could watch me while I look for my TV remote.

      25) Internet of Things devices could watch me while I blow my nose.

      26) Internet of Things devices could watch me while I rearrange my stamp collection.

      27) Internet of Things devices could watch me while I listen to the Backstreet Boys.

      28) Internet of Things devices could watch me while I do my calisthenics.

      29) Internet of Things devices could watch me while I search for a paper clip.

      30) Internet of Things devices could send information about me to advertisers.

      31) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I sleep.

      32) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pee.

      33) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make kaka.

      34) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I pleasure myself.

      35) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I wash my body in the shower.

      36) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I relax in the tub.

      37) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my teeth.

      38) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I make passionate love to my wife.

      39) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I brush my hair.

      40) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read a book.

      41) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I read Slashdot.

      42) Internet of Things devices could let advertisers use the data unsuspectingly collected about me while I bake cake.

      43) Internet of Things devices could let advertisers use the data unsuspectingly coll

    • it opens an attack vector into home networks.

      ET pwn home.

  • Not new (Score:4, Informative)

    by penguinoid ( 724646 ) on Sunday February 28, 2016 @06:28PM (#51605099) Homepage Journal

    Anyone familiar with IoT knows that most of them phone home to report.

    • by ls671 ( 1122017 )

      Just put those IoT on their own VLAN and do not allow them to connect anywhere!

      • Re: Not new (Score:5, Insightful)

        by nehumanuscrede ( 624750 ) on Sunday February 28, 2016 @09:06PM (#51605851)

        Easy for the typical /. reader perhaps, not so much for your everyday consumer. Go ask random folks what a Vlan is and you'll understand pretty quickly.

        The typical user isn't even aware of the possibility of this sort of thing.

        • so hype up the dangers and sell the "titaniumShield security appliance" for $300. it doesn't even have to work very well. who cares?

          • Re: (Score:2, Funny)

            by Anonymous Coward

            Just configure it to phone home so you can update its configuration periodically to cover new IoT devices that phone home....

      • Re:Not new (Score:4, Interesting)

        by Anonymous Coward on Sunday February 28, 2016 @09:57PM (#51606015)

        Then they don't work. Some have to have a 24/7 Internet connection, and if it gets cut, the devices turn off. I'm just waiting for everything out there, be it fridges, TVs, and anything else to either follow suit, or have a 3G antenna, so it has its own private pipe to tattle user info on.

      • Doesn't work, they either need to connect out to report data or you need to connect in to read data from them. You then end up with this ghastly mishmash of per-device firewall config rules to handle the requirements of each unit.
      • That's assuming that the device does has an offline mode, and will work without that connection to a Chinese server.

      • Don't connect them in the first place.

        Better yet, DON'T EVEN BUY these things...

    • Re:Not new (Score:5, Interesting)

      by Dutch Gun ( 899105 ) on Sunday February 28, 2016 @09:00PM (#51605833)

      Agreed. This doesn't surprise me one bit. Maybe the name gives it away... you know... that these Things communicate over the Internet?

      I'm going to take a potentially contrary position, though, and argue that if a device is internet enabled, it absolutely should be phoning home on a regular basis, and for very good reasons. The recent glibc library vulnerability only helps to validate my opinion, in fact, which is that it's absolutely inevitable that serious vulnerabilities will be found in ANY internet-facing device, and so these devices MUST be able to automatically update themselves. What's more, manufacturers should be responsible for providing security updates for a reasonable product lifetime - otherwise, they're no longer fit to stay connected, and essentially must be discarded in order to keep your network secure.

      I'm sure there are those who would argue against such a policy, but these are *consumer* devices, and we damn well know by now that a typical consumer will never update the firmware on their own device. We now accept that browsers must self-update in order to remain secure, and we're just now grappling with the notion that OSes must do it too. Frankly, anything that's internet-facing needs to be treated the same way. The manufacturer must take responsibility for this. Otherwise, we're going to have billions of tiny infection vectors that will last as long as the devices do, which could be decades. Look at how much of a problem this is for old desktops, servers, and routers sitting on the internet, spewing botnet-controlled traffic because they've never been updated. Granted, this has to be done in a secure manner, so that MITM attacks are not possible, but it's absolutely possible to do it right.

      Of course, we all know what's really going to happen, which is that these companies with absolutely no clue how to do internet security are going to get many thousands of people infected through these crappy little internet-enabled gizmos, and the people who get infected with the Zeus banking trojan or crypto-ransomware will be outraged, and articles will be written, and eventually things *may* improve slightly. I'm sure as hell not going to be one of the early-adoption suckers.

      • Re:Not new (Score:5, Interesting)

        by mlts ( 1038732 ) on Sunday February 28, 2016 @10:01PM (#51606027)

        Perhaps an even better thing would be to go to a hub and spoke topology? That way, devices can communicate with the center hub (or hubs, if redundancy is desired), and if there is a fix, the hub asks for it on behalf of one device, caches it, so other devices can use that same fix without issue. It is basically what happens when devices communicate through an access point, but the devices would use a low power, low range protocol as opposed to Wi-Fi, or even opening themselves for attack by touching the Internet directly. Plus, with a hub and spoke, an IDS/IPS mechanism can be places so if one device starts behaving suspiciously that is out of the design parameters (nmapping everything it can find), its connection gets dropped, and life goes on. As an added bonus, an attacker would either have to be physically nearer to intercept the low power protocol, or would have to attack the hardened hub (which could run on fairly modest hardware and use virtual machines to separate the firewall instance from the instance that deals with the devices.)

        • by AmiMoJo ( 196126 )

          I like your idea but I think it misses the fundamental problem with IoT devices: Lifespan.

          Older wifi chipsets don't support WPA2 and can't be upgraded. The only option is to replace them, which fortunately is an option with most laptops/computers. Old phones, games consoles, TVs though... You are screwed. The only options are to disable the functionality or use WEP which can be cracked in minutes.

          Unless people are going to be happy replacing their IoT doorbell, light switches, smoke alarms, thermostat, cook

          • by mlts ( 1038732 )

            Very true. The hub idea isn't perfect... but it is better than nothing, and with IoT, virtually anything is better than what we have now. Who owns the list is important, but hopefully it can be changed to whomever the consumer wants to maintain it. The key is having some way to not just block devices that have vulnerable firmware, but also limit devices from communicating directly with the outside world. That way if someone's smart toaster has a vulnerability, because it never directly communicates to t

  • by Anonymous Coward on Sunday February 28, 2016 @06:39PM (#51605157)

    It's really simple. It's separate from source code quality. If you have proprietary software running free on your device then you don't own the device, whoever set up the software owns it. Windows phones home because it's working for Microsoft. Your IOT devices phone home because they are working for a Chinese company. Your Android phone phones home because it's working for Samsung and your mobile operator. This is not different and it's not complicated.

    • And that's not just Free Software Foundation propaganda, it's simple capitalism. If only the device vendor can control the software that runs on the device then it's a monopoly situation and we've all seen how well they work. If you have the source and the ability to reflash the device, then there is competition among third-party firmware vendors and only the ones that provide value to the end user will succeed.
    • Spy features could just as easily be hidden in hardware. Unless you want to verify the die and masks used, you still have no clue what this device can do.

    • This is a red herring. If everything you bought was open source, would that INCREASE or DECREASE you level of security? The EULAs I agree to every day are open source, but do I bother reading them? Even if the code was available for every little thing you used, you would still be relying on trust.. or else you would be spending all day fiddling with every little thing.

      Phone home functionality can be hidden in the hardware, on a remote server, in a text file, or literally anywhere. The only way to control al

  • IoT devices (Score:4, Insightful)

    by ickleberry ( 864871 ) <web@pineapple.vg> on Sunday February 28, 2016 @06:43PM (#51605191) Homepage
    These used to be just IP Cameras, they have been around for years, but now they are suddenly being called IoT devices. I wish this I(di)oT fad would die off and people would just call a spade a spade (or even an IP Spade)
    • by wbr1 ( 2538558 )
      Spade eh? http://i.imgur.com/HEOJs.gifv [imgur.com]
    • But...but the hype!

      I need more Internet of Things on the Cloud* so I can control my scary DRONE!

    • by ceoyoyo ( 59147 )

      Kind of like social networking, Web x.0 and "the cloud?" People get paid the big bucks to come up with these things!

    • by houghi ( 78078 )

      It is just a name.. Language is not binary or logical. It is a tool of comunication. If people talk about IoT, do you or don't you know what people are talking about? Hint: it is not just camera's anymore. It is your toaster as well. It could very well be that you do not like the name, but renaming it to something you like will not really change, becasue then somebody else might not like it. Remember that a rose by any other name is still a rose.

      And calling a spade a spade might be good for you or me, but f

  • "insanely bad idea" (Score:4, Interesting)

    by Bruce66423 ( 1678196 ) on Sunday February 28, 2016 @06:44PM (#51605195)
    Depends on your perspective, doesn't it? If you are aiming to ensure that a cyber attack by the People's Liberation Army on the Imperialists will do a lot of damage, it seems like a GREAT idea...
  • If you think (Score:4, Interesting)

    by Ol Olsoc ( 1175323 ) on Sunday February 28, 2016 @06:45PM (#51605197)
    That Internet of Things phoning home is some sort of secret, you've been living under a rock the last few years. Phoning home is what they are designed to do. It's the core principle of the IoT.
    • That core principle was never meant to define IoT as some company monetizing your data.

      • That core principle was never meant to define IoT as some company monetizing your data.

        But it has become that.

        Because an IoT device could probably function just as well without phoning home and selling your data.

        Or in the cameras case, they don't have to punch through firewalls (I'd really like some more data on that one) in search of other cameras and constantly phone home. But they do, for some mysterious reason.

    • Re:If you think (Score:4, Informative)

      by jones_supa ( 887896 ) on Monday February 29, 2016 @07:10AM (#51607273)
      That's not true at all. IoT simply means an embedded device connected to Internet.
      • Hey, he's got his smugly-sarcastic-narrative-that-makes-him-feel-smart-on-teh-internet and he's sticking with it.

        • Hey, he's got his smugly-sarcastic-narrative-that-makes-him-feel-smart-on-teh-internet and he's sticking with it.

          What really pisses people of is when I'm smug, sarcastic, and right.

          Sorta like an honest feedback mechanism for me.

      • That's not true at all. IoT simply means an embedded device connected to Internet.

        That's a definition, not a principle.

        Now in an ideal world, this simple device would be under your control, secure, and the limit of phoning home would be checking for updates (under your control) and sending diagnostics when requested, and also under your control.

        But is that what these devices are doing? We don't even know why they are seeking out other cameras. We do know that they phone home even when told not to. So right away, not as simple as you claim. No security, doing odd things.

        Nest Therm

  • DDNS (Score:5, Informative)

    by 110010001000 ( 697113 ) on Sunday February 28, 2016 @06:47PM (#51605201) Homepage Journal
    This "secret network" is a "DDNS network" so you can more easily connect to your camera from the Internet. Clickbait.
    • It is pretty much a requirement for this kind of thing given the normal NAT operation of most, if not many, home routers and internet connections. How can you monitor your front doorbell from your phone if your home network is behind a NAT router and your phone is on the cellular data network? No, how can Joe Regular User do it?

      I am using a network power switch which does exactly this. It pings a server in China on a regular basis (3gstore.com). When I got my first status report from it, I wondered how it

  • Total FUD (Score:5, Informative)

    by Theaetetus ( 590071 ) <theaetetus DOT slashdot AT gmail DOT com> on Sunday February 28, 2016 @06:50PM (#51605215) Homepage Journal
    Just because something says P2P doesn't mean it "connects to a vast peer-to-peer network". These particular cameras are made to work with a smartphone or tablet app: the camera connects to the company's servers to tell them its IP address; your tablet connects to the server to find out the IP address of your camera; and then your tablet and the camera establish a peer-to-peer connection, so that none of the video travels via the company's servers.

    That's it - the two peers are your camera and your mobile device, not some fast torrent network or something.

    Now, sure, this could've been documented better, but Krebs should also know better than to jump to hyperbole based on two letters and a number in a configuration screen.

    • by fyngyrz ( 762201 ) on Sunday February 28, 2016 @07:25PM (#51605395) Homepage Journal

      And it is completely, absolutely, 100% unnecessary.

      o Plug in not-yet configured device.

      o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.

      o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"

      o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

      That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.

      If you THEN want to expose WackyWidget to the WAN, you could enable that separately.

      If you were out of your damned mind.

      If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.

      • by guruevi ( 827432 ) <evi AT smokingcube DOT be> on Sunday February 28, 2016 @07:41PM (#51605501) Homepage

        You're describing Bonjour/mDNS and yes it works within LANs but not if you want to connect from outside your network. People want convenience, punching a hole in your firewall is a "lot of work" and sometimes impossible depending on your configuration.

        And yes, anyone with the information could possibly have your camera talking to them but most people don't care or refuse to understand the issue. Whether it's China or the NSA, as long as people have "bread and circuses" they'll be fine.

      • by techabuse ( 4423361 ) on Sunday February 28, 2016 @07:47PM (#51605529)
        I own a few Chinese IP cameras i bought for experimenting, and no two of them work with the same app/P2P cloud bullshit/whatever. They do, however, all expose Telnet and SSH to the world. There's no way I'd let them anywhere near the WAN because they're all running Linux on a decently snappy ARM SOC and phoning home. Can you say beach head?
        • by fyngyrz ( 762201 )

          Smart. But you are (and I am) the exception. People are ignorant and gullible and dishonest marketing is a complementary protein for that particular receptor.

        • Same reason you lock down everything. Especially those things which are dual network capable. ( eg cellular equipped )

          There is a very good reason the smartphones and the alarm system reside on Private vlans.

          They can easily be utilized as a " beach head " or jump server into your network bypassing your firewall completely.

      • And it is completely, absolutely, 100% unnecessary.

        o Plug in not-yet configured device.

        o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.

        o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"

        o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

        That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.

        If you THEN want to expose WackyWidget to the WAN, you could enable that separately.

        If you were out of your damned mind.

        If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.

        That's a really long and condescending way to say "I don't understand how subnets work". While it may work fine on your household network, this camera is designed to be accessed over the public internet. Most people don't need to check security cameras that are in the same room as them.

        • Setup a VPN.

          Connect to VPN, check your camera, disconnect from VPN. Tada. Want to go a step further ? Configure VPN to only allow access to camera.

          No open ports on the edge router, can easily route outbound traffic from suspect device to a black hole or just deny it completely.

      • by tlhIngan ( 30335 ) <slashdotNO@SPAMworf.net> on Monday February 29, 2016 @03:22AM (#51606899)

        And it is completely, absolutely, 100% unnecessary.

        o Plug in not-yet configured device.

        o Shortly thereafter, it accepts DHCP configuration. Now it has an IP.

        o Then it vomits out a tiny UDP (broadcast) packet every 60 seconds or so that says "I'm a WackyWidget and my IP is Yad.daY.yad.daY"

        o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

        That's it. That's ALL of it. You need nothing more for an IP camera, a smart power plug, a smart lightbulb, an aquarium controller, the garage door opener, etc., etc., ad infinitum.

        If you THEN want to expose WackyWidget to the WAN, you could enable that separately.

        If you were out of your damned mind.

        If you haven't yet figured out that "the cloud" is nothing but a way to take/get things from you -- money, data, ownership of media, etc. -- then you really need to look at all this harder.

        which makes the device useless to the people who buy it. People buy security cameras with IP connectivity so they can view their camera from a remote location, for alerts and the ability to view and control devices remotely.

        Like you have a camera on your front door. It sends you an alert someone is there, to which you access your camera to see who it is. Generally, this is useful if the UPS or FedEx guy comes while you're at work, at which point you can ask them to drop the package off in the garage (which you open and close remotely). No package left on the door stop, and the garage door is closed by you so it's safe and waiting for you.

        And that's the reason why people are going for the "cloud" stuff. Sure there's probably a few lazy asses using it inside their home (or their home is a huge mansion that takes 10 minutes to get from one side to the other), but the key selling point of this "IoT" devices is remote access.

        Remotely turn on the lights. Remotely turn on the heat or AC so you come home to a warm or cool house. View cameras and recordings while you're out.

        What you propose is secure, but gives consumers none of that. They're buying it for the remote accessibility and giving them only local access until they do a bunch of fancy stuff is basically counter to what consumers are buying the things for.

      • o You start app, it listens for the UDP packet, when it hears it, it begins comm via TCP at the IP identified in the UDP broadcast. UDP broadcasts then cease until, or unless, the TCP (and possibly the DHCP) connection is dropped, in which case, begin again at whatever step is needed.

        Ease of use: 1 star
        Device required some weird configuration. Couldn't connect to it via my iPhone when I wasn't at home out of the box. Should come pre-configured in a way that most people want. Would not buy again.

      • by CRC'99 ( 96526 )

        ... because I only ever want to watch my video cameras while I'm in front of them.

        The whole idea of this is to get out of NAT systems - so the real solution is just use IPv6 - but we all know how long thats going to take.

      • by houghi ( 78078 )

        So let me get this straight. It just needs to broadcast its IP adress untill there is a connection and restarts when it gets a new IP untill it gets an autentification.

        So I have a garagedooropener and i,agine I do not have a domainname liked to it and I am married.

        I install it and my wife and I configure the IP adress at home. We go to work. It changes IP adress as my provider does randomly. So it starts spewing its IP over UDP all day long. I get home first, have to wait on average 30 seconds. I get the ne

    • by mikael ( 484 )

      A "vast peer-to-peer network" sounds like cloud computing. Cisco once tried to get their users to configure their Linksys routers through "The Cloud". Unless told to do otherwise, routers would auto-update the firmware so that all configuration settings could only be controlled from Cisco's router management website.

      • by Bert64 ( 520050 )

        How would you configure your router to actually work (ie before it has working connectivity)?

  • Phoning home isn't notable unless you know what it's doing so for. It could be to send information back, or it could just be to just for updates etc.

  • Insanely bad idea? (Score:5, Insightful)

    by gstoddart ( 321705 ) on Sunday February 28, 2016 @06:57PM (#51605249) Homepage

    the behavior is an "insanely bad idea," and that it opens an attack vector into home networks

    I'm sorry, but based on what we've been seeing, so far the entire Internet of Things is an insanely bad idea ... shoddy security by incompetent idiots who want more analytics data and ad revenue, and don't give a crap about your security.

    Fuck that, I want my toaster connected to the internet why again?

    That this is happening should no longer come as a surprise to anybody who has paid even the smallest amount of attention to how much of a mess the IoT is.

    • by bigdavex ( 155746 ) on Monday February 29, 2016 @12:06AM (#51606479)

      Fuck that, I want my toaster connected to the internet why again?

      How else do you think it will keep its antivirus software up-to-date?

  • by MindPrison ( 864299 ) on Sunday February 28, 2016 @07:08PM (#51605313) Journal
    I'm a user of the now Arduino compatible ESP 8266-12E ever so popular IoT 2$ device. It's a WiFi on a chip + a nice 80 MHz microcontroller (32 bit) with 4MBit flash ram to boot, it's insanely cheap for what you actually get...

    If you just use them as they are (With the AT+ command set, hayes compatible) - they already phone home because they can Upgrade the firmware - albeit you can initiate that yourself).

    But unless you've got a WiFi hotspot with a firewall where you can Wireshark monitor your network traffic - you will have NO idea whether this thing is phoning home with a few extra details about your network, it's bad enough that it actually phones "home" with your IP address, I'm not sure if it does that - but it's def. worth an extra look. Anyone know the details about this? Have anyone tried looking into the ESP8266 series to see if they even phone home after they've been bootloaded with the Arduino Bootloader?

    We've got to be a little careful about this - I agree completely - It's so tempting to just insert those wonderful all-in-one IoT devices here and there...and forget about the advanced details...because lets face it - they've made it wonderfully practical for us to use with very little skill or knowledge required to get these things talking to each other (while - perhaps...hiding a darker side).
    • IoT Subnet, it needs not be able to reach the internet ever.

      • by ceoyoyo ( 59147 )

        Not much of an internet of things then, is it?

        • I've got a couple hundred devices that work that way and seems pretty internet of things to me. Only they are my things and only allowed to talk to what I allow them to.

          So CCTV camera only talk to NVR's and an application specific gateway. Why would some wifi camera need to talk to the internet as a whole? If I wanted to access it directly I can VPN in. In general the application gateway thats part of my home automation give me all the live info I need. The NVR's deal with long term encryption and rete

          • by ceoyoyo ( 59147 )

            That's all well and good, but the manufacturers want to sell IP cameras and other "Internet of things" stuff to regular consumers. Regular consumers don't "VPN into" things. They tap on an app on their smartphone.

            Besides which, unless you're extraordinarily lucky or for some reason spend multiple times the regular rate for Internet service, you have a dynamic DNS address. That means something on your network, whether it's a toaster, desktop computer or your router, has to talk to an external DDNS server

            • Point being IoT end devices should not be exposed to the internet it's a horrid design for something that should work for 10+ years without modification. App specific controllers make sense thus why zwave etc does just that.

              Setting up a singular VPN to a dynamic IP is pretty easy and thats one thing updating one service to do so. My app gateway just works with my phone. Besides who wants to install and maintain a pile of different apps. My garage door opener has an app, I just use the single app gateway

  • That's what the whole point of the IoT. If you are going to control your lights or toaster or whatever with your phone, OF COURSE it has to connect to an external server - so that you can connect to the device. Naturally, it's stupid, but that's the IoT for you.

  • Now that kids is why you don't tell any device that doesn't need to get out on the net what the gateway address is.

    If you need to access it via the internet, then fair enough, but now we've got yet another example as to why we should use firewall settings to make sure they can only contact what you want them to contact.
    • by Endymion ( 12816 )

      We're seeing the current wave of WiFi-enabled devices because the cheap SoC parts now include a WiFi NIC. At some point in the future (I believe prototype hardware already exists) a new SoC will include a baseband processor and software defined radio. When that happens, all of these devices will no longer need your permission and LAN access to steal data - they will simply use the cellular networks.

      If you buy these WiFi devices - regardless of your plans to deny them your gateway address - you are supportin

  • Any IOT device that has access from a smartphone does something like this. If you look at the traffic from a Philips Hue hub you'll see SSDP broadcasts, NTP synchronisation and phoning home with details of it's local IP address and checking for updated firmware.

    This article seems to be yet more anti-Chinese nonsense. There was a very similar one recently by an American "journalist" that didn't understand that NTP is a distributed protocol either and implied these devices were somehow infiltrating US homes a

  • At the current state of affairs, almost all IoT devices are programmed using development environments provided by the semiconductor (e.g., http://www.nxp.com/products/so... [nxp.com]). And most of these are a composition of open-source tools (i.e., GCC, Eclipse, etc.) with some proprietary interfacing software (e.g., something like JTAG to program the chip with). The vendor-specific IDEs (e.g., customized Eclipse) often come with networking libraries (i.e., something BSD sockets-esque for Internet) they made and /may
  • by EvilSS ( 557649 ) on Sunday February 28, 2016 @07:29PM (#51605435)
    Really Dice, scared shitless to mention the manufacturer?

    Here is the Krebs link if you want the actual details and don't want to dig it out of the articles linked in the summary: [krebsonsecurity.com]http://krebsonsecurity.com/201... [krebsonsecurity.com]
  • by this, one can get a false impression that this sort of thing is confined to a "chinese manufacturer ", when it isn't.

  • from the no-shit-sherlock dept?

  • with legislation: (a) that this must be documented (what, where to, ...) and (b) how to switch it off. However that will not happen: (1) most of the legislators do not understand the problem; (2) those that do realise that this would stop $OurCountry products from doing this at the behest of GCHQ/NSA/... So it shall be ignored.

    There might be some movement when some government high ups are, through one of these, exposed: in bed with a hooker; snorting white powder; accepting money\Wcampaign-contributions fro

    • A better way to fix this is to forgo legislation ( think of the level of tech expertise within Congress for just a moment ) and start teaching the average user about the security concerns that comes with convenience.

  • Big Blothel is watching you!
  • by PPH ( 736903 ) on Sunday February 28, 2016 @09:06PM (#51605855)

    Set up a honeypot consisting of a Chinese DVR and a bunch of security cams pointing at pictures of Minuteman ICBMs sitting in their silos. Sit back and watch your IP address get hacked.

    • by rossz ( 67331 )

      Better idea. Set it on a long video loop that shows a bunch of missiles launching after several hours of just sitting there.

  • It gets dark at night, and water is wet...

    Giant fucking DUH! to the idiots who didn't think would happen...

    • It gets dark at night, and water is wet...

      Except at the poles.

      • Wet, but frozen, and while there are times at the poles it doesn't get dark at "clock" night, what percentage of the world's population actually lives there :)

  • Even if the user discovers it, it's still extremely hard to turn off.

    Why? Does it continue to draw energy from the ether after you unplug it?

    Sounds like an 80s episode of The Twilight Zone...

I just asked myself... what would John DeLorean do? -- Raoul Duke

Working...