Locking Down the Internet of Things (IoT)

With all the news of the Reaper malware that’s infecting Russia and Ukraine, and reminders of the disaster of last year’s Miria botnet, it’s a good time to review basic home network hygiene and best practices for securing the Internet of Things (IoT).

What is the Internet of Things (IoT)?

The Internet of Things, or IoT, is a hot marketing buzzword these days, but what does it really mean? Internet of Things refers to the recent phenomenon of connecting regular, everyday “dumb” devices to the Internet in order to enable cool new features. One of the most popular examples is the Nest Thermostat. Nest (who was bought by Google for $3.2B) created a ‘smart’ replacement for the dreary household HVAC thermostat. Not only was it beautiful and easy to use, it had built-in WiFi and could communicate with Nest’s Internet service. With the help of a smartphone app, Nest owners could monitor and even control the temperature of their homes from anywhere on the planet. Over the last few years, billions of devices have joined the Internet of Things: TVs, garage door openers, baby monitors, watches, appliances, and even light bulbs.

An Army of Robots

What might not be immediately obvious is that every one of these products is also a computer. While computer chips have found their way into all sorts of modern products, putting those computers on a network takes things to an entirely new level. Computers are hackable because they run software, and all software has bugs. But if that computer is not on a network, you have to be have physical access to hack it. Not so with IoT.  Cybersecurity professionals love to say that the “S” in “IoT” stands for security – meaning it has none – and it’s not far from the truth. Cost is a huge issue for most of these devices, and adding proper security adds a lot of cost – both in development and testing, but also hardware cost (faster CPUs, more memory, etc).

So what do you get with a massive influx of insecure computers on the Internet? A hacker’s dream come true. The security flaws in these products are widely known by the hacking community. Also, most of these devices have a special web page where you can configure them. And while most are protected with a user ID and password, these credentials are almost always set to default values, which are also well known. It’s trivial to write malware to exploit these weaknesses and gain control of these IoT devices. And when you have an army of devices you can control from anywhere on the Internet, you have what we call a botnet (shorthand for a ‘network of robots’). Hackers use these innocent-looking devices to do their bidding. One of the more common uses is to direct an unsurmountable wave of requests at some target web site to bring it to its knees – called a Distributed Denial of Service (DDoS) attack. That’s how the Mirai botnet took down a large portion of the Internet last Fall, and the Reaper botnet is poised to wreak similar havoc in the near future.

How Not to be Bot

So what are we to do? How do we keep our wonderful Internet of Things devices from being subverted and conscripted into a botnet? The primary thing we need to all do as consumers is to demand security for all our Internet-connected products. Do your homework, read the labels, compare products based on security and privacy features. Support regulatory or even voluntary initiatives to improve security and provide more transparency. We could really use some sort of Underwriters Laboratory for cyber security and privacy, providing independent analysis and a standardized product ratings. But until then, we need to do what we can on our own.

  • Change default passwords. If your device has any sort of administrative interface (probably a web page), change the default login password. Write it down or use a password manager.
  • Update the firmware. Not all IoT devices can be updated, which is a massive problem. But if your device has a way to update it’s firmware (which is what we call software that runs on these appliance-type devices), you must to keep it up to date. The admin web page should have a help/info link that will tell you how to check for updates and install them.
  • Register your devices. You should go ahead and register these devices online and get on the email lists. This is probably the most reliable way to get notified of bugs that need to be fixed. Yes, this will expose you to marketing crap. You can try to limit the spam by updating your ‘marketing preferences’ to only include security updates.
  • Dumb down your devices. If you don’t use the Internet features on your device, then don’t put it on the network at all. For example, most TVs today have an Internet connection because they come with built-in Netflix apps and such. But if you don’t use those features (for example, you use a FireTV, Apple TV or Roku), then you have no reason to plug into into your network or enable WiFi.
  • Unplug unused devices. If you have a device you no longer use (or trust), just get rid of it. Or if you use it only rarely, unplug it until you need it. For example, I have a web cam I use to watch my house when we travel. I only plug it in when we actually travel.
  • Quarantine your devices. Compromised devices on your network are basically beachheads for hackers within your home network. You can mitigate these risks by putting your IoT devices on your guest network. Don’t have a guest network? Most modern WiFi routers have this capability and it’s easy to set up. It’s a separate network for untrusted devices (including your guest’s devices, hence the name).
  • Restart your devices. Some of the malware that infects IoT devices can be cleansed just by powering the device off and back on. Unfortunately, unless you can update the software, it will still be vulnerable to re-attack.

As always, you can find these and over 100 more tips in my book. I also covered the topic of Internet of Things in a wonderful interview with John Graham-Cumming (CTO of Cloudflare) – check it out!

Privacy First: Apple Strikes Another Blow

Full disclosure: I’m an Apple user and have been for decades. But one of the reasons I’ve been such an ardent Apple fan is that I’ve always felt like they had my back. I’m not sure how much of this is altruistic – but you can argue that the actual reasons might be more compelling (if more cynical): it’s their business model. Apple is a hardware company. They make computers, phones, tablets, and other devices. The software that comes with those devices is almost entirely free and is used to increase the value of the hardware. Most people still think of Google as a search engine company. If you happen to know that Google makes the Android smartphone operating system, then you might think of them as a hardware and software maker, too. And they are. But Google makes about 90% of their revenue from advertising.

Why does that matter? Because this means that Google’s primary product is you. They want to know all about you (and I mean all about you) so they can sell highly-targeted ads. Google may be extremely keen to protect your privacy… from everyone but Google. While Apple certainly has access to your personal information, and they even have a small ad business, they appear to be taking great pains to avoid abusing their position, drawing a stark contrast with Google and others. They actually appear to care about protecting your privacy and see this as a key marketing differentiator.

Apple Fires Another Shot Across the Bow

Apple was the first browser-maker to block third-party cookies by default about 6 years ago, which caused a huge fuss. Google was even caught circumventing this and ended up paying a $22M fine (which is, of course, nothing to Google).

And now Apple is at it again: daring to protect its users’ privacy using a new technology called Intelligent Tracking Prevention (ITP). This feature, built into Apple’s Safari browser, adds some common sense limits on the scope of web tracking. The details are rather arcane (if you want to give it shot, try this article), but the upshot is that Apple is actually proactively trying to protect its users’ privacy without breaking the way the web works (at least not the parts that users care about). It’s not preventing you from seeing ads. It’s not even preventing you from being tracked. It’s just putting some strict time limits on how long you can be tracked, depending on the user’s apparent actual interest in the product or web site. Sounds reasonable, doesn’t it?

Let Me Get My Tiny Violin

Not to web advertisers. They’re collectively freaking out, calling it “sabotage”. But let’s just be clear here that people never asked to be tracked. Advertisers love to claim that their targeted ads are so amazingly beneficial that removing them is actually harming the people they’re tracking. From an open letter to Apple from several ad agencies:

Apple’s unilateral and heavy-handed approach is bad for consumer choice and bad for the ad-supported online content and services consumers love. Blocking cookies in this manner will drive a wedge between brands and their customers, and it will make advertising more generic and less timely and useful. Put simply, machine-driven cookie choices do not represent user choice; they represent browser-manufacturer choice.

There are several problems with this statement. First, ITP doesn’t block ads and it doesn’t even prevent tracking – it just puts a time limit on tracking. Second, making ads more generic just takes things back to the ways ads were before tracking (ie, less creepy) – which is how advertising worked for decades or even centuries. Finally, users rarely bother tweaking any settings – even if they know and understand how tracking works, many people simply can’t be motivated to change their default browser preferences. It’s the Tyranny of the Default. People don’t actively say “I want to be tracked! Where is the setting that allows that? I want to make sure it’s enabled!” But sadly they also don’t do anything to stop being tracked.

Time for a Change

So kudos to Apple for trying to strike a balance and sticking up for their users. But I’m honestly more pleased that this has once again raised the issue of privacy and tracking. Most people just aren’t aware of the degree to which they’re being tracked, nor have they probably considered the consequences for themselves and for society in general. It’s going on constantly, right under our noses, and the results have so far been kept largely secret. (If you want to get just a taste of what these marketers know about you, check out aboutthedata.com from Acxiom or My Account from Google).

We got here because people don’t want to pay for web content – which led us to the ad-based web. We can debate the ethics of ad-blocking, but we really just need a new revenue model for the web that doesn’t incur horrendous privacy issues (for example, the new Brave web browser and micropayments).

[NOTE: Check out this week’s podcast where I go more in-depth on how and why we’re tracked, and what you can do to protect your privacy.]