What kind of stuff is lurking out there on the vast (and growing) Internet of Things? A recent story in Forbes makes the point that its a lot more varied than you might think – everything from Caterpillar trucks to public school classrooms to a crematorium. And “yes,” I said “crematorium.” The idea that surveillance cameras can be accessed from the public Internet isn’t really new. Security researchers have been showing off ways to sidestep security features for IP enabled surveillance cameras for years. We wrote last week about the Federal Trade Commission’s case against a California company, TRENDNet, which made a line of balky, in secure home surveillance gear. But Kashmir Hill makes the point in her story that surveillance cameras are just the tip of the iceberg. Hill interviewed security researchers and professional Shodan jockeys, who use that hardware focused search engine to uncover supposedly secure equipment and industrial control […]
Government
Report: Cell Phone Data, Blackberry Mail Swept Up In NSA’s Net
Sensitive data from every major brand of cell phone can be captured and analyzed by the U.S. National Security Agency, (NSA) according to a report in the German magazine Der Spiegel on Saturday. Citing “top-secret, internal NSA documents viewed by SPIEGEL reporters, the magazine said that NSA security researchers have developed tools to sap contact lists, SMS traffic, notes and location information from popular devices such as Apple’s iPhone, Google’s Android and Blackberry phones, including Blackberry e-mail, a supposedly secure system that is one of the phone’s most trumpeted features. The documents describe a large-scale and well-organized program within the NSA to obtain data from mobile devices, with discrete teams of security analysts working on a specific platform, developing malware that infiltrates the computers the phones “synch” with, and then loads scripts onto the phones that provide access to a range of other features. See Also: Secure e-mail firms […]
With Settlement, FTC Issues Warning On IP-Enabled Cameras
The U.S. Federal Trade Commission (FTC) made one of its strongest statements to date on the issue of consumer privacy in the fast-emerging market for “smart” electronics: settling a complaint with the maker of SecurView, a line of home surveillance cameras that, it turned out, were just as easily used to spy into the homes of SecurView customers. In a statement on Wednesday, the FTC said that it settled a complaint against TRENDnet, the maker of the SecurView home security cameras. The FTC had charged the Torrance, California company with misrepresenting the security of its products. TRENDnet sold “faulty software that left (the cameras) open to online viewing” by anyone who knew the device’s IP address. Under the terms of its settlement with the Commission, TRENDnet must stop misrepresenting the “security, privacy, confidentiality, or integrity of the information that its cameras or other devices transmit,” as well as “the extent […]
U.S. Cyber Security Framework Is Good News-For Hackers
Ralph Langner, the renowned expert on the security of industrial control- and SCADA systems, warns that the latest draft of the U.S. Government’s Cyber Security Framework (CSF) will do little to make critical infrastructure more resistant to devastating cyber attacks. Writing on his blog, Langner said that a draft of the National Institute of Standards and Technology’s (NIST’s) Preliminary Cybersecurity Framework does little to compel critical infrastructure owners to improve the security of their systems, or guarantee uniform (and robust) cyber security standards in the critical infrastructure space. NIST released the latest draft of the CSF late last month (PDF). But Langner, writing on Wednesday, likened the framework to a recipe that, if used by three different chefs, produces three totally different dishes…or just a messy kitchen. “A less metaphorical words, a fundamental problem of the CSF is that it is not a method that, if applied properly, would lead to predictable results,” […]
That ARM-Sensinode Buy: What Does It Mean For Security And IoT?
We wrote last week about the decision of chip-maker ARM to buy the small(ish) Finnish software maker Sensinode Oy, which has become a big player in the market for software that runs low power devices like embedded sensors. The deal makes sense at the 100,000 foot level – ARM makes chips that power embedded devices, Sensinode makes the software that is powered by them. Perfect. But the deal actually works at a bunch of different levels, as I learned from a conversation with Michael Koster, the co-founder and lead architect at the group The Open Source Internet of Things (OSIOT). Koster is an authority on The Internet of Things and has helped create open-source toolkits and APIs that promote interaction among intelligent devices. Koster said that ARM’s purchase of Sensinode is as much about both firms’ investment in emerging IoT standards for low-powered, intelligent devices like Constrained Application Protocol (CoAP) […]
