Abridged info on RISKS (comp.risks)
----------------------------------------------------------------------
Date: Fri, 4 Nov 2016 1:53:04 PDT
From: "Peter G. Neumann" <
neumann@csl.sri.com>
Subject: "Your WiFi-connected thermostat can take down the whole
Internet. We need new regulations." (Bruce Schneier)
Bruce Schneier, 3 Nov 2016, *The Washington Post*, 3 Nov 2016
The government has to get involved in the "Internet of Things."
https://www.washingtonpost.com/posteverything/wp/2016/11/03/your-wifi-connected-thermostat-can-take-down-the-whole-internet-we-need-new-regulations/?utm_term=.284c3ae330c1&tid=sm_twBruce Schneier is a security technologist and a lecturer at the Kennedy
School of Government at Harvard University. His latest book is "Data and
Goliath: The Hidden Battles to Collect Your Data and Control Your World."
Late last month, popular websites like Twitter, Pinterest, Reddit and PayPal
went down for most of a day. The distributed denial-of-service attack that
caused the outages, and the vulnerabilities that made the attack possible,
was as much a failure of market and policy as it was of technology. If we
want to secure our increasingly computerized and connected world, we need
more government involvement in the security of the Internet of Things -- and
increased regulation of what are now critical and life-threatening
technologies. It's no longer a question of if, it's a question of when.
First, the facts. Those websites went down because their domain name
provider -- a company named Dyn -- was forced offline. We don't know who
perpetrated that attack, but it could have easily been a lone hacker.
Whoever it was launched a distributed denial-of-service attack against Dyn
by exploiting a vulnerability in large numbers -- possibly millions -- of
Internet-of-Things devices like webcams and digital video recorders, then
recruiting them all into a single botnet. The botnet bombarded Dyn with
traffic, so much that it went down. And when it went down, so did dozens of
websites.
Your security on the Internet depends on the security of millions of
Internet-enabled devices, designed and sold by companies you've never heard
of to consumers who don't care about your security.
The technical reason these devices are insecure is complicated, but there is
a market failure at work. The Internet of Things is bringing computerization
and connectivity to many tens of millions of devices worldwide. These
devices will affect every aspect of our lives, because they're things like
cars, home appliances, thermostats, lightbulbs, fitness trackers, medical
devices, smart streetlights and sidewalk squares. Many of these devices are
low-cost, designed and built offshore, then rebranded and resold. The teams
building these devices don't have the security expertise we've come to
expect from the major computer and smartphone manufacturers, simply because
the market won't stand for the additional costs that would require. These
devices don't get security updates like our more expensive computers, and
many don't even have a way to be patched. And, unlike our computers and
phones, they stay around for years and decades.
An additional market failure illustrated by the Dyn attack is that neither
the seller nor the buyer of those devices cares about fixing the
vulnerability. The owners of those devices don't care. They wanted a webcam
-- or thermostat, or refrigerator -- with nice features at a good price. Even
after they were recruited into this botnet, they still work fine -- you can't
even tell they were used in the attack. The sellers of those devices don't
care: They've already moved on to selling newer and better models. There is
no market solution because the insecurity primarily affects other people.
It's a form of invisible pollution.
And, like pollution, the only solution is to regulate. The government could
impose minimum security standards on IoT manufacturers, forcing them to make
their devices secure even though their customers don't care. They could
impose liabilities on manufacturers, allowing companies like Dyn to sue them
if their devices are used in DDoS attacks. The details would need to be
carefully scoped, but either of these options would raise the cost of
insecurity and give companies incentives to spend money making their devices
secure.
It's true that this is a domestic solution to an international problem and
that there's no U.S. regulation that will affect, say, an Asian-made product
sold in South America, even though that product could still be used to take
down U.S. websites. But the main costs in making software come from
development. If the United States and perhaps a few other major markets
implement strong Internet-security regulations on IoT devices, manufacturers
will be forced to upgrade their security if they want to sell to those
markets. And any improvements they make in their software will be available
in their products wherever they are sold, simply because it makes no sense
to maintain two different versions of the software. This is truly an area
where the actions of a few countries can drive worldwide change.
Regardless of what you think about regulation vs. market solutions, I
believe there is no choice. Governments will get involved in the IoT,
because the risks are too great and the stakes are too high. Computers are
now able to affect our world in a direct and physical manner.
Security researchers have demonstrated the ability to remotely take control
of Internet-enabled cars. They've demonstrated ransomware against home
thermostats and exposed vulnerabilities in implanted medical devices.
They've hacked voting machines and power plants. In one recent paper,
researchers showed how a vulnerability in smart lightbulbs could be used to
start a chain reaction, resulting in them all being controlled by the
attackers -- that;s every one in a city. Security flaws in these things could
mean people dying and property being destroyed.
Nothing motivates the U.S. government like fear. Remember 2001? A
small-government Republican president created the Department of Homeland
Security in the wake of the Sept. 11 terrorist attacks: a rushed and
ill-thought-out decision that we've been trying to fix for more than a
decade. A fatal IoT disaster will similarly spur our government into action,
and it's unlikely to be well-considered and thoughtful action. Our choice
isn't between government involvement and no government involvement. Our
choice is between smarter government involvement and stupider government
involvement. We have to start thinking about this now. Regulations are
necessary, important and complex -- and they're coming. We can't afford to
ignore these issues until it's too late.
In general, the software market demands that products be fast and cheap and
that security be a secondary consideration. That was okay when software
didn't matter -- it was okay that your spreadsheet crashed once in a while.
But a software bug that literally crashes your car is another thing
altogether. The security vulnerabilities in the Internet of Things are deep
and pervasive, and they won't get fixed if the market is left to sort it out
for itself. We need to proactively discuss good regulatory solutions;
otherwise, a disaster will impose bad ones on us.