This is Why People [SHOULD] Fear the ‘Internet of Things’

This is Why People Fear the ‘Internet of Things’

Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware. Now imagine that the geek gear you bought doesn’t actually let you block this P2P communication without some serious networking expertise or hardware surgery that few users would attempt.

The FI9286P, a Foscam camera that includes P2P communication by default.

This is the nightmare “Internet of Things” (IoT) scenario for any system administrator: The IP cameras that you bought to secure your physical space suddenly turn into a vast cloud network designed to share your pictures and videos far and wide. The best part? It’s all plug-and-play, no configuration necessary!

I first became aware of this bizarre experiment in how not to do IoT last week when a reader sent a link to a lengthy discussion thread on the support forum for Foscam, a Chinese firm that makes and sells security cameras. The thread was started by a Foscam user who noticed his IP camera was noisily and incessantly calling out to more than a dozen online hosts in almost as many countries.

Turns out, this Focscam camera was one of several newer models the company makes that comes with peer-to-peer networking capabilities baked in. This fact is not exactly spelled out for the user (although some of the models listed do say “P2P” in the product name, others do not).

But the bigger issue with these P2P -based cameras is that while the user interface for the camera has a setting to disable P2P traffic (it is enabled by default), Foscam admits that disabling the P2P option doesn’t actually do anything to stop the device from seeking out other P2P hosts online (see screenshot below).

This is a concern because the P2P function built into Foscam P2P cameras is designed to punch through firewalls and can’t be switched off without applying a firmware update plus an additional patch that the company only released after repeated pleas from users on its support forum.

Yeah, this setting doesn’t work. P2P is still enabled even after you uncheck the box.

One of the many hosts that Foscam users reported seeing in their firewall logs was iotcplatform.com, a domain registered to Chinese communications firm ThroughTek Co., Ltd. Turns out, this domain has shown up in firewall logs for a number of other curious tinkerers who cared to take a closer look at what their network attached storage and home automation toys were doing on their network.

In January 2015, a contributing writer for the threat-tracking SANS Internet Storm Centerwrote in IoT: The Rise of the Machines that he found the same iotcplatform.com domain called out in network traffic generated by a Maginon SmartPlug he’d purchased (smart plugs are power receptacles into which you plug lights and other appliances you may wish to control remotely).

What is the IOTC Plaform? According to ThroughTek, it’s a service developed to establish P2P communications between devices.

“I read the documentation provided with the device as well as all the website pages and there is no mention of this service,” wrote Xavier Mertens, an incident handler and blogger for SANS. “Manufacturers should include some technical documentation about the network requirements (ex: to download firmware updates).”

In another instance from May 2015, this blogger noted similar communications trafficemanating from a digital video recorder (DVR) device that’s sold in tandem with Internet-enabled surveillance cameras made by a company called Swann.

Likewise, postings from Dec. 2014 on the QNAP network attached storage (NAS) user forum indicate that some QNAP customers discovered mysterious traffic to iotcplatform.com and other Internet address requests that also were found in the Swann and Smart Plug traffic.

What do all of these things have in common? A visit to ThroughTek’s Web lists several “case studies” for its products, including Swann, QNAP and a home automation company based in Taiwan called AboCom.

A ThroughTek press release from October 2015 announced that the company’s P2P network — which it calls the Kalay Network — had grown to support more than seven million connected devices

ThroughTek did not respond to requests for comment. A ThroughTek press release from October 2015 announced that the company’s P2P network — which it calls the Kalay Network — had grown to support more than seven million connected devices and 100 million “IoT connections.”

I contacted Foscam to better understand the company’s relationship to ThroughTek, and to learn just how many Foscam devices now ship with ThroughTek’s built-in, always-on P2P technology. Foscam declined to say how many different models bundled the P2P technology, but it’s at least a dozen by my count of the models mentioned in the Foscam user manual and discussion thread.

Foscam customer service representative David Qu wrote in reply to requests for comment that “ThroughTek provides P2P technical support service for us.” He also said the P2P cameras merely keep a “heartbeat” connection to Foscam’s P2P server to check the connection status with the servers, and that no camera data will be stored on the company’s servers.

“The details about how P2P feature works which will be helpful for you understand why the camera need communicate with P2P servers,” Qu explained. “Our company deploy many servers in some regions of global world.” Qu further explained:

1. When the camera is powered on and connected to the internet, the camera will log in our main P2P server with fastest response and get the IP address of other server with low load and log in it. Then the camera will not connect the main P2P server.

2. When log in the camera via P2P with Foscam App, the app will also log in our main P2P server with fastest response and get the IP address of the server the camera connect to.

3. The App will ask the server create an independent tunnel between the app and the camera. The data and video will transfers directly between them and will not pass through the server. If the server fail to create the tunnel, the data and video will be forwarded by the server and all of them are encrypted.

4. Finally the camera will keep hearbeat connection with our P2P server in order to check the connection status with the servers so that the app can visit the camera directly via the server. Only when the camera power off/on or change another network, it will replicate the steps above.”

As I noted in a recent column IoT Reality: Smart Devices, Dumb Defaults, the problem with so many IoT devices is not necessarily that they’re ill-conceived, it’s that their default settings often ignore security and/or privacy concerns. I’m baffled as to why such a well-known brand as Foscam would enable P2P communications on a product that is primarily used to monitor and secure homes and offices.

Apparently I’m not alone in my bafflement. Nicholas Weaver, a senior researcher in networking and security for the International Computer Science Institute (ICSI), called the embedded P2P feature “an insanely bad idea” all around.

“It opens up all Foscam users not only to attacks on their cameras themselves (which may be very sensitive), but an exploit of the camera also enables further intrusions into the home network,” Weaver said.

“It opens up all Foscam users not only to attacks on their cameras themselves (which may be very sensitive), but an exploit of the camera also enables further intrusions into the home network,” Weaver said.

“Given the seemingly cavalier attitude and the almost certain lack of automatic updates, it is almost certain that these devices are remotely exploitable,” he added. “It is no wonder that Director of National Intelligence James Clapper is worried about the Internet of Things, how many government officials have or may unwittingly install potential spies like this in their home.”

If you’re curious about an IoT device you purchased and what it might do after you connect it to a network, the information is there if you know how and where to look. This Lifehacker post walks through some of the basic software tools and steps that even a novice can follow to learn more about what’s going on across a local network.

By Brian Krebs

BlockChain: Why the technology powering bitcoin will revolutionise digital identity

Bitcoin had a controversial infancy. The peer-to-peer crypto-currency first came to the general public’s attention with front page news reporting the DDoS (distributed denial-of-service) attack on the Mt. Gox exchange. Common sense would dictate that a $575m hack would’ve been its death knell, but counter to received wisdom it’s achieved a remarkable pivot. One of the key reasons for its resilience is the blockchain - the secure architecture behind the digital currency.

For the uninitiated, a blockchain is a shared, distributed ledger where no one organisation or individual (such as a bank or government entity) holds all of the information. Instead, tens of thousands of copies of the same ledger are distributed and maintained globally by many entities. This means that if any one version is changed, hacked or corrupted then it’s declared void and re-written with the version the rest of the network agrees with. It’s basic majority rule.

By deferring responsibility away from a single third party, the blockchain eradicates potential weaknesses in the chain and hardens the continually growing data against tampering and revision. In this way it’s incredibly secure as no single person or entity holds all the keys.  

The future of digital transactions

Financial organisations initially saw bitcoin as a threat, but are now waking up to peer-to-peer tech. Mistrust has transformed into eager adoption with the likes of Barclays becoming the first UK high street bank to accept bitcoinand CitiBank creating its own CitiCoin. All of this success is built on the blockchain, in particular its ability to help prevent fraud. 9 global banks have recently announced a blockchain partnership and we predict that this technology will be the future of all digital transactions sooner than you think.

New technologies are emerging that have less to do with digital currencies, but rather, they leverage the core innovation that has come out of bitcoin: the blockchain. As a generalised, distributed ledger, the blockchain can be used to store all types of data and transactions in a secure and open way.

Identity on the blockchain

But, what if we were to use the blockchain to transfer identity data? Front page stories of hacked databases and breached accounts can become a thing of the past. Identity can become something that is easier to manage for individuals, giving them greater control over who has their personal information and how they access it. But to get there, we must start with the fundamental need to verify that customers are exactly who they say they are. 

Data sets like electoral registers and passports are a rich resource but have distinct limitations – especially in today’s digital world. Data is not always the same across borders; old data often only exists in paper form and cross-referencing frequently leads to human error. Identity verification can quickly become a costly and time-consuming effort.

Globally businesses are losing £2.78 trillion ($4.2 trillion USD) each year to fraud according to research by the University of Portsmouth. Financial organisations in particular invest heavily in security processes to protect themselves and their customers from fraud – but this protection comes at a high price.

A digital watermark 

Creating a digital ID, combining the decentralised blockchain principle with identity verification, would act as a digital watermark, assigned to every online transaction. This would allow organisations to check identity on every transaction in real time, virtually eliminating fraud. There would also be marginal cost for firms verifying identity as the customer owns their digital ID file, effectively lending it to companies on a case-by-case basis.

Digital identities would enable people from all over the globe to login and verify payments without having to enter any of the traditional username and password information, all of which can be hacked or forgotten. Instead they would use a simple App that stores their encrypted identity, allowing them to share their data with companies and manage it on their own terms.

Currency is increasingly de-centralised and we see identity data as the next logical step. This new approach will rely on third parties like GBG and ShoCard to manage and process these de-centralised identities.

Those with the most data will no longer rule and identity will soon be the premier currency. Blockchain’s decentralised approach will give control back to customers – preventing fraud and boosting trust in the process. We see this deferment of ownership as a revolution not only for financial services, but for society at large.

It’s now time to take back control and own your identity.

Richard Law (CEO, GBG) & Armin Ebrahimi (CEO, ShoCard)

Richard Law is CEO of GBG, which provides clients with the identity data intelligence and technology they need to make smarter decisions about people.

Amrin Ebrahimi is CEO of ShoCard, a company at the forefront of providing identity products and services leveraging these new technologies.

Energy sector execs see successful cyberattack as likely

Older technology makes energy sector groups particularly vulnerable to cyberattacks.

A cyber attack on an organization in the energy, utility, oil and gas sectors is fully capable of causing harm to the physical plant, according to a Tripwire survey of IT professionals working in these fields.

Every one of the 150 IT executives that Tripwire polled for its 2016 Energy Survey said a kinetic cyberattack on operational technology in their organization could cause physical damage. The execs noted that not only were their organizations extremely vulnerable, but 76 percent believed their businesses are also a likely target for such an attack and about the same number believe that such an attack will come from a nation state.

The possibility of one country playing havoc with another nation's power system was brought to the public's attention in December 2015 when the Ukraine saw part of its power grid knocked offline, possibly by a Russian cyberattack. 

Despite the certainty that something will happen with the end result being some type of damage to either the physical plant or computer system, a large minority, 35.4 percent, of those surveyed said they could not accurately track all the threats coming into their systems. Another 16.2 percent said they don't have the visibility necessary to track all threats.

The reason for this inability lies in the fact that the systems designed for the energy sector are intended to be reliable, physically robust and long lasting and not necessarily cyber secure.

“Many energy organizations have control systems that are expected to have 10 to 30 year lifespans. These systems weren't originally put in place with network connectivity in mind, but they are being added to more modern IT networks to facilitate business efficiency. It's a real challenge to secure newly networked devices that weren't designed with basic network security to being with,” Tim Erlin, Tripwire's director of IT security and risk strategy, told SCMagazine.com.

Erlin did point out that despite the alarming responses given in the survey progress is being made. He noted the increasing amount of security research being conducted around industrial control systems as a positive sign. In addition, the energy sector now includes network security as part of its overall safety scheme.

“Safety is a concept that energy organizations already embrace," he said. "Extending cybersecurity to include safety will help with adoption in these organizations."

By Doug Olenick, Editor Security Magazine

Why thinking like a criminal is good for security

When planning an attack, criminals study their target victims looking for the weakest links.

Focusing too much on protecting only the crown jewels of the enterprise might leave gaps in security for criminals who are seeking other valuable assets. The hackneyed expression, “One man’s trash is another man’s treasure,” serves as a reminder that what the enterprise values is often different from what a criminal values.

 

Sample password protection policy

The password protection policy of a large financial services institution with more than 5,000 employees.

Defending a network and the critical assets of an enterprise is a lot like safeguarding a home. There are layers of security in homes just as there are in the enterprise. From the windows to the doors to the locks and alarm systems, home owners know the vulnerabilities and put protections in to keep criminals out. 

Ryan Stolte, CTO, Bay Dynamics said, “The big idea is that people are very specifically and deliberately attacking organizations.” The intent of those attacks, however, is not always the crown jewels. In order to defend the expanding network and everything that connects to it, “You need to put yourself in the shoes of bad guys."

In planning their attacks and seeking their victims, criminals look for the easiest access point, whether that is the organization that has, “Minimal security tools, lax security policies and/or exploitable employees and third party vendor users,” Stolte said.

“They collect their own social intelligence, gathering information about the victim business regarding what its surface areas look like, where it stores its most valuable data, which third-party vendors have access to their network and how they gain access, and which employees log in remotely and how they gain access to the network,” Stolte said.

In most breaches, organizations are being hacked by individuals. “It’s not just people sitting in China,” said Stotle. What most criminals want is data and their goal is to get access to credentials to get that data. “After they have breached you and gotten inside, they do it all over again, but from a different layer, to continually get deeper into an organization,” Stolte said.

The easiest ways for outsiders to gain access is by trying to compromise a particular person or to sneak in through an open door. “Technical engineering and social engineering go hand and hand,” said Stolte.

Social engineering is made a lot easier by the extensive use of social media platforms.  Increasingly criminals are patient and take a longer and windier road to reach the final destination of their intended target. 

n 1867 Lucien B. Smith of Kent, Ohio, twisted three lengths of wire together leaving the very sharp points exposed. That invention was barbed wire. After the barbed wire was put up, you knew just by looking whether your...

Tim Erlin, director of IT security and risk strategy, Tripwire said, “Shodan allows anyone to search for vulnerable things. They are scanning company networks and gaining access to internal networks by probing the individuals who interact with customers or the public. The one that is increasing is the supply chain attacks. Instead of attacking directly, they are going after their vendors and contractors to gain access.”

Public information provides a gold mine of useful tidbits for criminals. Will Gragido, head of threat intelligence at Digital Shadows said, "Gleaning career and relationship information, like the names of colleagues, mentors and friends from sources like Facebook, LinkedIn, and alumni sites helps establish cover for spear-phishing and other social-engineering campaigns.”

Public information provides a gold mine of useful tidbits for criminals.

While these commonly used social media have much to reveal, there are others that can be more revealing of information about software and code that is really useful to criminals. 

Gragido said, “Online profiles that might be easily misconfigured, such as GitHub accounts, frequently leak other types of information publicly, such as the identities of specific software developers in targeted organizations and snippets of the code they are working on, which, taken together, yields a lot of useful intelligence."

This extensive information that is often leaked unknowingly is particularly threatening to the security of an enterprise. "The challenge is that this information leaks from third-party sources far outside of organizations' own security boundaries, meaning they are almost blind to these exposures and cannot act in time to prevent them from fine-tuning attacks, like a precision attack on a specific software developer,” said Gragido.

The expanded network has posed many challenges to security teams, and Gragido said, "Other sources of reliable attack intelligence are exposed storage devices and cloud platforms.” In Gragido’s experience, he has seen instances of sensitive corporate information, such as strategy documents and board meeting details from a health insurer, that were publicly 'over-shared' by being posted in cloud sharing sites with inadequate password controls.

Gragido said, “Likewise, we have seen sensitive files pertaining to banks' ATM networks, for example, accidentally broadcast to the Web because employees have placed them on misconfigured remote storage drives in their homes."

Criminal acts

Ryan Stolte, CTO Bay Dynamics recommends asking these 5 questions from the perspective of a criminal:

• Which websites does the victim business host?
• What does their infrastructure look like (i.e. where are their doors and windows)?
• How do insiders remotely gain access to the network?
• Who are their third-party vendors?
• Who has the keys to the kingdom (think about employees who have the highest level of access to the business’s valuable information)?

Whether they are after credit card data, payment data, customer information, or any other kind of credentials from user names, to passwords, and healthcare records, criminals are gaining access even with extensive security measures in place, which begs the question how do security teams stop them?

If only there were an easy answer that didn’t require time and resources beyond those which are already stretched and limited. The first step is recognizing that it’s important to prioritize what is secured. 

All of this exposure creates avenues for criminals or other hostile groups to find an organization’s weak points for more targeted and efficient cyber-attacks, said Gragido.  “There is a greater premium on getting in front of these exposures with better situational awareness today, so that affected companies can recognize and eliminate these leaks at the source, outside their walls," he continued.

A combined focus on technical and human surveillance is good security practice.  “Have employees be aware. Lock doors and windows. There are a lot of technology things you can do. Bad guys have as good of technology as the good guys. We scan and find, but bad guys do too, but they act before the hole is fixed,” Stolte said.  

A slight shift in language when talking about security and data can also help security teams think like a criminal. Erlin said, “It’s a very common best practice for organizations to identify sensitive data. Using the term valuable instead twists perception away from what organizations feel is sensitive to what might be valuable to a criminal.”

Regardless of what other information criminals might find valuable, the crown jewels will always remain sensitive and top priority. Stolte said, “Organizations do the surveying, but one thing they fail to do well is protect the crown jewels. They need to know where they are and use that information to close off and fix the highest priority stuff.”

Think like a bad guy. Stolte said, “Take an inside-out approach to vulnerability management. Ensure that you are patching the right servers and that people don’t have more access than they should to layers of the network. Only the right people should have access to sensitive information at the application level.” 

Erlin said, “Threat modeling should be a continuous exercise. Threats change and evolve. It’s valuable because no one has infinite resources, so you have to focus on the most probable and impactful threats.”

Criminals are always after the weakest link, and they search for anything on the internet that might provide some kind of access. Information is out there, and security teams who use what criminals learn as part of their strategic security plan might be lucky enough to act before a breach.

By Kacy Zurkus for CSO Magazine

CES 2016 takeaways: IoT could be the death of your security

The explosion of the Internet of Things, as seen at CES 2016 in Las Vegas last week, and its implications on the cloud and cybersecurity.

The damage, the damnation, the truculent total churl of the event was this: all of the new Interent of Thingies/IoT/KewlGear has no cohesive security strategy. It's a mosh pit of certificates, easy-auth, Oh! Let's Connect Our Gear Together! (add breathy sigh!) meaninglessness.

Let's now take this in the curmudgeonly risk-averse cloud space, bit by bit:

1. Yo, consumer, get the cool gear! Ignore the fact that we're constantly sucking location-based data from your (fill-in-the-blank of wearble, drivable, or otherwise not tethered-with-a-power-or-Ethernet-cable product) into some database somewhere so we can glean as much intelligence (which will probably be ignored by anyone that might care or sold to some bidder that will use it for your personal actuarial assessment) as is possible!
2. The example of the Internet Tea Kettle shows there is no long list of must-have-security for any of the devices seen. So any particular device is an unknown entity, in terms of systems security, whether it's inside your ostensibly secure perimeter or reporting to the cloud. Worse, most wearable devices inside your physical secure perimeter are dutifully trying to report their data not only to the user, but to some mothership—from inside your offices, or home offices, or automobiles, including the auto's data itself.
3. Does this mean that we must now scan individuals walking into offices, plants, corporate/organizational traffic for their IoThingie devices? Each of these devices is as dangerous and rogue as the average smartphone, perhaps worse, as there is no security regimen in the industry relating to what data they use, keep, transport to a mothership, etc. Will these tiny devices start to clog up your wires, too? Will your cloud resources get bogged down by the importance of sending steps-walked data instead of line-of-business apps?
4. The IoThingies have no secondary auth capabilities. Think about that, and the standard that your organization applies to fixed and mobile computing resources. Cringe. Consume Zantac. Rinse. Repeat.
5. The cloud is seen by most IoThingies as the perfect place to store data, and most products come with the leech of requiring data to be stored somewhere. No one knows if their practices are as sloppy as Anthem, Target, or the OPEM. Perhaps they are better, I cannot know. But there is no inherent methodology to certify that even the most modest of security procedures are practices, not that a Good Housekeeping Seal of Approval is worth anything, anyway. There is no industry organization waiting in the wings to do these certifications, and Underwriters Laboratories, et al, haven't been tapped on the shoulder by the insurance industry to motivate organizations to adhere to anything but basal liability.
6. Drones. The FAA licensing is, at best, nihilistic. From my observations, there were more drone makers than tablet makers at CES 2016. Think about that. FAA licensing is also, at best, doing nothing for safety, industry, or users of drones. There is no inspection program, there is no safety program, there is no security program, there are only huge numbers of drones with cameras attached. Close your curtains. Is that a drone doing a video and some screen caps of YOUR R&D labs?
7. Bluetooth as the control mechanism became real, as did combos of Zigbee, Bluetooth, and non-Wi-Fi data transports. Again, no security methodology, and no method to create a bastion perimeter. I saw that Yubico has a new product, the Yubikey NEO, which uses Near Field Communications (NFC) for smartphone auth, using the FIDO U2F standards. It's a start.
8. Some top traditional IT vendors are adapting to the sense that their business ecosystems can make headway into consumer products, via Microsoft in-dash products, Apple compatibility and sometimes blessings, but much is open source. Much is also NOT ABLE TO BE UPDATED. Software provenance in terms of what's actually inside of a consumer product is often a secret sauce, and therefore a total mystery. What old versions of SSH or the root keys to an IoT device are lurking beneath the surface of innocuous devices?

Consumer and entertainment electronics are now “smart,” meaning rife with features, and that means microprocessors, FPGAs, and custom CPUs. In lieu of knowing what's inside of these devices, you'll need to shore up security, and be unwaveringly diligent, both in terms of local security and your cloud resources.

For two decades I've been warning that there is no such thing as a secure perimeter, and the IoT will pressure this point like nothing before in tech history.

By Tom Henderson for NetworkWorld